Skip to content

fix: bound scrape query parameters - #2334

Merged
zeitlinger merged 4 commits into
mainfrom
agent/bound-query-parameters
Aug 18, 2026
Merged

fix: bound scrape query parameters#2334
zeitlinger merged 4 commits into
mainfrom
agent/bound-query-parameters

Conversation

@zeitlinger

Copy link
Copy Markdown
Member

Summary

  • bound default query parsing by query length and parameter count
  • return HTTP 400 for malformed or excessive query parameters
  • deduplicate exact metric-name filters before lookup

This is the focused replacement for the #2285 portion of #2297.

Fixes #2285

Ongoing discussion

None currently. The malformed percent-encoding case raised during the earlier review is covered and returns HTTP 400.

Validation

  • mise run lint:fix
  • mise run build
  • ./mvnw test -pl prometheus-metrics-exporter-common,prometheus-metrics-model -Dcoverage.skip=true -Dcheckstyle.skip=true
Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
@github-actions

Copy link
Copy Markdown
Contributor

⚠️ API changes detected — maintainer review required

This PR modifies the published API diff for the following module(s):

  • prometheus-metrics-exporter-common

Please review the changes in docs/apidiffs/current_vs_latest/ carefully before approving.

@zeitlinger
zeitlinger marked this pull request as ready for review July 23, 2026 11:18
Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
@zeitlinger
zeitlinger merged commit 27e1912 into main Aug 18, 2026
22 checks passed
@zeitlinger
zeitlinger deleted the agent/bound-query-parameters branch August 18, 2026 08:02
zeitlinger added a commit that referenced this pull request Aug 19, 2026
## Summary

- document the default implementation values `maxQueryStringLength = 64
* 1024` and `maxQueryParameterCount = 1024` in `PrometheusHttpRequest`
JavaDoc
- clarify that these values are fixed implementation limits, not runtime
configuration
- clarify that invalid or excessive query parameters produce HTTP 400

Follow-up to
[#2334](#2334)
and
[discussion_r3752169308](#2334 (comment)).

## Validation

- `mise run lint:fix` *(blocked by the pre-existing 403 response for the
README CNCF Slack link; the push hook passed using a temporary
local-only README substitution, restored before completion)*
- `mise run build`
- `./mvnw -pl prometheus-metrics-exporter-common test
-Dcoverage.skip=true`

---------

Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

2 participants