fluentd 1.19.3-x64-mingw32 → 1.19.4-x64-mingw32

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b02fab90cf21116c45ee6fc51eb3719946b0d6699092cc94adaf2ced11e8f631
-  data.tar.gz: 9eb17482dcd40ef2f8211785e211be6fbcd4ec907a4c4f04ea8e58c3b52e2b6d
+  metadata.gz: b109ce733ba054b3b03daa1f47658e8287dcb3b2e0a1ca2c0cca4defb8b1415a
+  data.tar.gz: d80e36b87699060e8c895d9fb332dc521f0ba9cdbb0b0f4c80dd996003fdca50
 SHA512:
-  metadata.gz: 395b0e0a4a8774d46014a3f47fff15c9c226d5d7547c22a3d90dcf309cbfbce55aa2e1dcf02160b6d6909f0aa8737f37a0c95a956c24c317dc8958e3db43de7a
-  data.tar.gz: 7febff6dc16fae70f92d0b9855e851d8119e31e89dd79107a3a13bd32bfb7b07fbc28fcebbdbd081c7542fcb42c310215c7607b7fe6f6538d893a05a53054ada
+  metadata.gz: ec9c12b4dfa48360cd34ba349a84ab8777a079a1d8c35af4a28f94fd1db56691846cef5d6df96cd2ff690e1b467467b6f51c6672f956e90703bc02adb67654c1
+  data.tar.gz: 7af35f61b6d84663e4871f410e9f4d32116d59e5953ecf32797fbb3331f5caefff699d1a55820967b4b45d183ac0980a9776284e4d29ed94828264d5648d7992

data/CHANGELOG.md

@@ -1,5 +1,50 @@
 # v1.19
 
+## Release v1.19.4 - 2026/09/28
+
+### Bug Fix
+
+* buffer: enforce decompression_size_limit on the chunk IO path https://github.com/fluent/fluentd/pull/5504
+* buffer: clamp exported buffer size metrics to non-negative values https://github.com/fluent/fluentd/pull/5488
+* buffer: fix spurious `BufferOverflowError` caused by `queue_size` leaking when a chunk purge fails https://github.com/fluent/fluentd/pull/5487
+* buffer: fix `stage_byte_size` leak on staged to unstaged chunk demotion that could eventually raise spurious `BufferOverflowError` in plugins implementing `#format` https://github.com/fluent/fluentd/pull/5456
+* in_syslog: enforce message_length_limit on TCP/TLS transport https://github.com/fluent/fluentd/pull/5502
+  * The default value of `message_length_limit` is changed from 2048 to 8192 to match rsyslog's default `MaxMessageSize`.
+* output: fix incomplete path traversal check in extract_placeholders https://github.com/fluent/fluentd/pull/5501
+* output: treat JSON::GeneratorError as unrecoverable error https://github.com/fluent/fluentd/pull/5423
+* parser_syslog: fix NameError when RFC5424 timestamp has repeated spaces https://github.com/fluent/fluentd/pull/5500
+* parser_syslog: fix NameError when RFC3164 timestamp has repeated spaces https://github.com/fluent/fluentd/pull/5497
+* parser_syslog: avoid excessive backtracking when parsing malformed RFC5424 structured data https://github.com/fluent/fluentd/pull/5444
+* chunk: ensure to close the Tempfile for decompressed data https://github.com/fluent/fluentd/pull/5486
+* plugin base: bound the number of worker lock files by hashing the path into a fixed set of buckets https://github.com/fluent/fluentd/pull/5471
+* out_forward: stop the endless "ack in response and chunk id in sent data are different" warning storm by discarding (instead of reusing) a keepalive socket whose ack failed or came back with a mismatched chunk id https://github.com/fluent/fluentd/pull/5445
+* config: accept empty lines in quoted strings https://github.com/fluent/fluentd/pull/5478
+* config: fix a config error when a single scalar value is given to an array option in YAML config syntax (for example `retryable_response_codes: 503`) https://github.com/fluent/fluentd/pull/5433
+* supervisor: reduce memory usage of cleanup_lock_dir with huge number of lock files https://github.com/fluent/fluentd/pull/5472
+
+### Enhancement
+
+* in_http: add `<auth>` for basic authentication and `<security>` for client network allowlisting https://github.com/fluent/fluentd/pull/5503
+
+### Misc
+
+* gem: support json gem v3.x https://github.com/fluent/fluentd/pull/5493
+* Add `allow_comments: true` option for json parser https://github.com/fluent/fluentd/pull/5432
+* Set `allow_duplicate_key: true` for all `JSON.parse` call https://github.com/fluent/fluentd/pull/5430
+* CI fixes
+  * https://github.com/fluent/fluentd/pull/5495
+  * https://github.com/fluent/fluentd/pull/5477
+  * https://github.com/fluent/fluentd/pull/5466
+  * https://github.com/fluent/fluentd/pull/5460
+  * https://github.com/fluent/fluentd/pull/5455
+  * https://github.com/fluent/fluentd/pull/5454
+  * https://github.com/fluent/fluentd/pull/5453
+  * https://github.com/fluent/fluentd/pull/5452
+  * https://github.com/fluent/fluentd/pull/5434
+  * https://github.com/fluent/fluentd/pull/5426
+  * https://github.com/fluent/fluentd/pull/5425
+  * https://github.com/fluent/fluentd/pull/5424
+
 ## Release v1.19.3 - 2026/06/25
 
 ### Bug Fix

data/lib/fluent/command/cat.rb

@@ -326,7 +326,7 @@ case format
 when 'json'
   begin
     while line = $stdin.gets
-      record = Yajl.load(line)
+      record = JSON.parse(line, **Fluent::DEFAULT_JSON_PARSE_OPTIONS)
       w.write(record)
     end
   rescue

data/lib/fluent/config/basic_parser.rb

@@ -28,7 +28,6 @@ module Fluent
       SPACING = /(?:[ \t\r\n]|\z|\#.*?(?:\z|[\r\n]))+/
       ZERO_OR_MORE_SPACING = /(?:[ \t\r\n]|\z|\#.*?(?:\z|[\r\n]))*/
       SPACING_WITHOUT_COMMENT = /(?:[ \t\r\n]|\z)+/
-      LINE_END_WITHOUT_SPACING_AND_COMMENT = /(?:\z|[\r\n])/
 
       module ClassMethods
         def symbol(string)

data/lib/fluent/config/literal_parser.rb

@@ -21,11 +21,21 @@ require 'yajl'
 require 'socket'
 require 'ripper'
 
