[receiver/libhoney] Zstd truncated body is panicking

.chloggen/libhoney-compression-panic.yaml

@@ -0,0 +1,8 @@
+change_type: bug_fix
+component: libhoneyreceiver
+note: Properly handle compressed payloads
+issues: [42279]
+subtext:
+  Compression issues now return a 400 status rather than panic. 
+  Exposes the http library's compression algorthms to let users override if needed.
+change_logs: [user]

receiver/libhoneyreceiver/README.md

@@ -28,6 +28,7 @@ The following settings are required:
 
 - `http`
   - `endpoint` must set an endpoint. Defaults to `127.0.0.1:8080`
+  - `compression_algorithms` (optional): List of supported compression algorithms. Defaults to `["", "gzip", "zstd", "zlib", "snappy", "deflate"]`. Set to `[]` to disable automatic decompression.
 - `resources`: if the `service.name` field is different, map it here.
 - `scopes`: to get the `library.name` and `library.version` set in the scope section, set them here.
 - `attributes`: if the other trace-related data have different keys, map them here, defaults are otlp-like field names.
@@ -37,7 +38,6 @@ The following setting is required for refinery traffic since:
 - `auth_api`: should be set to `https://api.honeycomb.io` or a proxy that forwards to that host.
   Some libhoney software checks `/1/auth` to get environment names so it needs to be passed through.
 
-
 ```yaml
   libhoney:
     http:
@@ -64,6 +64,34 @@ The following setting is required for refinery traffic since:
           - duration_ms
 ```
 
+### Compression Support
+
+The receiver supports automatic decompression of compressed request bodies using confighttp.ServerConfig defaults.
+
+#### Disabling Compression
+
+If you're experiencing issues with clients that send incorrect `Content-Encoding` headers (claiming data is compressed when it's not), you can disable automatic decompression:
+
+```yaml
+receivers:
+  libhoney:
+    http:
+      endpoint: 0.0.0.0:8088
+      compression_algorithms: []  # Disable all automatic decompression
+```
+
+#### Custom Compression Algorithms
+
+You can specify exactly which compression algorithms to support:
+
+```yaml
+receivers:
+  libhoney:
+    http:
+      endpoint: 0.0.0.0:8088
+      compression_algorithms: ["gzip", "zstd"]  # Only support gzip and zstd
+```
+
 ### Telemetry data types supported
 
 It will subscribe to the Traces and Logs signals but accept traffic destined for either pipeline using one http receiver

receiver/libhoneyreceiver/factory.go

@@ -41,7 +41,8 @@ func createDefaultConfig() component.Config {
 	return &Config{
 		HTTP: configoptional.Default(HTTPConfig{
 			ServerConfig: confighttp.ServerConfig{
-				Endpoint: endpointStr,
+				Endpoint:              endpointStr,
+				CompressionAlgorithms: []string{},
 			},
 			TracesURLPaths: defaultTracesURLPaths,
 		}),

receiver/libhoneyreceiver/go.mod

@@ -4,6 +4,7 @@ go 1.24
 
 require (
 	github.com/gogo/protobuf v1.3.2
+	github.com/klauspost/compress v1.18.0
 	github.com/open-telemetry/opentelemetry-collector-contrib/internal/coreinternal v0.134.0
 	github.com/open-telemetry/opentelemetry-collector-contrib/internal/sharedcomponent v0.134.0
 	github.com/stretchr/testify v1.10.0
@@ -57,7 +58,6 @@ require (
 	github.com/golang/snappy v1.0.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/knadh/koanf/maps v0.1.2 // indirect
 	github.com/knadh/koanf/providers/confmap v1.0.0 // indirect
 	github.com/knadh/koanf/v2 v2.2.2 // indirect

receiver/libhoneyreceiver/receiver.go

@@ -217,10 +217,32 @@ func (r *libhoneyReceiver) handleEvent(resp http.ResponseWriter, req *http.Reque
 		r.settings.Logger.Debug("dataset parsed", zap.String("dataset.parsed", dataset))
 	}
 
-	body, err := io.ReadAll(req.Body)
+	// The confighttp middleware automatically handles decompression based on Content-Encoding header
+	// However, there's a bug where some clients send uncompressed data with Content-Encoding headers
+	// This causes the decompressor middleware to panic. We wrap the read in panic recovery.
+
+	var body []byte
+	func() {
+		defer func() {
+			if panicVal := recover(); panicVal != nil {
+				// Log the panic but don't expose internal details to the client
+				r.settings.Logger.Error("Panic during request body read (likely malformed compressed data)",
+					zap.Any("panic", panicVal),
+					zap.String("content-encoding", req.Header.Get("Content-Encoding")))
+				err = errors.New("failed to read request body: invalid compressed data")
+			}
+		}()
+		body, err = io.ReadAll(req.Body)
+	}()
+
 	if err != nil {
 		r.settings.Logger.Error("Failed to read request body", zap.Error(err))
 		writeLibhoneyError(resp, enc, "failed to read request body")
+		// Drain any remaining body to allow connection reuse
+		if req.Body != nil {
+			_, _ = io.ReadAll(req.Body)
+			_ = req.Body.Close()
+		}
 		return
 	}
 	if err = req.Body.Close(); err != nil {