statsd-instrument 4.0.0 → 4.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5ba68947d3fa5cec0f604135dbf0fdda92ba4d056262ae2864e3144f8ad395ba
-  data.tar.gz: 63200c83b270a8d840eb88ba3d58a8b615e3f1d4c20aaacb15946ce745f42a90
+  metadata.gz: c7184b3fb0852d7afea02fa71a292812ef26b491eb94ab2427f603b49f01202c
+  data.tar.gz: e40e7aa3d4cb034467b6d59fdfdb3bcbf55a2901e82c48368fd1e904d0aa67c5
 SHA512:
-  metadata.gz: cf8edd51de1582c7b90e9ae07d74277ff093a6ba6d9e896f502bdfab6f94abe1c5d9fb1ed019a8cdf0a700774606595182086dee310659512ac18c17ff8efd16
-  data.tar.gz: de8619df52375bf5aa0a544ee18f5849b892ce82f2ae3ebac77c30ca62c5cb9851ff267aff286e0f8eff2b2ce9f225af925d1d6d8a56cb5a7a8fd4ff9371e744
+  metadata.gz: e1d01801fcbedc88df3e57bf948e6a4b599b52365e80d55e66ced52d4b308427632d5dc8161614705a7524e9a7f1b56e85e717ef9e3f0509969091b801ec30c2
+  data.tar.gz: 97bf3cf218ef6be51d72dc96f067464cc8f21eb0b070be9e48d7097cc4863735f41a58a3ed6967829524b6df64af1d8a1122197fec46944ce8154dcf539a4721

data/CHANGELOG.md

@@ -6,6 +6,10 @@ section below.
 
 ## Unreleased changes
 
+## Version 4.0.1
+
+- Normalize ASCII whitespace in metric names and prefixes, and newlines (`\n` and `\r`) in tags and set values, including aggregated and compiled metrics.
+
 ## Version 4.0.0
 
 - Make the internal aggregator interface positional-only and injectable through `Client`, with fixed-arity `increment`, `gauge`, and `aggregate_timing` entrypoints for native aggregation backends. Public Client metric methods retain their keyword API.

data/README.md

@@ -114,6 +114,11 @@ Please note that since aggregation is an experimental feature, it should be used
 ## StatsD keys
 
 StatsD keys look like 'admin.logins.api.success'. Dots are used as namespace separators.
+Metric names and prefixes normalize `:`, `|`, `@`, and ASCII whitespace (spaces,
+tabs, and line breaks) to `_`, one underscore per character.
+Newlines (`\n`, `\r`) in set values are also replaced with `_`; in array/hash tags,
+newlines are removed alongside `|` and `,`. Other tag/value whitespace is preserved.
+Normalization is silent.
 
 ## Usage
 

data/lib/statsd/instrument/client.rb

@@ -213,8 +213,8 @@ module StatsD
       #
       #   - We recommend using `snake_case.metric_names` as naming scheme.
       #   - A `.` should be used for namespacing, e.g. `foo.bar.baz`
-      #   - A metric name should not include the following characters: `|`, `@`, and `:`.
-      #     The library will convert these characters to `_`.
+      #   - A metric name should not include `|`, `@`, `:`, or ASCII whitespace.
+      #     The library converts each such character to `_`, including in prefixes.
       #
       # @param value [Integer] (default: 1) The value to increment the counter by.
       #

data/lib/statsd/instrument/compiled_metric.rb

@@ -70,7 +70,8 @@ module StatsD
           # Create a new class for this specific metric
           # Using classes instead of instances for better YJIT optimization
           metric_class = tap do
-            @name = DatagramBlueprintBuilder.normalize_name(name).freeze
+            # Own a frozen name without freezing a mutable string from the caller.
+            @name = -DatagramBlueprintBuilder.normalize_name(name)
             @datagram_blueprint = datagram_blueprint
             @tag_combination_cache = {}
             @max_cache_size = max_cache_size
@@ -300,9 +301,10 @@ module StatsD
 
           # Normalizes metric names by replacing special characters
           # @param name [String] The metric name
-          # @return [String] The normalized metric name
+          # @return [String] The original string if clean, otherwise a new string.
+          #   Does not copy or freeze clean input; retaining callers own that step.
           def normalize_name(name)
-            name.tr(":|@", "_")
+            Sanitization.name(name)
           end
 
           private
@@ -314,16 +316,14 @@ module StatsD
           def build_prefix(client_prefix, no_prefix)
             return "" if no_prefix || client_prefix.nil?
 
