@obsunified/collector 2.3.0 → 2.4.4

package/src/otlp/decode/logs.ts

@@ -41,7 +41,26 @@ export interface DecodedLogRecord {
  * storage. Resource `service.name` and scope name are denormalized onto each
  * record so downstream code doesn't need to traverse the hierarchy.
  */
-export const decodeLogsRequest = (body: ReadBodyResult): DecodedLogRecord[] => {
+export const decodeLogsRequest = (body: ReadBodyResult): DecodedLogRecord[] =>
+	decodeLogsRequestCapped(body, Number.POSITIVE_INFINITY).records;
+
+export interface CappedLogsRequest {
+	/** First `maxRecords` records, in wire order. */
+	records: DecodedLogRecord[];
+	/** Records beyond the cap that were counted but never adapted. */
+	rejected: number;
+}
+
+/**
+ * Like {@link decodeLogsRequest}, but stops adapting once `maxRecords`
+ * records have been produced, so an oversized batch never gets a second,
+ * adapted in-memory copy. Output is identical to decoding everything and
+ * slicing the first `maxRecords`.
+ */
+export const decodeLogsRequestCapped = (
+	body: ReadBodyResult,
+	maxRecords: number,
+): CappedLogsRequest => {
 	let msg: ExportLogsServiceRequest;
 	try {
 		msg =
@@ -56,16 +75,25 @@ export const decodeLogsRequest = (body: ReadBodyResult): DecodedLogRecord[] => {
 	}
 
 	const out: DecodedLogRecord[] = [];
+	let rejected = 0;
 	for (const rl of msg.resourceLogs) {
+		if (out.length >= maxRecords) {
+			for (const sl of rl.scopeLogs) rejected += sl.logRecords.length;
+			continue;
+		}
 		const serviceName = extractServiceName(rl.resource?.attributes);
 		for (const sl of rl.scopeLogs) {
 			const loggerName = sl.scope?.name || null;
 			for (const log of sl.logRecords) {
+				if (out.length >= maxRecords) {
+					rejected++;
+					continue;
+				}
 				out.push(adaptLogRecord(log, serviceName, loggerName));
 			}
 		}
 	}
-	return out;
+	return { records: out, rejected };
 };
 
 const adaptLogRecord = (

package/src/otlp/decode/metrics.ts

@@ -78,7 +78,26 @@ export interface DecodedMetricPoint {
 
 export const decodeMetricsRequest = (
 	body: ReadBodyResult,
-): DecodedMetricPoint[] => {
+): DecodedMetricPoint[] =>
+	decodeMetricsRequestCapped(body, Number.POSITIVE_INFINITY).points;
+
+export interface CappedMetricsRequest {
+	/** First `maxPoints` points, in wire order. */
+	points: DecodedMetricPoint[];
+	/** Points beyond the cap that were counted but never adapted. */
+	rejected: number;
+}
+
+/**
+ * Like {@link decodeMetricsRequest}, but stops adapting once `maxPoints`
+ * points have been produced, so an oversized batch never gets a second,
+ * adapted in-memory copy. Output is identical to decoding everything and
+ * slicing the first `maxPoints`.
+ */
+export const decodeMetricsRequestCapped = (
+	body: ReadBodyResult,
+	maxPoints: number,
+): CappedMetricsRequest => {
 	let msg: ExportMetricsServiceRequest;
 	try {
 		msg =
@@ -96,7 +115,20 @@ export const decodeMetricsRequest = (
 	}
 
