Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Un-escape url coding when parsing baggage. #2529

Merged
merged 3 commits into from Jan 24, 2022
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
Expand Up @@ -28,6 +28,7 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
- Fixes the instrument kind for noop async instruments. (#2461)
- Change the `otlpmetric.Client` interface's `UploadMetrics` method to accept a single `ResourceMetrics` instead of a slice of them. (#2491)
- Specify explicit buckets in Prometheus example. (#2493)
- W3C baggage will now decode urlescaped values. (#2529)

## [1.3.0] - 2021-12-10

Expand Down
7 changes: 6 additions & 1 deletion baggage/baggage.go
Expand Up @@ -269,7 +269,12 @@ func parseMember(member string) (Member, error) {
}
// "Leading and trailing whitespaces are allowed but MUST be trimmed
// when converting the header into a data structure."
key, value = strings.TrimSpace(kv[0]), strings.TrimSpace(kv[1])
key = strings.TrimSpace(kv[0])
var err error
value, err = url.QueryUnescape(strings.TrimSpace(kv[1]))
if err != nil {
return Member{}, fmt.Errorf("%w: %q", err, value)
}
if !keyRe.MatchString(key) {
return Member{}, fmt.Errorf("%w: %q", errInvalidKey, key)
}
Expand Down
7 changes: 7 additions & 0 deletions baggage/baggage_test.go
Expand Up @@ -339,6 +339,13 @@ func TestBaggageParse(t *testing.T) {
"foo": {Value: "2"},
},
},
{
name: "url encoded value",
in: "key1=val%252",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This test was insufficient. The regexp check now happens after QueryUnescape, not at all what was intended in the original code. As a result, valid strings like val%27 do not pass the check. This specific test does pass because the decoded string val%2 still "looks like" URL-encoded (i.e. it passes the regex).

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

want: baggage.List{
"key1": {Value: "val%2"},
},
},
{
name: "invalid member: empty",
in: "foo=,,bar=",
Expand Down
7 changes: 7 additions & 0 deletions propagation/baggage_test.go
Expand Up @@ -118,6 +118,13 @@ func TestExtractValidBaggageFromHTTPReq(t *testing.T) {
{Key: "key2", Value: "val2"},
},
},
{
name: "valid header with url encoded string",
header: "key1=val%252",
want: members{
{Key: "key1", Value: "val%2"},
},
},
}

for _, tt := range tests {
Expand Down