RUBY-3831 Skip OpenTelemetry command spans for sensitive commands

[comandeo-mongo]

Description

RUBY-3831.

The OpenTelemetry command tracer JSON-serialized the entire command body into the db.query.text span attribute (excluding only lsid, $db, $clusterTime, signature). Auth commands (saslStart, saslContinue, createUser, updateUser, …) carry SCRAM proofs and cleartext passwords, so enabling OTEL_RUBY_INSTRUMENTATION_MONGODB_QUERY_TEXT_MAX_LENGTH > 0 would have leaked credentials to any tracing backend.

Per the OpenTelemetry tracing spec (specifications/source/open-telemetry/open-telemetry.md lines 216-217 and the Security Implication section), drivers MUST NOT create a command span for sensitive commands at all — attribute-level redaction is not enough. The sensitive list is the same one already enforced by Mongo::Monitoring::Event::Secure.

Changes

• lib/mongo/tracing/open_telemetry/command_tracer.rb: include Mongo::Monitoring::Event::Secure and short-circuit trace_command when the command is sensitive (no span is created, the block still runs and its return value is propagated). Also skip hello / legacy hello regardless of speculativeAuthenticate — handshake/heartbeat traffic does not belong in traces.
• spec/mongo/tracing/open_telemetry/command_tracer_spec.rb: add coverage asserting that start_span and OpenTelemetry::Trace.with_span are NOT invoked for each sensitive command, for hello/ismaster/isMaster with and without speculativeAuthenticate, while the block still runs and its result is returned.

Test plan

• bundle exec rubocop lib/mongo/tracing/open_telemetry/command_tracer.rb spec/mongo/tracing/open_telemetry/command_tracer_spec.rb — clean
• MONGODB_URI=mongodb://localhost:27017,localhost:27018,localhost:27019/ bundle exec rspec spec/mongo/tracing/open_telemetry/command_tracer_spec.rb — 115 examples, 0 failures
• MONGODB_URI=… bundle exec rspec spec/mongo/tracing/open_telemetry/operation_tracer_spec.rb — 45 examples, 0 failures (regression check)

[Copilot]

Pull request overview

This PR updates the driver’s OpenTelemetry command tracing to avoid creating any command spans for sensitive/authentication-related commands (per spec security requirements), and to also omit hello/legacy handshake commands from tracing to prevent noisy/irrelevant spans and any risk of credential leakage via span attributes (notably db.query.text).

Changes:

• Short-circuit CommandTracer#trace_command to skip span creation entirely for sensitive commands (using the existing Mongo::Monitoring::Event::Secure sensitive-command logic) and always skip hello/ismaster/isMaster.
• Add spec coverage asserting no spans/context are created for sensitive and hello/legacy hello commands while still yielding and returning the block result.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
lib/mongo/tracing/open_telemetry/command_tracer.rb	Skip OpenTelemetry command spans for sensitive commands and for hello/legacy hello, while still executing the command block.
spec/mongo/tracing/open_telemetry/command_tracer_spec.rb	Add tests confirming spans and OTEL context are not entered for skipped commands, and that the traced block still runs/returns normally.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.