-            "#{client_prefix}."
+            "#{Sanitization.name(client_prefix.to_s)}."
           end
 
           # Normalizes tag names/values by removing StatsD protocol special characters
           # @param str [Symbol, String, Integer, Float] The string to normalize
           # @return [String] The normalized string
           def normalize_statsd_string(str)
-            str = str.to_s
-            str = str.tr("|,", "") if /[|,]/.match?(str)
-            str
+            Sanitization.tag(str.to_s)
           end
 
           # Compiles all tags (default_tags, static_tags, dynamic_tags) into a single string
@@ -412,10 +412,10 @@ module StatsD
           # Sanitize string and symbol values (other types handled by sprintf %s)
           values = @tag_values.map do |arg|
             if arg.is_a?(String)
-              /[|,]/.match?(arg) ? arg.tr("|,", "") : arg
+              Sanitization::TAG_PATTERN.match?(arg) ? arg.tr(Sanitization::TAG_CHARACTERS, "") : arg
             elsif arg.is_a?(Symbol)
               str = arg.to_s
-              /[|,]/.match?(str) ? str.tr("|,", "") : str
+              Sanitization::TAG_PATTERN.match?(str) ? str.tr(Sanitization::TAG_CHARACTERS, "") : str
             else
               arg
             end

data/lib/statsd/instrument/datagram.rb

@@ -72,9 +72,9 @@ module StatsD
 
       PARSER = %r{
         \A
-        (?<name>[^\:\|\@]+)\:(?<value>(?:[^\:\|\@]+:)*[^\:\|\@]+)\|(?<type>c|ms|g|s|h|d)
-        (?:\|\@(?<sample_rate>\d*(?:\.\d*)?))?
-        (?:\|\#(?<tags>(?:[^\|,]+(?:,[^\|,]+)*)))?
+        (?<name>[^:|@]+):(?<value>(?:[^:|@]+:)*[^:|@]+)\|(?<type>c|ms|g|s|h|d)
+        (?:\|@(?<sample_rate>\d*(?:\.\d*)?))?
+        (?:\|\#(?<tags>(?:[^|,]+(?:,[^|,]+)*)))?
         \n? # In some implementations, the datagram may include a trailing newline.
         \z
       }x.freeze

data/lib/statsd/instrument/datagram_builder.rb

@@ -20,13 +20,13 @@ module StatsD
         end
 
         def normalize_string(string)
-          string = string.tr("|#", "_") if /[|#]/.match?(string)
+          string = string.tr("|#\r\n", "_") if /[|#\r\n]/.match?(string)
           string
         end
       end
 
       def initialize(prefix: nil, default_tags: nil)
-        @prefix = prefix.nil? ? "" : "#{prefix}.".tr(":|@", "_")
+        @prefix = prefix.nil? ? "" : "#{Sanitization.name(prefix.to_s)}."
         @default_tags = default_tags.nil? || default_tags.empty? ? nil : compile_tags(default_tags, "|#".b)
       end
 
@@ -43,6 +43,8 @@ module StatsD
       end
 
       def s(name, value, sample_rate, tags)
+        value = value.to_s
+        value = value.tr("\r\n", "_") if /[\r\n]/.match?(value)
         generate_generic_datagram(name, value, "s", sample_rate, tags)
       end
 