 	const out: DecodedMetricPoint[] = [];
+	let rejected = 0;
 	for (const rm of msg.resourceMetrics) {
+		if (out.length >= maxPoints) {
+			for (const sm of rm.scopeMetrics) rejected += countPoints(sm);
+			continue;
+		}
+		const remaining = maxPoints - out.length;
+		const total = rm.scopeMetrics.reduce((n, sm) => n + countPoints(sm), 0);
+		if (total > remaining) {
+			// Trim this resource's data points in place (wire order) so the
+			// adapters below only ever build `remaining` points.
+			rejected += total - remaining;
+			trimScopeMetrics(rm.scopeMetrics, remaining);
+		}
 		const resourceAttrs = rm.resource?.attributes ?? [];
 		const resourceAttrsJson = resourceAttrs.length
 			? JSON.stringify(keyValuesToRecord(resourceAttrs))
@@ -106,7 +138,40 @@ export const decodeMetricsRequest = (
 			addMetrics(out, rm, sm, serviceName, resourceAttrsJson);
 		}
 	}
-	return out;
+	return { points: out, rejected };
+};
+
+/** Data-point count of the metric kinds `addMetrics` emits. */
+const metricPointCount = (metric: Metric): number => {
+	switch (metric.data.case) {
+		case "gauge":
+		case "sum":
+		case "histogram":
+		case "exponentialHistogram":
+		case "summary":
+			return metric.data.value.dataPoints.length;
+		default:
+			return 0;
+	}
+};
+
+const countPoints = (sm: ScopeMetrics): number =>
+	sm.metrics.reduce((n, m) => n + metricPointCount(m), 0);
+
+/** Keep only the first `budget` emitted data points, in wire order. */
+const trimScopeMetrics = (scopeMetrics: ScopeMetrics[], budget: number) => {
+	let left = budget;
+	for (const sm of scopeMetrics) {
+		for (const metric of sm.metrics) {
+			const n = metricPointCount(metric);
+			if (n === 0) continue;
+			if (n > left) {
+				const data = metric.data.value as { dataPoints: unknown[] };
+				data.dataPoints = data.dataPoints.slice(0, left);
+			}
+			left -= Math.min(n, left);
+		}
+	}
 };
 
 const addMetrics = (

package/src/otlp/decode/traces.ts

@@ -7,7 +7,10 @@ import {
 	type ExportTraceServiceRequest,
 	ExportTraceServiceRequestSchema,
 } from "../gen/opentelemetry/proto/collector/trace/v1/trace_service_pb.js";
-import type { ResourceSpans } from "../gen/opentelemetry/proto/trace/v1/trace_pb.js";
+import type {
+	ResourceSpans,
+	Span,
+} from "../gen/opentelemetry/proto/trace/v1/trace_pb.js";
 import { decodeJsonBody, OtlpDecodeError, type ReadBodyResult } from "./body";
 import { adaptKeyValue, bigintToString, bytesToHex } from "./values";
 
@@ -17,7 +20,57 @@ import { adaptKeyValue, bigintToString, bytesToHex } from "./values";
  */
 export const decodeTraceRequest = (
 	body: ReadBodyResult,
-): OtlpTraceExportRequest => {
+): OtlpTraceExportRequest =>
+	decodeTraceRequestCapped(body, Number.POSITIVE_INFINITY).request;
+
+export interface CappedTraceRequest {
+	/** Adapted request holding at most `maxSpans` spans. */
+	request: OtlpTraceExportRequest;
+	/** Spans kept (≤ maxSpans). */
+	accepted: number;
+	/** Well-formed spans dropped because the cap was reached. */
+	rejected: number;
+}
+
+/**
+ * Like {@link decodeTraceRequest}, but applies the per-request span cap to
+ * the raw decoded message *before* adapting, so an oversized batch never
+ * gets a second, adapted in-memory copy. Spans with malformed trace/span
+ * ID lengths are skipped without counting against the cap — exactly as
+ * the adapter drops them — so the kept set is identical to adapting
+ * everything and keeping the first `maxSpans`.
+ */
+export const decodeTraceRequestCapped = (
+	body: ReadBodyResult,
+	maxSpans: number,
+): CappedTraceRequest => {
+	const msg = parseTraceMessage(body);
+	let accepted = 0;
+	let rejected = 0;
+	const resourceSpans: OtlpResourceSpans[] = [];
+	for (const rs of msg.resourceSpans) {
+		for (const ss of rs.scopeSpans) {
+			const kept: Span[] = [];
+			for (const s of ss.spans) {
+				if (!hasValidIds(s)) continue;
+				if (accepted >= maxSpans) {
+					rejected++;
+				} else {
+					kept.push(s);
+					accepted++;
+				}
+			}
+			ss.spans = kept;
+		}
+		resourceSpans.push(adaptResourceSpans(rs));
+	}
+	return { request: { resourceSpans }, accepted, rejected };
+};
+
+const hasValidIds = (s: Span): boolean =>
+	s.traceId.length === 16 && s.spanId.length === 8;
+
+const parseTraceMessage = (body: ReadBodyResult): ExportTraceServiceRequest => {
 	let msg: ExportTraceServiceRequest;
 	try {
 		msg =
@@ -30,7 +83,7 @@ export const decodeTraceRequest = (
 			400,
 		);
 	}
-	return { resourceSpans: msg.resourceSpans.map(adaptResourceSpans) };
+	return msg;
 };
 
