fix: bound scrape query parameters

prometheus-metrics-exporter-common/src/main/java/io/prometheus/metrics/exporter/common/InvalidQueryParameterException.java

@@ -0,0 +1,21 @@
+package io.prometheus.metrics.exporter.common;
+
+import java.io.UnsupportedEncodingException;
+import java.net.URLDecoder;
+
+class InvalidQueryParameterException extends RuntimeException {
+
+  InvalidQueryParameterException(String message) {
+    super(message);
+  }
+
+  // decode with Charset is only available in Java 10+, but we want to support Java 8
+  @SuppressWarnings("JdkObsolete")
+  static String urlDecode(String value) throws UnsupportedEncodingException {
+    try {
+      return URLDecoder.decode(value, "UTF-8");
+    } catch (IllegalArgumentException e) {
+      throw new InvalidQueryParameterException("Invalid percent-encoding in query string");
+    }
+  }
+}

prometheus-metrics-exporter-common/src/main/java/io/prometheus/metrics/exporter/common/PrometheusHttpRequest.java

@@ -3,7 +3,6 @@
 import io.prometheus.metrics.annotations.StableApi;
 import io.prometheus.metrics.model.registry.PrometheusScrapeRequest;
 import java.io.UnsupportedEncodingException;
-import java.net.URLDecoder;
 import java.util.ArrayList;
 import java.util.Enumeration;
 import javax.annotation.Nullable;
@@ -49,15 +48,43 @@ default String getParameter(String name) {
   @SuppressWarnings("JdkObsolete")
   default String[] getParameterValues(String name) {
     try {
+      int maxQueryStringLength = 64 * 1024;
+      int maxQueryParameterCount = 1024;
       ArrayList<String> result = new ArrayList<>();
       String queryString = getQueryString();
       if (queryString != null) {
-        String[] pairs = queryString.split("&");
-        for (String pair : pairs) {
+        if (queryString.length() > maxQueryStringLength) {
+          throw new InvalidQueryParameterException(
+              "Query string too long: "
+                  + queryString.length()
+                  + " characters (max "
+                  + maxQueryStringLength
+                  + ")");
+        }
+        int start = 0;
+        int parameterCount = 0;
+        for (int end = queryString.indexOf('&'); start <= queryString.length(); ) {
+          parameterCount++;
+          if (parameterCount > maxQueryParameterCount) {
+            throw new InvalidQueryParameterException(
+                "Too many query parameters: "
+                    + parameterCount
+                    + " (max "
+                    + maxQueryParameterCount
+                    + ")");
+          }
+          String pair =
+              end == -1 ? queryString.substring(start) : queryString.substring(start, end);
           int idx = pair.indexOf("=");
-          if (idx != -1 && URLDecoder.decode(pair.substring(0, idx), "UTF-8").equals(name)) {
-            result.add(URLDecoder.decode(pair.substring(idx + 1), "UTF-8"));
+          if (idx != -1
+              && InvalidQueryParameterException.urlDecode(pair.substring(0, idx)).equals(name)) {
+            result.add(InvalidQueryParameterException.urlDecode(pair.substring(idx + 1)));
+          }
+          if (end == -1) {
+            break;
           }
+          start = end + 1;
+          end = queryString.indexOf('&', start);
         }
       }
       if (result.isEmpty()) {

prometheus-metrics-exporter-common/src/main/java/io/prometheus/metrics/exporter/common/PrometheusScrapeHandler.java

