Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

otel: redact sensitive query parameters before recording http.url

Aberta
  • Algo errado?
#4,655 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

@sai5880 já está trabalhando nisso.

Desde 21/10/2026.

  • #4659 de @sai5880 — aberto

Avaliação

Dificuldade
4/5
Tempo estimado
1-2 dias
Facilidade para iniciantes
55/100
Tipo de issue
Bug
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
go
Domínio
observability, security

Direção de pesquisa

Start with otel/transport.go and the existing URL tests in otel/transport_test.go, then read sensitiveParams and sanitizeURL in github/github.go. Add coverage for query credentials and URL userinfo, ensuring the URL recorded in http.url is redacted without changing the request URL sent by the transport. Done means the span no longer exposes those secrets and the existing query free URL behavior remains covered.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Summary

The OpenTelemetry transport records the full request URL, including query string and userinfo, in the http.url span attribute. go-github already treats certain query parameters as sensitive and redacts them on error paths, but the OTel instrumentation bypasses that redaction, so those values are exported to tracing/APM backends.

Location

  • otel/transport.go:61-66 (attribute set)
  • github/github.go:1964 (sensitiveParams)
  • github/github.go:1966-1984 (sanitizeURL)

At HEAD (2190e6a):

	// Inject Attributes
	span.SetAttributes(
		attribute.String("http.method", req.Method),
		attribute.String("http.url", req.URL.String()),
		attribute.String("http.host", req.URL.Host),
	)

Details

req.URL.String() is the raw request URL. For requests that carry credentials in the query string, or that include userinfo, the resulting span attribute contains the secret verbatim:

http.url = https://api.github.com/user/repos?access_token=ghp_abc123&page=1
http.url = https://user:[email protected]/user

The github package already classifies exactly these parameters as sensitive:

var sensitiveParams = []string{"client_secret", "access_token", "token"}

// sanitizeURL redacts sensitive parameters from the URL which may be
// exposed to the user.
func sanitizeURL(uri *url.URL) *url.URL {
	...
	for _, p := range sensitiveParams {
		if len(params.Get(p)) > 0 {
			params.Set(p, "REDACTED")
			redacted = true
		}
	}
	...
}

That helper is applied at github/github.go:1482, 1777, 1849, 1907, 1948 and 1949, i.e. only in error and redirect handling. The OTel transport is a separate package and never applies it. Note also that sanitizeURL handles query parameters only; it does not strip url.User, which URL.String() renders as user:password@host.

otel/transport_test.go asserts http.url for a query-free URL (https://api.github.com/users/google), so nothing currently guards this behavior.

Impact

Any application that wraps the go-github client with otel.NewTransport and calls endpoints that pass credentials via query parameters (for example OAuth token exchange with client_secret, or legacy calls passing access_token) writes those secrets into every span attribute set. Span attributes are typically exported to a tracing backend, sampled into logs, and retained for days, which turns a short-lived token into a long-lived copy in a third-party system. It also defeats the existing redaction guarantee, since the same URL appears redacted in an error message and unredacted in the span for the same request.

Signed URL parameters (for example pre-signed download links returned by some endpoints and then re-requested) are likewise recorded in full.

Suggested fix

Reuse one shared sanitation helper instead of duplicating the parameter list:

  1. Export a helper from the github package (for example github.SanitizeURL or a small github.RedactURL returning a string) that applies sensitiveParams and, ideally, also clears url.User. Have the existing sanitizeURL and the OTel transport both call it.
  2. In otel/transport.go, record the sanitized value, or record only scheme, host and path:
	u := *req.URL
	u.User = nil
	u.RawQuery = "" // or apply the shared redaction helper
	span.SetAttributes(
		attribute.String("http.method", req.Method),
		attribute.String("http.url", u.String()),
		attribute.String("http.host", req.URL.Host),
	)

Note that simply calling the existing sanitizeURL is not safe from otel: it mutates uri.RawQuery in place (see the open issue about this mutation), which would rewrite the request URL that is actually sent. Copy the URL first, or fix the mutation separately.

Also worth considering url.full from the current OpenTelemetry semantic conventions, which supersedes http.url, and documenting that recorded URLs are redacted.

Add a regression test:

req := httptest.NewRequest("GET", "https://api.github.com/user?access_token=secret", nil)
// ... RoundTrip, then assert:
// attrs["http.url"].AsString() == "https://api.github.com/user?access_token=REDACTED"

Verification

Static review only. I read otel/transport.go, otel/transport_test.go, and the sensitiveParams / sanitizeURL code in github/github.go at commit 2190e6a (2026-10-21). No runtime proof of concept was executed and no exporter was run; the exposure follows directly from req.URL.String() being placed into a span attribute with no redaction step.

Linguagem predominante
Go
Estrelas
11.3k
Forks
2.6k
Merge médio
2d 8h
PRs com merge (30d)
38

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de google/go-github

Todas as issues de google/go-github

Issues semelhantes

Mais issues de Go

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.