Repository navigation
Conversation
With legacy validation off, which is the default, an empty string passes
_validate_labelname. A metric declared with labelnames=[''] then exposes
g{="x"} 1.0, which both bundled parsers reject as invalid labels. Legacy
validation already refuses it, and _validate_metric_name refuses an empty
metric name the same way.
Both parsers call the same function, so a quoted empty label name such as
a{""="x"} 1 is now refused on input as well.
Signed-off-by: Christopher Krah <48338417+chrikrah@users.noreply.github.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
_validate_labelnameinprometheus_client/validation.py:76only checks that a name encodes as UTF-8 when legacy validation is off, which is the default, so an empty label name passes. The OpenMetrics 2.0 grammar allows no such key:label-key = label-name / DQUOTE escaped-string-non-empty DQUOTE. The library then writes the unquoted{="x"}, which its own parsers refuse.On this branch the
Gauge(...)call raises, worded like the error_validate_metric_namegives for an empty metric name. Exemplar keys go through the same function, soinc(exemplar={'': 'abc'})is refused too. Legacy validation already rejected both throughMETRIC_LABEL_NAME_RE, andLabelName.IsValidin prometheus/common returns false for an empty name in UTF-8 mode.parser.py:97calls the same function, so both parsers now reject the quotedg{""="x"} 1.0too, and a case in each parser's tests pins that. At base they returnedlabels={'': 'x'}.GaugeMetricFamily(labels=[''])in a custom collector still writesg{="x"} 1.0, because metric families skip every name check today, so I left them out of scope.Verification
There is no issue for this. #1236 edits two other lines of the same file and leaves
_validate_labelnamealone.@csmarchbanks, this makes a call that used to succeed raise at construction. Its exposition already fails to parse, so I'd ship the raise without a deprecation warning first. Does that work for you?