splunk / splunk/token-meter

/health returns local filesystem paths

Open
#39 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
94
Forks
16
Avg merge
1d 12h
Merged PRs (30d)
5

Description

Summary

GET /health is unauthenticated and returns:

  • page_path — absolute path to page.html
  • page_candidates — the full search list of local paths

That is local filesystem layout, including home-directory prefixes. Architecture says public HTTP should not carry local paths.

page_path is currently used by scripts/install / install-linux to confirm the process on :8722 is this runtime (os.path.commonpath). So any change needs an installer-compatible substitute (for example a fingerprint of the runtime root) rather than just deleting the field.

page_candidates is not needed for that check and can go.

Where

health_state() in token_meter/app.py, plus the Python snippet in scripts/install and scripts/install-linux.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Read health_state() in token_meter/app.py and then the Python snippets in scripts/install and scripts/install-linux to understand how page_path is used by os.path.commonpath. Replace the exposed local-path data with an installer-compatible runtime substitute, remove page_candidates, and verify that /health no longer reveals filesystem paths while the installer check still works.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api, backend, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.