dd-trace 4.18.0 → 4.20.0

package/packages/dd-trace/src/config.js

@@ -235,8 +235,9 @@ class Config {
 
     const inServerlessEnvironment = inAWSLambda || isGCPFunction || isAzureFunctionConsumptionPlan
 
-    const DD_TRACE_TELEMETRY_ENABLED = coalesce(
-      process.env.DD_TRACE_TELEMETRY_ENABLED,
+    const DD_INSTRUMENTATION_TELEMETRY_ENABLED = coalesce(
+      process.env.DD_TRACE_TELEMETRY_ENABLED, // for backward compatibility
+      process.env.DD_INSTRUMENTATION_TELEMETRY_ENABLED, // to comply with instrumentation telemetry specs
       !inServerlessEnvironment
     )
     const DD_TELEMETRY_HEARTBEAT_INTERVAL = process.env.DD_TELEMETRY_HEARTBEAT_INTERVAL
@@ -308,6 +309,10 @@ class Config {
       options.tracePropagationStyle,
       defaultPropagationStyle
     )
+    const DD_TRACE_PROPAGATION_EXTRACT_FIRST = coalesce(
+      process.env.DD_TRACE_PROPAGATION_EXTRACT_FIRST,
+      false
+    )
     const DD_TRACE_RUNTIME_ID_ENABLED = coalesce(
       options.experimental && options.experimental.runtimeId,
       process.env.DD_TRACE_EXPERIMENTAL_RUNTIME_ID_ENABLED,
@@ -367,10 +372,11 @@ class Config {
       isGCPFunction || isAzureFunctionConsumptionPlan
     )
 
+    // the tracer generates 128 bit IDs by default as of v5
     const DD_TRACE_128_BIT_TRACEID_GENERATION_ENABLED = coalesce(
       options.traceId128BitGenerationEnabled,
       process.env.DD_TRACE_128_BIT_TRACEID_GENERATION_ENABLED,
-      false
+      true
     )
 
     const DD_TRACE_128_BIT_TRACEID_LOGGING_ENABLED = coalesce(
@@ -577,6 +583,7 @@ ken|consumer_?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)
       inject: DD_TRACE_PROPAGATION_STYLE_INJECT,
       extract: DD_TRACE_PROPAGATION_STYLE_EXTRACT
     }
+    this.tracePropagationExtractFirst = isTrue(DD_TRACE_PROPAGATION_EXTRACT_FIRST)
     this.experimental = {
       runtimeId: isTrue(DD_TRACE_RUNTIME_ID_ENABLED),
       exporter: DD_TRACE_EXPORTER,
@@ -598,7 +605,7 @@ ken|consumer_?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)
     this.startupLogs = isTrue(DD_TRACE_STARTUP_LOGS)
     // Disabled for CI Visibility's agentless
     this.telemetry = {
-      enabled: DD_TRACE_EXPORTER !== 'datadog' && isTrue(DD_TRACE_TELEMETRY_ENABLED),
+      enabled: DD_TRACE_EXPORTER !== 'datadog' && isTrue(DD_INSTRUMENTATION_TELEMETRY_ENABLED),
       heartbeatInterval: DD_TELEMETRY_HEARTBEAT_INTERVAL,
       debug: isTrue(DD_TELEMETRY_DEBUG),
       logCollection: isTrue(DD_TELEMETRY_LOG_COLLECTION_ENABLED),
@@ -608,7 +615,7 @@ ken|consumer_?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)
     this.tagsHeaderMaxLength = parseInt(DD_TRACE_X_DATADOG_TAGS_MAX_LENGTH)
     this.appsec = {
       enabled: DD_APPSEC_ENABLED,
-      rules: DD_APPSEC_RULES ? safeJsonParse(maybeFile(DD_APPSEC_RULES)) : require('./appsec/recommended.json'),
+      rules: DD_APPSEC_RULES,
       customRulesProvided: !!DD_APPSEC_RULES,
       rateLimit: DD_APPSEC_TRACE_RATE_LIMIT,
       wafTimeout: DD_APPSEC_WAF_TIMEOUT,

