open-telemetry/otel-arrow

(otelarrowreceiver): blocking clients that misuse the otlp-pdata-size header

Opened this issue · 0 comments

After #181 is merged there is a potential vulnerability where clients can misuse the otlp-pdata-size header that the otelarrowexporter adds to outgoing requests. This header is meant to allow the receiver to know the uncompressed size of the incoming request without doing any decompression or translation/allocations into pdata objects, so that we can have finer control over the inflight memory usage within the receiver.

However as was pointed out in #181 (comment) this header could be misused with values much larger than the actual uncompressed size and potentially block our receivers from processing any other requests. We need a method to identify clients that misuse this header and ban them from sending subsequent requests to ensure the availability of our server.