@@ -60,10 +60,19 @@ public PrometheusScrapeHandler(PrometheusProperties config, PrometheusRegistry r
   public void handleRequest(PrometheusHttpExchange exchange) throws IOException {
     try {
       PrometheusHttpRequest request = exchange.getRequest();
-      MetricSnapshots snapshots = scrape(request);
+      String[] includedNames = null;
+      String debugParam = null;
+      try {
+        includedNames = request.getParameterValues("name[]");
+        debugParam = request.getParameter("debug");
+      } catch (InvalidQueryParameterException e) {
+        writeInvalidQueryParametersResponse(exchange);
+        return;
+      }
+      MetricSnapshots snapshots = scrape(request, includedNames);
       String acceptHeader = request.getHeader("Accept");
       EscapingScheme escapingScheme = EscapingScheme.fromAcceptHeader(acceptHeader);
-      if (writeDebugResponse(snapshots, escapingScheme, exchange)) {
+      if (writeDebugResponse(snapshots, escapingScheme, debugParam, exchange)) {
         return;
       }
       ExpositionFormatWriter writer = expositionFormats.findWriter(acceptHeader);
@@ -136,9 +145,9 @@ private Predicate<String> makeNameFilter(@Nullable String[] includedNames) {
     return result;
   }
 
-  private MetricSnapshots scrape(PrometheusHttpRequest request) {
+  private MetricSnapshots scrape(PrometheusHttpRequest request, @Nullable String[] includedNames) {
 
-    Predicate<String> filter = makeNameFilter(request.getParameterValues("name[]"));
+    Predicate<String> filter = makeNameFilter(includedNames);
     if (filter != null) {
       return registry.scrape(filter, request);
     } else {
@@ -147,9 +156,11 @@ private MetricSnapshots scrape(PrometheusHttpRequest request) {
   }
 
   private boolean writeDebugResponse(
-      MetricSnapshots snapshots, EscapingScheme escapingScheme, PrometheusHttpExchange exchange)
+      MetricSnapshots snapshots,
+      EscapingScheme escapingScheme,
+      @Nullable String debugParam,
+      PrometheusHttpExchange exchange)
       throws IOException {
-    String debugParam = exchange.getRequest().getParameter("debug");
     PrometheusHttpResponse response = exchange.getResponse();
     if (debugParam == null) {
       return false;
@@ -184,6 +195,16 @@ private boolean writeDebugResponse(
     }
   }
 
+  private void writeInvalidQueryParametersResponse(PrometheusHttpExchange exchange)
+      throws IOException {
+    PrometheusHttpResponse response = exchange.getResponse();
+    response.setHeader("Content-Type", "text/plain; charset=utf-8");
+    byte[] message = "Invalid query parameters".getBytes(StandardCharsets.UTF_8);
+    try (OutputStream outputStream = response.sendHeadersAndGetBody(400, message.length)) {
+      outputStream.write(message);
+    }
+  }
+
   private boolean shouldUseCompression(PrometheusHttpRequest request) {
     if (preferUncompressedResponse) {
       return false;

prometheus-metrics-exporter-common/src/test/java/io/prometheus/metrics/exporter/common/PrometheusHttpRequestTest.java

@@ -1,6 +1,7 @@
 package io.prometheus.metrics.exporter.common;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
 
 import java.util.Collections;
 import java.util.Enumeration;
@@ -80,6 +81,22 @@ void testGetParameterValuesIgnoresParametersWithoutEquals() {
     assertThat(values).containsExactly("value1", "value2");
   }
 
+  @Test
+  void testGetParameterValuesRejectsMalformedEncodedName() {
+    PrometheusHttpRequest request = new TestPrometheusHttpRequest("name%ZZ=value");
+
+    assertThatExceptionOfType(InvalidQueryParameterException.class)
+        .isThrownBy(() -> request.getParameterValues("name"));
+  }
+
+  @Test
+  void testGetParameterValuesRejectsMalformedEncodedValue() {
+    PrometheusHttpRequest request = new TestPrometheusHttpRequest("name=value%ZZ");
+
+    assertThatExceptionOfType(InvalidQueryParameterException.class)
+        .isThrownBy(() -> request.getParameterValues("name"));
+  }
+
   /** Test implementation of PrometheusHttpRequest for testing default methods. */
   private static class TestPrometheusHttpRequest implements PrometheusHttpRequest {
     private final String queryString;

prometheus-metrics-exporter-common/src/test/java/io/prometheus/metrics/exporter/common/PrometheusScrapeHandlerTest.java

@@ -164,6 +164,36 @@ void testMultipleMetricNameFilters() throws IOException {
     assertThat(body).doesNotContain("metric_three");
   }
 
