mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-12 23:54:01 +09:00
ZverGuy
eb0d6e5957
vlselect has no notion of a tenant: whatever filter reaches it decides what is returned. The upstream parameters are therefore rebuilt from a per-endpoint allowlist with the namespace scope as the only extra_stream_filters value, so a client cannot widen it through extra_filters, tenant headers or an alternate parameter spelling. VictoriaLogs ANDs extra_stream_filters into every subquery, so union and in() queries pass through unparsed. What the query can still do is cost: a missing start scans the whole retention, a tiny step returns a bucket per millisecond, query has no default limit, and ignore_global_time_filter lifts the window altogether. Each of those is bounded or refused here, and a tail resume point becomes a capped start_offset. Assisted-by: LLM Signed-off-by: ZverGuy <maximbel2003@gmail.com>