 // ── proto-native → legacy shape adapters ─────────────────────────────
@@ -44,7 +97,7 @@ const adaptResourceSpans = (rs: ResourceSpans): OtlpResourceSpans => ({
 			? { name: ss.scope.name, version: ss.scope.version }
 			: undefined,
 		spans: ss.spans.flatMap((s) => {
-			if (s.traceId.length !== 16 || s.spanId.length !== 8) return [];
+			if (!hasValidIds(s)) return [];
 			return [
 				{
 					traceId: bytesToHex(s.traceId),

package/src/otlp/decode/values.ts

@@ -55,23 +55,63 @@ export const anyValueToString = (v: AnyValue | undefined): string => {
 			return bytesToBase64(v.value.value);
 		case "arrayValue":
 		case "kvlistValue":
-			return JSON.stringify(adaptAnyValue(v));
+			return JSON.stringify(adaptAnyValueAt(v, 1));
 		default:
 			return "";
 	}
 };
 
+/**
+ * Max nesting depth for `arrayValue` / `kvlistValue` AnyValues. Real OTel
+ * attributes are a handful of levels deep at most; the cap keeps recursion
+ * bounded (no stack overflow on hostile payloads) and keeps stored JSON far
+ * below SQLite's 1000-level JSON depth limit. Containers nested deeper than
+ * this are replaced by {@link TRUNCATED_DEPTH_MARKER}.
+ */
+export const MAX_ANY_VALUE_DEPTH = 64;
+export const TRUNCATED_DEPTH_MARKER = `[truncated: nested deeper than ${MAX_ANY_VALUE_DEPTH} levels]`;
+
+/**
+ * Assign as an own data property. Plain `out[key] = v` would treat a
+ * `__proto__` attribute key as a prototype setter and silently drop it;
+ * defineProperty stores it like any other key (and JSON.stringify emits it).
+ */
+const setOwn = (
+	out: Record<string, ObsJsonValue>,
+	key: string,
+	value: ObsJsonValue,
+): void => {
+	if (key === "__proto__") {
+		Object.defineProperty(out, key, {
+			value,
+			enumerable: true,
+			writable: true,
+			configurable: true,
+		});
+	} else {
+		out[key] = value;
+	}
+};
+
 export const keyValuesToRecord = (
 	kvs: KeyValue[],
+): Record<string, ObsJsonValue> => keyValuesToRecordAt(kvs, 0);
+
+const keyValuesToRecordAt = (
+	kvs: KeyValue[],
+	depth: number,
 ): Record<string, ObsJsonValue> => {
 	const out: Record<string, ObsJsonValue> = {};
 	for (const kv of kvs) {
-		out[kv.key] = anyValueToJson(kv.value);
+		setOwn(out, kv.key, anyValueToJson(kv.value, depth + 1));
 	}
 	return out;
 };
 
