alertmanager icon indicating copy to clipboard operation
alertmanager copied to clipboard

validate sns message body

Open qinxx108 opened this issue 3 years ago • 4 comments

Add validation for message, if not a validate message, we will replace the message with error message Separate from https://github.com/prometheus/alertmanager/pull/2808

qinxx108 avatar Feb 14 '22 09:02 qinxx108

The code could use strings.ToValidUTF8 to eliminate invalid UTF-8 byte sequence rather than dropping everything.

Thanks for the comment! I wonder which will be better in case of user experience. The subject is replaced by some "error" alerting your subject is invalid VS the subject is changed without your notice

On the other hand https://pkg.go.dev/strings#ToValidUTF8 can also return you an empty string as described here: "ToValidUTF8 returns a copy of the string s with each run of invalid UTF-8 byte sequences replaced by the replacement string, which may be empty."

@simonpasquier please let me know what you think

qinxx108 avatar Apr 08 '22 22:04 qinxx108

My opinion is dropping everything is safer option because it will be very obvious to the receiver that something is wrong. For example, in the case where message body is a JSON, replacing the whole body would choke the receiver's JSON parser - a very clear signal something is wrong; if we replace invalid character, then the JSON parsing would succeed but the receiver consumes incomplete information (imagine we replace a invalid "0", in someone's bank account).

However, I do think there are cases where replacing invalid character would be the right thing, but by default I feel we should go with the safest behaviour. In the future, we can have configuration options to let users configure different behaviour upon invalid SNS message body.

alvinlin123 avatar Apr 11 '22 05:04 alvinlin123

in prometheus we generally drop when there is an error rather than potentially misleading the users, I think I prefer to have the explicit error as well.

roidelapluie avatar Apr 11 '22 17:04 roidelapluie

Thanks @roidelapluie for your comments. I wonder if everybody is okay with current approach, can i get approved for this PR?

Thank you so much

Yijie

qinxx108 avatar Sep 11 '23 20:09 qinxx108