@@ -76,16 +78,13 @@ module StatsD
 
       # Utility function to remove invalid characters from a StatsD metric name
       def normalize_name(name)
-        # Fast path when no normalization is needed to avoid copying the string
-        return name unless /[:|@]/.match?(name)
-
-        name.tr(":|@", "_")
+        Sanitization.name(name)
       end
 
       def generate_generic_datagram(name, value, type, sample_rate, tags)
         datagram = "".b <<
           @prefix <<
-          (/[:|@]/.match?(name) ? name.tr(":|@", "_") : name) <<
+          (Sanitization::NAME_PATTERN.match?(name) ? name.tr(Sanitization::NAME_CHARACTERS, "_") : name) <<
           ":" << value.to_s <<
           "|" << type
 
@@ -105,7 +104,8 @@ module StatsD
 
       def compile_tags(tags, buffer = "".b)
         if tags.is_a?(String)
-          tags = self.class.normalize_string(tags) if /[|,]/.match?(tags)
+          # String tags are already serialized: commas separate tags here.
+          tags = self.class.normalize_string(tags) if Sanitization::TAG_PATTERN.match?(tags)
           buffer << tags
           return buffer
         end
@@ -118,14 +118,14 @@ module StatsD
               buffer << ","
             end
             key = key.to_s
-            key = key.tr("|,", "") if /[|,]/.match?(key)
+            key = key.tr(Sanitization::TAG_CHARACTERS, "") if Sanitization::TAG_PATTERN.match?(key)
             value = value.to_s
-            value = value.tr("|,", "") if /[|,]/.match?(value)
+            value = value.tr(Sanitization::TAG_CHARACTERS, "") if Sanitization::TAG_PATTERN.match?(value)
             buffer << key << ":" << value
           end
         else
-          if tags.any? { |tag| /[|,]/.match?(tag) }
-            tags = tags.map { |tag| tag.tr("|,", "") }
+          if tags.any? { |tag| Sanitization::TAG_PATTERN.match?(tag) }
+            tags = tags.map { |tag| Sanitization.tag(tag) }
           end
           buffer << tags.join(",")
         end

data/lib/statsd/instrument/dogstatsd_datagram.rb

@@ -62,11 +62,11 @@ module StatsD
 
       SERVICE_CHECK_PARSER = %r{
         \A
-        (?<type>_sc)\|(?<name>[^\|]+)\|(?<value>\d+)
-        (?:\|h:(?<hostname>[^\|]+))?
+        (?<type>_sc)\|(?<name>[^|]+)\|(?<value>\d+)
+        (?:\|h:(?<hostname>[^|]+))?
         (?:\|d:(?<timestamp>\d+))?
-        (?:\|\#(?<tags>(?:[^\|,]+(?:,[^\|,]+)*)))?
-        (?:\|m:(?<message>[^\|]+))?
+        (?:\|\#(?<tags>(?:[^|,]+(?:,[^|,]+)*)))?
+        (?:\|m:(?<message>[^|]+))?
         \n? # In some implementations, the datagram may include a trailing newline.
         \z
       }x.freeze
@@ -74,14 +74,14 @@ module StatsD
       # |k:my-key|p:low|s:source|t:success|
       EVENT_PARSER = %r{
         \A
-        (?<type>_e)\{\d+\,\d+\}:(?<name>[^\|]+)\|(?<value>[^\|]+)
-        (?:\|h:(?<hostname>[^\|]+))?
+        (?<type>_e)\{\d+,\d+\}:(?<name>[^|]+)\|(?<value>[^|]+)
+        (?:\|h:(?<hostname>[^|]+))?
         (?:\|d:(?<timestamp>\d+))?
-        (?:\|k:(?<aggregation_key>[^\|]+))?
-        (?:\|p:(?<priority>[^\|]+))?
-        (?:\|s:(?<source_type_name>[^\|]+))?
-        (?:\|t:(?<alert_type>[^\|]+))?
-        (?:\|\#(?<tags>(?:[^\|,]+(?:,[^\|,]+)*)))?
+        (?:\|k:(?<aggregation_key>[^|]+))?
+        (?:\|p:(?<priority>[^|]+))?
+        (?:\|s:(?<source_type_name>[^|]+))?
+        (?:\|t:(?<alert_type>[^|]+))?
+        (?:\|\#(?<tags>(?:[^|,]+(?:,[^|,]+)*)))?
         \n? # In some implementations, the datagram may include a trailing newline.
         \z
       }x.freeze

data/lib/statsd/instrument/dogstatsd_datagram_builder.rb

@@ -84,7 +84,7 @@ module StatsD
           compile_tags(tags, datagram)
         end
 
