prometheus / prometheus/client_js
The 'config' argument to Metric.constructor is not a defined type and is open-ended
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 3.5k
- Forks
- 429
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 22
Description
The typescript type puts a limit on what fields to populate from this object, however the implementation just does Object.assign(this, ...) which is all sorts of fun for prototype pollution, and also makes #812 a bit of a challenge since basically anything goes.
In fact it was already previously being abused by summary.js to set the store, which is not an allowed value for that data structure.
I'm going to want to make this concrete to fix the labels() issue without making a giant footgun for everyone else. We won't touch a config field unless we already know the name. But it can be folded into the validation section which should keep things from getting long winded.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by examining Metric.constructor and the config type, then inspect summary.js where store is assigned through the config object. Trace the existing validation section and identify which config field names are supported. Done means unknown fields are not assigned, the labels() change remains possible, and the existing config behavior is covered by validation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js, typescript
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100