From aef294ae245f5d99e179e0dd8dce685d87c581f8 Mon Sep 17 00:00:00 2001 From: martincostello Date: Tue, 15 Sep 2026 15:43:26 +0100 Subject: [PATCH 1/4] [API] Handle empty tracestate value Avoid an internal `IndexOutOfRangeException` if a `tracestate` value was empty once trimmed. --- src/OpenTelemetry.Api/CHANGELOG.md | 5 +++++ .../Context/Propagation/TraceStateUtils.cs | 6 +++++- .../Context/Propagation/TracestateUtilsTests.cs | 3 +++ 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/src/OpenTelemetry.Api/CHANGELOG.md b/src/OpenTelemetry.Api/CHANGELOG.md index 55c3f63b434..d40e49a835f 100644 --- a/src/OpenTelemetry.Api/CHANGELOG.md +++ b/src/OpenTelemetry.Api/CHANGELOG.md @@ -15,6 +15,11 @@ Notes](../../RELEASENOTES.md). * Reduced allocations when constructing `SpanAttributes` from an array. ([#7698](https://github.com/open-telemetry/opentelemetry-dotnet/pull/7698)) +* Fixed parsing of an inbound `tracestate` header whose member value trimed + to a empty value that previously threw an `IndexOutOfRangeException` + internally and could silently truncate the tracestate. + ([#TODO](https://github.com/open-telemetry/opentelemetry-dotnet/pull/TODO)) + ## 1.18.0 Released 2026-Aug-21 diff --git a/src/OpenTelemetry.Api/Context/Propagation/TraceStateUtils.cs b/src/OpenTelemetry.Api/Context/Propagation/TraceStateUtils.cs index 3ec6857fcd8..58bb4781197 100644 --- a/src/OpenTelemetry.Api/Context/Propagation/TraceStateUtils.cs +++ b/src/OpenTelemetry.Api/Context/Propagation/TraceStateUtils.cs @@ -101,6 +101,10 @@ internal static bool AppendTraceState(string traceStateString, List value) // Value is opaque string up to 256 characters printable ASCII RFC0020 characters (i.e., the range // 0x20 to 0x7E) except comma , and =. - if (value.Length > ValueMaxSize || value[value.Length - 1] == ' ' /* '\u0020' */) + if (value.Length == 0 || value.Length > ValueMaxSize || value[value.Length - 1] == ' ' /* '\u0020' */) { return false; } diff --git a/test/OpenTelemetry.Api.Tests/Context/Propagation/TracestateUtilsTests.cs b/test/OpenTelemetry.Api.Tests/Context/Propagation/TracestateUtilsTests.cs index e9c0afecfa8..2efed684fe2 100644 --- a/test/OpenTelemetry.Api.Tests/Context/Propagation/TracestateUtilsTests.cs +++ b/test/OpenTelemetry.Api.Tests/Context/Propagation/TracestateUtilsTests.cs @@ -32,6 +32,9 @@ public void EmptyTracestate(string tracestate) [InlineData("k\t=v")] [InlineData("k=v,k=v")] [InlineData("k1=v1,,,k2=v2")] + [InlineData("k=\t")] + [InlineData("k=\u000B")] + [InlineData("b=1,a=\t,c=2")] [InlineData("k=morethan256......................................................................................................................................................................................................................................................")] [InlineData("v=morethan256......................................................................................................................................................................................................................................................")] public void InvalidTracestate(string tracestate) From 2cf9bc9c5dba2b679abab8e0ffb1314193e594f6 Mon Sep 17 00:00:00 2001 From: martincostello Date: Tue, 15 Sep 2026 16:32:34 +0100 Subject: [PATCH 2/4] [API] Fix CS8602 error Remove Debug.Assert() and instead just return false if it were null. --- .../Context/Propagation/TraceStateUtils.cs | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/src/OpenTelemetry.Api/Context/Propagation/TraceStateUtils.cs b/src/OpenTelemetry.Api/Context/Propagation/TraceStateUtils.cs index 58bb4781197..4f66d28783c 100644 --- a/src/OpenTelemetry.Api/Context/Propagation/TraceStateUtils.cs +++ b/src/OpenTelemetry.Api/Context/Propagation/TraceStateUtils.cs @@ -1,7 +1,6 @@ // Copyright The OpenTelemetry Authors // SPDX-License-Identifier: Apache-2.0 -using System.Diagnostics; using System.Runtime.CompilerServices; using OpenTelemetry.Internal; @@ -26,9 +25,7 @@ internal static class TraceStateUtils /// True if string was parsed successfully and tracestate was recognized, false otherwise. internal static bool AppendTraceState(string traceStateString, List> tracestate) { - Debug.Assert(tracestate != null, "tracestate list cannot be null"); - - if (string.IsNullOrEmpty(traceStateString)) + if (tracestate is null || string.IsNullOrEmpty(traceStateString)) { return false; } @@ -88,11 +85,7 @@ internal static bool AppendTraceState(string traceStateString, List Date: Tue, 15 Sep 2026 17:35:00 +0100 Subject: [PATCH 3/4] [API] Fix CHANGELOG Add PR number and fix typo. --- src/OpenTelemetry.Api/CHANGELOG.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/OpenTelemetry.Api/CHANGELOG.md b/src/OpenTelemetry.Api/CHANGELOG.md index d40e49a835f..f9ffffd4d9e 100644 --- a/src/OpenTelemetry.Api/CHANGELOG.md +++ b/src/OpenTelemetry.Api/CHANGELOG.md @@ -15,10 +15,10 @@ Notes](../../RELEASENOTES.md). * Reduced allocations when constructing `SpanAttributes` from an array. ([#7698](https://github.com/open-telemetry/opentelemetry-dotnet/pull/7698)) -* Fixed parsing of an inbound `tracestate` header whose member value trimed +* Fixed parsing of an inbound `tracestate` header whose member value trimmed to a empty value that previously threw an `IndexOutOfRangeException` internally and could silently truncate the tracestate. - ([#TODO](https://github.com/open-telemetry/opentelemetry-dotnet/pull/TODO)) + ([#7756](https://github.com/open-telemetry/opentelemetry-dotnet/pull/7756)) ## 1.18.0 From b33a0fae4457bf4d642ecc35f41ce5de37f324f5 Mon Sep 17 00:00:00 2001 From: Martin Costello Date: Tue, 15 Sep 2026 17:43:16 +0100 Subject: [PATCH 4/4] [API] Fix typo Fix typo in CHANGELOG entry. --- src/OpenTelemetry.Api/CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/OpenTelemetry.Api/CHANGELOG.md b/src/OpenTelemetry.Api/CHANGELOG.md index f9ffffd4d9e..70b7b035a0f 100644 --- a/src/OpenTelemetry.Api/CHANGELOG.md +++ b/src/OpenTelemetry.Api/CHANGELOG.md @@ -16,7 +16,7 @@ Notes](../../RELEASENOTES.md). ([#7698](https://github.com/open-telemetry/opentelemetry-dotnet/pull/7698)) * Fixed parsing of an inbound `tracestate` header whose member value trimmed - to a empty value that previously threw an `IndexOutOfRangeException` + to an empty value that previously threw an `IndexOutOfRangeException` internally and could silently truncate the tracestate. ([#7756](https://github.com/open-telemetry/opentelemetry-dotnet/pull/7756))