-const anyValueToJson = (v: AnyValue | undefined): ObsJsonValue => {
+const anyValueToJson = (
+	v: AnyValue | undefined,
+	depth: number,
+): ObsJsonValue => {
 	if (!v) return null;
 	switch (v.value.case) {
 		case "stringValue":
@@ -86,20 +126,28 @@ const anyValueToJson = (v: AnyValue | undefined): ObsJsonValue => {
 		case "bytesValue":
 			return bytesToBase64(v.value.value);
 		case "arrayValue":
-			return v.value.value.values.map((x) => anyValueToJson(x));
+			if (depth > MAX_ANY_VALUE_DEPTH) return TRUNCATED_DEPTH_MARKER;
+			return v.value.value.values.map((x) => anyValueToJson(x, depth + 1));
 		case "kvlistValue":
-			return keyValuesToRecord(v.value.value.values);
+			if (depth > MAX_ANY_VALUE_DEPTH) return TRUNCATED_DEPTH_MARKER;
+			return keyValuesToRecordAt(v.value.value.values, depth);
 		default:
 			return null;
 	}
 };
 
-export const adaptKeyValue = (kv: KeyValue): OtlpKeyValue => ({
+export const adaptKeyValue = (kv: KeyValue): OtlpKeyValue =>
+	adaptKeyValueAt(kv, 0);
+
+const adaptKeyValueAt = (kv: KeyValue, depth: number): OtlpKeyValue => ({
 	key: kv.key,
-	value: kv.value ? adaptAnyValue(kv.value) : undefined,
+	value: kv.value ? adaptAnyValueAt(kv.value, depth + 1) : undefined,
 });
 
-export const adaptAnyValue = (v: AnyValue): OtlpAnyValue => {
+export const adaptAnyValue = (v: AnyValue): OtlpAnyValue =>
+	adaptAnyValueAt(v, 1);
+
+const adaptAnyValueAt = (v: AnyValue, depth: number): OtlpAnyValue => {
 	switch (v.value.case) {
 		case "stringValue":
 			return { stringValue: v.value.value };
@@ -110,15 +158,21 @@ export const adaptAnyValue = (v: AnyValue): OtlpAnyValue => {
 		case "doubleValue":
 			return { doubleValue: v.value.value };
 		case "arrayValue":
+			if (depth > MAX_ANY_VALUE_DEPTH)
+				return { stringValue: TRUNCATED_DEPTH_MARKER };
 			return {
 				arrayValue: {
-					values: v.value.value.values.map((x) => adaptAnyValue(x)),
+					values: v.value.value.values.map((x) =>
+						adaptAnyValueAt(x, depth + 1),
+					),
 				},
 			};
 		case "kvlistValue":
+			if (depth > MAX_ANY_VALUE_DEPTH)
+				return { stringValue: TRUNCATED_DEPTH_MARKER };
 			return {
 				kvlistValue: {
-					values: v.value.value.values.map(adaptKeyValue),
+					values: v.value.value.values.map((kv) => adaptKeyValueAt(kv, depth)),
 				},
 			};
 		case "bytesValue":