+require 'fluent/env'
 require 'fluent/config/basic_parser'
 
 module Fluent
   module Config
     class LiteralParser < BasicParser
+      # A physical line break (LF, CR, or CRLF) inside a quoted string.
+      # CRLF is normalized to LF so that the same config text does not produce a
+      # different value depending on whether the file was saved with LF or CRLF.
+      # A lone CR is kept as-is, and an escaped "\r\n" still produces CRLF.
+      LINE_BREAK = /\r\n|[\r\n]/
+      # A backslash immediately followed by a physical line break.
+      # It works as a line continuation, so both are stripped from the value.
+      LINE_CONTINUATION = /\\#{LINE_BREAK}/o
+
       def self.unescape_char(c)
         case c
         when '"'
@@ -98,11 +108,10 @@ module Fluent
             else
               return string.join
             end
-          elsif check(/[^"]#{LINE_END_WITHOUT_SPACING_AND_COMMENT}/o)
-            if s = check(/[^\\]#{LINE_END_WITHOUT_SPACING_AND_COMMENT}/o)
-              string << s
-            end
-            skip(/[^"]#{LINE_END_WITHOUT_SPACING_AND_COMMENT}/o)
+          elsif skip(LINE_CONTINUATION)
+            next
+          elsif s = scan(LINE_BREAK)
+            string << (s == "\r\n" ? "\n" : s)
           elsif s = scan(/\\./)
             string << eval_escape_char(s[1,1])
           elsif skip(/\#\{/)
@@ -125,6 +134,8 @@ module Fluent
             string << "'"
           elsif s = scan(/\\\\/)
             string << "\\"
+          elsif s = scan(LINE_BREAK)
+            string << (s == "\r\n" ? "\n" : s)
           elsif s = scan(/./)
             string << s
           else
@@ -241,7 +252,7 @@ EOM
             # '{"foo":"bar", #' -> '{"foo":"bar"}' (to check)
             parsed = nil
             begin
-              parsed = JSON.parse(buffer + line_buffer.rstrip.sub(/,$/, '') + (is_array ? "]" : "}"))
+              parsed = JSON.parse(buffer + line_buffer.rstrip.sub(/,$/, '') + (is_array ? "]" : "}"), **Fluent::DEFAULT_JSON_PARSE_OPTIONS)
             rescue JSON::ParserError
               # This '#' is in json string literals
             end
@@ -276,7 +287,7 @@ EOM
 
           line_buffer << char
           begin
-            result = JSON.parse(buffer + line_buffer)
+            result = JSON.parse(buffer + line_buffer, **Fluent::DEFAULT_JSON_PARSE_OPTIONS)
           rescue JSON::ParserError
             # Incomplete json string yet
           end

data/lib/fluent/config/types.rb

@@ -201,7 +201,7 @@ module Fluent
       return nil if val.nil?
 
       param = if val.is_a?(String)
-                val.start_with?('{') ? JSON.parse(val) : Hash[val.strip.split(/\s*,\s*/).map{|v| v.split(':', 2)}]
+                val.start_with?('{') ? JSON.parse(val, **Fluent::DEFAULT_JSON_PARSE_OPTIONS) : Hash[val.strip.split(/\s*,\s*/).map{|v| v.split(':', 2)}]
               else
                 val
               end
@@ -228,7 +228,15 @@ module Fluent
       return nil if val.nil?
 
       param = if val.is_a?(String)
-                val.start_with?('[') ? JSON.parse(val) : val.strip.split(/\s*,\s*/)
+                val.start_with?('[') ? JSON.parse(val, **Fluent::DEFAULT_JSON_PARSE_OPTIONS) : val.strip.split(/\s*,\s*/)
+              elsif val.is_a?(Array)
+                val
+              elsif val.is_a?(Numeric) || val == true || val == false
+                # Wrap only the bare scalars that Psych/YAML actually produces
+                # here (nil is handled by the early return above). Any other
+                # type (Hash, Symbol, Time, arbitrary objects) falls through and
+                # still raises "array required" below.
+                [val]
               else
                 val
               end

data/lib/fluent/configurable.rb

@@ -14,6 +14,7 @@
 #    limitations under the License.
 #
 
+require 'fluent/env'
 require 'fluent/config/configure_proxy'
 require 'fluent/config/section'
 require 'fluent/config/error'

data/lib/fluent/daemon.rb

@@ -5,9 +5,10 @@ here = File.dirname(__FILE__)
 $LOAD_PATH << File.expand_path(File.join(here, '..'))
 
 require 'serverengine'
+require 'fluent/env'
 require 'fluent/supervisor'
 
 server_module = Fluent.const_get(ARGV[0])
 worker_module = Fluent.const_get(ARGV[1])
-params = JSON.parse(ARGV[2])
+params = JSON.parse(ARGV[2], **Fluent::DEFAULT_JSON_PARSE_OPTIONS)
 ServerEngine::Daemon.run_server(server_module, worker_module) { Fluent::Supervisor.serverengine_config(params) }

data/lib/fluent/env.rb

@@ -26,6 +26,7 @@ module Fluent
   DEFAULT_SOCKET_PATH = ENV['FLUENT_SOCKET'] || '/var/run/fluent/fluent.sock'
   DEFAULT_BACKUP_DIR = ENV['FLUENT_BACKUP_DIR'] || '/tmp/fluent'
   DEFAULT_OJ_OPTIONS = Fluent::OjOptions.load_env
+  DEFAULT_JSON_PARSE_OPTIONS = { allow_duplicate_key: true, allow_comments: true }.freeze
   DEFAULT_DIR_PERMISSION = 0755
   DEFAULT_FILE_PERMISSION = 0644
   INSTANCE_ID = ENV['FLUENT_INSTANCE_ID'] || SecureRandom.uuid

data/lib/fluent/plugin/base.rb

@@ -14,6 +14,7 @@
 #    limitations under the License.
 #
 
+require 'zlib'
 require 'fluent/plugin'
 require 'fluent/configurable'
 require 'fluent/system_config'
@@ -69,9 +70,13 @@ module Fluent
         true
       end
 
+      LOCK_FILE_BUCKETS = 65536
+
       def get_lock_path(name)
-        name = name.gsub(/[^a-zA-Z0-9]/, "_")
-        File.join(@fluentd_lock_dir, "fluentd-#{name}.lock")
+        # The mapping from a name to a bucket MUST be identical across worker processes.
+        # Ruby's String#hash is randomly seeded per process and MUST NOT be used here.
+        bucket = Zlib.crc32(name.to_s) % LOCK_FILE_BUCKETS
+        File.join(@fluentd_lock_dir, "fluentd-bucket-#{bucket}.lock")
       end
 
       def acquire_worker_lock(name)

data/lib/fluent/plugin/buf_file.rb

@@ -163,7 +163,7 @@ module Fluent
           end
 
           begin
-            chunk = Fluent::Plugin::Buffer::FileChunk.new(m, path, mode, compress: @compress) # file chunk resumes contents of metadata
+            chunk = Fluent::Plugin::Buffer::FileChunk.new(m, path, mode, compress: @compress, decompression_size_limit: @decompression_size_limit) # file chunk resumes contents of metadata
           rescue Fluent::Plugin::Buffer::FileChunk::FileChunkError => e
             exist_broken_file = true
             handle_broken_files(path, mode, e)

data/lib/fluent/plugin/buffer/chunk.rb

@@ -220,9 +220,13 @@ module Fluent
                               Tempfile.new('decompressed-data')
                             end
                 output_io.binmode if output_io.is_a?(Tempfile)
-                decompress(input_io: chunk_io, output_io: output_io)
-                output_io.seek(0, IO::SEEK_SET)
-                yield output_io
+                begin
+                  decompress(input_io: chunk_io, output_io: output_io)
+                  output_io.seek(0, IO::SEEK_SET)
+                  yield output_io
+                ensure
+                  output_io.close! if output_io.is_a?(Tempfile)
+                end
               end
             end
           end
@@ -274,9 +278,13 @@ module Fluent
                               Tempfile.new('decompressed-data')
                             end
                 output_io.binmode if output_io.is_a?(Tempfile)
-                decompress(input_io: chunk_io, output_io: output_io, type: :zstd)
-                output_io.seek(0, IO::SEEK_SET)
-                yield output_io
+                begin
+                  decompress(input_io: chunk_io, output_io: output_io, type: :zstd)
+                  output_io.seek(0, IO::SEEK_SET)
+                  yield output_io
+                ensure
+                  output_io.close! if output_io.is_a?(Tempfile)
+                end
               end
             end
           end

data/lib/fluent/plugin/buffer/file_chunk.rb

@@ -168,9 +168,11 @@ module Fluent
 
         def open(**kwargs, &block)
           @chunk.seek(0, IO::SEEK_SET)
-          val = yield @chunk
-          @chunk.seek(0, IO::SEEK_END) if self.staged?
-          val
+          begin
+            yield @chunk
+          ensure
+            @chunk.seek(0, IO::SEEK_END) if self.staged?
+          end
         end
 
         def self.assume_chunk_state(path)

data/lib/fluent/plugin/buffer/file_single_chunk.rb

@@ -141,9 +141,11 @@ module Fluent
 
         def open(**kwargs, &block)
           @chunk.seek(0, IO::SEEK_SET)
-          val = yield @chunk
-          @chunk.seek(0, IO::SEEK_END) if self.staged?
-          val
+          begin
+            yield @chunk
+          ensure
+            @chunk.seek(0, IO::SEEK_END) if self.staged?
+          end
         end
 
         def self.assume_chunk_state(path)

data/lib/fluent/plugin/buffer.rb

@@ -601,13 +601,19 @@ module Fluent
           metadata = chunk.metadata
           log.on_trace { log.trace "purging a chunk", instance: self.object_id, chunk_id: dump_unique_id_hex(chunk_id), metadata: metadata }
 
+          bytesize = chunk.bytesize
           begin
-            bytesize = chunk.bytesize
             chunk.purge
-            @queue_size_metrics.sub(bytesize)
           rescue => e
             log.error "failed to purge buffer chunk", chunk_id: dump_unique_id_hex(chunk_id), error_class: e.class, error: e
             log.error_backtrace
+          ensure
+            # Always release the queued byte counter, even when purge raises
+            # (e.g. unlink/close failure on the buffer path). Otherwise
+            # @queue_size is never decremented for a dequeued chunk that is
+            # gone from both @queue and @dequeued, so the leak ratchets toward
+            # total_limit_size and storable? becomes permanently false (#5468).
+            @queue_size_metrics.sub(bytesize)
           end
 
           @dequeued_num[chunk.metadata] -= 1
@@ -850,7 +856,12 @@ module Fluent
                     # As already processed content is kept after rollback, then unstaged chunk should be queued.
                     # After that, re-process current split again.
                     # New chunk should be allocated, to do it, modify @stage and so on.
-                    synchronize { @stage.delete(modified_metadata) }
+                    synchronize do
+                      @stage.delete(modified_metadata)
+                      # Subtract this chunk's already-counted staged bytes here;
+                      # otherwise @stage_size leaks upward over the buffer's lifetime.
+                      @stage_size_metrics.sub(original_bytesize) if chunk.staged?
+                    end
                     staged_chunk_used = false
                     chunk.unstaged!
                     break
@@ -912,8 +923,15 @@ module Fluent
       ]
 
       def statistics
-        stage_size, queue_size = @stage_size_metrics.get, @queue_size_metrics.get
-        buffer_space = 1.0 - ((stage_size + queue_size * 1.0) / @total_limit_size)
+        # Export-only clamp: internal gauges may go transiently negative during
+        # the deferred stage_size add vs enqueue_chunk sub race (#5303, #2712).
+        # Clamping the gauge store itself would turn that into a permanent
+        # over-count and break Buffer#storable? -- keep raw gauge semantics.
+        stage_size = [@stage_size_metrics.get, 0].max
+        queue_size = [@queue_size_metrics.get, 0].max
+        denom = @total_limit_size.to_f
+        # denom > 0 already excludes 0/0 NaN; stage/queue are floored above.
+        buffer_space = denom > 0.0 ? (1.0 - (stage_size + queue_size).to_f / denom).clamp(0.0, 1.0) : 0.0
         @stage_length_metrics.set(@stage.size)
         @queue_length_metrics.set(@queue.size)
         @available_buffer_space_ratios_metrics.set(buffer_space * 100)

data/lib/fluent/plugin/compressable.rb

@@ -75,9 +75,9 @@ module Fluent
 
       def io_decompress(input, output, type = :gzip)
         if type == :gzip
-          Extractor.io_decompress_gzip(input, output)
+          Extractor.io_decompress_gzip(input, output, limit: @decompression_size_limit || DEFAULT_DECOMPRESSION_SIZE_LIMIT)
         elsif type == :zstd
-          Extractor.io_decompress_zstd(input, output)
+          Extractor.io_decompress_zstd(input, output, limit: @decompression_size_limit || DEFAULT_DECOMPRESSION_SIZE_LIMIT)
         else
           raise ArgumentError, "Unknown compression type: #{type}"
         end

data/lib/fluent/plugin/extractor.rb

@@ -26,6 +26,9 @@ module Fluent
 
       BYTES_TO_READ = 64 * 1024
       INFLATE_BYTES_TO_READ = 1024
+      # Zstd::StreamReader#read takes a number of compressed bytes, unlike
+      # Zlib::GzipReader#read which takes decompressed bytes
+      ZSTD_BYTES_TO_READ = 1024
 
       def self.decompress_gzip(compressed_data, limit:)
         io = StringIO.new(compressed_data)
@@ -55,8 +58,7 @@ module Fluent
         reader = Zstd::StreamReader.new(io)
         out = ''
         loop do
-          # Zstd::StreamReader needs to specify the size of the buffer
-          out << reader.read(BYTES_TO_READ)
+          out << reader.read(ZSTD_BYTES_TO_READ)
           if out.bytesize > limit
             raise SizeLimitError, "Decompressed data exceeds limit of #{limit} bytes"
           end
@@ -88,10 +90,15 @@ module Fluent
         out
       end
 
-      def self.io_decompress_gzip(input, output)
+      def self.io_decompress_gzip(input, output, limit:)
+        size = 0
         loop do
           reader = Zlib::GzipReader.new(input)
           while (chunk = reader.read(BYTES_TO_READ))
+            size += chunk.bytesize
+            if size > limit
+              raise SizeLimitError, "Decompressed data exceeds limit of #{limit} bytes"
+            end
             output.write(chunk)
           end
           unused = reader.unused
@@ -105,11 +112,15 @@ module Fluent
         output
       end
 
-      def self.io_decompress_zstd(input, output)
+      def self.io_decompress_zstd(input, output, limit:)
         reader = Zstd::StreamReader.new(input)
+        size = 0
         loop do
-          # Zstd::StreamReader needs to specify the size of the buffer
-          chunk = reader.read(BYTES_TO_READ)
+          chunk = reader.read(ZSTD_BYTES_TO_READ)
+          size += chunk.bytesize
+          if size > limit
+            raise SizeLimitError, "Decompressed data exceeds limit of #{limit} bytes"
+          end
           output.write(chunk)
           # Zstd::StreamReader doesn't provide unused data, so we have to manually adjust the position
           break if input.eof?

data/lib/fluent/plugin/filter_record_transformer.rb

@@ -18,6 +18,7 @@ require 'socket'
 require 'json'
 require 'ostruct'
 
+require 'fluent/env'
 require 'fluent/plugin/filter'
 require 'fluent/config/error'
 require 'fluent/event'
@@ -116,7 +117,7 @@ module Fluent::Plugin
 
     def parse_value(value_str)
       if value_str.start_with?('{', '[')
-        JSON.parse(value_str)
+        JSON.parse(value_str, **Fluent::DEFAULT_JSON_PARSE_OPTIONS)
       else
         value_str
       end

data/lib/fluent/plugin/in_http.rb

@@ -24,6 +24,8 @@ require 'webrick/httputils'
 require 'uri'
 require 'socket'
 require 'json'
+require 'ipaddr'
+require 'openssl'
 
 module Fluent::Plugin
   class InHttpParser < Parser
@@ -90,6 +92,22 @@ module Fluent::Plugin
     desc "Add prefix to incoming tag"
     config_param :add_tag_prefix, :string, default: nil
 
+    config_section :auth, required: false, multi: false do
+      desc 'The method for HTTP authentication'
+      config_param :method, :enum, list: [:basic], default: :basic
+      desc 'The username for basic authentication'
+      config_param :username, :string
+      desc 'The password for basic authentication'
+      config_param :password, :string, secret: true
+    end
+
+    config_section :security, required: false, multi: false do
+      config_section :client, param_name: :clients, required: false, multi: true do
+        desc 'Address or network of the client, IPv4 or IPv6. e.g. 192.168.1.10, 192.168.0.0/16, fd00::/8'
+        config_param :network, :string
+      end
+    end
+
     config_section :parse do
       config_set_default :@type, 'in_http'
     end
@@ -100,6 +118,7 @@ module Fluent::Plugin
       super
 
       @km = nil
+      @nodes = []
       @format_name = nil
       @parser_time_key = nil
 
@@ -127,6 +146,8 @@ module Fluent::Plugin
 
       raise Fluent::ConfigError, "'add_tag_prefix' parameter must not be empty" if @add_tag_prefix && @add_tag_prefix.empty?
 
+      configure_security if @security
+
       m = if @parser_configs.first['@type'] == 'in_http'
             @parser_msgpack = parser_create(usage: 'parser_in_http_msgpack', type: 'msgpack')
             @parser_msgpack.time_key = nil
@@ -260,11 +281,33 @@ module Fluent::Plugin
 
     private
 
+    def configure_security
+      @nodes = @security.clients.map do |client|
+        begin
+          IPAddr.new(client.network)
+        rescue ArgumentError
+          raise Fluent::ConfigError, "network '#{client.network}' address format is invalid"
+        end
+      end
+    end
+
+    def allowed_client?(address)
+      return true if @nodes.empty?
+      @nodes.any? { |node| node.include?(address) rescue false }
+    end
+
     def on_server_connect(conn)
+      unless allowed_client?(conn.remote_addr)
+        log.warn "client address does not match any allowed network", address: conn.remote_addr
+        conn.data {|_data| }
+        conn.close
+        return
+      end
+
       handler = Handler.new(conn, @km, method(:on_request),
                             @body_size_limit, @decompression_size_limit, @format_name, log,
                             @cors_allow_origins, @cors_allow_credentials,
-                            @add_query_params)
+                            @add_query_params, @auth)
 
       conn.on(:data) do |data|
         handler.on_read(data)
@@ -347,7 +390,7 @@ module Fluent::Plugin
       attr_reader :content_type
 
       def initialize(io, km, callback, body_size_limit, decompression_size_limit, format_name, log,
-                     cors_allow_origins, cors_allow_credentials, add_query_params)
+                     cors_allow_origins, cors_allow_credentials, add_query_params, auth = nil)
         @io = io
         @km = km
         @callback = callback
@@ -360,6 +403,8 @@ module Fluent::Plugin
         @cors_allow_credentials = cors_allow_credentials
         @idle = 0
         @add_query_params = add_query_params
+        @auth = auth
+        @authorization = nil
         @km.add(self)
 
         @remote_port, @remote_addr = io.remote_port, io.remote_addr
@@ -399,6 +444,7 @@ module Fluent::Plugin
         @env = {}
         @content_type = ""
         @content_encoding = ""
+        @authorization = nil
         headers.each_pair {|k,v|
           @env["HTTP_#{k.tr('-','_').upcase}"] = v
           case k
@@ -426,8 +472,22 @@ module Fluent::Plugin
             @access_control_request_method = v
           when /\AAccess-Control-Request-Headers\Z/i
             @access_control_request_headers = v
+          when /\AAuthorization\Z/i
+            @authorization = v.is_a?(Array) ? v.first : v
           end
         }
+
+        if @auth
+          # Never let the credential reach a record built by add_http_headers.
+          @env.delete("HTTP_AUTHORIZATION")
+
+          unless preflight_request? || authenticate
+            @log.warn "authentication failed", address: @remote_addr
+            send_response_and_close(RES_401_STATUS, {'WWW-Authenticate' => AUTH_CHALLENGE}, "")
+            return
+          end
+        end
+
         if expect
           if expect == '100-continue'.freeze
             if !size || size < @body_size_limit
@@ -442,6 +502,8 @@ module Fluent::Plugin
       end
 
       def on_body(chunk)
+        return if closing?
+
         if @body.bytesize + chunk.bytesize > @body_size_limit
           unless closing?
             send_response_and_close("413 Request Entity Too Large", {}, "Too large")
@@ -452,6 +514,8 @@ module Fluent::Plugin
       end
 
       RES_200_STATUS = "200 OK".freeze
+      RES_401_STATUS = "401 Unauthorized".freeze
+      AUTH_CHALLENGE = 'Basic realm="fluentd"'.freeze
       RES_403_STATUS = "403 Forbidden".freeze
 
       # Azure App Service sends GET requests for health checking purpose.
@@ -651,6 +715,23 @@ module Fluent::Plugin
       def parse_query(query)
         query.nil? ? {} : Hash[URI.decode_www_form(query, Encoding::ASCII_8BIT)]
       end
+
+      # Browsers never attach Authorization to a CORS preflight.
+      def preflight_request?
+        @parser.http_method == 'OPTIONS'.freeze
+      end
+
+      def authenticate
+        scheme, credentials = @authorization.to_s.split(' ', 2)
+        return false unless scheme == 'Basic'.freeze
+
+        username, password = credentials.to_s.unpack1('m').to_s.split(':', 2)
+        username_matched = OpenSSL.secure_compare(username.to_s, @auth.username)
+        password_matched = OpenSSL.secure_compare(password.to_s, @auth.password)
+        username_matched && password_matched
+      rescue ArgumentError
+        false
+      end
     end
   end
 end

data/lib/fluent/plugin/in_monitor_agent.rb

@@ -16,6 +16,7 @@
 
 require 'json'
 
+require 'fluent/env'
 require 'fluent/config/types'
 require 'fluent/plugin/input'
 require 'fluent/plugin/output'
@@ -101,7 +102,7 @@ module Fluent::Plugin
       end
 
       def render_ltsv(obj, code: 200)
-        normalized = JSON.parse(obj.to_json)
+        normalized = JSON.parse(obj.to_json, **Fluent::DEFAULT_JSON_PARSE_OPTIONS)
         text = ''
         normalized.each do |hash|
           row = []

data/lib/fluent/plugin/in_sample.rb

@@ -16,6 +16,7 @@
 
 require 'json'
 
+require 'fluent/env'
 require 'fluent/plugin/input'
 require 'fluent/config/error'
 
