arturobernalg opened a new pull request, #920: URL: https://github.com/apache/httpcomponents-client/pull/920
The span name and the per-URI I/O tag carried the query string, which may hold tokens and makes the tag cardinality unbounded. Observed with a request to `/path?token=SECRET`: the classic span name was `GET http://127.0.0.1:PORT/path?token=SECRET`, the async one `GET /path?token=SECRET`, and the `uri` tag `/path?token=SECRET`. The name and the tag now carry the scheme, host and path only. Userinfo and fragment did not reach them in the observed cases and are stripped defensively. Metric names and tag keys are unchanged. Tests added, classic and async. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
