properly escape prometheus labels; fixes #2407

1 files changed, 22 insertions, 2 deletions

diff --git a/src/rrd2json.c b/src/rrd2json.c
index 776226aee9..314c2bc2a1 100644
--- a/src/rrd2json.c
+++ b/src/rrd2json.c
@@ -176,7 +176,7 @@ static inline size_t prometheus_name_copy(char *d, const char *s, size_t usable)
     for(n = 0; *s && n < usable ; d++, s++, n++) {
         register char c = *s;
 
-        if(unlikely(c != '.' && !isalnum(c))) *d = '_';
+        if(!isalnum(c)) *d = '_';
         else *d = c;
     }
     *d = '\0';
@@ -184,13 +184,33 @@ static inline size_t prometheus_name_copy(char *d, const char *s, size_t usable)
     return n;
 }
 
+static inline size_t prometheus_label_copy(char *d, const char *s, size_t usable) {
+    size_t n;
+
+    // make sure we can escape one character without overflowing the buffer
+    usable--;
+
+    for(n = 0; *s && n < usable ; d++, s++, n++) {
+        register char c = *s;
+
+        if(unlikely(c == '"' || c == '\\' || c == '\n')) {
+            *d++ = '\\';
+            n++;
+        }
+        *d = c;
+    }
+    *d = '\0';
+
+    return n;
+}
+
 #define PROMETHEUS_ELEMENT_MAX 256
 
 void rrd_stats_api_v1_charts_allmetrics_prometheus(RRDHOST *host, BUFFER *wb, int help, int types, int names) {
     rrdhost_rdlock(host);
 
     char hostname[PROMETHEUS_ELEMENT_MAX + 1];
-    prometheus_name_copy(hostname, host->hostname, PROMETHEUS_ELEMENT_MAX);
+    prometheus_label_copy(hostname, host->hostname, PROMETHEUS_ELEMENT_MAX);
 
     // for each chart
     RRDSET *st;