-        datagram << "|m:#{normalize_name(message)}" if message
+        datagram << "|m:#{Sanitization.service_check_message(message)}" if message
         datagram
       end
 

data/lib/statsd/instrument/sanitization.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module StatsD
+  module Instrument
+    # Field-specific wire normalization. Clean strings are returned unchanged;
+    # callers retaining a frozen value must take ownership themselves.
+    # @api private
+    module Sanitization
+      # Hot serializers use these same rules inline to avoid per-field Ruby calls.
+      NAME_PATTERN = /[:|@\s]/.freeze
+      NAME_CHARACTERS = ":|@ \t\r\n\f\v"
+      TAG_PATTERN = /[|,\r\n]/.freeze
+      TAG_CHARACTERS = "|,\r\n"
+
+      class << self
+        # Replace each ASCII whitespace or protocol delimiter with one underscore.
+        # @return [String] The original string if clean, otherwise a new string.
+        def name(string)
+          NAME_PATTERN.match?(string) ? string.tr(NAME_CHARACTERS, "_") : string
+        end
+
+        # Tag components allow spaces and colons, but not field/tag separators.
+        def tag(string)
+          TAG_PATTERN.match?(string) ? string.tr(TAG_CHARACTERS, "") : string
+        end
+
+        # Keep message whitespace intact; this is not a metric name.
+        def service_check_message(string)
+          /[:|@\r\n]/.match?(string) ? string.tr(":|@\r\n", "_") : string
+        end
+      end
+    end
+  end
+end

data/lib/statsd/instrument/version.rb

@@ -2,6 +2,6 @@
 
 module StatsD
   module Instrument
-    VERSION = "4.0.0"
+    VERSION = "4.0.1"
   end
 end

data/lib/statsd/instrument.rb

@@ -391,6 +391,7 @@ require "statsd/instrument/client"
 require "statsd/instrument/datagram"
 require "statsd/instrument/aggregator"
 require "statsd/instrument/dogstatsd_datagram"
+require "statsd/instrument/sanitization"
 require "statsd/instrument/datagram_builder"
 require "statsd/instrument/statsd_datagram_builder"
 require "statsd/instrument/dogstatsd_datagram_builder"

