internal/lume: don't capture metrics for paths that don't open

The code and data behind xeiaso.net

This fixes an issue where an attacker could create infinite cardinality
in my prometheus server by sending a bunch of bogus GET requests.
Metrics are only tracked for paths that make sense.

Signed-off-by: Xe Iaso <me@xeiaso.net>

Xe Iaso 2 years ago 57bd9082 a1614672

+6 -1

1 changed file

expand all

internal

lume

lume.go

+6 -1

internal/lume/lume.go

··· 87 87 } 88 88 89 89 func (f *FS) Open(name string) (fs.File, error) { 90 + fin, err := f.fs.Open(name) 91 + if err != nil { 92 + return nil, err 93 + } 94 + 90 95 opens.Add(name, 1) 91 96 92 - return f.fs.Open(name) 97 + return fin, nil 93 98 } 94 99 95 100 type Options struct {

Configure Feed

Configure Feed