Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

otel: redact sensitive query parameters before recording http.url

Aperta
  • Qualcosa non va?
#4,655 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@sai5880 ci sta già lavorando.

Dal 21/10/2026.

  • #4659 di @sai5880 — aperta

Valutazione

Difficoltà
4/5
Tempo stimato
1-2 giorni
Idoneità per principianti
55/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
go
Ambito
observability, security

Direzione di ricerca

Start with otel/transport.go and the existing URL tests in otel/transport_test.go, then read sensitiveParams and sanitizeURL in github/github.go. Add coverage for query credentials and URL userinfo, ensuring the URL recorded in http.url is redacted without changing the request URL sent by the transport. Done means the span no longer exposes those secrets and the existing query free URL behavior remains covered.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

The OpenTelemetry transport records the full request URL, including query string and userinfo, in the http.url span attribute. go-github already treats certain query parameters as sensitive and redacts them on error paths, but the OTel instrumentation bypasses that redaction, so those values are exported to tracing/APM backends.

Location

  • otel/transport.go:61-66 (attribute set)
  • github/github.go:1964 (sensitiveParams)
  • github/github.go:1966-1984 (sanitizeURL)

At HEAD (2190e6a):

	// Inject Attributes
	span.SetAttributes(
		attribute.String("http.method", req.Method),
		attribute.String("http.url", req.URL.String()),
		attribute.String("http.host", req.URL.Host),
	)

Details

req.URL.String() is the raw request URL. For requests that carry credentials in the query string, or that include userinfo, the resulting span attribute contains the secret verbatim:

http.url = https://api.github.com/user/repos?access_token=ghp_abc123&page=1
http.url = https://user:[email protected]/user

The github package already classifies exactly these parameters as sensitive:

var sensitiveParams = []string{"client_secret", "access_token", "token"}

// sanitizeURL redacts sensitive parameters from the URL which may be
// exposed to the user.
func sanitizeURL(uri *url.URL) *url.URL {
	...
	for _, p := range sensitiveParams {
		if len(params.Get(p)) > 0 {
			params.Set(p, "REDACTED")
			redacted = true
		}
	}
	...
}

That helper is applied at github/github.go:1482, 1777, 1849, 1907, 1948 and 1949, i.e. only in error and redirect handling. The OTel transport is a separate package and never applies it. Note also that sanitizeURL handles query parameters only; it does not strip url.User, which URL.String() renders as user:password@host.

otel/transport_test.go asserts http.url for a query-free URL (https://api.github.com/users/google), so nothing currently guards this behavior.

Impact

Any application that wraps the go-github client with otel.NewTransport and calls endpoints that pass credentials via query parameters (for example OAuth token exchange with client_secret, or legacy calls passing access_token) writes those secrets into every span attribute set. Span attributes are typically exported to a tracing backend, sampled into logs, and retained for days, which turns a short-lived token into a long-lived copy in a third-party system. It also defeats the existing redaction guarantee, since the same URL appears redacted in an error message and unredacted in the span for the same request.

Signed URL parameters (for example pre-signed download links returned by some endpoints and then re-requested) are likewise recorded in full.

Suggested fix

Reuse one shared sanitation helper instead of duplicating the parameter list:

  1. Export a helper from the github package (for example github.SanitizeURL or a small github.RedactURL returning a string) that applies sensitiveParams and, ideally, also clears url.User. Have the existing sanitizeURL and the OTel transport both call it.
  2. In otel/transport.go, record the sanitized value, or record only scheme, host and path:
	u := *req.URL
	u.User = nil
	u.RawQuery = "" // or apply the shared redaction helper
	span.SetAttributes(
		attribute.String("http.method", req.Method),
		attribute.String("http.url", u.String()),
		attribute.String("http.host", req.URL.Host),
	)

Note that simply calling the existing sanitizeURL is not safe from otel: it mutates uri.RawQuery in place (see the open issue about this mutation), which would rewrite the request URL that is actually sent. Copy the URL first, or fix the mutation separately.

Also worth considering url.full from the current OpenTelemetry semantic conventions, which supersedes http.url, and documenting that recorded URLs are redacted.

Add a regression test:

req := httptest.NewRequest("GET", "https://api.github.com/user?access_token=secret", nil)
// ... RoundTrip, then assert:
// attrs["http.url"].AsString() == "https://api.github.com/user?access_token=REDACTED"

Verification

Static review only. I read otel/transport.go, otel/transport_test.go, and the sensitiveParams / sanitizeURL code in github/github.go at commit 2190e6a (2026-10-21). No runtime proof of concept was executed and no exporter was run; the exposure follows directly from req.URL.String() being placed into a span attribute with no redaction step.

Lingua principale
Go
Stelle
11.3k
Fork
2.6k
Merge medio
2g 14h
PR unite (30g)
33

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di google/go-github

Tutte le issue di google/go-github

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.