fix(tracer): drop dd= list-entries over 256 bytes from incoming tracestate by mtoffl01 · Pull Request #4721 · DataDog/dd-trace-go

mtoffl01 · 2026-05-04T18:55:24Z

What does this PR do?

During extraction, parseTracestate drops any dd= list-entry from the incoming tracestate header whose length exceeds 256 bytes, mirroring the cap already enforced on inject. The entry is excluded from both the parsed fields and the propagating tag stored on the SpanContext. Other vendors' list-entries are preserved.

Also adds a tracestateDDMaxSize constant and switches the existing inject-side literal to reference it.

This PR also modifies existing behavior: the prior loop iterated through every dd= list-entry it found (a quirk whose purpose wasn't clear), whereas now encountering an oversized dd= list-entry halts further parsing, so any later dd= list-entries are not considered. Multi-dd= headers are invalid per W3C anyway.

Motivation

Inject already caps the dd= list-entry; extract had no equivalent ceiling.

codecov · 2026-05-04T18:59:52Z

Codecov Report

❌ Patch coverage is 91.66667% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 62.10%. Comparing base (df8d054) to head (8326d73).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
ddtrace/tracer/textmap.go	91.66%	1 Missing and 1 partial ⚠️

Additional details and impacted files

Files with missing lines	Coverage Δ
ddtrace/tracer/textmap.go	`84.36% <91.66%> (ø)`

... and 450 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

datadog-datadog-prod-us1-2 · 2026-05-04T19:00:57Z

🎉 All green!

❄️ No new flaky tests detected
🧪 All tests passed

🎯 Code Coverage (details)
• Patch Coverage: 91.67%
• Overall Coverage: 61.39% (+3.88%)

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 8326d73 | Docs | Datadog PR Page | Give us feedback!}

…state During extraction, parseTracestate drops any dd= list-entry whose length exceeds 256 bytes, mirroring the cap already enforced on inject. The entry is excluded from both the parsed fields and the propagating tag stored on the SpanContext. Other vendors' list-entries are preserved. Adds a tracestateDDMaxSize constant and switches the existing inject literal to reference it. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0b8c0c71b3

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

bm1549

LGTM pending review from a dd-trace-go expert

…check Per W3C list-member syntax, optional whitespace is allowed around each list-entry. Without per-entry trim, an oversized entry like " dd=..." did not match the dd= prefix check, so the size cap was skipped and the entry was stored as a propagating tag. Trim each entry before the prefix and length check in both the parse loop and the cleanup-rebuild loop. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

pr-commenter · 2026-05-04T21:59:39Z

Benchmarks

Benchmark execution time: 2026-05-04 21:59:35

Comparing candidate commit 8326d73 in PR branch mtoff/tracestate-max with baseline commit df8d054 in branch main.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 206 metrics, 9 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

🟩 = significantly better candidate vs. baseline
🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

mtoffl01 · 2026-05-05T01:01:26Z

/remove

gh-worker-devflow-routing-ef8351 · 2026-05-05T01:01:29Z

View all feedbacks in Devflow UI.

2026-05-05 01:01:28 UTC ℹ️ Start processing command /remove

2026-05-05 01:01:30 UTC ℹ️ Devflow: /remove

…state (#4721) ### What does this PR do? During extraction, `parseTracestate` drops any `dd=` list-entry from the incoming tracestate header whose length exceeds 256 bytes, mirroring the cap already enforced on inject. The entry is excluded from both the parsed fields and the propagating tag stored on the SpanContext. Other vendors' list-entries are preserved. Also adds a `tracestateDDMaxSize` constant and switches the existing inject-side literal to reference it. This PR also modifies existing behavior: the prior loop iterated through every `dd=` list-entry it found (a quirk whose purpose wasn't clear), whereas now encountering an oversized `dd=` list-entry halts further parsing, so any later `dd=` list-entries are not considered. Multi-`dd=` headers are invalid per W3C anyway. ### Motivation Inject already caps the `dd=` list-entry; extract had no equivalent ceiling. Co-authored-by: brian.marks <[email protected]>

mtoffl01 requested review from a team as code owners May 4, 2026 18:55

mtoffl01 marked this pull request as draft May 4, 2026 19:04

mtoffl01 force-pushed the mtoff/tracestate-max branch from c349c8c to 2c953d3 Compare May 4, 2026 19:31

mtoffl01 changed the title ~~fix(tracer): cap tracestate header at 512 bytes on inject and extract~~ fix(tracer): drop oversized dd= entry from incoming tracestate May 4, 2026

mtoffl01 force-pushed the mtoff/tracestate-max branch from 2c953d3 to 42fb0c0 Compare May 4, 2026 19:35

mtoffl01 changed the title ~~fix(tracer): drop oversized dd= entry from incoming tracestate~~ fix(tracer): drop dd= list-entries over 512 bytes from incoming tracestate May 4, 2026

mtoffl01 force-pushed the mtoff/tracestate-max branch from 42fb0c0 to 678063c Compare May 4, 2026 19:37

mtoffl01 changed the title ~~fix(tracer): drop dd= list-entries over 512 bytes from incoming tracestate~~ fix(tracer): drop dd= list-entries over 256 bytes from incoming tracestate May 4, 2026

mtoffl01 force-pushed the mtoff/tracestate-max branch 2 times, most recently from b145180 to c5e14f5 Compare May 4, 2026 19:50

mtoffl01 force-pushed the mtoff/tracestate-max branch from c5e14f5 to 0b8c0c7 Compare May 4, 2026 20:07

mtoffl01 marked this pull request as ready for review May 4, 2026 20:09

chatgpt-codex-connector Bot reviewed May 4, 2026

View reviewed changes

Comment thread ddtrace/tracer/textmap.go Outdated

bm1549 approved these changes May 4, 2026

View reviewed changes

hannahkm approved these changes May 4, 2026

View reviewed changes

gh-worker-dd-devflow-36fce6 Bot added the mergequeue-status: waiting label May 4, 2026

gh-worker-dd-devflow-36fce6 Bot added mergequeue-status: removed mergequeue-status: queued mergequeue-status: in_progress and removed mergequeue-status: waiting mergequeue-status: removed mergequeue-status: queued labels May 5, 2026

gh-worker-dd-mergequeue-cf854d Bot merged commit 86c0f03 into main May 5, 2026
225 of 226 checks passed

gh-worker-dd-mergequeue-cf854d Bot deleted the mtoff/tracestate-max branch May 5, 2026 13:10

gh-worker-dd-devflow-36fce6 Bot added mergequeue-status: done and removed mergequeue-status: in_progress labels May 5, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(tracer): drop dd= list-entries over 256 bytes from incoming tracestate#4721

fix(tracer): drop dd= list-entries over 256 bytes from incoming tracestate#4721
gh-worker-dd-mergequeue-cf854d[bot] merged 2 commits into
mainfrom
mtoff/tracestate-max

mtoffl01 commented May 4, 2026 •

edited

Loading

Uh oh!

codecov Bot commented May 4, 2026 •

edited

Loading

Uh oh!

datadog-datadog-prod-us1-2 Bot commented May 4, 2026 •

edited by datadog-prod-us1-4 Bot

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

bm1549 left a comment

Uh oh!

pr-commenter Bot commented May 4, 2026

Explanation

More details about the CI and significant changes

Uh oh!

mtoffl01 commented May 5, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 Bot commented May 5, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

mtoffl01 commented May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Motivation

Uh oh!

codecov Bot commented May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

datadog-datadog-prod-us1-2 Bot commented May 4, 2026 • edited by datadog-prod-us1-4 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

bm1549 left a comment

Choose a reason for hiding this comment

Uh oh!

pr-commenter Bot commented May 4, 2026

Benchmarks

Explanation

More details about the CI and significant changes

Uh oh!

mtoffl01 commented May 5, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 Bot commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mtoffl01 commented May 4, 2026 •

edited

Loading

codecov Bot commented May 4, 2026 •

edited

Loading

datadog-datadog-prod-us1-2 Bot commented May 4, 2026 •

edited by datadog-prod-us1-4 Bot

Loading

gh-worker-devflow-routing-ef8351 Bot commented May 5, 2026 •

edited

Loading