http.url must not contain credentials

open-telemetry · Apr 3, 2021 · c3bf9c5 · c3bf9c5
1 parent 87950d1
commit c3bf9c5
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/...ation-api/src/main/java/io/opentelemetry/instrumentation/api/tracer/HttpClientTracer.java b/...ation-api/src/main/java/io/opentelemetry/instrumentation/api/tracer/HttpClientTracer.java
@@ -182,9 +182,13 @@ private void setUrl(AttributeSetter setter, REQUEST request) {
     try {
       URI url = url(request);
       if (url != null) {
+        if (url.getUserInfo() != null) {
+          throw new IllegalArgumentException("http.url MUST NOT contain credentials!");
+        }
         netPeerAttributes.setNetPeer(setter, url.getHost(), null, url.getPort());
         setter.setAttribute(SemanticAttributes.HTTP_URL, url.toString());
       }
+
     } catch (Exception e) {
       log.debug("Error tagging url", e);
     }