data/test/newline_normalization_test.rb

@@ -0,0 +1,262 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class NewlineNormalizationTest < Minitest::Test
+  def setup
+    @old_client = StatsD.singleton_client
+    @sink = StatsD::Instrument::CaptureSink.new(parent: StatsD::Instrument::NullSink.new)
+    @clients = []
+  end
+
+  def teardown
+    StatsD.singleton_client = @old_client
+    @clients.each do |client|
+      aggregator = client.instance_variable_get(:@aggregator)
+      next unless aggregator
+
+      aggregator.instance_variable_get(:@flush_thread)&.kill
+      ObjectSpace.undefine_finalizer(aggregator)
+    end
+  end
+
+  def test_all_generic_metric_types_keep_line_breaks_inside_the_prefix
+    builder = StatsD::Instrument::DatagramBuilder.new(prefix: "storefront")
+    [:c, :g, :ms, :s, :h, :d, :kv].each do |type|
+      ["\n", "\r", "\r\n"].each do |delimiter|
+        datagram = builder.public_send(type, "http.requests#{delimiter}checkout", 1, nil, nil)
+        assert_equal("storefront.http.requests#{"_" * delimiter.size}checkout:1|#{type}", datagram)
+      end
+    end
+  end
+
+  def test_prefix_and_name_are_sanitized_without_mutating_inputs
+    prefix = "app\r\nnamespace"
+    name = "name\r\nchild"
+    builder = StatsD::Instrument::DatagramBuilder.new(prefix: prefix)
+    assert_equal("app__namespace.name__child:1|c", builder.c(name, 1, nil, nil))
+    assert_equal("app\r\nnamespace", prefix)
+    assert_equal("name\r\nchild", name)
+    assert_equal("name__child", builder.send(:normalize_name, name))
+  end
+
+  def test_array_and_hash_tags_remove_delimiters_without_mutating_inputs
+    builder = StatsD::Instrument::DatagramBuilder.new
+    array = ["k\r\ney:v\r\na|l,ue", "good:tag"].freeze
+    hash = { "k\r\ney" => "v\r\na|l,ue", good: "tag" }.freeze
+    [array, hash].each do |tags|
+      assert_equal("name:1|c|#key:value,good:tag", builder.c("name", 1, nil, tags))
+    end
+    assert_equal("k\r\ney:v\r\na|l,ue", array.first)
+    assert_equal("v\r\na|l,ue", hash.values.first)
+  end
+
+  def test_serialized_tags_preserve_commas_as_separators
+    builder = StatsD::Instrument::DatagramBuilder.new
+    assert_equal("name:1|c|#a:one_,b:two_", builder.c("name", 1, nil, "a:one\r,b:two\n"))
+    assert_equal("name:1|c|#a:one,b:two", builder.c("name", 1, nil, "a:one,b:two"))
+  end
+
+  def test_default_tags_in_each_supported_representation
+    [["k:v\n"], { k: "v\n" }, "k:v\n"].each do |tags|
+      builder = StatsD::Instrument::DatagramBuilder.new(default_tags: tags)
+      datagram = builder.c("name", 1, nil, ["extra:tag"])
+      refute_match(/[\r\n]/, datagram)
+      assert_includes(datagram, ",extra:tag")
+    end
+  end
+
+  def test_set_values_replace_newlines
+    builder = StatsD::Instrument::DatagramBuilder.new(prefix: "app")
+    assert_equal("app.users:alice__smith|s", builder.s("users", "alice\r\nsmith", nil, nil))
+    assert_equal("app.users:42|s", builder.s("users", 42, nil, nil))
+  end
+
+  def test_unicode_and_valid_inputs_are_unchanged
+    builder = StatsD::Instrument::DatagramBuilder.new(prefix: "shop")
+    assert_equal("shop.café:1|c|#city:東京", builder.c("café", 1, nil, ["city:東京"]))
+    name = +"safe.name"
+    assert_same(name, builder.send(:normalize_name, name))
+  end
+
+  def test_dogstatsd_service_check_name_and_tags
+    builder = StatsD::Instrument::DogStatsDDatagramBuilder.new(prefix: "app\n")
+    assert_equal("_sc|app_.service_check|0|#key:value", builder._sc("service\rcheck", :ok, tags: ["key:va\nlue"]))
+    # Event text has its own documented escaping; tag normalization must preserve it.
+    event = builder._e("title", "first\nsecond", tags: ["key:va\nlue"])
