fix: cap W3C Baggage extract at 8192 bytes and 180 entries - #993
Open
tonghuaroot wants to merge 1 commit into
Open
fix: cap W3C Baggage extract at 8192 bytes and 180 entries#993tonghuaroot wants to merge 1 commit into
tonghuaroot wants to merge 1 commit into
Conversation
`otel_propagator_baggage:extract/5` walked an attacker-controlled `baggage` HTTP header through `string:lexemes/2` and `lists:foldl/3` without any size or entry-count cap. The W3C Baggage specification recommends 8192 bytes and 180 entries; the other OpenTelemetry SDKs (Java SDK 1.62.0 `W3CBaggagePropagator`, Go `propagation/baggage.go`, .NET `BaggagePropagator.cs`, C++ `baggage.h`) all enforce equivalent caps. The Erlang implementation enforced neither, so a single inbound request with an oversized `baggage` header could pin a BEAM scheduler and inflate per-process heap. This change: - Rejects headers larger than `MAX_BAGGAGE_BYTES` (8192) before `string:lexemes/2` walks them. - Stops decoding after `MAX_BAGGAGE_ENTRIES` (180) regardless of how many pairs `lexemes` produced. - Replaces the non-exhaustive `[Key, Value] = string:split(Pair, "=")` match with a `case` that skips malformed pairs instead of crashing. Adds `otel_propagator_baggage_SUITE` covering simple extract, the byte and entry caps, headers within both caps, malformed-pair skipping, and the missing-header path. Signed-off-by: tonghuaroot <tonghuaroot@gmail.com>
terry-xiaoyu
added a commit
to emqx/opentelemetry-erlang
that referenced
this pull request
Jul 8, 2026
otel_propagator_baggage:extract/5 previously walked the inbound `baggage` header via string:lexemes/2 and lists:foldl/3 with no byte or entry-count cap, and crashed on malformed pairs through `[Key, Value] = string:split(Pair, "=")`. Add ?MAX_BAGGAGE_BYTES (8192) and ?MAX_BAGGAGE_ENTRIES (180) limits recommended by the W3C Baggage specification, dropping oversized headers and stopping the decode loop after the entry cap. Malformed pairs are now skipped instead of crashing. This brings the Erlang implementation in line with the other OpenTelemetry SDKs and addresses GHSA-64w2-whjg-q7q7. Adds a CT suite covering simple extract, byte cap, entry cap, within-cap, malformed-pair skipping, and missing header. Backports open-telemetry#993.
terry-xiaoyu
added a commit
to emqx/opentelemetry-erlang
that referenced
this pull request
Jul 9, 2026
otel_propagator_baggage:extract/5 previously walked the inbound `baggage` header via string:lexemes/2 and lists:foldl/3 with no byte or entry-count cap, and crashed on malformed pairs through `[Key, Value] = string:split(Pair, "=")`. Add ?MAX_BAGGAGE_BYTES (8192) and ?MAX_BAGGAGE_ENTRIES (180) limits recommended by the W3C Baggage specification, dropping oversized headers and stopping the decode loop after the entry cap. Malformed pairs are now skipped instead of crashing. This brings the Erlang implementation in line with the other OpenTelemetry SDKs and addresses GHSA-64w2-whjg-q7q7. Adds a CT suite covering simple extract, byte cap, entry cap, within-cap, malformed-pair skipping, and missing header. Backports open-telemetry#993.
terry-xiaoyu
added a commit
to emqx/opentelemetry-erlang
that referenced
this pull request
Jul 9, 2026
otel_propagator_baggage:extract/5 previously walked the inbound `baggage` header via string:lexemes/2 and lists:foldl/3 with no byte or entry-count cap, and crashed on malformed pairs through `[Key, Value] = string:split(Pair, "=")`. Add ?MAX_BAGGAGE_BYTES (8192) and ?MAX_BAGGAGE_ENTRIES (180) limits recommended by the W3C Baggage specification, dropping oversized headers and stopping the decode loop after the entry cap. Malformed pairs are now skipped instead of crashing. This brings the Erlang implementation in line with the other OpenTelemetry SDKs and addresses GHSA-64w2-whjg-q7q7. Adds a CT suite covering simple extract, byte cap, entry cap, within-cap, malformed-pair skipping, and missing header. Backports open-telemetry#993.
terry-xiaoyu
added a commit
to emqx/opentelemetry-erlang
that referenced
this pull request
Jul 9, 2026
otel_propagator_baggage:extract/5 previously walked the inbound `baggage` header via string:lexemes/2 and lists:foldl/3 with no byte or entry-count cap, and crashed on malformed pairs through `[Key, Value] = string:split(Pair, "=")`. Add ?MAX_BAGGAGE_BYTES (8192) and ?MAX_BAGGAGE_ENTRIES (180) limits recommended by the W3C Baggage specification, dropping oversized headers and stopping the decode loop after the entry cap. Malformed pairs are now skipped instead of crashing. This brings the Erlang implementation in line with the other OpenTelemetry SDKs and addresses GHSA-64w2-whjg-q7q7. Adds a CT suite covering simple extract, byte cap, entry cap, within-cap, malformed-pair skipping, and missing header. Backports open-telemetry#993.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #992.
otel_propagator_baggage:extract/5currently walks the inboundbaggageHTTP header throughstring:lexemes(String, [$,])andlists:foldl/3without any byte or entry-count cap. The W3C Baggage specification recommends 8192 bytes and 180 entries, and the other OpenTelemetry SDKs (Java SDK 1.62.0W3CBaggagePropagator, Gopropagation/baggage.gomaxBytes/maxMembers, .NETBaggagePropagator.csMaxBaggageLength/MaxBaggageItems, C++baggage.hFromHeaderkMaxSize/kMaxKeyValuePairs) all enforce equivalent caps. This brings the Erlang implementation in line.The maintainers reviewed this off-list as GHSA-64w2-whjg-q7q7 and asked for it to land as a regular issue/PR (https://github.com/open-telemetry/opentelemetry-erlang/security/advisories/GHSA-64w2-whjg-q7q7).
Changes
apps/opentelemetry_api/src/otel_propagator_baggage.erlMAX_BAGGAGE_BYTES = 8192andMAX_BAGGAGE_ENTRIES = 180defines.extract/5rejects headers larger thanMAX_BAGGAGE_BYTESbeforestring:lexemes/2walks them.decode_pairs/3, which stops afterMAX_BAGGAGE_ENTRIESregardless of how many pairslexemesproduced.decode_pairs/3matchesstring:split(Pair, "=")viacaseand skips malformed pairs instead of crashing on[Key, Value] = ...like the previous code did.apps/opentelemetry_api/test/otel_propagator_baggage_SUITE.erlVerification
Run on
erlang:27-alpine(Erlang/OTP 27) with rebar3 3.24.0, against the worktree at this PR's head.