Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

otel: redact sensitive query parameters before recording http.url

Đang mở
  • Có gì không ổn?
#4,655 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

@sai5880 đang làm issue này rồi.

Từ ngày 21/10/2026.

  • #4659 của @sai5880 — đang mở

Đánh giá

Độ khó
4/5
Thời gian dự kiến
1-2 ngày
Mức phù hợp với người mới
55/100
Loại issue
Lỗi
Độ rõ ràng
Đặc tả rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
go
Lĩnh vực
observability, security

Hướng nghiên cứu

Start with otel/transport.go and the existing URL tests in otel/transport_test.go, then read sensitiveParams and sanitizeURL in github/github.go. Add coverage for query credentials and URL userinfo, ensuring the URL recorded in http.url is redacted without changing the request URL sent by the transport. Done means the span no longer exposes those secrets and the existing query free URL behavior remains covered.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

Summary

The OpenTelemetry transport records the full request URL, including query string and userinfo, in the http.url span attribute. go-github already treats certain query parameters as sensitive and redacts them on error paths, but the OTel instrumentation bypasses that redaction, so those values are exported to tracing/APM backends.

Location

  • otel/transport.go:61-66 (attribute set)
  • github/github.go:1964 (sensitiveParams)
  • github/github.go:1966-1984 (sanitizeURL)

At HEAD (2190e6a):

	// Inject Attributes
	span.SetAttributes(
		attribute.String("http.method", req.Method),
		attribute.String("http.url", req.URL.String()),
		attribute.String("http.host", req.URL.Host),
	)

Details

req.URL.String() is the raw request URL. For requests that carry credentials in the query string, or that include userinfo, the resulting span attribute contains the secret verbatim:

http.url = https://api.github.com/user/repos?access_token=ghp_abc123&page=1
http.url = https://user:[email protected]/user

The github package already classifies exactly these parameters as sensitive:

var sensitiveParams = []string{"client_secret", "access_token", "token"}

// sanitizeURL redacts sensitive parameters from the URL which may be
// exposed to the user.
func sanitizeURL(uri *url.URL) *url.URL {
	...
	for _, p := range sensitiveParams {
		if len(params.Get(p)) > 0 {
			params.Set(p, "REDACTED")
			redacted = true
		}
	}
	...
}

That helper is applied at github/github.go:1482, 1777, 1849, 1907, 1948 and 1949, i.e. only in error and redirect handling. The OTel transport is a separate package and never applies it. Note also that sanitizeURL handles query parameters only; it does not strip url.User, which URL.String() renders as user:password@host.

otel/transport_test.go asserts http.url for a query-free URL (https://api.github.com/users/google), so nothing currently guards this behavior.

Impact

Any application that wraps the go-github client with otel.NewTransport and calls endpoints that pass credentials via query parameters (for example OAuth token exchange with client_secret, or legacy calls passing access_token) writes those secrets into every span attribute set. Span attributes are typically exported to a tracing backend, sampled into logs, and retained for days, which turns a short-lived token into a long-lived copy in a third-party system. It also defeats the existing redaction guarantee, since the same URL appears redacted in an error message and unredacted in the span for the same request.

Signed URL parameters (for example pre-signed download links returned by some endpoints and then re-requested) are likewise recorded in full.

Suggested fix

Reuse one shared sanitation helper instead of duplicating the parameter list:

  1. Export a helper from the github package (for example github.SanitizeURL or a small github.RedactURL returning a string) that applies sensitiveParams and, ideally, also clears url.User. Have the existing sanitizeURL and the OTel transport both call it.
  2. In otel/transport.go, record the sanitized value, or record only scheme, host and path:
	u := *req.URL
	u.User = nil
	u.RawQuery = "" // or apply the shared redaction helper
	span.SetAttributes(
		attribute.String("http.method", req.Method),
		attribute.String("http.url", u.String()),
		attribute.String("http.host", req.URL.Host),
	)

Note that simply calling the existing sanitizeURL is not safe from otel: it mutates uri.RawQuery in place (see the open issue about this mutation), which would rewrite the request URL that is actually sent. Copy the URL first, or fix the mutation separately.

Also worth considering url.full from the current OpenTelemetry semantic conventions, which supersedes http.url, and documenting that recorded URLs are redacted.

Add a regression test:

req := httptest.NewRequest("GET", "https://api.github.com/user?access_token=secret", nil)
// ... RoundTrip, then assert:
// attrs["http.url"].AsString() == "https://api.github.com/user?access_token=REDACTED"

Verification

Static review only. I read otel/transport.go, otel/transport_test.go, and the sensitiveParams / sanitizeURL code in github/github.go at commit 2190e6a (2026-10-21). No runtime proof of concept was executed and no exporter was run; the exposure follows directly from req.URL.String() being placed into a span attribute with no redaction step.

Ngôn ngữ chính
Go
Star
11.3k
Fork
2.6k
Merge trung bình
2 ngày 8 giờ
Pull request đã merge (30 ngày)
38

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của google/go-github

Tất cả issue của google/go-github

Issue tương tự

Thêm issue về Go

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.