package/packages/dd-trace/src/datastreams/processor.js

@@ -4,12 +4,16 @@ const pkg = require('../../../../package.json')
 const Uint64 = require('int64-buffer').Uint64BE
 
 const { LogCollapsingLowestDenseDDSketch } = require('@datadog/sketches-js')
-
+const { encodePathwayContext } = require('./pathway')
 const { DataStreamsWriter } = require('./writer')
 const { computePathwayHash } = require('./pathway')
+const { types } = require('util')
+const { PATHWAY_HASH } = require('../../../../ext/tags')
+
 const ENTRY_PARENT_HASH = Buffer.from('0000000000000000', 'hex')
 
 const HIGH_ACCURACY_DISTRIBUTION = 0.0075
+const CONTEXT_PROPAGATION_KEY = 'dd-pathway-ctx'
 
 class StatsPoint {
   constructor (hash, parentHash, edgeTags) {
@@ -18,6 +22,7 @@ class StatsPoint {
     this.edgeTags = edgeTags
     this.edgeLatency = new LogCollapsingLowestDenseDDSketch(HIGH_ACCURACY_DISTRIBUTION)
     this.pathwayLatency = new LogCollapsingLowestDenseDDSketch(HIGH_ACCURACY_DISTRIBUTION)
+    this.payloadSize = new LogCollapsingLowestDenseDDSketch(HIGH_ACCURACY_DISTRIBUTION)
   }
 
   addLatencies (checkpoint) {
@@ -25,6 +30,7 @@ class StatsPoint {
     const pathwayLatencySec = checkpoint.pathwayLatencyNs / 1e9
     this.edgeLatency.accept(edgeLatencySec)
     this.pathwayLatency.accept(pathwayLatencySec)
+    this.payloadSize.accept(checkpoint.payloadSize)
   }
 
   encode () {
@@ -33,7 +39,8 @@ class StatsPoint {
       ParentHash: this.parentHash,
       EdgeTags: this.edgeTags,
       EdgeLatency: this.edgeLatency.toProto(),
-      PathwayLatency: this.pathwayLatency.toProto()
+      PathwayLatency: this.pathwayLatency.toProto(),
+      PayloadSize: this.payloadSize.toProto()
     }
   }
 }
@@ -49,6 +56,29 @@ class StatsBucket extends Map {
   }
 }
 
+function getSizeOrZero (obj) {
+  if (typeof obj === 'string') {
+    return Buffer.from(obj, 'utf-8').length
+  }
+  if (types.isArrayBuffer(obj)) {
+    return obj.byteLength
+  }
+  if (Buffer.isBuffer(obj)) {
+    return obj.length
+  }
+  return 0
+}
+
+function getHeadersSize (headers) {
+  if (headers === undefined) return 0
+  return Object.entries(headers).reduce((prev, [key, val]) => getSizeOrZero(key) + getSizeOrZero(val) + prev, 0)
+}
+
+function getMessageSize (message) {
+  const { key, value, headers } = message
+  return getSizeOrZero(key) + getSizeOrZero(value) + getHeadersSize(headers)
+}
+
 class TimeBuckets extends Map {
   forTime (time) {
     if (!this.has(time)) {
@@ -105,15 +135,19 @@ class DataStreamsProcessor {
     this.writer.flush(payload)
   }
 
-  recordCheckpoint (checkpoint) {
+  recordCheckpoint (checkpoint, span = null) {
     if (!this.enabled) return
     const bucketTime = Math.round(checkpoint.currentTimestamp - (checkpoint.currentTimestamp % this.bucketSizeNs))
     this.buckets.forTime(bucketTime)
       .forCheckpoint(checkpoint)
       .addLatencies(checkpoint)
+    // set DSM pathway hash on span to enable related traces feature on DSM tab, convert from buffer to uint64
+    if (span) {
+      span.setTag(PATHWAY_HASH, checkpoint.hash.readBigUInt64BE(0).toString())
+    }
   }
 