+    refute_match(/[\r\n]/, event)
+    assert_includes(event, 'first\nsecond')
+    assert_includes(event, "|#key:value")
+  end
+
+  def test_normal_and_aggregated_client_paths
+    [false, true].each do |aggregate|
+      client = new_client(aggregate)
+      [:increment, :gauge, :measure, :distribution, :histogram].each do |method|
+        client.public_send(method, "metric\r\nname", 1, tags: { "k\r\ney" => "va\nlue" })
+        client.public_send(method, "unprefixed\nname", 1, tags: ["key:va\nlue"], no_prefix: true)
+      end
+      client.set("set\nname", "v\nalue", tags: ["key:va\nlue"])
+      client.force_flush
+      assert_equal(11, @sink.datagrams.size)
+      @sink.datagrams.each do |datagram|
+        refute_match(/[\r\n]/, datagram.source)
+        assert_includes(datagram.source, "key:value")
+      end
+      @sink.clear
+    end
+  end
+
+  def test_aggregator_finalizer_and_unhealthy_thread_fallback
+    client = new_client(true)
+    aggregator = client.instance_variable_get(:@aggregator)
+    client.increment("name\nchild", tags: ["key:va\nlue"])
+    finalizer = aggregator.instance_variable_get(:@finalizer)
+    StatsD::Instrument::Aggregator.finalize(finalizer).call
+    assert_equal(1, @sink.datagrams.size)
+    refute_match(/[\r\n]/, @sink.datagrams.first.source)
+
+    @sink.clear
+    aggregator.stubs(:thread_healthcheck).returns(false)
+    client.increment("name\nchild", tags: ["key:va\nlue"])
+    assert_equal(1, @sink.datagrams.size)
+    refute_match(/[\r\n]/, @sink.datagrams.first.source)
+  end
+
+  def test_compiled_static_and_dynamic_fields_with_and_without_aggregation
+    [false, true].each do |aggregate|
+      client = new_client(aggregate)
+      StatsD.singleton_client = client
+      [
+        StatsD::Instrument::CompiledMetric::Counter,
+        StatsD::Instrument::CompiledMetric::Gauge,
+        StatsD::Instrument::CompiledMetric::Distribution,
+      ].each do |base|
+        metric = Class.new(base) do
+          define(name: "name\r\nchild", static_tags: { "static\nkey" => "va\rlue" }, tags: { dynamic: String, symbol: Symbol })
+        end
+        2.times { metric.public_send(base.method_name, 1, dynamic: "va\nlue", symbol: :"sym\rbol") }
+        client.force_flush
+        assert_equal(aggregate ? 1 : 2, @sink.datagrams.size)
+        @sink.datagrams.each do |datagram|
+          refute_match(/[\r\n]/, datagram.source)
+          assert_includes(datagram.source, "app_.name__child:")
+          assert_includes(datagram.source, "statickey:value")
+          assert_includes(datagram.source, "dynamic:value,symbol:symbol")
+        end
+        @sink.clear
+
+        metric = Class.new(base) { define(name: "static\nname", static_tags: { key: "va\nlue" }) }
+        metric.public_send(base.method_name, 1)
+        client.force_flush
+        assert_equal(1, @sink.datagrams.size)
+        refute_match(/[\r\n]/, @sink.datagrams.first.source)
+        @sink.clear
+      end
+    end
+  end
+
+  def test_compiled_default_tags_and_dynamic_keys
+    builder = StatsD::Instrument::CompiledMetric::DatagramBlueprintBuilder
+    [["default:va\nlue"], { default: "va\nlue" }, "default:va\nlue"].each do |tags|
+      blueprint = builder.build(
+        name: "name\n",
+        type: "c",
+        client_prefix: "app\r",
+        no_prefix: false,
+        default_tags: tags,
+        static_tags: {},
+        dynamic_tags: { "dy\nnamic" => String },
+        sample_rate: 1,
+      )
+      datagram = StatsD::Instrument::CompiledMetric::PrecompiledDatagram.new(["va\nlue"], blueprint, 1).to_datagram(1)
+      assert_equal("app_.name_:1|c|#default:value,dynamic:value", datagram)
+    end
+  end
+
