Skip to content

fix: bound scrape query parameters - #2334

Merged
zeitlinger merged 4 commits into
mainfrom
agent/bound-query-parameters
Aug 18, 2026
Merged

fix: bound scrape query parameters#2334
zeitlinger merged 4 commits into
mainfrom
agent/bound-query-parameters

Conversation

@zeitlinger

Copy link
Copy Markdown
Member

Summary

  • bound default query parsing by query length and parameter count
  • return HTTP 400 for malformed or excessive query parameters
  • deduplicate exact metric-name filters before lookup

This is the focused replacement for the #2285 portion of #2297.

Fixes #2285

Ongoing discussion

None currently. The malformed percent-encoding case raised during the earlier review is covered and returns HTTP 400.

Validation

  • mise run lint:fix
  • mise run build
  • ./mvnw test -pl prometheus-metrics-exporter-common,prometheus-metrics-model -Dcoverage.skip=true -Dcheckstyle.skip=true

Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
@github-actions

Copy link
Copy Markdown
Contributor

⚠️ API changes detected — maintainer review required

This PR modifies the published API diff for the following module(s):

  • prometheus-metrics-exporter-common

Please review the changes in docs/apidiffs/current_vs_latest/ carefully before approving.

@zeitlinger
zeitlinger marked this pull request as ready for review July 23, 2026 11:18
Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
@zeitlinger
zeitlinger merged commit 27e1912 into main Aug 18, 2026
22 checks passed
@zeitlinger
zeitlinger deleted the agent/bound-query-parameters branch August 18, 2026 08:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

# Security Report: Denial of Service via Unbounded name[] Query Parameter Flooding in prometheus/client_java

2 participants