package/src/otlp/decode.test.ts

@@ -1,12 +1,17 @@
 import { create, toBinary, toJson } from "@bufbuild/protobuf";
 import { describe, expect, it } from "vitest";
+import { toStoredSpans } from "../lib/otlp";
 import {
 	decodeLogsRequest,
+	decodeLogsRequestCapped,
 	decodeMetricsRequest,
+	decodeMetricsRequestCapped,
 	decodeTraceRequest,
+	decodeTraceRequestCapped,
 	OtlpDecodeError,
 	readOtlpBody,
 } from "./decode";
+import { MAX_ANY_VALUE_DEPTH, TRUNCATED_DEPTH_MARKER } from "./decode/values";
 import { ExportLogsServiceRequestSchema } from "./gen/opentelemetry/proto/collector/logs/v1/logs_service_pb.js";
 import { ExportMetricsServiceRequestSchema } from "./gen/opentelemetry/proto/collector/metrics/v1/metrics_service_pb.js";
 import { ExportTraceServiceRequestSchema } from "./gen/opentelemetry/proto/collector/trace/v1/trace_service_pb.js";
@@ -798,3 +803,303 @@ describe("decodeMetricsRequest", () => {
 		]);
 	});
 });
+
+// ── Security hardening: pre-adaptation caps, depth cap, __proto__ keys ──
+
+const strAttr = (key: string, value: string) =>
+	create(KeyValueSchema, {
+		key,
+		value: create(AnyValueSchema, { value: { case: "stringValue", value } }),
+	});
+
+/** AnyValue nested `levels` kvlists deep, innermost holding a string. */
+const nestedKvlist = (levels: number) => {
+	let v = create(AnyValueSchema, {
+		value: { case: "stringValue", value: "leaf" },
+	});
+	for (let i = 0; i < levels; i++) {
+		v = create(AnyValueSchema, {
+			value: {
+				case: "kvlistValue",
+				value: { values: [create(KeyValueSchema, { key: "k", value: v })] },
+			},
+		});
+	}
+	return v;
+};
+
+const jsonDepth = (v: unknown): number => {
+	if (Array.isArray(v)) return 1 + Math.max(0, ...v.map(jsonDepth));
+	if (v && typeof v === "object")
+		return 1 + Math.max(0, ...Object.values(v).map(jsonDepth));
+	return 0;
+};
+
+const traceBatch = (spanCounts: number[], invalidEvery = 0) =>
+	create(ExportTraceServiceRequestSchema, {
+		resourceSpans: spanCounts.map((count, r) =>
+			create(ResourceSpansSchema, {
+				resource: create(ResourceSchema, {
+					attributes: [strAttr("service.name", `svc-${r}`)],
+				}),
+				scopeSpans: [
+					create(ScopeSpansSchema, {
+						spans: Array.from({ length: count }, (_, i) =>
+							create(SpanSchema, {
+								traceId:
+									invalidEvery && i % invalidEvery === 0
+										? new Uint8Array(3)
+										: new Uint8Array(16).fill((i % 250) + 1),
+								spanId: new Uint8Array(8).fill((r % 250) + 1),
+								name: `op-${r}-${i}`,
+							}),
+						),
+					}),
+				],
+			}),
+		),
+	});
+
+describe("decodeTraceRequestCapped", () => {
+	it("keeps exactly the spans the post-adapt cap kept, and counts the rest", () => {
+		const bytes = toBinary(
+			ExportTraceServiceRequestSchema,
+			traceBatch([300, 400], 7),
+		);
+		const full = decodeTraceRequest({ bytes, wireFormat: "protobuf" });
+		const fullSpans = (full.resourceSpans ?? []).flatMap((rs) =>
+			(rs.scopeSpans ?? []).flatMap((ss) => ss.spans ?? []),
+		);
+		const capped = decodeTraceRequestCapped(
+			{ bytes, wireFormat: "protobuf" },
+			500,
+		);
+		const cappedSpans = capped.request.resourceSpans?.flatMap((rs) =>
+			(rs.scopeSpans ?? []).flatMap((ss) => ss.spans ?? []),
+		);
+		expect(capped.accepted).toBe(500);
+		expect(capped.rejected).toBe(fullSpans.length - 500);
+		expect(cappedSpans).toEqual(fullSpans.slice(0, 500));
+		// Resource/scope structure is preserved even when all its spans drop.
+		expect(capped.request.resourceSpans).toHaveLength(2);
+	});
+
+	it("does not reject anything under the cap (JSON)", () => {
+		const json = toJson(ExportTraceServiceRequestSchema, traceBatch([10, 5]));
