From 3519167a98d693a7d4151992333548e1bb8d3268 Mon Sep 17 00:00:00 2001 From: Gregor Zeitlinger Date: Tue, 18 Aug 2026 14:11:51 +0000 Subject: [PATCH 1/4] docs: document scrape query limits Signed-off-by: Gregor Zeitlinger --- .../metrics/exporter/common/PrometheusHttpRequest.java | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/prometheus-metrics-exporter-common/src/main/java/io/prometheus/metrics/exporter/common/PrometheusHttpRequest.java b/prometheus-metrics-exporter-common/src/main/java/io/prometheus/metrics/exporter/common/PrometheusHttpRequest.java index 31ce2cc73..ce6fe256d 100644 --- a/prometheus-metrics-exporter-common/src/main/java/io/prometheus/metrics/exporter/common/PrometheusHttpRequest.java +++ b/prometheus-metrics-exporter-common/src/main/java/io/prometheus/metrics/exporter/common/PrometheusHttpRequest.java @@ -41,7 +41,13 @@ default String getParameter(String name) { } } - /** See {@code jakarta.servlet.ServletRequest.getParameterValues(String)} */ + /** + * See {@code jakarta.servlet.ServletRequest.getParameterValues(String)}. + * + *

For safety, query strings are limited to 65,536 characters and 1,024 {@code &}-separated + * parameter pairs. Requests that exceed either limit or contain invalid percent-encoding are + * rejected by the scrape handler with HTTP {@code 400 Bad Request}. + */ @Override @Nullable // decode with Charset is only available in Java 10+, but we want to support Java 8 From 5c2b6b810380fc5126553d36976a46012be2c102 Mon Sep 17 00:00:00 2001 From: Gregor Zeitlinger Date: Tue, 18 Aug 2026 14:28:54 +0000 Subject: [PATCH 2/4] docs: clarify scrape query limit configuration Signed-off-by: Gregor Zeitlinger --- .../metrics/exporter/common/PrometheusHttpRequest.java | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/prometheus-metrics-exporter-common/src/main/java/io/prometheus/metrics/exporter/common/PrometheusHttpRequest.java b/prometheus-metrics-exporter-common/src/main/java/io/prometheus/metrics/exporter/common/PrometheusHttpRequest.java index ce6fe256d..829540d3f 100644 --- a/prometheus-metrics-exporter-common/src/main/java/io/prometheus/metrics/exporter/common/PrometheusHttpRequest.java +++ b/prometheus-metrics-exporter-common/src/main/java/io/prometheus/metrics/exporter/common/PrometheusHttpRequest.java @@ -44,9 +44,11 @@ default String getParameter(String name) { /** * See {@code jakarta.servlet.ServletRequest.getParameterValues(String)}. * - *

For safety, query strings are limited to 65,536 characters and 1,024 {@code &}-separated - * parameter pairs. Requests that exceed either limit or contain invalid percent-encoding are - * rejected by the scrape handler with HTTP {@code 400 Bad Request}. + *

For safety, the default implementation applies two fixed limits: {@code + * maxQueryStringLength = 64 * 1024} (65,536 characters) and {@code maxQueryParameterCount = + * 1024} ({@code &}-separated parameter pairs). These implementation values are not exposed as + * runtime configuration. Requests that exceed either limit or contain invalid percent-encoding + * are rejected by the scrape handler with HTTP {@code 400 Bad Request}. */ @Override @Nullable From 1a68d610980fa8e411ab8f425bb461262f163175 Mon Sep 17 00:00:00 2001 From: Gregor Zeitlinger Date: Tue, 18 Aug 2026 14:29:36 +0000 Subject: [PATCH 3/4] style: format query limit documentation Signed-off-by: Gregor Zeitlinger --- .../metrics/exporter/common/PrometheusHttpRequest.java | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/prometheus-metrics-exporter-common/src/main/java/io/prometheus/metrics/exporter/common/PrometheusHttpRequest.java b/prometheus-metrics-exporter-common/src/main/java/io/prometheus/metrics/exporter/common/PrometheusHttpRequest.java index 829540d3f..a0a8311f6 100644 --- a/prometheus-metrics-exporter-common/src/main/java/io/prometheus/metrics/exporter/common/PrometheusHttpRequest.java +++ b/prometheus-metrics-exporter-common/src/main/java/io/prometheus/metrics/exporter/common/PrometheusHttpRequest.java @@ -44,11 +44,11 @@ default String getParameter(String name) { /** * See {@code jakarta.servlet.ServletRequest.getParameterValues(String)}. * - *

For safety, the default implementation applies two fixed limits: {@code - * maxQueryStringLength = 64 * 1024} (65,536 characters) and {@code maxQueryParameterCount = - * 1024} ({@code &}-separated parameter pairs). These implementation values are not exposed as - * runtime configuration. Requests that exceed either limit or contain invalid percent-encoding - * are rejected by the scrape handler with HTTP {@code 400 Bad Request}. + *

For safety, the default implementation applies two fixed limits: {@code maxQueryStringLength + * = 64 * 1024} (65,536 characters) and {@code maxQueryParameterCount = 1024} ({@code &}-separated + * parameter pairs). These implementation values are not exposed as runtime configuration. + * Requests that exceed either limit or contain invalid percent-encoding are rejected by the + * scrape handler with HTTP {@code 400 Bad Request}. */ @Override @Nullable From 7785168226ee95d8bca627fdd79c512247f34f12 Mon Sep 17 00:00:00 2001 From: Gregor Zeitlinger Date: Wed, 19 Aug 2026 09:37:05 +0000 Subject: [PATCH 4/4] docs: clarify scrape query limits are fixed Signed-off-by: Gregor Zeitlinger --- docs/content/exporters/filter.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/content/exporters/filter.md b/docs/content/exporters/filter.md index eb893733a..7d3e71d0e 100644 --- a/docs/content/exporters/filter.md +++ b/docs/content/exporters/filter.md @@ -23,7 +23,8 @@ params: For safety, exporters limit the query string to 65,536 characters and accept at most 1,024 query parameters. The parameter limit counts every `&`-separated pair, including repeated -parameters and empty pairs. +parameters and empty pairs. These are fixed implementation limits and cannot be changed through +runtime configuration. If a request exceeds either limit or contains invalid percent-encoding, the `/metrics` endpoint returns HTTP `400 Bad Request` with the plain-text response `Invalid query parameters`.