@@ -44,7 +45,7 @@ module Fluent::Plugin
     desc "The sample data to be generated. An array of JSON hashes or a single JSON hash."
     config_param :sample, alias: :dummy, default: [{"message" => "sample"}] do |val|
       begin
-        parsed = JSON.parse(val)
+        parsed = JSON.parse(val, **Fluent::DEFAULT_JSON_PARSE_OPTIONS)
       rescue JSON::ParserError => ex
         # Fluent::ConfigParseError, "got incomplete JSON" will be raised
         # at literal_parser.rb with --use-v1-config, but I had to

data/lib/fluent/plugin/in_syslog.rb

@@ -98,8 +98,8 @@ module Fluent::Plugin
     desc 'The field name of the facility.'
     config_param :facility_key, :string, default: nil
 
-    desc "The max bytes of message"
-    config_param :message_length_limit, :size, default: 2048
+    desc "The max bytes of message. The messages exceeding this limit are dropped (UDP, TCP/TLS with traditional frame_type) or the connection is closed (TCP/TLS with octet_count frame_type)."
+    config_param :message_length_limit, :size, default: 8192
 
     config_param :blocking_timeout, :time, default: 0.5
 
@@ -190,29 +190,95 @@ module Fluent::Plugin
         resolve_name: @resolve_hostname,
         send_keepalive_packet: @send_keepalive_packet
       ) do |conn|
+        discard_till_next_delimiter = false
         conn.data do |data|
           buffer = conn.buffer
           buffer << data
           pos = 0
           if octet_count_frame
+            # Once an octet-counted stream contains an untrustworthy frame header, the stream
+            # can't be resynchronized. So close the connection instead of skipping bytes.
+            close_connection = false
             while idx = buffer.index(delimiter, pos)
-              num = Integer(buffer[pos..idx])
+              begin
+                num = Integer(buffer[pos..idx])
+              rescue ArgumentError
+                log.info "The message length is not a number, closing connection"
+                log.on_debug { log.debug "The message length is not a number:", head: buffer[pos, 32].dump }
+                close_connection = true
+                break
+              end
+
+              if num < 0
+                log.info "The message length is negative, closing connection:", size: num
+                close_connection = true
+                break
+              end
+
+              if num > @message_length_limit
+                log.info "The message length exceeds 'message_length_limit', closing connection:", limit: @message_length_limit, size: num
+                close_connection = true
+                break
+              end
+
               msg = buffer[idx + delimiter_size, num]
               if msg.size != num
+                # The frame is not fully received yet.
                 break
               end
 
               pos = idx + delimiter_size + num
               message_handler(msg, conn)
             end
+            buffer.slice!(0, pos) if pos > 0
+
+            # If the remaining buffer has no delimiter, no message length can be parsed from it.
+            # Since a valid frame header is much shorter than the limit, such a buffer never
+            # becomes a valid frame. (Note that a partially received valid frame always has a
+            # delimiter after its length, so this doesn't drop it even if it slightly exceeds
+            # the limit with its length header.)
+            if !close_connection && !buffer.index(delimiter) && buffer.bytesize > @message_length_limit
+              log.info "The buffer size exceeds 'message_length_limit', closing connection:", limit: @message_length_limit, size: buffer.bytesize
+              log.on_debug { log.debug "The buffer size exceeds 'message_length_limit':", head: buffer[...32] }
+              close_connection = true
+            end
+
+            if close_connection
+              buffer.clear
+              conn.close
+              next
+            end
           else
             while idx = buffer.index(delimiter, pos)
               msg = buffer[pos...idx]
               pos = idx + delimiter_size
+
+              if discard_till_next_delimiter
+                discard_till_next_delimiter = false
+                next
+              end
+
+              if msg.bytesize > @message_length_limit
+                log.info "The received data is larger than 'message_length_limit', dropped:", limit: @message_length_limit, size: msg.bytesize
+                log.on_debug { log.debug "The received data is larger than 'message_length_limit':", head: msg[...32] }
+                next
+              end
+
               message_handler(msg, conn)
             end
+            buffer.slice!(0, pos) if pos > 0
+
+            # If the buffer size exceeds the limit here, it means that the next message will
+            # definitely exceed the limit. So we should clear the buffer here. Otherwise, it will
+            # keep storing useless data until the next delimiter comes.
+            if buffer.bytesize > @message_length_limit
+              log.info "The buffer size exceeds 'message_length_limit', cleared:", limit: @message_length_limit, size: buffer.bytesize
+              log.on_debug { log.debug "The buffer size exceeds 'message_length_limit':", head: buffer[...32] }
+              buffer.clear
+              # We should discard the subsequent data until the next delimiter comes.
+              discard_till_next_delimiter = true
+            end
           end
-          buffer.slice!(0, pos) if pos > 0
         end
       end
     end

data/lib/fluent/plugin/out_forward/connection_manager.rb

@@ -78,6 +78,24 @@ module Fluent::Plugin
         end
       end
 
+      # Drop a socket instead of returning it to the keepalive reuse pool.
+      #
+      # Used when a chunk's ack timed out or came back with a mismatched chunk
+      # id: such a connection may still carry an in-flight/stale ack for a
+      # previous chunk. Reusing it would let that stale ack be read against a
+      # chunk sent on the reused socket, permanently offsetting every following
+      # ack and flooding the log with 'ack in response and chunk id in sent data
+      # are different' warnings (see #4057). Revoking removes it from the pool so
+      # the next chunk uses a fresh connection with a clean ack stream.
+      def discard(sock)
+        if @socket_cache
+          @socket_cache.revoke(sock)
+        else
+          sock.close_write rescue nil
+          sock.close rescue nil
+        end
+      end
+
       private
 
       def connect_keepalive(host:, port:, hostname:, ack: nil)

