chore(deps): Update module go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.39.0 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	require	minor	v0.38.0 -> v0.39.0

GitHub Vulnerability Alerts

CVE-2023-25151

Impact

The v0.38.0 release of go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp uses the httpconv.ServerRequest function to annotate metric measurements for the http.server.request_content_length, http.server.response_content_length, and http.server.duration instruments.

The ServerRequest function sets the http.target attribute value to be the whole request URI (including the query string)¹. The metric instruments do not "forget" previous measurement attributes when cumulative temporality is used, this means the cardinality of the measurements allocated is directly correlated with the unique URIs handled. If the query string is constantly random, this will result in a constant increase in memory allocation that can be used in a denial-of-service attack.

Pseudo-attack:

for infinite loop {
  r := generate_random_string()
  do_http_request("/some/path?random="+r)
}

Patches

• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp - v0.39.0
• go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego - v0.39.0

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

Footnotes

1. https://togithub.com/open-telemetry/opentelemetry-go/blob/6cb5718eaaed5c408c3bf4ad1aecee5c20ccdaa9/semconv/internal/v2/http.go#L202-L208 ↩

[codecov]

Codecov Report

Merging #1452 (f8ad751) into main (3c888cc) will increase coverage by 0.22%.
The diff coverage is n/a.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1452      +/-   ##
==========================================
+ Coverage   54.11%   54.34%   +0.22%     
==========================================
  Files         116      116              
  Lines       13084    13084              
==========================================
+ Hits         7081     7111      +30     
+ Misses       5407     5376      -31     
- Partials      596      597       +1     

Impacted Files	Coverage Δ
internal/audit/local/badgerdb.go	64.00% <0.00%> (+0.61%)	⬆️
internal/engine/engine.go	63.21% <0.00%> (+0.68%)	⬆️
internal/storage/index/builder.go	84.46% <0.00%> (+7.28%)	⬆️
internal/compile/errors.go	51.56% <0.00%> (+15.62%)	⬆️