-  setCheckpoint (edgeTags, ctx = null) {
+  setCheckpoint (edgeTags, span, ctx = null, payloadSize = 0) {
     if (!this.enabled) return null
     const nowNs = Date.now() * 1e6
     const direction = edgeTags.find(t => t.startsWith('direction:'))
@@ -147,16 +181,7 @@ class DataStreamsProcessor {
     const hash = computePathwayHash(this.service, this.env, edgeTags, parentHash)
     const edgeLatencyNs = nowNs - edgeStartNs
     const pathwayLatencyNs = nowNs - pathwayStartNs
-    const checkpoint = {
-      currentTimestamp: nowNs,
-      parentHash: parentHash,
-      hash: hash,
-      edgeTags: edgeTags,
-      edgeLatencyNs: edgeLatencyNs,
-      pathwayLatencyNs: pathwayLatencyNs
-    }
-    this.recordCheckpoint(checkpoint)
-    return {
+    const dataStreamsContext = {
       hash: hash,
       edgeStartNs: edgeStartNs,
       pathwayStartNs: pathwayStartNs,
@@ -164,6 +189,22 @@ class DataStreamsProcessor {
       closestOppositeDirectionHash: closestOppositeDirectionHash,
       closestOppositeDirectionEdgeStart: closestOppositeDirectionEdgeStart
     }
+    if (direction === 'direction:out') {
+      // Add the header for this now, as the callee doesn't have access to context when producing
+      payloadSize += getSizeOrZero(encodePathwayContext(dataStreamsContext))
+      payloadSize += CONTEXT_PROPAGATION_KEY.length
+    }
+    const checkpoint = {
+      currentTimestamp: nowNs,
+      parentHash: parentHash,
+      hash: hash,
+      edgeTags: edgeTags,
+      edgeLatencyNs: edgeLatencyNs,
+      pathwayLatencyNs: pathwayLatencyNs,
+      payloadSize: payloadSize
+    }
+    this.recordCheckpoint(checkpoint, span)
+    return dataStreamsContext
   }
 
   _serializeBuckets () {
@@ -194,5 +235,9 @@ module.exports = {
   StatsPoint: StatsPoint,
   StatsBucket: StatsBucket,
   TimeBuckets,
-  ENTRY_PARENT_HASH
+  getMessageSize,
+  getHeadersSize,
+  getSizeOrZero,
+  ENTRY_PARENT_HASH,
+  CONTEXT_PROPAGATION_KEY
 }

package/packages/dd-trace/src/format.js

@@ -14,7 +14,7 @@ const SPAN_SAMPLING_MECHANISM = constants.SPAN_SAMPLING_MECHANISM
 const SPAN_SAMPLING_RULE_RATE = constants.SPAN_SAMPLING_RULE_RATE
 const SPAN_SAMPLING_MAX_PER_SECOND = constants.SPAN_SAMPLING_MAX_PER_SECOND
 const SAMPLING_MECHANISM_SPAN = constants.SAMPLING_MECHANISM_SPAN
-const { MEASURED, BASE_SERVICE } = tags
+const { MEASURED, BASE_SERVICE, ANALYTICS } = tags
 const ORIGIN_KEY = constants.ORIGIN_KEY
 const HOSTNAME_KEY = constants.HOSTNAME_KEY
 const TOP_LEVEL_KEY = constants.TOP_LEVEL_KEY
@@ -24,6 +24,7 @@ const ERROR_STACK = constants.ERROR_STACK
 const ERROR_TYPE = constants.ERROR_TYPE
 
 const map = {
+  'operation.name': 'name',
   'service.name': 'service',
   'span.type': 'type',
   'resource.name': 'resource'
@@ -83,6 +84,7 @@ function extractTags (trace, span) {
 
   for (const tag in tags) {
     switch (tag) {
+      case 'operation.name':
       case 'service.name':
       case 'span.type':
       case 'resource.name':
@@ -92,6 +94,9 @@ function extractTags (trace, span) {
       case 'http.status_code':
         addTag(trace.meta, {}, tag, tags[tag] && String(tags[tag]))
         break
+      case 'analytics.event':
+        addTag({}, trace.metrics, ANALYTICS, tags[tag] === undefined || tags[tag] ? 1 : 0)
+        break
       case HOSTNAME_KEY:
       case MEASURED:
         addTag({}, trace.metrics, tag, tags[tag] === undefined || tags[tag] ? 1 : 0)

package/packages/dd-trace/src/id.js

@@ -42,6 +42,18 @@ class Identifier {
   toJSON () {
     return this.toString()
   }
+
+  equals (other) {
+    const length = this._buffer.length
+    const otherLength = other._buffer.length
+
+    // Only compare the bytes available in both IDs.
+    for (let i = length, j = otherLength; i >= 0 && j >= 0; i--, j--) {
+      if (this._buffer[i] !== other._buffer[j]) return false
+    }
+
+    return true
+  }
 }
 
