Skip to content

out_influxdb: allow stripping of tag prefix #9427

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

out_influxdb: allow stripping of tag prefix #9427

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e25fc64
out_influxdb: allow stripping of tag prefix
ueli-g Sep 26, 2024
79bc485
out_influxdb properly free configuration string value on exit
ueli-g Sep 30, 2024
2d115fa
Add clarifying remarks, make sure prefix match length is always reset
Oct 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 30 additions & 1 deletion plugins/out_influxdb/influxdb.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,8 @@ static int influxdb_format(struct flb_config *config,
char *str = NULL;
size_t str_size;
char tmp[128];
int prefix_match = 0;
int prefix_offset = 0;
msgpack_object map;
Comment on lines +77 to 79
Copy link

@coderabbitai coderabbitai bot Sep 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Fix OOB read on tag and per-record state leak (prefix_offset).

  • tag is a raw buffer with explicit length; strncmp(tag, …, ctx->prefix_len) can read past tag when prefix_len > tag_len.
  • prefix_offset is not reset inside the event loop; a prior match can incorrectly affect subsequent records.

Apply:

@@
-    char tmp[128];
-    int prefix_match = 0;
-    int prefix_offset = 0;
+    char tmp[128];
+    int prefix_offset = 0;
@@
-        prefix_match = strncmp(tag, ctx->prefix, ctx->prefix_len);
-        if (prefix_match == 0) {
-            if (tag_len > ctx->prefix_len) {
-                prefix_offset = ctx->prefix_len;
-            }
-        }
+        /* reset per-record */
+        prefix_offset = 0;
+        /* safe compare: only when prefix is non-empty and tag is longer */
+        if (ctx->prefix_len > 0 && tag_len > ctx->prefix_len) {
+            if (memcmp(tag, ctx->prefix, (size_t) ctx->prefix_len) == 0) {
+                prefix_offset = ctx->prefix_len;
+            }
+        }

And ensure memcmp is declared:

 #include <stdio.h>
+#include <string.h>

This prevents undefined reads and guarantees no negative length is passed to influxdb_bulk_append_header.

Also applies to: 129-139

🤖 Prompt for AI Agents 
In plugins/out_influxdb/influxdb.c around lines 77-79 (and similarly 129-139),
fix the OOB read and state leak by treating tag as a length-delimited buffer:
obtain tag_len from tag.via.raw.size and only compare up to that length (do not
call strncmp with ctx->prefix_len if ctx->prefix_len > tag_len); use memcmp with
the minimum of the two lengths or explicitly require tag_len >= ctx->prefix_len
before matching to avoid undefined reads, and reset prefix_offset to 0 at the
start of each event/record iteration so previous matches do not carry over; also
ensure memcmp is declared by including the proper header (string.h) so the
comparator is defined, and guard calls to influxdb_bulk_append_header so no
negative length is ever passed.

struct flb_time tm;
struct influxdb_bulk *bulk = NULL;
Expand Down Expand Up @@ -124,8 +126,16 @@ static int influxdb_format(struct flb_config *config,
ctx->seq++;
}

prefix_match = strncmp(tag, ctx->prefix, ctx->prefix_len);
if (prefix_match == 0) {
if (tag_len > ctx->prefix_len) {
prefix_offset = ctx->prefix_len;
}
}

ret = influxdb_bulk_append_header(bulk_head,
tag, tag_len,
tag + prefix_offset,
tag_len - prefix_offset,
seq,
ctx->seq_name, ctx->seq_len);
if (ret == -1) {
Expand Down Expand Up @@ -369,6 +379,15 @@ static int cb_influxdb_init(struct flb_output_instance *ins, struct flb_config *
}
ctx->seq_len = strlen(ctx->seq_name);

/* prefix */
tmp = flb_output_get_property("strip_prefix", ins);
if (!tmp) {
ctx->prefix = flb_strdup("");
} else {
ctx->prefix = flb_strdup(tmp);
}
ctx->prefix_len = strlen(ctx->prefix);

if (ctx->custom_uri) {
/* custom URI endpoint (e.g: Grafana */
if (ctx->custom_uri[0] != '/') {
Expand Down Expand Up @@ -595,6 +614,10 @@ static int cb_influxdb_exit(void *data, struct flb_config *config)
flb_free(ctx->seq_name);
}

if (ctx->prefix) {
flb_free(ctx->prefix);
}

flb_upstream_destroy(ctx->u);
flb_free(ctx);

Expand Down Expand Up @@ -697,6 +720,12 @@ static struct flb_config_map config_map[] = {
"Use influxdb line protocol's integer type suffix."
},

{
FLB_CONFIG_MAP_STR, "strip_prefix", NULL,
0, FLB_FALSE, 0,
"Prefix to be removed from the record tag when writing influx measurements."
},

/* EOF */
{0}
};
Expand Down
4 changes: 4 additions & 0 deletions plugins/out_influxdb/influxdb.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,10 @@ struct flb_influxdb {
char *seq_name;
int seq_len;

/* prefix */
char *prefix;
int prefix_len;

/* auto_tags: on/off */
int auto_tags;

Expand Down