TritonDataCenter / node-artedi

a library for measuring fish
2 stars 4 forks source link

label values not escaped properly #16

Closed davepacheco closed 3 years ago

davepacheco commented 6 years ago

I'm trying to expose a counter of errors with an "errorMessage" label. I tested with an error message that happened to have a quoted string in it, and I discovered that artedi doesn't seem to escape these properly. Here's an example:

var artedi = require('artedi');
var collector = artedi.createCollector();
var counter = collector.counter({
    name: 'test_counter',
    help: 'test help text',
    labels: {
        test_value: 'value with a "string"'
    }
});

counter.increment();
collector.collect(artedi.FMT_PROM, function (err, text) {
    if (err) {
        throw (err);
    }

    console.error(text);
});

When I run that:

dap@zathras test $ node escape-issue.js 
# HELP test_counter test help text
# TYPE test_counter counter
test_counter{test_value="value with a "string""} 1

According to the exposition format docs:

label_value can be any sequence of UTF-8 characters, but the backslash (\, double-quote ("}, and line feed (\n) characters have to be escaped as \, \", and \n, respectively.

Here, the double quotes in "string" should be escaped, but aren't. (I wonder if we can accomplish this by using JSON.stringify() on the string containing the label value, but I'm not sure if that's quite correct.)

bahamat commented 3 years ago

Fixed in #27