When FollowRedirects is true, credentials (Authorization header, Cookie
headers set via HTTPHeaders) were forwarded to any redirect target,
including cross-host redirects.

Fix by detecting cross-host redirects via isCrossHostRedirect, which
walks the req.Response chain to find the original request's hostname and
compares it to the current destination. Each credential round-tripper
(bearer, basic auth, OAuth2) skips adding credentials when
isCrossHostRedirect returns true. A new sensitiveHeadersStripRT also
strips sensitive headers added by headersRoundTripper on cross-host
redirects.

This approach requires no CheckRedirect hook and works whether the
caller uses NewClientFromConfig or a custom http.Client built from
NewRoundTripperFromConfigWithContext directly.

This aligns to Go's HTTP client behaviour.

Signed-off-by: Julien Pivotto <[email protected]>

* Enable modernize linter
* Add linter exceptions to match upstream Prometheus.
* Apply linter improvements.

Signed-off-by: SuperQ <[email protected]>

Signed-off-by: Bryan Boreham <[email protected]>

Use strings.Cut instead of strings.Split.

Signed-off-by: Bryan Boreham <[email protected]>

We don't need to modify the string version of the number via a memory
allocation; it's much faster to modify the integer version.

Signed-off-by: Bryan Boreham <[email protected]>

Signed-off-by: Bryan Boreham <[email protected]>

Signed-off-by: prombot <[email protected]>

config: strip credentials on cross-host redirects

Walk every hop in the redirect chain rather than only checking the
current request's host. Once any hop leaves the original host, the
function returns true for all subsequent requests in that chain, even
if a later hop redirects back to the original host.

This mirrors net/http's own behaviour and closes the bypass window
where a cross→original→cross chain could slip credentials through.

Signed-off-by: Julien Pivotto <[email protected]>

Move isCrossHostRedirect early in oauth2RoundTripper.RoundTrip so that
cross-host redirects bypass token-source initialisation entirely and go
straight to Base.RoundTrip. Base is read under the RLock to avoid a
data race with concurrent reconfigurations.

Signed-off-by: Julien Pivotto <[email protected]>

Modernize Go

config: make isCrossHostRedirect sticky across the redirect chain

…ost-check

config: check cross-host redirect before OAuth2 token fetch

The text exposition parser panics with a nil pointer dereference when it
encounters a closing brace before any metric name has been read, e.g. for
the input "{}". In startOfLine a leading "{" sets currentMetricIsInsideBraces
and jumps straight to label parsing without going through readingMetricName,
so currentMF/currentMetric are still nil when startLabelName dereferences
currentMetric on the "}" branch.

Since TextToMetricFamilies is used to decode untrusted scrape payloads, a
malicious or compromised target could crash any consumer that does not wrap
the parser in its own recover().

Guard the "}" branch on currentMF == nil and return a parse error, mirroring
the existing guard in startLabelValue. currentMF is checked rather than
currentMetric because reset only clears currentMF between parses.

Introduced in #670.

Signed-off-by: Julien Pivotto <[email protected]>

…empty-braces-panic

expfmt: fix nil pointer panic when parsing empty braces "{}"

model: reduce allocations in Time.UnmarshalJSON

LoadHTTPConfigFile called SetDirectory with filepath.Dir(filepath.Dir(filename)),
resolving relative file paths (http_headers files, *_file credentials) against the
config file's grandparent directory instead of its own directory. This contradicts
the SetDirectory contract and every other config loader.

The behavior was masked by the testdata fixtures, which prefixed file paths with
the config file's own directory name (e.g. files: [testdata/headers-file] for a
config living in testdata/) to compensate. Drop those redundant prefixes and add a
regression test that loads a config from a temp dir and asserts a plain relative
path resolves next to the config file.

Signed-off-by: Julien Pivotto <[email protected]>

…nfigfile-dir

config: resolve LoadHTTPConfigFile paths relative to the config file