data/lib/fluent/plugin/out_forward.rb

@@ -525,17 +525,28 @@ module Fluent::Plugin
 
     def ack_check(select_interval)
       @ack_handler.collect_response(select_interval) do |chunk_id, node, sock, result|
-        @connection_manager.close(sock)
-
         case result
         when AckHandler::Result::SUCCESS
+          @connection_manager.close(sock)
           commit_write(chunk_id)
         when AckHandler::Result::FAILED
+          # The ack timed out or the peer closed the connection. A keepalive
+          # socket may still have an in-flight ack for this chunk, so drop it
+          # instead of returning it to the reuse pool; otherwise a late ack
+          # could later be read against a chunk sent on the reused socket (#4057).
+          @connection_manager.discard(sock)
           node&.disable!
           rollback_write(chunk_id, update_retry: false) if chunk_id
         when AckHandler::Result::CHUNKID_UNMATCHED
+          # The ack read from this socket belongs to a different chunk than the
+          # one tracked for it: the keepalive connection's ack stream is out of
+          # sync (e.g. a stale ack left over from before an aggregator restart).
+          # Discard the socket so the following acks are not each offset by one,
+          # which would otherwise flood the log with mismatch warnings (#4057).
+          @connection_manager.discard(sock)
           rollback_write(chunk_id, update_retry: false)
         else
+          @connection_manager.close(sock)
           log.warn("BUG: invalid status #{result} #{chunk_id}")
 
           if chunk_id

data/lib/fluent/plugin/output.rb

@@ -28,6 +28,7 @@ require 'fluent/unique_id'
 require 'fluent/clock'
 require 'fluent/ext_monitor_require'
 
+require 'json'
 require 'time'
 
 module Fluent
@@ -44,8 +45,21 @@ module Fluent
       CHUNK_KEY_PLACEHOLDER_PATTERN = /\$\{([-_.@$a-zA-Z0-9]+)\}/
       CHUNK_TAG_PLACEHOLDER_PATTERN = /\$\{(tag(?:\[-?\d+\])?)\}/
       CHUNK_ID_PLACEHOLDER_PATTERN = /\$\{chunk_id\}/
-      INVALID_PATH_COMPONENT_PATTERN = %r{\.\.[/\\]|^[/\\]}
-      PARENT_DIRECTORY_PATTERN = %r{\.\.[/\\]}
+
+      # Matches absolute paths, including the POSIX root, Windows drive roots, and UNC paths (e.g., \\host\share).
+      # It also accounts for forward slashes used as directory separators in Windows.
+      ABSOLUTE_PATH_PATTERN = %r{\A[/\\]}
+      # Matches Windows drive specifications.
+      # A trailing separator after the colon is not required, because a drive-relative path like C:Windows can still escape a relative path template.
+      WINDOWS_DRIVE_PATTERN = %r{\A[a-zA-Z]:}
+      # Matches .. only when it acts as an independent path component (e.g., ../etc or foo/..),
+      # ignoring dots embedded within strings like app..web or a..b/c.
+      # It uses zero-width negative lookarounds to avoid consuming characters.
+      # This ensures that adjacent components like /a/../../b are accurately detected and counted without missing any.
+      PARENT_DIRECTORY_PATTERN = %r{(?<![^/\\])\.\.(?![^/\\])}
+
+      INVALID_PATH_COMPONENT_PATTERN =
+        Regexp.union(ABSOLUTE_PATH_PATTERN, WINDOWS_DRIVE_PATTERN, PARENT_DIRECTORY_PATTERN)
 
       CHUNKING_FIELD_WARN_NUM = 4
 
@@ -878,12 +892,13 @@ module Fluent
 
               replace
             end
-            # Check if the number of parent directory components (../) has increased due to variable substitution
-            if rvalue.match?(PARENT_DIRECTORY_PATTERN)
-              if rvalue.scan(PARENT_DIRECTORY_PATTERN).size > str.scan(PARENT_DIRECTORY_PATTERN).size
-                raise Fluent::UnrecoverableError, "Invalid path component detected, replaced to: #{rvalue}"
-              end
-            end
+          end
+
+          # Verifies that the number of parent directory traversals (..) has not increased after variable substitution.
+          # While each replaced value is validated individually, this step prevents harmless values from concatenating into a dangerous path (e.g., ${tag}${key}/ becoming ../ if both tag and key are .).
+          if rvalue.match?(PARENT_DIRECTORY_PATTERN) &&
+             rvalue.scan(PARENT_DIRECTORY_PATTERN).size > str.scan(PARENT_DIRECTORY_PATTERN).size
+            raise Fluent::UnrecoverableError, "Invalid path component detected, replaced to: #{rvalue}"
           end
 
           if rvalue =~ CHUNK_KEY_PLACEHOLDER_PATTERN
@@ -1212,7 +1227,7 @@ module Fluent
         end
       end
 
-      UNRECOVERABLE_ERRORS = [Fluent::UnrecoverableError, TypeError, ArgumentError, NoMethodError, MessagePack::UnpackError, EncodingError]
+      UNRECOVERABLE_ERRORS = [Fluent::UnrecoverableError, TypeError, ArgumentError, NoMethodError, MessagePack::UnpackError, EncodingError, JSON::GeneratorError]
 
       def try_flush
         chunk = @buffer.dequeue_chunk
@@ -1319,9 +1334,14 @@ module Fluent
         if @buffer.disable_chunk_backup
           log.warn "disable_chunk_backup is true. #{dump_unique_id_hex(chunk.unique_id)} chunk is thrown away"
         else
-          @buffer.backup(chunk.unique_id) { |f|
-            chunk.write_to(f)
-          }
+          begin
+            @buffer.backup(chunk.unique_id) { |f|
+              chunk.write_to(f)
+            }
+          rescue => e
+            log.warn "failed to back up #{dump_unique_id_hex(chunk.unique_id)} chunk. it is thrown away", error: e
+            log.warn_backtrace
+          end
         end
         commit_write(chunk.unique_id, secondary: using_secondary, delayed: delayed_commit)
       end

data/lib/fluent/plugin/parser_json.rb

@@ -14,6 +14,7 @@
 #    limitations under the License.
 #
 
+require 'fluent/env'
 require 'fluent/plugin/parser'
 require 'fluent/time'
 require 'fluent/oj_options'
@@ -38,6 +39,10 @@ module Fluent
 
