p2.7: prometheus /metrics

Default GET /metrics is Prometheus text; JSON stays at /metrics.json
and ?format=json. :8443 needs the metrics caller bearer; loopback
stays open. Restricted callers have no per-caller series and no
tavily:restricted gauge.

vendor/github.com/prometheus/common/expfmt/fuzz.go

@@ -0,0 +1,39 @@
+// Copyright 2014 The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Build only when actually fuzzing
+//go:build gofuzz
+
+package expfmt
+
+import (
+	"bytes"
+
+	"github.com/prometheus/common/model"
+)
+
+// Fuzz text metric parser with with github.com/dvyukov/go-fuzz:
+//
+//	go-fuzz-build github.com/prometheus/common/expfmt
+//	go-fuzz -bin expfmt-fuzz.zip -workdir fuzz
+//
+// Further input samples should go in the folder fuzz/corpus.
+func Fuzz(in []byte) int {
+	parser := NewTextParser(model.UTF8Validation)
+	_, err := parser.TextToMetricFamilies(bytes.NewReader(in))
+	if err != nil {
+		return 0
+	}
+
+	return 1
+}