1 files changed, 41 insertions, 2 deletions
diff --git a/lib/gitlab/metrics/dashboard/stages/url_validator.rb b/lib/gitlab/metrics/dashboard/stages/url_validator.rb
index ff36f7b605e..9e2bb0d1a70 100644
--- a/lib/gitlab/metrics/dashboard/stages/url_validator.rb
+++ b/lib/gitlab/metrics/dashboard/stages/url_validator.rb
@@ -6,8 +6,47 @@ module Gitlab
       module Stages
         class UrlValidator < BaseStage
           def transform!
-            dashboard[:links]&.each do |link|
-              Gitlab::UrlBlocker.validate!(link[:url])
+            validate_dashboard_links(dashboard)
+
+            validate_chart_links(dashboard)
+          end
+
+          private
+
+          def blocker_args
+            {
+              schemes: %w(http https),
+              ports: [],
+              allow_localhost: allow_setting_local_requests?,
+              allow_local_network: allow_setting_local_requests?,
+              ascii_only: false,
+              enforce_user: false,
+              enforce_sanitization: false,
+              dns_rebind_protection: true
+            }
+          end
+
+          def allow_setting_local_requests?
+            Gitlab::CurrentSettings.allow_local_requests_from_web_hooks_and_services?
+          end
+
+          def validate_dashboard_links(dashboard)
+            validate_links(dashboard[:links])
+          end
+
+          def validate_chart_links(dashboard)
+            dashboard[:panel_groups].each do |panel_group|
+              panel_group[:panels].each do |panel|
+                validate_links(panel[:links])
+              end
+            end
+          end
+
+          def validate_links(links)
+            links&.each do |link|
+              next unless link.is_a? Hash
+
+              Gitlab::UrlBlocker.validate!(link[:url], blocker_args)
             rescue Gitlab::UrlBlocker::BlockedUrlError
               link[:url] = ''
             end