prometheus / prometheus/client_js

The 'config' argument to Metric.constructor is not a defined type and is open-ended

Open
#814 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

security semver-major
Dominant language
JavaScript
Stars
3.5k
Forks
429
Avg merge
3d 3h
Merged PRs (30d)
22

Description

The typescript type puts a limit on what fields to populate from this object, however the implementation just does Object.assign(this, ...) which is all sorts of fun for prototype pollution, and also makes #812 a bit of a challenge since basically anything goes.

In fact it was already previously being abused by summary.js to set the store, which is not an allowed value for that data structure.

I'm going to want to make this concrete to fix the labels() issue without making a giant footgun for everyone else. We won't touch a config field unless we already know the name. But it can be folded into the validation section which should keep things from getting long winded.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by examining Metric.constructor and the config type, then inspect summary.js where store is assigned through the config object. Trace the existing validation section and identify which config field names are supported. Done means unknown fields are not assigned, the labels() change remains possible, and the existing config behavior is covered by validation.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js, typescript
Domain
backend, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.