diff --git a/node/metrics.go b/node/metrics.go index d0bc92d32bac5e11f1a15c83e5e71d60b47643b0..74a804819bb10d0dd89c684094e4a9c846d762c1 100644 --- a/node/metrics.go +++ b/node/metrics.go @@ -7,7 +7,6 @@ import ( "flag" "log" "net/http" - "regexp" "strings" "time" @@ -80,9 +79,6 @@ func (p *metricsProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) { }) } -// Regexp used to validate query arguments. -var argRx = regexp.MustCompile(`^[-_.a-zA-Z0-9]*$`) - func (p *metricsProxy) queryFromRequest(r *http.Request) (string, v1.Range, error) { name := r.FormValue("query") d, err := time.ParseDuration(r.FormValue("t")) @@ -90,8 +86,9 @@ func (p *metricsProxy) queryFromRequest(r *http.Request) (string, v1.Range, erro d = time.Hour } + // We only care that the argument does not contain quotes. arg := r.FormValue("arg") - if !argRx.MatchString(arg) { + if strings.Contains(arg, "\"") { return "", v1.Range{}, errors.New("bad argument") } q, ok := knownQueries[name]