Information disclosure / improper tenant isolation

Proof-of-concept (conceptual, actionable steps): Context: VictoriaMetrics in a multi-tenant setup with per-tenant data access. Tenants: 100, 108, 116, 1239 (with representative data). A long tenant filter regex is used to select a subset of tenants. Problem (before fix): If the tenant filter value is very long, the internal representation via TagFilter.String() can be truncated to a placeholder like '...'. When the engine later evaluates the filter, the truncated representation can cause incorrect matching semantics. This could result in data from unintended tenants (e.g., tenant 1239) being included in a query intended for a different subset (e.g., 100, 108, 116). Attack scenario (high-level): 1) Deploy VictoriaMetrics with multi-tenant mode and populate sample data for tenants: 100, 108, 116, 1239. 2) Issue a query that uses a long regex-based tenant filter, e.g. value = long_regex_pattern_matching_multiple_tenants (IsRegexp = true). 3) Observe results: due to the old string representation, the filter may be evaluated incorrectly, causing data leakage from one or more tenants not intended by the filter (for example, including 1239 data in a result set that should have excluded it, or omitting 108). Reproduction outline (pseudocode and steps): - Prepare data for tenants: 100, 108, 116, 1239. - Construct a TagFilter for tenant_id with a very long regex, IsRegexp = true, e.g.: Key: "tenant_id" Value: "^(100|101|102|...|ReplicaOfLongRegexWithManyTerms|1239)$" // intentionally long IsRegexp: true - Execute a query that applies this tenant filter and returns a small, verifiable metric (e.g., count or sum). - Observe that, on an unpatched build, the result set may include data from an unintended tenant (e.g., 1239) or miss an intended tenant (e.g., 108). What to test after patch: - Run the same long-regex-based filter and verify that results now include exactly the intended tenants without leakage, e.g., [100, 108, 116] or the exact set dictated by the long regex, but without data from unintended tenants. Notes: The test TestApplyFiltersToTenants in the referenced test suite demonstrates a mismatch caused by long tenant filters. The fix ensures the operator for each filter term is preserved (e.g., =, !=, =~, !~) instead of relying on a truncated human-readable representation, thus preserving correct semantics.

diff --git a/app/vmctl/vm_native.go b/app/vmctl/vm_native.go index 2ca364a87bc46..de47a2eeb5430 100644 --- a/app/vmctl/vm_native.go +++ b/app/vmctl/vm_native.go @@ -405,7 +405,16 @@ func buildMatchWithFilter(filter string, metricName string) (string, error) { if len(tf.Key) == 0 { continue } - a = append(a, tf.String()) + switch { + case tf.IsNegative && tf.IsRegexp: + a = append(a, fmt.Sprintf("%s!~%q", tf.Key, tf.Value)) + case tf.IsNegative: + a = append(a, fmt.Sprintf("%s!=%q", tf.Key, tf.Value)) + case tf.IsRegexp: + a = append(a, fmt.Sprintf("%s=~%q", tf.Key, tf.Value)) + default: + a = append(a, fmt.Sprintf("%s=%q", tf.Key, tf.Value)) + } } a = append(a, nameFilter) filters = append(filters, strings.Join(a, ",")) diff --git a/lib/promrelabel/if_expression.go b/lib/promrelabel/if_expression.go index 3afd69f5ed218..322ddb4760983 100644 --- a/lib/promrelabel/if_expression.go +++ b/lib/promrelabel/if_expression.go @@ -50,6 +50,17 @@ func (ie *IfExpression) Parse(s string) error { return nil } +// ParseFromMetricExpr parses if from given MetricExpr +func (ie *IfExpression) ParseFromMetricExpr(me *metricsql.MetricExpr) error { + var ieLocal ifExpression + if err := ieLocal.parseFromMetricExpr(me); err != nil { + return err + } + + ie.ies = []*ifExpression{&ieLocal} + return nil +} + // UnmarshalJSON unmarshals ie from JSON data. func (ie *IfExpression) UnmarshalJSON(data []byte) error { var v any @@ -182,6 +193,16 @@ func (ie *ifExpression) Parse(s string) error { return nil } +func (ie *ifExpression) parseFromMetricExpr(me *metricsql.MetricExpr) error { + lfss, err := metricExprToLabelFilterss(me) + if err != nil { + return fmt.Errorf("cannot parse series selector: %w", err) + } + ie.s = string(me.AppendString(nil)) + ie.lfss = lfss + return nil +} + // UnmarshalJSON unmarshals ie from JSON data. func (ie *ifExpression) UnmarshalJSON(data []byte) error { var s string