You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Bug - Label values are not escaped - Allows injection #346
The text format requires \, " and line feed to be escaped inside a quoted label value.
This crate writes them through verbatim, so a label value containing " ends the value and the label set early.
The result is not a parseable document: a scraper drops the whole target's series.
Present at v0.25.1 (commit 6465716). \ and line feed take the same path.
Repro
#[derive(Clone,Hash,PartialEq,Eq,EncodeLabelSet,Debug)]structEscaping{client_version:String,}#[test]fnlabel_value_is_escaped_in_text_exposition(){letmut registry = Registry::default();let family = Family::<Escaping,Counter>::default();
registry.register("requests","Requests", family.clone());
family
.get_or_create(&Escaping{client_version:r#"a"} evil{x="1"#.to_string(),}).inc();letmut buffer = String::new();encode(&mut buffer,®istry).unwrap();assert_eq!(r#"# HELP requests Requests.# TYPE requests counterrequests_total{client_version="a\"} evil{x=\"1"} 1# EOF"#,
buffer
);}
Activity
[-]Bug - Label values are not escaped[/-][+]Bug - Label values are not escaped - Allows injection[/+]krisztianfekete commentedon Sep 23, 2026
Thanks for the report and repro @amunra. Wondering if you have time to pick this one up maybe?
amunra commentedon Sep 24, 2026
Not immediately: We've worked around the bug in our own code by sanitising in the meantime.
Sanitize caller-controlled gRPC telemetry attributes
amunra commentedon Oct 13, 2026
Thank you!