Bug - Label values are not escaped - Allows injection

[amunra]

Bug

The text format requires \, " and line feed to be escaped inside a quoted label value.
This crate writes them through verbatim, so a label value containing " ends the value and the label set early.
The result is not a parseable document: a scraper drops the whole target's series.

Present at v0.25.1 (commit 6465716). \ and line feed take the same path.

Repro

#[derive(Clone, Hash, PartialEq, Eq, EncodeLabelSet, Debug)]
struct Escaping {
    client_version: String,
}

#[test]
fn label_value_is_escaped_in_text_exposition() {
    let mut registry = Registry::default();
    let family = Family::<Escaping, Counter>::default();
    registry.register("requests", "Requests", family.clone());
    family
        .get_or_create(&Escaping {
            client_version: r#"a"} evil{x="1"#.to_string(),
        })
        .inc();
    let mut buffer = String::new();
    encode(&mut buffer, &registry).unwrap();
    assert_eq!(
        r#"# HELP requests Requests.
# TYPE requests counter
requests_total{client_version="a\"} evil{x=\"1"} 1
# EOF
"#,
        buffer
    );
}

assertion `left == right` failed
  left: "…requests_total{client_version=\"a\\\"} evil{x=\\\"1\"} 1\n# EOF\n"
 right: "…requests_total{client_version=\"a\"} evil{x=\"1\"} 1\n# EOF\n"

[krisztianfekete]

Thanks for the report and repro @amunra. Wondering if you have time to pick this one up maybe?

[amunra]

Not immediately: We've worked around the bug in our own code by sanitising in the meantime.