securenow 8.11.1 → 8.11.3

package/legacy-semconv.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { isOtpCodeField } = require('./otp-redaction');
+
 /**
  * Legacy semantic-convention attributes for the OpenTelemetry 0.221+ /
  * contrib 0.74+ instrumentations, which emit ONLY the stable conventions.
@@ -24,7 +26,7 @@
  *  - http.client_ip is NOT derived from the first X-Forwarded-For entry (that
  *    value is spoofable). SecureNow's requestHook sets http.client_ip from the
  *    trusted-proxy resolver (resolve-ip.js).
- *  - Signature-style query parameters (same list upstream now redacts on
+ *  - OTP/code and signature-style query parameters (same list upstream redacts on
  *    url.query / url.full) are replaced with REDACTED in http.target / http.url.
  *    Every other byte of the target is kept exactly as received, so detection
  *    rules that match encoded payloads keep working.
@@ -62,7 +64,6 @@ function defined(attributes) {
 function redactSearch(search, paramsToRedact = DEFAULT_REDACTED_QUERY_PARAMS) {
   if (typeof search !== 'string' || search.length < 2 || search[0] !== '?') return search;
   const sensitive = new Set(paramsToRedact || []);
-  if (sensitive.size === 0) return search;
   let changed = false;
   const parts = search.slice(1).split('&').map((part) => {
     const eq = part.indexOf('=');
@@ -71,7 +72,7 @@ function redactSearch(search, paramsToRedact = DEFAULT_REDACTED_QUERY_PARAMS) {
     try {
       key = decodeURIComponent(rawKey.replace(/\+/g, ' '));
     } catch (_) {}
-    if (!sensitive.has(key)) return part;
+    if (!sensitive.has(key) && !isOtpCodeField(key)) return part;
     changed = true;
     return `${rawKey}=${REDACTED}`;
   });