+		const bytes = new TextEncoder().encode(JSON.stringify(json));
+		const capped = decodeTraceRequestCapped({ bytes, wireFormat: "json" }, 500);
+		expect(capped).toMatchObject({ accepted: 15, rejected: 0 });
+		expect(capped.request).toEqual(
+			decodeTraceRequest({ bytes, wireFormat: "json" }),
+		);
+	});
+
+	it("still surfaces malformed bodies as OtlpDecodeError 400", () => {
+		expect(() =>
+			decodeTraceRequestCapped(
+				{ bytes: new Uint8Array([0xff, 0xff]), wireFormat: "protobuf" },
+				500,
+			),
+		).toThrow(OtlpDecodeError);
+	});
+});
+
+describe("decodeLogsRequestCapped", () => {
+	const logsBatch = (counts: number[]) =>
+		create(ExportLogsServiceRequestSchema, {
+			resourceLogs: counts.map((count, r) =>
+				create(ResourceLogsSchema, {
+					resource: create(ResourceSchema, {
+						attributes: [strAttr("service.name", `svc-${r}`)],
+					}),
+					scopeLogs: [
+						create(ScopeLogsSchema, {
+							logRecords: Array.from({ length: count }, (_, i) =>
+								create(LogRecordSchema, {
+									timeUnixNano: 1_700_000_000_000_000_000n,
+									body: create(AnyValueSchema, {
+										value: { case: "stringValue", value: `m-${r}-${i}` },
+									}),
+								}),
+							),
+						}),
+					],
+				}),
+			),
+		});
+
+	it("equals decode-then-slice and reports the same rejected count", () => {
+		const bytes = toBinary(
+			ExportLogsServiceRequestSchema,
+			logsBatch([600, 300, 400]),
+		);
+		const full = decodeLogsRequest({ bytes, wireFormat: "protobuf" });
+		const capped = decodeLogsRequestCapped(
+			{ bytes, wireFormat: "protobuf" },
+			1000,
+		);
+		expect(capped.rejected).toBe(full.length - 1000);
+		expect(capped.records.map((r) => r.message)).toEqual(
+			full.slice(0, 1000).map((r) => r.message),
+		);
+	});
+});
+
+describe("decodeMetricsRequestCapped", () => {
+	const gauge = (name: string, n: number) =>
+		create(MetricSchema, {
+			name,
+			data: {
+				case: "gauge",
+				value: create(GaugeSchema, {
+					dataPoints: Array.from({ length: n }, (_, i) =>
+						create(NumberDataPointSchema, {
+							timeUnixNano: 1_700_000_000_000_000_000n + BigInt(i),
+							value: { case: "asDouble", value: i },
+						}),
+					),
+				}),
+			},
+		});
+	const metricsBatch = () =>
+		create(ExportMetricsServiceRequestSchema, {
+			resourceMetrics: [
+				create(ResourceMetricsSchema, {
+					scopeMetrics: [
+						create(ScopeMetricsSchema, {
+							metrics: [gauge("a", 1500), gauge("b", 800)],
+						}),
+					],
+				}),
+				create(ResourceMetricsSchema, {
+					scopeMetrics: [
+						create(ScopeMetricsSchema, { metrics: [gauge("c", 50)] }),
+					],
+				}),
+			],
+		});
+
+	it("equals decode-then-slice and reports the same rejected count", () => {
+		const bytes = toBinary(ExportMetricsServiceRequestSchema, metricsBatch());
+		const full = decodeMetricsRequest({ bytes, wireFormat: "protobuf" });
+		const capped = decodeMetricsRequestCapped(
+			{ bytes, wireFormat: "protobuf" },
+			2000,
+		);
+		expect(full).toHaveLength(2350);
+		expect(capped.rejected).toBe(350);
+		expect(capped.points).toEqual(full.slice(0, 2000));
+	});
+});
+
+describe("AnyValue nesting depth cap", () => {
+	const logWithAttr = (value: ReturnType<typeof nestedKvlist>) =>
+		toBinary(
+			ExportLogsServiceRequestSchema,
+			create(ExportLogsServiceRequestSchema, {
+				resourceLogs: [
+					create(ResourceLogsSchema, {
+						scopeLogs: [
+							create(ScopeLogsSchema, {
+								logRecords: [
+									create(LogRecordSchema, {
+										attributes: [
+											create(KeyValueSchema, { key: "deep", value }),
+										],
+									}),
