v1.1.0-beta.13

Security

• OTLP header values are no longer written to the debug log. Two leaks are fixed:

  • Debug logging logged the raw values of all OTEL_EXPORTER_OTLP_HEADERS and the
    signal-specific OTEL_EXPORTER_OTLP_{TRACES,METRICS,LOGS}_HEADERS. The message was
    emitted above the per-header loop that redacts Authorization, so the credential
    reached the log regardless of that redaction. Thanks to @arpitjain099 (#100).
  • OtlpHttpSpanExporter and OtlpHttpLogRecordExporter printed every header value
    except Authorization, at construction and on each export request — including
    headers configured in code, which never pass through an environment variable.

  Who is affected: applications running with OTEL_LOG_LEVEL=DEBUG (or OTelLog at
  debug) and a credential in an OTLP header, from the environment or from exporter
  config. Treat any debug logs collected from an affected build as containing that
  credential and rotate it.

  Tracked as GHSA-4rh6-c2v5-374w (CWE-532). Affects >= 1.0.0-alpha on this
  line and >= 0.9.0 on the stable channel; see the 0.9.8 entry.

Added

• OTEL_DART_HEADER_LOG_ALLOWLIST, and OTel.initialize(otlpHeaderLogAllowlist:),
  name the OTLP headers whose values may appear in the debug log (#96).
  Names match exactly, case insensitively; the code parameter replaces
  the environment variable rather than adding to it; authorization and
  proxy-authorization are never logged even when listed. Thanks to @arpitjain099 (#101).

Changed

• Debug logs now print name: [REDACTED] for any header value not on the allowlist,
  replacing Authorization: [REDACTED - length: N] — the length is dropped on purpose,
  since it narrows the search space for the token. Header names and the header count are
  still logged. A header value you relied on seeing at debug level now has to be listed
  in OTEL_DART_HEADER_LOG_ALLOWLIST.