+  def test_compiled_dynamic_tags_are_checked_after_mutation_and_with_cache_disabled
+    StatsD.singleton_client = new_client(false)
+    metric = Class.new(StatsD::Instrument::CompiledMetric::Counter) do
+      define(name: "name", tags: { key: String }, max_cache_size: 0)
+    end
+    tag = +"value"
+    metric.increment(key: tag)
+    @sink.clear
+    tag << "\nwith|newline"
+    metric.increment(key: tag)
+    assert_equal(1, @sink.datagrams.size)
+    refute_match(/[\r\n]/, @sink.datagrams.first.source)
+    assert_includes(@sink.datagrams.first.source, "|#default:value,key:valuewithnewline")
+  end
+
+  def test_compiled_name_does_not_freeze_the_input_string
+    StatsD.singleton_client = new_client(false)
+    name = +"name"
+    metric = Class.new(StatsD::Instrument::CompiledMetric::Counter)
+    metric.define(name: name)
+    name << ".changed"
+    assert_equal("name", metric.metric_name)
+    assert_predicate(metric.metric_name, :frozen?)
+  end
+
+  def test_normalization_is_silent
+    StatsD.logger.expects(:warn).never
+    StatsD.logger.expects(:error).never
+    client = new_client(false)
+    client.increment("name\n", tags: ["key:va\nlue"])
+    assert_equal(1, @sink.datagrams.size)
+    assert_equal("app_.name_:1|c|#default:value,key:value", @sink.datagrams.first.source)
+  end
+
+  def test_names_and_prefixes_share_normalization_across_all_paths
+    [false, true].each do |aggregate|
+      [" ", "\t", "\n", "\r", "\f", "\v", ":", "|", "@"].each do |character|
+        client = new_client(aggregate).clone_with_options(prefix: "app#{character}prefix")
+        @clients << client
+        StatsD.singleton_client = client
+        client.increment("my#{character}value")
+        client.increment("my#{character}value", no_prefix: true)
+        metric = Class.new(StatsD::Instrument::CompiledMetric::Counter)
+        metric.define(name: "my#{character}value")
+        metric.increment
+        unprefixed = Class.new(StatsD::Instrument::CompiledMetric::Counter)
+        unprefixed.define(name: "my#{character}value", no_prefix: true)
+        unprefixed.increment
+        client.force_flush
+        assert_equal(4, @sink.datagrams.size)
+        assert_equal(["app_prefix.my_value", "app_prefix.my_value", "my_value", "my_value"], @sink.datagrams.map(&:name).sort)
+        assert_equal("my_value", metric.metric_name)
+        @sink.clear
+      end
+    end
+  end
+
+  def test_tag_values_and_service_check_messages_keep_spaces
+    builder = StatsD::Instrument::DogStatsDDatagramBuilder.new(prefix: "my app")
+    assert_equal("my_app.my_metric:1|c|#key:hello world", builder.c("my metric", 1, nil, ["key:hello world"]))
+    assert_equal("my_app.my_metric:1|c|#key:hello world", builder.c("my metric", 1, nil, { key: "hello world" }))
+    assert_equal("my_app.users:Alice Smith|s", builder.s("users", "Alice Smith", nil, nil))
+    assert_equal("_sc|my_app.my_service|0|m:hello world_", builder._sc("my service", :ok, message: "hello world\n"))
+
+    StatsD.singleton_client = new_client(false)
+    metric = Class.new(StatsD::Instrument::CompiledMetric::Counter)
+    metric.define(name: "my metric", static_tags: { static: "hello world" }, tags: { dynamic: String })
+    metric.increment(dynamic: "hello world")
+    assert_includes(@sink.datagrams.last.tags, "static:hello world")
+    assert_includes(@sink.datagrams.last.tags, "dynamic:hello world")
+  end
+
+  private
+
+  def new_client(aggregate)
+    client = StatsD::Instrument::Client.new(
+      sink: @sink,
+      prefix: "app\n",
+      default_tags: ["default:va\nlue"],
+      enable_aggregation: aggregate,
+      aggregation_flush_interval: 3600,
+    )
+    @clients << client
+    client
+  end
+end

