{"action":"created","issue":{"url":"https://api.github.com/repos/graphite-project/carbon/issues/417","labels_url":"https://api.github.com/repos/graphite-project/carbon/issues/417/labels{/name}","comments_url":"https://api.github.com/repos/graphite-project/carbon/issues/417/comments","events_url":"https://api.github.com/repos/graphite-project/carbon/issues/417/events","html_url":"https://github.com/graphite-project/carbon/issues/417","id":91303061,"number":417,"title":"Define what a metric can be.","user":{"login":"docwhat","id":40799,"avatar_url":"https://avatars.githubusercontent.com/u/40799?v=3","gravatar_id":"","url":"https://api.github.com/users/docwhat","html_url":"https://github.com/docwhat","followers_url":"https://api.github.com/users/docwhat/followers","following_url":"https://api.github.com/users/docwhat/following{/other_user}","gists_url":"https://api.github.com/users/docwhat/gists{/gist_id}","starred_url":"https://api.github.com/users/docwhat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docwhat/subscriptions","organizations_url":"https://api.github.com/users/docwhat/orgs","repos_url":"https://api.github.com/users/docwhat/repos","events_url":"https://api.github.com/users/docwhat/events{/privacy}","received_events_url":"https://api.github.com/users/docwhat/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-06-26T17:08:05Z","updated_at":"2015-06-26T17:44:06Z","closed_at":null,"body":"Right now, graphite and carbon both share the concept of a metric, but they don't have any kind of validation.\r\n\r\nI haven't tested it, but given the way the `getFilesystemPath()` works, I would assume you could craft a metric that would cause problems on the carbon server.  Especially on windows.\r\n\r\nI think it'd be beneficial if a metric was fully defined.  Something like:\r\n\r\n1. A metric path contains metric nodes separated by `.`.\r\n2. A metric path may not exceed 1024 characters. (Or some limit.  Windows NTFS has a path limit, depending on the filesystem type)\r\n3. A metric node may only contain characters that match the regexp: `/[A-Za-z0-9_-]+/`\r\n\r\nThis should prevent most/all exploits involving `getFilesystemPath()` in carbon.\r\n\r\nIt would also fix potential problems in graphite-web() mechanisms as well."},"comment":{"url":"https://api.github.com/repos/graphite-project/carbon/issues/comments/115806338","html_url":"https://github.com/graphite-project/carbon/issues/417#issuecomment-115806338","issue_url":"https://api.github.com/repos/graphite-project/carbon/issues/417","id":115806338,"user":{"login":"seh","id":175841,"avatar_url":"https://avatars.githubusercontent.com/u/175841?v=3","gravatar_id":"","url":"https://api.github.com/users/seh","html_url":"https://github.com/seh","followers_url":"https://api.github.com/users/seh/followers","following_url":"https://api.github.com/users/seh/following{/other_user}","gists_url":"https://api.github.com/users/seh/gists{/gist_id}","starred_url":"https://api.github.com/users/seh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/seh/subscriptions","organizations_url":"https://api.github.com/users/seh/orgs","repos_url":"https://api.github.com/users/seh/repos","events_url":"https://api.github.com/users/seh/events{/privacy}","received_events_url":"https://api.github.com/users/seh/received_events","type":"User","site_admin":false},"created_at":"2015-06-26T17:44:06Z","updated_at":"2015-06-26T17:44:06Z","body":"Potentially related: #181 and #331."}}