Add strict validation to OpenMetrics 2.0 encoder to reject invalid input

Signed-off-by: David Ashpole <dashpole@google.com>

Author: dashpole

expfmt/openmetrics_2_0_create.go

@@ -19,7 +19,10 @@ import (
 	"fmt"
 	"io"
 	"math"
+	"sort"
 	"strconv"
+	"strings"
+	"unicode/utf8"
 
 	dto "github.com/prometheus/client_model/go"
 )
@@ -37,6 +40,15 @@ func MetricFamilyToOpenMetrics20(out io.Writer, in *dto.MetricFamily, options ..
 	if name == "" {
 		return 0, fmt.Errorf("MetricFamily has no name: %s", in)
 	}
+	if !utf8.ValidString(name) || strings.ContainsAny(name, "\n\r") {
+		return 0, fmt.Errorf("MetricFamily name %q is not valid UTF-8 or contains raw newlines", name)
+	}
+	if in.Help != nil && !utf8.ValidString(*in.Help) {
+		return 0, fmt.Errorf("MetricFamily help %q is not valid UTF-8", *in.Help)
+	}
+	if in.Unit != nil && !utf8.ValidString(*in.Unit) {
+		return 0, fmt.Errorf("MetricFamily unit %q is not valid UTF-8", *in.Unit)
+	}
 
 	// Try the interface upgrade. If it doesn't work, we'll use a
 	// bufio.Writer from the sync.Pool.
@@ -149,12 +161,18 @@ func MetricFamilyToOpenMetrics20(out io.Writer, in *dto.MetricFamily, options ..
 	}
 
 	// Finally the samples, one line for each.
+	if err := checkDuplicateLabelSets(name, in.Metric); err != nil {
+		return written, err
+	}
 	for _, metric := range in.Metric {
+		if metric == nil {
+			return written, fmt.Errorf("expected non-nil metric in MetricFamily %s", name)
+		}
+		if err := validateMetric20(name, metricType, metric); err != nil {
+			return written, err
+		}
 		switch metricType {
 		case dto.MetricType_COUNTER:
-			if metric.Counter == nil {
-				return written, fmt.Errorf("expected counter in metric %s %s", name, metric)
-			}
 			n, err = writeOpenMetrics20Sample(w, name, metric, metric.Counter.GetValue(), 0, false, metric.Counter.Exemplar)
 		case dto.MetricType_GAUGE:
 			if metric.Gauge == nil {
@@ -334,3 +352,138 @@ func writeCompositeHistogram(w enhancedWriter, name string, metric *dto.Metric,
 	_ = isGauge
 	return 0, errors.New("histogram not implemented yet")
 }
+
+func validateMetric20(name string, metricType dto.MetricType, metric *dto.Metric) error {
+	if err := validateLabels20(metric.Label); err != nil {
+		return fmt.Errorf("invalid label in metric %s: %w", name, err)
+	}
+
+	switch metricType {
+	case dto.MetricType_COUNTER:
+		if metric.Counter == nil {
+			return fmt.Errorf("expected counter in metric %s %s", name, metric)
+		}
+		val := metric.Counter.GetValue()
+		if math.IsNaN(val) {
+			return fmt.Errorf("counter value cannot be NaN in metric %s", name)
+		}
+		if val < 0 {
+			return fmt.Errorf("counter value cannot be negative (%g) in metric %s", val, name)
+		}
+		if metric.Counter.CreatedTimestamp != nil {
+			if err := metric.Counter.CreatedTimestamp.CheckValid(); err != nil {
+				return fmt.Errorf("invalid created timestamp in metric %s: %w", name, err)
+			}
+		}
+		if ex := metric.Counter.Exemplar; ex != nil && ex.Timestamp != nil {
+			if err := validateExemplar20(ex); err != nil {
+				return fmt.Errorf("invalid exemplar in metric %s: %w", name, err)
+			}
+		}
+	case dto.MetricType_GAUGE:
+		if metric.Gauge == nil {
+			return fmt.Errorf("expected gauge in metric %s %s", name, metric)
+		}
+	case dto.MetricType_UNTYPED:
+		if metric.Untyped == nil {
+			return fmt.Errorf("expected untyped in metric %s %s", name, metric)
+		}
+	}
+	return nil
+}
+
+func validateLabels20(labels []*dto.LabelPair) error {
+	for i, lp := range labels {
+		if lp == nil {
+			return errors.New("expected non-nil label pair")
+		}
+		lname := lp.GetName()
+		if lname == "" {
+			return errors.New("label name cannot be empty")
+		}
+		if !utf8.ValidString(lname) || strings.ContainsAny(lname, "\n\r") {
+			return fmt.Errorf("label name %q is not valid UTF-8 or contains raw newlines", lname)
+		}
+		if !utf8.ValidString(lp.GetValue()) {
+			return fmt.Errorf("label value %q is not valid UTF-8", lp.GetValue())
+		}
+		for j := i + 1; j < len(labels); j++ {
+			if labels[j] != nil && labels[j].GetName() == lname {
+				return fmt.Errorf("duplicate label name %q", lname)
+			}
+		}
+	}
+	return nil
+}
+
+func validateExemplar20(e *dto.Exemplar) error {
+	if err := e.Timestamp.CheckValid(); err != nil {
+		return err
+	}
+	return validateLabels20(e.Label)
+}
+
+func equalLabelSets(a, b []*dto.LabelPair) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for _, lA := range a {
+		if lA == nil {
+			return false
+		}
+		found := false
+		for _, lB := range b {
+			if lB != nil && lA.GetName() == lB.GetName() && lA.GetValue() == lB.GetValue() {
+				found = true
+				break
+			}
+		}
+		if !found {
+			return false
+		}
+	}
+	return true
+}
+
+func checkDuplicateLabelSets(name string, metrics []*dto.Metric) error {
+	if len(metrics) <= 32 {
+		for i, metric := range metrics {
+			if metric == nil {
+				continue
+			}
+			for j := range i {
+				if metrics[j] != nil && equalLabelSets(metric.Label, metrics[j].Label) {
+					return fmt.Errorf("duplicate label set in MetricFamily %s", name)
+				}
+			}
+		}
+		return nil
+	}
+
+	seen := make(map[string]struct{}, len(metrics))
+	for _, metric := range metrics {
+		if metric == nil {
+			continue
+		}
+		key := labelSetKey(metric.Label)
+		if _, ok := seen[key]; ok {
+			return fmt.Errorf("duplicate label set in MetricFamily %s", name)
+		}
+		seen[key] = struct{}{}
+	}
+	return nil
+}
+
+func labelSetKey(labels []*dto.LabelPair) string {
+	if len(labels) == 0 {
+		return ""
+	}
+	pairs := make([]string, len(labels))
+	for i, lp := range labels {
+		if lp != nil {
+			pairs[i] = lp.GetName() + "\x00" + lp.GetValue()
+		}
+	}
+	sort.Strings(pairs)
+	return strings.Join(pairs, "\x00\x00")
+}