Skip to content

Conversation

@shmsr
Copy link
Member

@shmsr shmsr commented Dec 4, 2025

Proposed commit message

This PR hardens the Prometheus metrics parser against panics caused by malformed input data. The underlying Prometheus textparse library can panic on certain malformed inputs when calling parser.Labels() or parser.Exemplar(). These panics can crash Metricbeat when scraping endpoints that return unexpected data.

  • Panic recovery: Added safeLabels and safeExemplar wrapper functions that use defer recover() to catch panics from the Prometheus parser library
  • Nil pointer fix: Fixed MetricFamily.GetUnit() to check for nil Unit before dereferencing

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
  • I have added an entry in ./changelog/fragments using the changelog tool.

Author's Checklist

  • Safeguard against panics when encountered unexpected data
  • Added TestParseMetricFamiliesMalformedInput with known crash-inducing inputs
  • Added fuzz test FuzzParseMetricFamilies to discover future crash inputs
  • Added unit tests for struct getter methods to increase coverage

Add safeLabels and safeExemplar wrappers to prevent panics from
malformed Prometheus metrics crashing the application. The underlying
Prometheus textparse library can panic on certain malformed inputs.

Also fix nil pointer dereference in MetricFamily.GetUnit().
@shmsr shmsr requested a review from a team as a code owner December 4, 2025 10:34
@shmsr shmsr requested review from mauri870 and orestisfl December 4, 2025 10:34
@shmsr shmsr self-assigned this Dec 4, 2025
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Dec 4, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Dec 4, 2025

🤖 GitHub comments

Just comment with:

  • run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

@shmsr shmsr added the Team:Obs-InfraObs Label for the Observability Infrastructure Monitoring team label Dec 4, 2025
@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Dec 4, 2025
@mergify
Copy link
Contributor

mergify bot commented Dec 4, 2025

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @shmsr? 🙏.
For such, you'll need to label your PR with:

  • The upcoming major version of the Elastic Stack
  • The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

  • backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit
  • backport-active-all is the label that automatically backports to all active branches.
  • backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
  • backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

@pierrehilbert pierrehilbert added the Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team label Dec 4, 2025
@elasticmachine
Copy link
Contributor

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

Copy link
Contributor

@mykola-elastic mykola-elastic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@shmsr shmsr requested a review from rdner December 10, 2025 11:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team Team:Obs-InfraObs Label for the Observability Infrastructure Monitoring team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants