JSON from private host addresses

Issue Summary

New JSON data source does not allow use with private host addresses. I get the error: “Can’t query private addresses.”

If databases can be hosted on internal DNS names why couldn’t JSON data sources? Could this be made configurable?

Steps to Reproduce

1. Install Redash via Docker, which is now recommended.
2. Use JSON Data Source (new in v8 beta 2)
3. Point to JSON file hosted on local computer.

On Docker the localhost URL will look like url: http://host.docker.internal:5001/mydata/my_data.json

Expected: As a developer I can view local JSON for testing new data sources or new application URLs. Actual: Error on the query screen, “Can’t query private addresses.”

Technical details:

• Redash Version: 8.0 beta 2
• Browser/OS: Chrome/Windows
• How did you install Redash: Docker, updated docker-compose.yaml to redash/redash:8.0.0-beta.2.b29352

The error seems to come from: https://github.com/getredash/redash/blob/4c56900248834579374336d269000bb8cf34066c/redash/query_runner/json_ds.py#L180

Comments

I’ve tested a local copy of the container with this raise commented out, and everything works fine. I understand in PaaS or when Redash is externally visible, this is necessary to protect internal data sources. But I’m evaluating Redash to run inside my production cluster only accessible to internal users. A core use case is to surface data internal to the cluster (PostgreSql, MongoDB, JSON, and CSV) and control it via dashboard groups and permissions. If databases can be hosted on internal DNS names why couldn’t JSON data sources? Could this be made configurable?

[arikfr]

Maybe, but it’s a really easy fix/change. A PR addressing this (in the way outlined above) is welcomed.

[arikfr]

@yzorg

but I also worry about turning off security features with obscure settings.

We can have proper documentation around it.

But the other option you suggested is fine as well. No need for env var, just have it in a separate file and we won’t enable it by default. The implementation can definitely be shared between the two – just add the needed configuration in the JSON one, and subclass it for the second.