Fix BaggageBuilder.put() silently accepting empty string keys#8660
Open
itsmehotpants wants to merge 2 commits into
Open
Fix BaggageBuilder.put() silently accepting empty string keys#8660itsmehotpants wants to merge 2 commits into
itsmehotpants wants to merge 2 commits into
Conversation
Per the W3C Baggage spec (§3 definition), a baggage-name must be a
non-empty token. An empty string key is therefore invalid and should
be ignored, not stored and later propagated downstream.
The W3CBaggagePropagator.isValidBaggageKey() already correctly
rejects empty keys when *parsing* incoming headers. This change
closes the same gap on the *programmatic* builder path so that
calling Baggage.builder().put("", value).build() is a no-op,
consistent with how null keys are handled today.
- ImmutableBaggage.Builder.put(): add key.isEmpty() guard
- BaggageBuilder.java: document the empty-key contract in Javadoc
- ImmutableBaggageTest: correct put_keyEmpty to assert the right
behaviour; add put_keyEmpty_withMetadata variant
Fixes open-telemetry#8657
|
|
Pull request dashboard statusStatus last refreshed: 2026-07-26 18:31:14 UTC.
This automated status or its linked feedback items may be incorrect. If something looks wrong, please report it with the result you expected. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #8660 +/- ##
============================================
+ Coverage 91.46% 91.48% +0.01%
+ Complexity 10457 10456 -1
============================================
Files 1021 1021
Lines 27647 27647
Branches 3242 3242
============================================
+ Hits 25288 25293 +5
+ Misses 1616 1611 -5
Partials 743 743 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The W3C Baggage spec requires that a
baggage-namebe a non-empty token (§3 definition). An empty string""is therefore an invalid key and should be silently ignored, the same waynullkeys already are.Currently,
ImmutableBaggage.Builder.put()accepts empty string keys and stores them. When theW3CBaggagePropagatorlater serialises theBaggageinto a header, it includes the empty-key entry, which can produce malformedbaggageheaders like:This corrupts propagation for downstream services.
Inconsistency with the propagator
The parsing path (
W3CBaggagePropagator.isValidBaggageKey) already correctly rejects empty/blank keys when reading incoming headers:This PR closes the same gap on the programmatic builder path.
Change
ImmutableBaggage.Builder.put(): addkey.isEmpty()to the existing early-return null-guardBaggageBuilder.java: document the empty-key contract in Javadoc (links W3C spec)ImmutableBaggageTest: correct the existingput_keyEmptytest (it was asserting the buggy behaviour); addput_keyEmpty_withMetadatavariantFixes #8657