nbari / mariadb_exporter / 35066479748

88%

main: 88%

Build Type

push

github

Committed by nbari

Commit Message

Harden scrape-safety guards and fix audit findings for 0.9.0

A deep review of the unreleased 0.9.0 changeset found the production
code sound but the new structural test guards bypassable, plus a few
residual correctness gaps. Every fix carries a mutation-verified
regression test (seen red on the unfixed code, green after).

Guards (tests/collector_safety.rs):
- Replace substring scanning with a masking lexer (line/block comments,
  raw/byte/C strings, char-vs-lifetime, escape-aware, offset-preserving)
  so prose and literal contents can neither impersonate pinned code
  shapes nor corrupt delimiter depth.
- Offload-error guard: statement-bounded .await? detection plus deferred
  propagation via bound results (let r = offload(..).await; ...; r?),
  while a later unrelated .await? no longer false-positives.
- OS-read call graph now walks the whole crate (not just src/collectors),
  matches callees by word boundary, and learns plain-import leaf names —
  catching out-of-tree helpers and fn-value passing. Markers extended
  with procfs/std::process.
- Span guard pins the actual let scrape = scrape.instrument(...) rebinding
  before tokio::spawn; panic-profile guard requires [profile.release] to
  exist and also walks .cargo/config.toml for -Cpanic=abort rustflags.

Code fixes:
- scraper: epoch check, epoch update and outcome-gauge publication now
  happen under one lock (publish_outcome_if_current), so a stale abort
  cannot overwrite a newer scrape's success in any interleaving.
  Counters and durations stay unconditional.
- system umbrella: sub-collector work is constructed inside a per-sub
  catch_unwind, so even a synchronous panic in an overridden collect()
  degrades to warn-and-continue instead of failing the system collector.
- system.process: group membership is an exact name match (mariadbd,
  mysqld, mariadbd-safe, mysqld_safe); mysqldump and mysqld_exporter no
  longer leak into group="mariadb".

Tests:
- End-to-end 503 through the real serve... (continued)

Coverage Stats

771 of 884 new or added lines in 9 files covered. (87.22%)

4 existing lines in 3 files now uncovered.

10285 of 11651 relevant lines covered (88.28%)

7098.72 hits per line