+								],
+							}),
+						],
+					}),
+				],
+			}),
+		);
+
+	it("leaves realistic nesting untouched", () => {
+		const [log] = decodeLogsRequest({
+			bytes: logWithAttr(nestedKvlist(MAX_ANY_VALUE_DEPTH)),
+			wireFormat: "protobuf",
+		});
+		expect(JSON.stringify(log?.attributes)).not.toContain("truncated");
+		expect(jsonDepth(log?.attributes)).toBe(MAX_ANY_VALUE_DEPTH + 1);
+	});
+
+	it("truncates attributes nested past the cap (logs/metrics path)", () => {
+		const [log] = decodeLogsRequest({
+			bytes: logWithAttr(nestedKvlist(400)),
+			wireFormat: "protobuf",
+		});
+		const serialized = JSON.stringify(log?.attributes);
+		expect(serialized).toContain(TRUNCATED_DEPTH_MARKER);
+		expect(jsonDepth(log?.attributes)).toBeLessThanOrEqual(
+			MAX_ANY_VALUE_DEPTH + 1,
+		);
+	});
+
+	it("truncates span attributes nested past the cap (traces path)", () => {
+		const msg = traceBatch([1]);
+		const span = msg.resourceSpans[0]?.scopeSpans[0]?.spans[0];
+		if (!span) throw new Error("fixture");
+		span.attributes = [
+			create(KeyValueSchema, { key: "deep", value: nestedKvlist(400) }),
+		];
+		const bytes = toBinary(ExportTraceServiceRequestSchema, msg);
+		const stored = toStoredSpans(
+			decodeTraceRequest({ bytes, wireFormat: "protobuf" }),
+			"p",
+			new Date(),
+			72,
+		);
+		const attrs = JSON.parse(stored[0]?.attributesJson ?? "{}");
+		expect(stored[0]?.attributesJson).toContain(TRUNCATED_DEPTH_MARKER);
+		expect(jsonDepth(attrs)).toBeLessThanOrEqual(MAX_ANY_VALUE_DEPTH + 1);
+	});
+});
+
+describe("__proto__ attribute keys", () => {
+	it("are stored as normal own keys, not dropped or used as a prototype", () => {
+		const bytes = toBinary(
+			ExportLogsServiceRequestSchema,
+			create(ExportLogsServiceRequestSchema, {
+				resourceLogs: [
+					create(ResourceLogsSchema, {
+						scopeLogs: [
+							create(ScopeLogsSchema, {
+								logRecords: [
+									create(LogRecordSchema, {
+										attributes: [
+											strAttr("__proto__", "x"),
+											create(KeyValueSchema, {
+												key: "nested",
+												value: create(AnyValueSchema, {
+													value: {
+														case: "kvlistValue",
+														value: {
+															values: [
+																create(KeyValueSchema, {
+																	key: "__proto__",
+																	value: nestedKvlist(1),
+																}),
+															],
+														},
+													},
+												}),
+											}),
+										],
+									}),
+								],
+							}),
+						],
+					}),
+				],
+			}),
+		);
+		const [log] = decodeLogsRequest({ bytes, wireFormat: "protobuf" });
+		const attrs = log?.attributes ?? {};
+		expect(Object.keys(attrs)).toEqual(["__proto__", "nested"]);
+		expect(Object.getPrototypeOf(attrs)).toBe(Object.prototype);
+		expect(JSON.stringify(attrs)).toBe(
+			'{"__proto__":"x","nested":{"__proto__":{"k":"leaf"}}}',
+		);
+	});
+});

package/src/otlp/decode.ts

@@ -1,11 +1,17 @@
 export type { OtlpWireFormat, ReadBodyResult } from "./decode/body";
 export { OtlpDecodeError, readOtlpBody } from "./decode/body";
 export type { DecodedLogRecord } from "./decode/logs";
-export { decodeLogsRequest } from "./decode/logs";
+export { decodeLogsRequest, decodeLogsRequestCapped } from "./decode/logs";
 export type {
 	DecodedExemplar,
 	DecodedMetricPoint,
 	MetricType,
 } from "./decode/metrics";
-export { decodeMetricsRequest } from "./decode/metrics";
-export { decodeTraceRequest } from "./decode/traces";
+export {
+	decodeMetricsRequest,
+	decodeMetricsRequestCapped,
+} from "./decode/metrics";
+export {
+	decodeTraceRequest,
+	decodeTraceRequestCapped,
+} from "./decode/traces";