 // Create a buffer, using an optional hexadecimal value if provided.

package/packages/dd-trace/src/iitm.js

@@ -3,7 +3,7 @@
 const semver = require('semver')
 const logger = require('./log')
 const { addHook } = require('import-in-the-middle')
-const dc = require('../../diagnostics_channel')
+const dc = require('dc-polyfill')
 
 if (semver.satisfies(process.versions.node, '>=14.13.1')) {
   const moduleLoadStartChannel = dc.channel('dd-trace:moduleLoadStart')

package/packages/dd-trace/src/log/channels.js

@@ -1,6 +1,6 @@
 'use strict'
 
-const { channel } = require('../../../diagnostics_channel')
+const { channel } = require('dc-polyfill')
 
 const Level = {
   Debug: 'debug',

package/packages/dd-trace/src/opentelemetry/span.js

@@ -11,6 +11,7 @@ const tracer = require('../../')
 const DatadogSpan = require('../opentracing/span')
 const { ERROR_MESSAGE, ERROR_TYPE, ERROR_STACK } = require('../constants')
 const { SERVICE_NAME, RESOURCE_NAME } = require('../../../../ext/tags')
+const kinds = require('../../../../ext/kinds')
 
 const SpanContext = require('./span_context')
 
@@ -19,6 +20,93 @@ function hrTimeToMilliseconds (time) {
   return time[0] * 1e3 + time[1] / 1e6
 }
 
+const spanKindNames = {
+  [api.SpanKind.INTERNAL]: kinds.INTERNAL,
+  [api.SpanKind.SERVER]: kinds.SERVER,
+  [api.SpanKind.CLIENT]: kinds.CLIENT,
+  [api.SpanKind.PRODUCER]: kinds.PRODUCER,
+  [api.SpanKind.CONSUMER]: kinds.CONSUMER
+}
+
+/**
+ * Several of these attributes are not yet supported by the Node.js OTel API.
+ * We check for old equivalents where we can, but not all had equivalents.
+ */
+function spanNameMapper (spanName, kind, attributes) {
+  if (spanName) return spanName
+
+  const opName = attributes['operation.name']
+  if (opName) return opName
+
+  const { INTERNAL, SERVER, CLIENT } = api.SpanKind
+
+  // HTTP server and client requests
+  // TODO: Drop http.method when http.request.method is supported.
+  for (const key of ['http.method', 'http.request.method']) {
+    if (key in attributes) {
+      if (kind === SERVER) {
+        return 'http.server.request'
+      }
+      if (kind === CLIENT) {
+        return 'http.client.request'
+      }
+    }
+  }
+
+  // Databases
+  const dbSystem = attributes['db.system']
+  if (dbSystem && kind === CLIENT) {
+    return `${dbSystem}.query`
+  }
+
+  // Messaging
+  const msgSys = attributes['messaging.system']
+  const msgOp = attributes['messaging.operation']
+  if (msgSys && msgOp && kind !== INTERNAL) {
+    return `${msgSys}.${msgOp}`
+  }
+
+  // RPC (and AWS)
+  const rpcSystem = attributes['rpc.system']
+  if (rpcSystem) {
+    if (kind === CLIENT) {
+      return rpcSystem === 'aws-api'
+        ? `aws.${attributes['rpc.service'] || 'client'}.request`
+        : `${rpcSystem}.client.request`
+    }
+    if (kind === SERVER) {
+      return `${rpcSystem}.server.request`
+    }
+  }
+
+  // FaaS
+  const faasProvider = attributes['faas.invoked_provider']
+  const faasName = attributes['faas.invoked_name']
+  const faasTrigger = attributes['faas.trigger']
+  if (kind === CLIENT && faasProvider && faasName) {
+    return `${faasProvider}.${faasName}.invoke`
+  }
+  if (kind === SERVER && faasTrigger) {
+    return `${faasTrigger}.invoke`
+  }
+
+  // GraphQL
+  // NOTE: Not part of Semantic Convention spec yet, but is used in the GraphQL
+  // integration.
+  const isGraphQL = 'graphql.operation.type' in attributes
+  if (isGraphQL) return 'graphql.server.request'
+
+  // Network
+  // TODO: Doesn't exist yet. No equivalent.
+  const protocol = attributes['network.protocol.name']
+  const protocolPrefix = protocol ? `${protocol}.` : ''
+  if (kind === SERVER) return `${protocolPrefix}server.request`
+  if (kind === CLIENT) return `${protocolPrefix}client.request`
+
+  // If all else fails, default to stringified span.kind.
+  return spanKindNames[kind]
+}
+
 class Span {
   constructor (
     parentTracer,
@@ -27,7 +115,8 @@ class Span {
     spanContext,
     kind,
     links = [],
-    timeInput
+    timeInput,
+    attributes
   ) {
     const { _tracer } = tracer
 