       config_set_default :time_type, :float
 
+      # Use a shared proc rather than a per-call lambda so that
+      # configure_json_parser returns the same object every time.
+      JSON_PARSE_PROC = ->(text) { JSON.parse(text, **Fluent::DEFAULT_JSON_PARSE_OPTIONS) }
+
       def configure(conf)
         if conf.has_key?('time_format')
           conf['time_type'] ||= 'string'
@@ -54,7 +59,7 @@ module Fluent
 
           log&.info "Oj is not installed, and failing back to JSON for json parser"
           configure_json_parser(:json)
-        when :json then [JSON.method(:parse), JSON::ParserError]
+        when :json then [JSON_PARSE_PROC, JSON::ParserError]
         when :yajl then [Yajl.method(:load), Yajl::ParseError]
         else
           raise "BUG: unknown json parser specified: #{name}"

data/lib/fluent/plugin/parser_syslog.rb

@@ -44,7 +44,7 @@ module Fluent
       RFC3164_CAPTURES = RFC3164_WITHOUT_TIME_AND_PRI_REGEXP.names.freeze
       RFC3164_PRI_REGEXP = /^<(?<pri>[0-9]{1,3})>/
 
-      RFC5424_WITHOUT_TIME_AND_PRI_REGEXP = /(?<host>[!-~]{1,255}) (?<ident>[!-~]{1,48}) (?<pid>[!-~]{1,128}) (?<msgid>[!-~]{1,32}) (?<extradata>(?:\-|(?:\[.*?(?<!\\)\])+))(?: (?<message>.+))?\z/m
+      RFC5424_WITHOUT_TIME_AND_PRI_REGEXP = /(?<host>[!-~]{1,255}) (?<ident>[!-~]{1,48}) (?<pid>[!-~]{1,128}) (?<msgid>[!-~]{1,32}) (?<extradata>(?:\-|(?:\[.*?(?<!\\)\])))(?: (?<message>.+))?\z/m
       RFC5424_CAPTURES = RFC5424_WITHOUT_TIME_AND_PRI_REGEXP.names.freeze
       RFC5424_PRI_REGEXP = /^<(?<pri>\d{1,3})>\d\d{0,2}\s/
 
@@ -314,7 +314,7 @@ module Fluent
             i = text.index(SPLIT_CHAR, i + 1)
           end
 
-          time_str = sq ? text.slice(idx, i - cursor).squeeze(SPLIT_CHAR) : text.slice(cursor, i - cursor)
+          time_str = sq ? text.slice(cursor, i - cursor).squeeze(SPLIT_CHAR) : text.slice(cursor, i - cursor)
           cursor = i + 1
         end
 
@@ -406,7 +406,7 @@ module Fluent
             i = text.index(SPLIT_CHAR, i + 1)
           end
 
-          time_str = sq ? text.slice(idx, i - cursor).squeeze(SPLIT_CHAR) : text.slice(cursor, i - cursor)
+          time_str = sq ? text.slice(cursor, i - cursor).squeeze(SPLIT_CHAR) : text.slice(cursor, i - cursor)
           cursor = i + 1
         end
 

data/lib/fluent/plugin/sd_file.rb

@@ -16,6 +16,7 @@
 
 require 'cool.io'
 
+require 'fluent/env'
 require 'fluent/plugin_helper'
 require 'fluent/plugin/service_discovery'
 
@@ -75,7 +76,7 @@ module Fluent
             -> (v) { YAML.safe_load(v).map }
           when :json
             require 'json'
-            -> (v) { JSON.parse(v) }
+            -> (v) { JSON.parse(v, **Fluent::DEFAULT_JSON_PARSE_OPTIONS) }
           end
       end
 

data/lib/fluent/plugin/storage_local.rb

@@ -90,7 +90,7 @@ module Fluent
                 log.warn "detect empty plugin storage file during startup. Ignored: #{@path}"
                 return
               end
-              data = JSON.parse(data)
+              data = JSON.parse(data, **Fluent::DEFAULT_JSON_PARSE_OPTIONS)
               raise Fluent::ConfigError, "Invalid contents (not object) in plugin storage file: '#{@path}'" unless data.is_a?(Hash)
             rescue => e
               log.error "failed to read data from plugin storage file", path: @path, error: e
@@ -114,7 +114,7 @@ module Fluent
         return unless File.exist?(@path)
         begin
           json_string = File.open(@path, 'r:utf-8:utf-8'){ |io| io.read }
-          json = JSON.parse(json_string)
+          json = JSON.parse(json_string, **Fluent::DEFAULT_JSON_PARSE_OPTIONS)
           unless json.is_a?(Hash)
             log.error "broken content for plugin storage (Hash required: ignored)", type: json.class
             log.debug "broken content", content: json_string

data/lib/fluent/supervisor.rb

@@ -100,7 +100,14 @@ module Fluent
     end
 
     def cleanup_lock_dir
-      FileUtils.rm(Dir.glob(File.join(@fluentd_lock_dir, "fluentd-*.lock")))
+      begin
+        Dir.each_child(@fluentd_lock_dir) do |name|
+          FileUtils.rm_f(File.join(@fluentd_lock_dir, name)) if File.fnmatch?("fluentd-*.lock", name)
+        end
+      rescue Errno::ENOENT
+        # Directory is already missing. Fall through and let rmdir below
+        # fail in the same way as the current implementation.
+      end
       FileUtils.rmdir(@fluentd_lock_dir)
     end
 

data/lib/fluent/version.rb

@@ -16,6 +16,6 @@
 
 module Fluent
 
-  VERSION = '1.19.3'
+  VERSION = '1.19.4'
 
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: fluentd
 version: !ruby/object:Gem::Version
-  version: 1.19.3
+  version: 1.19.4
 platform: x64-mingw32
 authors:
 - Sadayuki Furuhashi
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-06-25 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -954,7 +953,6 @@ metadata:
   source_code_uri: https://github.com/fluent/fluentd
   changelog_uri: https://github.com/fluent/fluentd/blob/master/CHANGELOG.md
   bug_tracker_uri: https://github.com/fluent/fluentd/issues
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -969,8 +967,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.22
-signing_key:
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Fluentd event collector
 test_files: []