Graphite Web URL config broken after v2.14.0

[AlexanderS]

Describe the bug

A configuration for Graphite with "http://host/graphite/" that was working fine before, is broken after an update to v2.14.0.

It fails with Unsupported scheme: a random url scheme which always differs from the current request's one,

To Reproduce

Provide a link to a live example, or an unambiguous set of steps to reproduce this issue. Include configuration, logs, etc. to reproduce, if relevant.

1. Set the Graphite Web URL to something like http://host/.
2. Open a host/service with an embedded graph.

Expected behavior

The graphs should load without an explicit port in the URL.

Screenshots

Your Environment

Include as many relevant details about the environment you experienced the problem in

• Icinga Web 2 version and modules (System - About): 2.14.0
• Web browser used: Vivaldi (Chrome based)
• Icinga 2 version used (icinga2 --version): r2.16.3-1
• PHP version used (php --version): 8.2.32
• Server operating system and version: Debian

Additional context

I already found a workaround. You can set the Graphite Web URL to: http://host:80/graphite and it will work again.

I think the issue was introduced in: 8f153bd5f5efb7dc8864cc0ca32a1b45e368839c. The GraphingTrait is using FakeSchemeRequest in the call of Url::fromPath here and the updated parseUrl function tries to guess the port of the URL from the scheme of the request... Maybe parseUrl should get the scheme from $parts['scheme']?

[lippserd]

Hi @AlexanderS,

Thanks for the report. The referenced commit is indeed the cause and was meant to fix a low-risk open redirect vulnerability. We'll have a look.

Best regards,
Eric

[nilmerg]

This is most surely a problem because a fake request is used by the graphite module to construct the url. Not sure why it does that, but not doing it is probably the solution.