@@ -35,7 +124,7 @@ class Span {
     const startTime = hrTimeToMilliseconds(hrStartTime)
 
     this._ddSpan = new DatadogSpan(_tracer, _tracer._processor, _tracer._prioritySampler, {
-      operationName: spanName,
+      operationName: spanNameMapper(spanName, kind, attributes),
       context: spanContext._ddContext,
       startTime,
       hostname: _tracer._hostname,
@@ -46,6 +135,10 @@ class Span {
       }
     }, _tracer._debug)
 
+    if (attributes) {
+      this.setAttributes(attributes)
+    }
+
     this._parentTracer = parentTracer
     this._context = context
 

package/packages/dd-trace/src/opentelemetry/tracer.js

@@ -78,23 +78,22 @@ class Tracer {
     //   return api.trace.wrapSpanContext(spanContext)
     // }
 
-    const span = new Span(
+    return new Span(
       this,
       context,
       name,
       spanContext,
       spanKind,
       links,
-      options.startTime
+      options.startTime,
+
+      // Set initial span attributes. The attributes object may have been mutated
+      // by the sampler, so we sanitize the merged attributes before setting them.
+      sanitizeAttributes(
+        // Object.assign(attributes, samplingResult.attributes)
+        attributes
+      )
     )
-    // Set initial span attributes. The attributes object may have been mutated
-    // by the sampler, so we sanitize the merged attributes before setting them.
-    const initAttributes = sanitizeAttributes(
-      // Object.assign(attributes, samplingResult.attributes)
-      attributes
-    )
-    span.setAttributes(initAttributes)
-    return span
   }
 
   startActiveSpan (name, options, context, fn) {

package/packages/dd-trace/src/opentracing/propagation/text_map.js

@@ -236,11 +236,20 @@ class TextMapPropagator {
   _extractDatadogContext (carrier) {
     const spanContext = this._extractGenericContext(carrier, traceKey, spanKey, 10)
 
-    if (spanContext) {
-      this._extractOrigin(carrier, spanContext)
-      this._extractBaggageItems(carrier, spanContext)
-      this._extractSamplingPriority(carrier, spanContext)
-      this._extractTags(carrier, spanContext)
+    if (!spanContext) return spanContext
+
+    this._extractOrigin(carrier, spanContext)
+    this._extractBaggageItems(carrier, spanContext)
+    this._extractSamplingPriority(carrier, spanContext)
+    this._extractTags(carrier, spanContext)
+
+    if (this._config.tracePropagationExtractFirst) return spanContext
+
+    const tc = this._extractTraceparentContext(carrier)
+
+    if (tc && spanContext._traceId.equals(tc._traceId)) {
+      spanContext._traceparent = tc._traceparent
+      spanContext._tracestate = tc._tracestate
     }
 
     return spanContext

package/packages/dd-trace/src/opentracing/span.js

@@ -12,6 +12,7 @@ const runtimeMetrics = require('../runtime_metrics')
 const log = require('../log')
 const { storage } = require('../../../datadog-core')
 const telemetryMetrics = require('../telemetry/metrics')
+const { channel } = require('dc-polyfill')
 
 const tracerMetrics = telemetryMetrics.manager.namespace('tracers')
 
