Skip to content

[ISSUE #10901] Fix OTLP header parsing and avoid leaking header config - #10917

Open
123123213weqw wants to merge 4 commits into
apache:developfrom
123123213weqw:wangyue/issue-10901-otlp-header-parse
Open

[ISSUE #10901] Fix OTLP header parsing and avoid leaking header config#10917
123123213weqw wants to merge 4 commits into
apache:developfrom
123123213weqw:wangyue/issue-10901-otlp-header-parse

Conversation

@123123213weqw

Copy link
Copy Markdown

What is the purpose of the change

Fix #10901.

ProxyMetricsManager parsed metricsGrpcExporterHeader entries with item.split(":"), which drops any valid value containing a colon (e.g. a URI or a structured authorization value). On a parse failure the warning logged the complete header configuration, which may contain authorization tokens or API keys. The same split behavior was also applied to metricsLabel.

Brief changelog

  • ProxyMetricsManager: split each entry at the first colon with split(":", 2) so header values may contain colons
  • warning logs now print only the offending entry instead of the full header configuration

How was this patch verified

  • Code review: split(":", 2) keeps the rest of the value after the first colon
  • git diff --check clean

@RockteMQ-AI RockteMQ-AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Summary

This PR fixes OTLP header parsing in ProxyMetricsManager:

  1. split(":", 2) — correctly handles label values that contain colons (e.g., URLs). The original split(":") would break on such values.
  2. Log message fix — logs the specific invalid item instead of the entire labels string, making debugging easier.

Both changes are correct. LGTM.

Note: This PR also includes changes from #10914-#10916. See the series overlap comment on those PRs.


Automated review by github-manager-bot

@RockteMQ-AI RockteMQ-AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review Summary

This PR fixes OTLP header parsing in ProxyMetricsManager to handle values containing colons and improves error logging.

Findings

  • [Critical] ProxyMetricsManager.java — The original split(":") would break on header values containing colons (e.g., Authorization: Bearer token:with:colons). The fix uses split(":", 2) to split only on the first colon.
  • [Info] The improved error log now shows the actual invalid item instead of the full header string, making debugging easier.

Overall

Good fix for OTLP header parsing. The original code would fail on valid header values containing colons.


Automated review by RockteMQ-AI

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[studio][Bug] Proxy OTLP header parsing can reject valid values and expose secrets

2 participants