Character Injection Causing Malformed Metrics about nginx-lua-prometheus HOT 2 CLOSED

As a side note, using ngx.var.uri of a publicly available site as a metric label directly is not a great idea, since you basically allow anyone on the internet to increase your metric cardinality. Please see the following discussions for more detail:

• #41
• prometheus/client_golang#491
• #47

from nginx-lua-prometheus.

Thanks a lot for the detailed report!

We currently escape double quotes and backslashes in label values, but looking at the openmetrics spec I think we also need to escape line breaks:

escaped-char = normal-char
escaped-char =/ BS ("n" / DQUOTE / BS)
escaped-char =/ BS normal-char

; Any unicode character, except newline, double quote, and backslash
normal-char = %x00-09 / %x0B-21 / %x23-5B / %x5D-D7FF / %xE000-10FFFF

Is this something you would be interested in preparing a PR for?

from nginx-lua-prometheus.