Redact specific url query string values and url credentials in instrumentations

[rads-1996]

Description

This pull request provides an implementation for issue #2992 which points to a specification which states that specific URL query string values should now be redacted by default. This PR also aligns with the semantic conventions for HTTP spans which states that sensitive content provided in url.full SHOULD be scrubbed when instrumentations can identify it, in such case username and password SHOULD be redacted (https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md).

The existing method remove_url_credentials (PR: #538), which previously removed the username:password portion from a URL if present, has been updated to replace the credentials with the string REDACTED.

The new method redact_query_parameters removes the values of query string parameters for the following keys by default:

  - AWSAccessKeyId

  - Signature

  - sig

  - X-Goog-Signature

Note: This is not an exhaustive list and is subject to change over time.

These methods have been absorbed in the following instrumentations - httpx, requests, urllib, aiohttp, tornado, asgi, wsgi.

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration

• Unit tests have been added to validate the functionality of both remove_url_credentials and redact_query_parameters methods.
• Integration tests for the instrumentations have been updated.

Does This PR Require a Core Repo Change?

• Yes. - Link to PR:
• No.

Checklist:

See contributing.md for styleguide, changelog guidelines, and more.

• Followed the style guidelines of this project
• Changelogs have been updated
• Unit tests have been added
• Documentation has been updated

[hectorhdzg]

Please update the changelog to include these changes

[rads-1996]

@hectorhdzg, @xrmx I observed that in the method - opentelemetry-python-contrib\instrumentation\opentelemetry-instrumentation-aiohttp-server\src\opentelemetry\instrumentation\aiohttp_server\__init__.py, remove_url_credentials was added as part of the PR - #1800 and not through PR #538, which introduces the remove_url_credentials method. In the description of PR #538, the aiohttp-server instrumentation is not mentioned. Neither does that PR introduce any change in the aiohttp-server instrumentation. In addition, although the aiohttp-server uses remove_url_credentials in init.py, it does not have a corresponding test in the test_aiohttp_server_integration.py file. I am not sure, if we should remove the implementation of credential and query string redaction entirely from aiohttp-server (since it was not added as part of PR #538), or if instead we should add the integration test for it. Would appreciate your feedback and suggestions on this.

[xrmx]

@hectorhdzg, @xrmx I observed that in the method - opentelemetry-python-contrib\instrumentation\opentelemetry-instrumentation-aiohttp-server\src\opentelemetry\instrumentation\aiohttp_server\__init__.py, remove_url_credentials was added as part of the PR - #1800 and not through PR #538, which introduces the remove_url_credentials method. In the description of PR #538, the aiohttp-server instrumentation is not mentioned. Neither does that PR introduce any change in the aiohttp-server instrumentation. In addition, although the aiohttp-server uses remove_url_credentials in init.py, it does not have a corresponding test in the test_aiohttp_server_integration.py file. I am not sure, if we should remove the implementation of credential and query string redaction entirely from aiohttp-server (since it was not added as part of PR #538), or if instead we should add the integration test for it. Would appreciate your feedback and suggestions on this.

I think we should just add the tests

[rads-1996]

@xrmx I've added the test for the aiohttp-server. Based on the behavior of collect_request_attributes, credentials were being discarded and not included in the collected request attributes. However, to ensure credentials are properly redacted, I added logic to explicitly check the Authorization header for a username and password, and redact them if present. Additionally, the query string is now redacted if it contains sensitive information.

[emdneto]

It looks like that for httpx < 0.20, the username:password isn't present in the URL itself, but in headers as basic auth. Maybe we need to implement custom logic here to check that?

[rads-1996]

@emdneto I did add the logic for checking the auth in the headers. However based on the conversation with @xrmx - #3508 (comment), I removed the logic for it.

[emdneto]

I mean in the httpx instrumentation test to make tests pass

[rads-1996]

I mean in the httpx instrumentation test to make tests pass

I see, sure I will add the logic for it. Thank you for the suggestion.

[xrmx]

Suggested change

	([#3517](https://github.com/open-telemetry/opentelemetry-python-contrib/pull/3517))
	([#3517](https://github.com/open-telemetry/opentelemetry-python-contrib/pull/3517))