otel: redact sensitive query parameters before recording http.url #4655

Summary

The OpenTelemetry transport records the full request URL, including query string and userinfo, in the http.url span attribute. go-github already treats certain query parameters as sensitive and redacts them on error paths, but the OTel instrumentation bypasses that redaction, so those values are exported to tracing/APM backends.

Location

• otel/transport.go:61-66 (attribute set)
• github/github.go:1964 (sensitiveParams)
• github/github.go:1966-1984 (sanitizeURL)

At HEAD (2190e6a):

	// Inject Attributes
	span.SetAttributes(
		attribute.String("http.method", req.Method),
		attribute.String("http.url", req.URL.String()),
		attribute.String("http.host", req.URL.Host),
	)

Details

req.URL.String() is the raw request URL. For requests that carry credentials in the query string, or that include userinfo, the resulting span attribute contains the secret verbatim:

http.url = https://api.github.com/user/repos?access_token=ghp_abc123&page=1
http.url = https://user:ghp_abc123@api.github.com/user

The github package already classifies exactly these parameters as sensitive:

var sensitiveParams = []string{"client_secret", "access_token", "token"}

// sanitizeURL redacts sensitive parameters from the URL which may be
// exposed to the user.
func sanitizeURL(uri *url.URL) *url.URL {
	...
	for _, p := range sensitiveParams {
		if len(params.Get(p)) > 0 {
			params.Set(p, "REDACTED")
			redacted = true
		}
	}
	...
}

That helper is applied at github/github.go:1482, 1777, 1849, 1907, 1948 and 1949, i.e. only in error and redirect handling. The OTel transport is a separate package and never applies it. Note also that sanitizeURL handles query parameters only; it does not strip url.User, which URL.String() renders as user:password@host.

otel/transport_test.go asserts http.url for a query-free URL (https://api.github.com/users/google), so nothing currently guards this behavior.

Impact

Any application that wraps the go-github client with otel.NewTransport and calls endpoints that pass credentials via query parameters (for example OAuth token exchange with client_secret, or legacy calls passing access_token) writes those secrets into every span attribute set. Span attributes are typically exported to a tracing backend, sampled into logs, and retained for days, which turns a short-lived token into a long-lived copy in a third-party system. It also defeats the existing redaction guarantee, since the same URL appears redacted in an error message and unredacted in the span for the same request.

Signed URL parameters (for example pre-signed download links returned by some endpoints and then re-requested) are likewise recorded in full.

Suggested fix

Reuse one shared sanitation helper instead of duplicating the parameter list:

1. Export a helper from the github package (for example github.SanitizeURL or a small github.RedactURL returning a string) that applies sensitiveParams and, ideally, also clears url.User. Have the existing sanitizeURL and the OTel transport both call it.
2. In otel/transport.go, record the sanitized value, or record only scheme, host and path:

	u := *req.URL
	u.User = nil
	u.RawQuery = "" // or apply the shared redaction helper
	span.SetAttributes(
		attribute.String("http.method", req.Method),
		attribute.String("http.url", u.String()),
		attribute.String("http.host", req.URL.Host),
	)

Note that simply calling the existing sanitizeURL is not safe from otel: it mutates uri.RawQuery in place (see the open issue about this mutation), which would rewrite the request URL that is actually sent. Copy the URL first, or fix the mutation separately.

Also worth considering url.full from the current OpenTelemetry semantic conventions, which supersedes http.url, and documenting that recorded URLs are redacted.

Add a regression test:

req := httptest.NewRequest("GET", "https://api.github.com/user?access_token=secret", nil)
// ... RoundTrip, then assert:
// attrs["http.url"].AsString() == "https://api.github.com/user?access_token=REDACTED"

Verification

Static review only. I read otel/transport.go, otel/transport_test.go, and the sensitiveParams / sanitizeURL code in github/github.go at commit 2190e6a (2026-10-21). No runtime proof of concept was executed and no exporter was run; the exposure follows directly from req.URL.String() being placed into a span attribute with no redaction step.