data/test/rubocop/singleton_configuration_test.rb

@@ -19,9 +19,7 @@ module Rubocop
     def test_offense_statsd_prefix
       assert_offense('StatsD.prefix = "foo"')
       # The interpolation is intentionally literal source passed to the cop under test.
-      # rubocop:disable Lint/InterpolationCheck
-      assert_offense('"#{StatsD.prefix}.foo"')
-      # rubocop:enable Lint/InterpolationCheck
+      assert_offense("\"\#{StatsD.prefix}.foo\"")
     end
 
     def test_offense_statsd_default_tags

data/test/sanitization_test.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class SanitizationTest < Minitest::Test
+  def test_clean_input_is_returned_without_copying_or_freezing
+    [:name, :tag, :service_check_message].each do |method|
+      mutable = +"café.safe_value"
+      assert_same(mutable, StatsD::Instrument::Sanitization.public_send(method, mutable))
+      refute_predicate(mutable, :frozen?)
+      assert_same(mutable.freeze, StatsD::Instrument::Sanitization.public_send(method, mutable))
+    end
+  end
+
+  def test_name_replaces_each_ascii_whitespace_and_protocol_delimiter
+    [" ", "\t", "\n", "\r", "\f", "\v", ":", "|", "@"].each do |character|
+      name = +"prefix.#{character}my#{character}value"
+      expected_original = name.dup
+      assert_equal("prefix._my_value", StatsD::Instrument::Sanitization.name(name))
+      assert_equal(expected_original, name)
+      refute_predicate(name, :frozen?)
+    end
+    assert_equal("name___value", StatsD::Instrument::Sanitization.name("name \t\nvalue"))
+  end
+
+  def test_name_does_not_expand_whitespace_matching_to_unicode
+    name = "café\u00a0value"
+    assert_same(name, StatsD::Instrument::Sanitization.name(name))
+  end
+
+  def test_tags_and_values_keep_ordinary_whitespace
+    text = "hello \tworld\f\v"
+    [:tag, :service_check_message].each do |method|
+      assert_same(text, StatsD::Instrument::Sanitization.public_send(method, text))
+    end
+  end
+
+  def test_each_field_preserves_its_existing_replacement_rules
+    sanitizer = StatsD::Instrument::Sanitization
+    assert_equal("tag:value", sanitizer.tag("tag:va|,\r\nlue"))
+    assert_equal("hello world____", sanitizer.service_check_message("hello world:|@\n"))
+  end
+
+  def test_compiled_name_helper_returns_clean_input_unchanged
+    name = +"name"
+    assert_same(name, StatsD::Instrument::CompiledMetric::DatagramBlueprintBuilder.normalize_name(name))
+    refute_predicate(name, :frozen?)
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: statsd-instrument
 version: !ruby/object:Gem::Version
-  version: 4.0.0
+  version: 4.0.1
 platform: ruby
 authors:
 - Jesse Storimer
@@ -71,6 +71,7 @@ files:
 - lib/statsd/instrument/rubocop/positional_arguments.rb
 - lib/statsd/instrument/rubocop/singleton_configuration.rb
 - lib/statsd/instrument/rubocop/splat_arguments.rb
+- lib/statsd/instrument/sanitization.rb
 - lib/statsd/instrument/sink.rb
 - lib/statsd/instrument/statsd_datagram_builder.rb
 - lib/statsd/instrument/strict.rb
@@ -101,6 +102,7 @@ files:
 - test/integration_test.rb
 - test/log_sink_test.rb
 - test/matchers_test.rb
+- test/newline_normalization_test.rb
 - test/null_sink_test.rb
 - test/rubocop/measure_as_dist_argument_test.rb
 - test/rubocop/metaprogramming_positional_arguments_test.rb
@@ -110,6 +112,7 @@ files:
 - test/rubocop/positional_arguments_test.rb
 - test/rubocop/singleton_configuration_test.rb
 - test/rubocop/splat_arguments_test.rb
+- test/sanitization_test.rb
 - test/statsd_datagram_builder_test.rb
 - test/statsd_instrumentation_test.rb
 - test/statsd_test.rb
@@ -135,7 +138,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.18
+rubygems_version: 4.0.21
 specification_version: 4
 summary: A StatsD client for Ruby apps
 test_files:
@@ -161,6 +164,7 @@ test_files:
 - test/integration_test.rb
 - test/log_sink_test.rb
 - test/matchers_test.rb
+- test/newline_normalization_test.rb
 - test/null_sink_test.rb
 - test/rubocop/measure_as_dist_argument_test.rb
 - test/rubocop/metaprogramming_positional_arguments_test.rb
@@ -170,6 +174,7 @@ test_files:
 - test/rubocop/positional_arguments_test.rb
 - test/rubocop/singleton_configuration_test.rb
 - test/rubocop/splat_arguments_test.rb
+- test/sanitization_test.rb
 - test/statsd_datagram_builder_test.rb
 - test/statsd_instrumentation_test.rb
 - test/statsd_test.rb