Skip to content

fix: redact invalid configuration values#2335

Open
zeitlinger wants to merge 1 commit into
mainfrom
agent/redact-config-values
Open

fix: redact invalid configuration values#2335
zeitlinger wants to merge 1 commit into
mainfrom
agent/redact-config-values

Conversation

@zeitlinger

Copy link
Copy Markdown
Member

Summary

  • remove raw invalid configuration values from exception messages
  • avoid exposing configured properties-file paths
  • apply the same redaction to PushGateway validation paths

This is the focused replacement for the #2286 portion of #2297.

Fixes #2286

Ongoing discussion

None currently. The earlier escape-versus-redact question is resolved in favor of full redaction because servlet containers can expose exception messages.

Validation

  • mise run lint:fix
  • mise run build
  • ./mvnw test -pl prometheus-metrics-config,prometheus-metrics-exporter-pushgateway -Dcoverage.skip=true -Dcheckstyle.skip=true

Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
@zeitlinger
zeitlinger marked this pull request as ready for review July 23, 2026 11:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

# Security Report: Sensitive Configuration Values Leaked via PrometheusPropertiesException to HTTP Clients

1 participant