OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http
@opentelemetry/instrumentation-http redacts sensitive URL query parameters on outgoing (client) spans but not on incoming (server) spans. The server-span path writes the raw query string verbatim into the url.query attribute, so credentials embedded in inbound request URLs — AWS presigned-URL signatures, Azure SAS tokens (sig), GCS signed-URL signatures — are exported in plaintext to the configured tracing backend. Configuring the redactedQueryParams option does not change this, as this applies only to …