Skip to content

feat: propagate traceparent from bandit callback URLs #196

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
myleshorton merged 1 commit into from
Mar 24, 2026
Merged

feat: propagate traceparent from bandit callback URLs #196

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions protocol/group/mutableurltest.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -641,6 +641,11 @@ func urlTestGET(ctx context.Context, link string, detour N.Dialer) (uint16, erro
if err != nil {
return 0, err
}
// Propagate embedded trace context so the bandit callback
// appears in the same distributed trace as the config assignment.
if tp := linkURL.Query().Get("tp"); tp != "" {
req.Header.Set("traceparent", tp)
}
Comment on lines +644 to +648
Copy link

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tp comes from a URL query parameter and is copied verbatim into an HTTP header. If it contains control characters (or is just not a valid W3C traceparent), Go's HTTP client can fail the request at send time (invalid header value) and an untrusted URL could also attempt header injection. Consider validating/sanitizing the value (e.g., trim spaces, reject any CTLs, and only accept the expected version-traceid-spanid-flags format) before setting traceparent.

Copilot uses AI. Check for mistakes.
Comment on lines +644 to +648
Copy link

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This new behavior (extract tp from the test URL and propagate it as the traceparent header) is not covered by tests. Since this package already has unit tests for urlTestGroup, consider adding a focused test that asserts a request created by urlTestGET includes the expected header when tp is present (and omits it when absent/invalid).

Copilot uses AI. Check for mistakes.
client := http.Client{
Transport: &http.Transport{
DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
Expand Down
Loading