@@ -30,6 +31,8 @@ const integrationCounters = {
   span_finished: {}
 }
 
+const finishCh = channel('dd-trace:span:finish')
+
 function getIntegrationCounter (event, integration) {
   const counters = integrationCounters[event]
 
@@ -176,6 +179,7 @@ class DatadogSpan {
     this._duration = finishTime - this._startTime
     this._spanContext._trace.finished.push(this)
     this._spanContext._isFinished = true
+    finishCh.publish(this)
     this._processor.process(this)
   }
 

package/packages/dd-trace/src/opentracing/span_context.js

@@ -2,6 +2,9 @@
 
 const { AUTO_KEEP } = require('../../../../ext/priority')
 
+// the lowercase, hex encoded upper 64 bits of a 128-bit trace id, if present
+const TRACE_ID_128 = '_dd.p.tid'
+
 class DatadogSpanContext {
   constructor (props) {
     props = props || {}
@@ -35,8 +38,8 @@ class DatadogSpanContext {
 
   toTraceparent () {
     const flags = this._sampling.priority >= AUTO_KEEP ? '01' : '00'
-    const traceId = this._traceId.toBuffer().length <= 8 && this._trace.tags['_dd.p.tid']
-      ? this._trace.tags['_dd.p.tid'] + this._traceId.toString(16).padStart(16, '0')
+    const traceId = this._traceId.toBuffer().length <= 8 && this._trace.tags[TRACE_ID_128]
+      ? this._trace.tags[TRACE_ID_128] + this._traceId.toString(16).padStart(16, '0')
       : this._traceId.toString(16).padStart(32, '0')
     const spanId = this._spanId.toString(16).padStart(16, '0')
     const version = (this._traceparent && this._traceparent.version) || '00'

package/packages/dd-trace/src/plugin_manager.js

@@ -1,6 +1,6 @@
 'use strict'
 
-const { channel } = require('../../diagnostics_channel')
+const { channel } = require('dc-polyfill')
 const { isFalse } = require('./util')
 const plugins = require('./plugins')
 const log = require('./log')

package/packages/dd-trace/src/plugins/database.js

@@ -36,7 +36,7 @@ class DatabasePlugin extends StoragePlugin {
     const { encodedDddbs, encodedDde, encodedDdps, encodedDdpv } = this.serviceTags
 
     return `dddbs='${encodedDddbs}',dde='${encodedDde}',` +
-    `ddps='${encodedDdps}',ddpv='${encodedDdpv}'`
+      `ddps='${encodedDdps}',ddpv='${encodedDdpv}'`
   }
 
   getDbmServiceName (span, tracerService) {

package/packages/dd-trace/src/plugins/plugin.js

@@ -2,7 +2,7 @@
 
 // TODO: move anything related to tracing to TracingPlugin instead
 
-const dc = require('../../../diagnostics_channel')
+const dc = require('dc-polyfill')
 const { storage } = require('../../../datadog-core')
 
 class Subscription {

package/packages/dd-trace/src/plugins/util/ci.js

@@ -1,5 +1,3 @@
-const URL = require('url').URL
-
 const {
   GIT_BRANCH,
   GIT_COMMIT_SHA,
@@ -24,6 +22,7 @@ const {
   CI_NODE_LABELS,
   CI_NODE_NAME
 } = require('./tags')
+const { filterSensitiveInfoFromRepository } = require('./url')
 
 // Receives a string with the form 'John Doe <john.doe@gmail.com>'
 // and returns { name: 'John Doe', email: 'john.doe@gmail.com' }
@@ -67,20 +66,6 @@ function normalizeRef (ref) {
   return ref.replace(/origin\/|refs\/heads\/|tags\//gm, '')
 }
 
