10000 Reject invalid HTTP methods and resources · prometheus/client_python@cc17408 · GitHub
[go: up one dir, main page]
Skip to content

Commit cc17408

Browse files
andy-maierandy-maier
committed
Reject invalid HTTP methods and resources
This change addresses the issue that currently, any HTTP method is handled by returning success and metrics data, which causes network scanners to report issues. Details: * This change rejects any HTTP methods and resources other than the following: OPTIONS (any) - returns 200 and an 'Allow' header indicating allowed methods GET (any) - returns 200 and metrics GET /favicon.ico - returns 200 and no body (this is no change) Other HTTP methods than these are rejected with 405 "Method Not Allowed" and an 'Allow' header indicating the allowed HTTP methods. Any returned HTTP errors are also displayed in the response body after a hash sign and with a brief hint, e.g. "# HTTP 405 Method Not Allowed: XXX; use OPTIONS or GET". * Needed to pin asgiref to ==3.6.0 also for py3.8 to circumvent the same error as for pypy3.8. Signed-off-by: Andreas Maier <maiera@de.ibm.com>
1 parent 4535ce0 commit cc17408

File tree

3 files changed

+34
-4
lines changed

3 files changed

+34
-4
lines changed

‎docs/content/exporting/http/_index.md

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,4 +52,23 @@ chain is used (see Python [ssl.SSLContext.load_default_certs()](https://docs.pyt
5252
from prometheus_client import start_http_server
5353

5454
start_http_server(8000, certfile="server.crt", keyfile="server.key")
55-
```
55+
```
56+
57+
# Supported HTTP methods
58+
59+
The prometheus client will handle the following HTTP methods and resources:
60+
61+
* `OPTIONS (any)` - returns HTTP status 200 and an 'Allow' header indicating the
62+
allowed methods (OPTIONS, GET)
63+
* `GET (any)` - returns HTTP status 200 and the metrics data
64+
* `GET /favicon.ico` - returns HTTP status 200 and an empty response body. Some
65+
browsers support this to display the returned icon in the browser tab.
66+
67+
Other HTTP methods than these are rejected with HTTP status 405 "Method Not Allowed"
68+
and an 'Allow' header indicating the allowed methods (OPTIONS, GET).
69+
70+
Any returned HTTP errors are also displayed in the response body after a hash
71+
sign and with a brief hint. Example:
72+
```
73+
# HTTP 405 Method Not Allowed: XXX; use OPTIONS or GET
74+
```

‎prometheus_client/exposition.py

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -118,12 +118,23 @@ def prometheus_app(environ, start_response):
118118
accept_header = environ.get('HTTP_ACCEPT')
119119
accept_encoding_header = environ.get('HTTP_ACCEPT_ENCODING')
120120
params = parse_qs(environ.get('QUERY_STRING', ''))
121-
if environ['PATH_INFO'] == '/favicon.ico':
121+
122+
if environ['REQUEST_METHOD'] == 'OPTIONS':
123+
status = '200 OK'
124+
headers = [('Allow', 'OPTIONS,GET')]
125+
output = b''
126+
elif environ['REQUEST_METHOD'] != 'GET':
127+
status = '405 Method Not Allowed'
128+
headers = [('Allow', 'OPTIONS,GET')]
129+
output = '# HTTP {}: {}; use OPTIONS or GET\n'.format(status, environ['REQUEST_METHOD']).encode()
130+
elif environ['PATH_INFO'] == '/favicon.ico':
122131
# Serve empty response for browsers
123132
status = '200 OK'
124133
headers = [('', '')]
125134
output = b''
126135
else:
136+
# Note: For backwards compatibility, the URI path for GET is not
137+
# constrained to the documented /metrics, but any path is allowed.
127138
# Bake output
128139
status, headers, output = _bake_output(registry, accept_header, accept_encoding_header, params, disable_compression)
129140
# Return output

‎tox.ini

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@ deps =
77
pytest
88
attrs
99
{py3.8,pypy3.8}: twisted
10-
py3.8: asgiref
11-
# See https://github.com/django/asgiref/issues/393 for why we need to pin asgiref for pypy
10+
# See https://github.com/django/asgiref/issues/393 for why we need to pin asgiref
11+
py3.8: asgiref==3.6.0
1212
pypy3.8: asgiref==3.6.0
1313
commands = coverage run --parallel -m pytest {posargs}
1414

0 commit comments

Comments
 (0)
0