Skip to content

snuffle 0578b13

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Oct 09:20
· 1 commit to main since this release
0578b13
0578b13
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode. 
fix(logql): close SQL injection and unbounded range loops (#12)

- Keep the regexp parser pattern and capture-group indexes in separate
  fields. A label named __regex no longer puts the raw pattern into SQL.
- Cap Loki range queries at 11000 points per series, reject timestamps
  that overflow int64 nanoseconds when aligned to the step, and count
  steps by index instead of ts += step.
- Return an error for a lone '!' in a LogQL label filter instead of
  looping forever.
- Normalize /loki/api/v1/label/<name>/... in request metrics so caller
  text never becomes a metric label value.
- Add a fuzz test that sends queries through the HTTP API, records every
  SQL statement, and checks that user text stays inside SQL literals.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Assets 8
Loading