-function filterSensitiveInfoFromRepository (repositoryUrl) {
-  if (repositoryUrl.startsWith('git@')) {
-    return repositoryUrl
-  }
-
-  try {
-    const { protocol, hostname, pathname } = new URL(repositoryUrl)
-
-    return `${protocol}//${hostname}${pathname}`
-  } catch (e) {
-    return ''
-  }
-}
-
 function resolveTilde (filePath) {
   if (!filePath || typeof filePath !== 'string') {
     return ''
@@ -271,20 +256,22 @@ module.exports = {
       const ref = GITHUB_HEAD_REF || GITHUB_REF || ''
       const refKey = ref.includes('tags/') ? GIT_TAG : GIT_BRANCH
 
+      // Both pipeline URL and job URL include GITHUB_SERVER_URL, which can include user credentials,
+      // so we pass them through `filterSensitiveInfoFromRepository`.
       tags = {
         [CI_PIPELINE_ID]: GITHUB_RUN_ID,
         [CI_PIPELINE_NAME]: GITHUB_WORKFLOW,
         [CI_PIPELINE_NUMBER]: GITHUB_RUN_NUMBER,
-        [CI_PIPELINE_URL]: pipelineURL,
+        [CI_PIPELINE_URL]: filterSensitiveInfoFromRepository(pipelineURL),
         [CI_PROVIDER_NAME]: 'github',
         [GIT_COMMIT_SHA]: GITHUB_SHA,
         [GIT_REPOSITORY_URL]: repositoryURL,
-        [CI_JOB_URL]: jobUrl,
+        [CI_JOB_URL]: filterSensitiveInfoFromRepository(jobUrl),
         [CI_JOB_NAME]: GITHUB_JOB,
         [CI_WORKSPACE_PATH]: GITHUB_WORKSPACE,
         [refKey]: ref,
         [CI_ENV_VARS]: JSON.stringify({
-          GITHUB_SERVER_URL,
+          GITHUB_SERVER_URL: filterSensitiveInfoFromRepository(GITHUB_SERVER_URL),
           GITHUB_REPOSITORY,
           GITHUB_RUN_ID,
           GITHUB_RUN_ATTEMPT

package/packages/dd-trace/src/plugins/util/git.js

@@ -19,6 +19,7 @@ const {
   GIT_COMMIT_AUTHOR_NAME,
   CI_WORKSPACE_PATH
 } = require('./tags')
+const { filterSensitiveInfoFromRepository } = require('./url')
 
 const GIT_REV_LIST_MAX_BUFFER = 8 * 1024 * 1024 // 8MB
 
@@ -214,7 +215,7 @@ function getGitMetadata (ciMetadata) {
 
   return {
     [GIT_REPOSITORY_URL]:
-      repositoryUrl || sanitizedExec('git', ['ls-remote', '--get-url']),
+      filterSensitiveInfoFromRepository(repositoryUrl || sanitizedExec('git', ['ls-remote', '--get-url'])),
     [GIT_COMMIT_MESSAGE]:
       commitMessage || sanitizedExec('git', ['show', '-s', '--format=%s']),
     [GIT_COMMIT_AUTHOR_DATE]: authorDate,

package/packages/dd-trace/src/plugins/util/ip_extractor.js

@@ -48,8 +48,8 @@ function extractIp (config, req) {
 
   let firstPrivateIp
   if (headers) {
-    for (let i = 0; i < ipHeaderList.length; i++) {
-      const firstIp = findFirstIp(headers[ipHeaderList[i]])
+    for (const ipHeaderName of ipHeaderList) {
+      const firstIp = findFirstIp(headers[ipHeaderName])
 
       if (firstIp.public) {
         return firstIp.public
@@ -59,7 +59,7 @@ function extractIp (config, req) {
     }
   }
 
-  return firstPrivateIp || (req.socket && req.socket.remoteAddress)
+  return firstPrivateIp || req.socket?.remoteAddress
 }
 
 function findFirstIp (str) {
@@ -68,8 +68,8 @@ function findFirstIp (str) {
 
   const splitted = str.split(',')
 
-  for (let i = 0; i < splitted.length; i++) {
-    const chunk = splitted[i].trim()
+  for (const part of splitted) {
+    const chunk = part.trim()
 
     // TODO: strip port and interface data ?
 
@@ -90,5 +90,6 @@ function findFirstIp (str) {
 }
 
 module.exports = {
-  extractIp
+  extractIp,
+  ipHeaderList
 }