From 1a07a62935198d7db759aaf27cb7b54386683c78 Mon Sep 17 00:00:00 2001 From: Matt Johnston Date: Sun, 19 Apr 2026 14:33:09 -0300 Subject: [PATCH] fix(deno_telemetry): guard against malformed request URLs in span attributes --- vendor/deno_telemetry/util.ts | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/vendor/deno_telemetry/util.ts b/vendor/deno_telemetry/util.ts index 54612a4d7..d86c3fcb2 100644 --- a/vendor/deno_telemetry/util.ts +++ b/vendor/deno_telemetry/util.ts @@ -9,14 +9,21 @@ export function updateSpanFromRequest(span: Span, request: Request) { span.updateName(request.method); span.setAttribute("http.request.method", request.method); - const url = new URL(request.url); span.setAttribute("url.full", request.url); - span.setAttribute( - "url.scheme", - StringPrototypeSlice(url.protocol, 0, -1), - ); - span.setAttribute("url.path", url.pathname); - span.setAttribute("url.query", StringPrototypeSlice(url.search, 1)); + // Malformed URLs (e.g. invalid hosts from internet scanners) would otherwise + // throw here and crash the request handler before it can respond. Record the + // raw URL above and skip the parsed attributes when parsing fails. + try { + const url = new URL(request.url); + span.setAttribute( + "url.scheme", + StringPrototypeSlice(url.protocol, 0, -1), + ); + span.setAttribute("url.path", url.pathname); + span.setAttribute("url.query", StringPrototypeSlice(url.search, 1)); + } catch { + span.setAttribute("url.parse_error", "true"); + } } export function updateSpanFromResponse(span: Span, response: Response) {