Add strict validation to OpenMetrics 2.0 encoder to reject invalid input

Signed-off-by: David Ashpole <dashpole@google.com>

Author: dashpole

expfmt/openmetrics_2_0_create.go

@@ -20,6 +20,8 @@ import (
 	"io"
 	"math"
 	"strconv"
+	"strings"
+	"unicode/utf8"
 
 	dto "github.com/prometheus/client_model/go"
 )
@@ -37,6 +39,15 @@ func MetricFamilyToOpenMetrics20(out io.Writer, in *dto.MetricFamily, options ..
 	if name == "" {
 		return 0, fmt.Errorf("MetricFamily has no name: %s", in)
 	}
+	if !utf8.ValidString(name) || strings.ContainsAny(name, "\n\r") {
+		return 0, fmt.Errorf("MetricFamily name %q is not valid UTF-8 or contains raw newlines", name)
+	}
+	if in.Help != nil && !utf8.ValidString(*in.Help) {
+		return 0, fmt.Errorf("MetricFamily help %q is not valid UTF-8", *in.Help)
+	}
+	if in.Unit != nil && !utf8.ValidString(*in.Unit) {
+		return 0, fmt.Errorf("MetricFamily unit %q is not valid UTF-8", *in.Unit)
+	}
 
 	// Try the interface upgrade. If it doesn't work, we'll use a
 	// bufio.Writer from the sync.Pool.
@@ -150,11 +161,11 @@ func MetricFamilyToOpenMetrics20(out io.Writer, in *dto.MetricFamily, options ..
 
 	// Finally the samples, one line for each.
 	for _, metric := range in.Metric {
+		if err := validateMetric20(name, metricType, metric); err != nil {
+			return written, err
+		}
 		switch metricType {
 		case dto.MetricType_COUNTER:
-			if metric.Counter == nil {
-				return written, fmt.Errorf("expected counter in metric %s %s", name, metric)
-			}
 			n, err = writeOpenMetrics20Sample(w, name, metric, metric.Counter.GetValue(), 0, false, metric.Counter.Exemplar)
 		case dto.MetricType_GAUGE:
 			if metric.Gauge == nil {
@@ -334,3 +345,70 @@ func writeCompositeHistogram(w enhancedWriter, name string, metric *dto.Metric,
 	_ = isGauge
 	return 0, errors.New("histogram not implemented yet")
 }
+
+func validateMetric20(name string, metricType dto.MetricType, metric *dto.Metric) error {
+	if err := validateLabels20(metric.Label); err != nil {
+		return fmt.Errorf("invalid label in metric %s: %w", name, err)
+	}
+
+	switch metricType {
+	case dto.MetricType_COUNTER:
+		if metric.Counter == nil {
+			return fmt.Errorf("expected counter in metric %s %s", name, metric)
+		}
+		val := metric.Counter.GetValue()
+		if math.IsNaN(val) {
+			return fmt.Errorf("counter value cannot be NaN in metric %s", name)
+		}
+		if val < 0 {
+			return fmt.Errorf("counter value cannot be negative (%g) in metric %s", val, name)
+		}
+		if metric.Counter.CreatedTimestamp != nil {
+			if err := metric.Counter.CreatedTimestamp.CheckValid(); err != nil {
+				return fmt.Errorf("invalid created timestamp in metric %s: %w", name, err)
+			}
+		}
+		if ex := metric.Counter.Exemplar; ex != nil && ex.Timestamp != nil {
+			if err := validateExemplar20(ex); err != nil {
+				return fmt.Errorf("invalid exemplar in metric %s: %w", name, err)
+			}
+		}
+	case dto.MetricType_GAUGE:
+		if metric.Gauge == nil {
+			return fmt.Errorf("expected gauge in metric %s %s", name, metric)
+		}
+	case dto.MetricType_UNTYPED:
+		if metric.Untyped == nil {
+			return fmt.Errorf("expected untyped in metric %s %s", name, metric)
+		}
+	}
+	return nil
+}
+
+func validateLabels20(labels []*dto.LabelPair) error {
+	seen := make(map[string]struct{}, len(labels))
+	for _, lp := range labels {
+		lname := lp.GetName()
+		if lname == "" {
+			return errors.New("label name cannot be empty")
+		}
+		if !utf8.ValidString(lname) || strings.ContainsAny(lname, "\n\r") {
+			return fmt.Errorf("label name %q is not valid UTF-8 or contains raw newlines", lname)
+		}
+		if !utf8.ValidString(lp.GetValue()) {
+			return fmt.Errorf("label value %q is not valid UTF-8", lp.GetValue())
+		}
+		if _, ok := seen[lname]; ok {
+			return fmt.Errorf("duplicate label name %q", lname)
+		}
+		seen[lname] = struct{}{}
+	}
+	return nil
+}
+
+func validateExemplar20(e *dto.Exemplar) error {
+	if err := e.Timestamp.CheckValid(); err != nil {
+		return err
+	}
+	return validateLabels20(e.Label)
+}

expfmt/openmetrics_2_0_create_test.go

@@ -379,6 +379,77 @@ func TestCreateOpenMetrics20_Errors(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "CounterValueNaN",
+			in: &dto.MetricFamily{
+				Name: proto.String("test_counter_total"),
+				Type: dto.MetricType_COUNTER.Enum(),
+				Metric: []*dto.Metric{
+					{Counter: &dto.Counter{Value: proto.Float64(math.NaN())}},
+				},
+			},
+		},
+		{
+			name: "CounterValueNegative",
+			in: &dto.MetricFamily{
+				Name: proto.String("test_counter_total"),
+				Type: dto.MetricType_COUNTER.Enum(),
+				Metric: []*dto.Metric{
+					{Counter: &dto.Counter{Value: proto.Float64(-5.0)}},
+				},
+			},
+		},
+		{
+			name: "DuplicateLabelName",
+			in: &dto.MetricFamily{
+				Name: proto.String("test_counter_total"),
+				Type: dto.MetricType_COUNTER.Enum(),
+				Metric: []*dto.Metric{
+					{
+						Label: []*dto.LabelPair{
+							{Name: proto.String("foo"), Value: proto.String("bar")},
+							{Name: proto.String("foo"), Value: proto.String("baz")},
+						},
+						Counter: &dto.Counter{Value: proto.Float64(1.0)},
+					},
+				},
+			},
+		},
+		{
+			name: "EmptyLabelName",
+			in: &dto.MetricFamily{
+				Name: proto.String("test_counter_total"),
+				Type: dto.MetricType_COUNTER.Enum(),
+				Metric: []*dto.Metric{
+					{
+						Label: []*dto.LabelPair{
+							{Name: proto.String(""), Value: proto.String("bar")},
+						},
+						Counter: &dto.Counter{Value: proto.Float64(1.0)},
+					},
+				},
+			},
+		},
+		{
+			name: "NewlineInMetricName",
+			in: &dto.MetricFamily{
+				Name: proto.String("test_counter\ntotal"),
+				Type: dto.MetricType_COUNTER.Enum(),
+				Metric: []*dto.Metric{
+					{Counter: &dto.Counter{Value: proto.Float64(1.0)}},
+				},
+			},
+		},
+		{
+			name: "InvalidUTF8MetricName",
+			in: &dto.MetricFamily{
+				Name: proto.String("test_\xff_total"),
+				Type: dto.MetricType_COUNTER.Enum(),
+				Metric: []*dto.Metric{
+					{Counter: &dto.Counter{Value: proto.Float64(1.0)}},
+				},
+			},
+		},
 	}
 
 	for _, tc := range tests {