+  @Test
+  void testRejectsTooManyQueryParameters() throws IOException {
+    StringBuilder queryString = new StringBuilder("name[]=test_counter");
+    for (int i = 0; i < 1024; i++) {
+      queryString.append("&name[]=metric_").append(i);
+    }
+
+    TestHttpExchange exchange = new TestHttpExchange("GET", queryString.toString());
+    handler.handleRequest(exchange);
+
+    assertThat(exchange.getResponseCode()).isEqualTo(400);
+    assertThat(exchange.getResponseHeaders().get("Content-Type"))
+        .isEqualTo("text/plain; charset=utf-8");
+    assertThat(exchange.getResponseBody()).isEqualTo("Invalid query parameters");
+  }
+
+  @Test
+  void testRejectsTooLongQueryString() throws IOException {
+    StringBuilder queryString = new StringBuilder("name[]=");
+    for (int i = 0; i < 64 * 1024; i++) {
+      queryString.append("a");
+    }
+
+    TestHttpExchange exchange = new TestHttpExchange("GET", queryString.toString());
+    handler.handleRequest(exchange);
+
+    assertThat(exchange.getResponseCode()).isEqualTo(400);
+    assertThat(exchange.getResponseBody()).isEqualTo("Invalid query parameters");
+  }
+
   /** Test implementation of PrometheusHttpExchange for testing. */
   private static class TestHttpExchange implements PrometheusHttpExchange {
     private final TestHttpRequest request;
@@ -216,7 +246,7 @@ public Map<String, String> getResponseHeaders() {
     }
 
     public String getResponseBody() {
-      return rawResponseBody.toString(StandardCharsets.UTF_8);
+      return new String(rawResponseBody.toByteArray(), StandardCharsets.UTF_8);
     }
 
     public boolean isGzipCompressed() {

prometheus-metrics-model/src/main/java/io/prometheus/metrics/model/registry/MetricNameFilter.java

@@ -6,6 +6,7 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
+import java.util.LinkedHashSet;
 import java.util.function.Predicate;
 import javax.annotation.Nullable;
 
@@ -26,10 +27,10 @@ private MetricNameFilter(
       Collection<String> nameIsNotEqualTo,
       Collection<String> nameStartsWith,
       Collection<String> nameDoesNotStartWith) {
-    this.nameIsEqualTo = unmodifiableCollection(new ArrayList<>(nameIsEqualTo));
-    this.nameIsNotEqualTo = unmodifiableCollection(new ArrayList<>(nameIsNotEqualTo));
-    this.nameStartsWith = unmodifiableCollection(new ArrayList<>(nameStartsWith));
-    this.nameDoesNotStartWith = unmodifiableCollection(new ArrayList<>(nameDoesNotStartWith));
+    this.nameIsEqualTo = unmodifiableCollection(new LinkedHashSet<>(nameIsEqualTo));
+    this.nameIsNotEqualTo = unmodifiableCollection(new LinkedHashSet<>(nameIsNotEqualTo));
+    this.nameStartsWith = unmodifiableCollection(new LinkedHashSet<>(nameStartsWith));
+    this.nameDoesNotStartWith = unmodifiableCollection(new LinkedHashSet<>(nameDoesNotStartWith));
   }
 
   @Override
@@ -44,6 +45,9 @@ private boolean matchesNameEqualTo(String metricName) {
     if (nameIsEqualTo.isEmpty()) {
       return true;
     }
+    if (nameIsEqualTo.contains(metricName)) {
+      return true;
+    }
     for (String name : nameIsEqualTo) {
       // The following ignores suffixes like _total.
       // "request_count" and "request_count_total" both match a metric named "request_count".
@@ -58,6 +62,9 @@ private boolean matchesNameNotEqualTo(String metricName) {
     if (nameIsNotEqualTo.isEmpty()) {
       return false;
     }
+    if (nameIsNotEqualTo.contains(metricName)) {
+      return true;
+    }
     for (String name : nameIsNotEqualTo) {
       // The following ignores suffixes like _total.
       // "request_count" and "request_count_total" both match a metric named "request_count".