You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Outgoing HttpClient LatencyInfo enricher value has incomplete escaping #7757
The outgoing HttpClient latency enricher (AddHttpClientLatencyTelemetry)
serializes the LatencyInfo tag value as a positional string but escapes nothing,
so legal input can shift the positional layout and corrupt the value a parser
reads.
The section delimiter , is never escaped. A , in any string field
(server name, tag name, tag value, checkpoint/measure name) shifts every
downstream section.
List items do not escape /.AppendTags, AppendCheckpoints, and AppendMeasures append names and values raw, so a / inside an item corrupts
the item-level split.
The server name field is not escaped at all (AppendServerName).
AppendTags / AppendCheckpoints / AppendMeasures append names and values raw, escaping neither , nor /.
Impact
Low severity. Most fields are registered/controlled names (checkpoints, measures,
tags). The one caller-controlled field is the server application name, taken from
a response header, which can legally contain , and /. Newlines are not
reachable (rejected by the server), so this is a data-integrity / parse-corruption
issue for consumers of LatencyInfo, not a log-forging issue.
Proposed fix
Escape , and / in every string field, including the server name, matching the
scheme the incoming enricher uses (/ and , replaced with _).
Notes
Discovered during API review of #7729 (AddHttpLatencyTelemetry). The incoming
enricher had the same class of defect and was fixed in that change; this issue
tracks the remaining gap in the outgoing HttpClient enricher, which currently
escapes nothing.
changed the title [-]LatencyInfo enricher value has incomplete/inconsistent escaping[/-][+]Outgoing HttpClient LatencyInfo enricher value has incomplete escaping[/+]on Sep 15, 2026
I'd like to work on this. I'll align the outgoing latency enricher's delimiter escaping with the incoming enricher and add regression tests for server names, tags, checkpoints, and measures.
Activity
[-]LatencyInfo enricher value has incomplete/inconsistent escaping[/-][+]Outgoing HttpClient LatencyInfo enricher value has incomplete escaping[/+]Escape comma and slash delimiters in HttpLatencyLogEnricher
Rename AddHttpLatencyTelemetry to AddHttpServerLatencyTelemetry (API-…
zjdangge commentedon Oct 20, 2026
I'd like to work on this. I'll align the outgoing latency enricher's delimiter escaping with the incoming enricher and add regression tests for server names, tags, checkpoints, and measures.