[go: up one dir, main page]

Remove `path` and `branch` labels from metrics.

Summary

Some Prometheus metrics features expose path and branch labels that contain user-input data.

These labels could contain sensitive data and have unbounded cardinality limits.

These labels must be removed from the metrics.

Affected feature flags:

prometheus_transaction_event_change_default_branch_total
prometheus_transaction_event_create_repository_total
prometheus_transaction_event_fork_repository_total
prometheus_transaction_event_import_repository_total
prometheus_transaction_event_mirrors_failed_total
prometheus_transaction_event_mirrors_scheduled_total
prometheus_transaction_event_push_branch_total
prometheus_transaction_event_push_commit_total
prometheus_transaction_event_push_tag_total
prometheus_transaction_event_remote_mirrors_failed_total
prometheus_transaction_event_remote_mirrors_finished_total
prometheus_transaction_event_remote_mirrors_running_total
prometheus_transaction_event_remove_branch_total
prometheus_transaction_event_remove_repository_total
prometheus_transaction_event_remove_tag_total

Results of GitLab environment info

Affects 11.0

Edited by Ben Kochie