Comply with W3C Baggage specification limits

CHANGELOG.md

@@ -15,6 +15,12 @@ The next release will require at least [Go 1.25].
 
 - Support testing of [Go 1.26]. (#7902)
 
+### Fixed
+
+- Update `Baggage` in `go.opentelemetry.io/otel/propagation` and `Parse` and `New` in `go.opentelemetry.io/otel/baggage` to comply with W3C Baggage specification limits.
+  `New` and `Parse` now return partial baggage along with an error when limits are exceeded.
+  Errors from baggage extraction are reported to the global error handler. (#7880)
+
 <!-- Released section -->
 <!-- Don't change this section unless doing release -->
 

baggage/baggage.go

@@ -14,8 +14,7 @@ import (
 )
 
 const (
-	maxMembers               = 180
-	maxBytesPerMembers       = 4096
+	maxMembers               = 64
 	maxBytesPerBaggageString = 8192
 
 	listDelimiter     = ","
@@ -29,7 +28,6 @@ var (
 	errInvalidProperty = errors.New("invalid baggage list-member property")
 	errInvalidMember   = errors.New("invalid baggage list-member")
 	errMemberNumber    = errors.New("too many list-members in baggage-string")
-	errMemberBytes     = errors.New("list-member too large")
 	errBaggageBytes    = errors.New("baggage-string too large")
 )
 
@@ -309,10 +307,6 @@ func newInvalidMember() Member {
 // an error if the input is invalid according to the W3C Baggage
 // specification.
 func parseMember(member string) (Member, error) {
-	if n := len(member); n > maxBytesPerMembers {
-		return newInvalidMember(), fmt.Errorf("%w: %d", errMemberBytes, n)
-	}
-
 	var props properties
 	keyValue, properties, found := strings.Cut(member, propertyDelimiter)
 	if found {
@@ -430,6 +424,10 @@ type Baggage struct { //nolint:golint
 // New returns a new valid Baggage. It returns an error if it results in a
 // Baggage exceeding limits set in that specification.
 //
+// If the resulting Baggage exceeds the maximum allowed members or bytes,
+// members are dropped until the limits are satisfied and an error is returned
+// along with the partial result.
+//
 // It expects all the provided members to have already been validated.
 func New(members ...Member) (Baggage, error) {
 	if len(members) == 0 {
@@ -441,25 +439,49 @@ func New(members ...Member) (Baggage, error) {
 		if !m.hasData {
 			return Baggage{}, errInvalidMember
 		}
-
 		// OpenTelemetry resolves duplicates by last-one-wins.
 		b[m.key] = baggage.Item{
 			Value:      m.value,
 			Properties: m.properties.asInternal(),
 		}
 	}
 
-	// Check member numbers after deduplication.
+	var truncateErr error
+
+	// Check member count after deduplication.
 	if len(b) > maxMembers {
-		return Baggage{}, errMemberNumber
+		truncateErr = errors.Join(truncateErr, errMemberNumber)
+		for k := range b {
+			if len(b) <= maxMembers {
+				break
+			}
+			delete(b, k)
+		}
 	}
 
-	bag := Baggage{b}
-	if n := len(bag.String()); n > maxBytesPerBaggageString {
-		return Baggage{}, fmt.Errorf("%w: %d", errBaggageBytes, n)
+	// Check byte size and drop members if necessary.
+	totalBytes := 0
+	first := true
+	for k := range b {
+		m := Member{
+			key:        k,
+			value:      b[k].Value,
+			properties: fromInternalProperties(b[k].Properties),
+		}
+		memberSize := len(m.String())
+		if !first {
+			memberSize++ // comma separator
+		}
+		if totalBytes+memberSize > maxBytesPerBaggageString {
+			truncateErr = errors.Join(truncateErr, fmt.Errorf("%w: %d", errBaggageBytes, totalBytes+memberSize))
+			delete(b, k)
+			continue
+		}
+		totalBytes += memberSize
+		first = false
 	}
 
-	return bag, nil
+	return Baggage{b}, truncateErr
 }
 
 // Parse attempts to decode a baggage-string from the passed string. It
@@ -470,36 +492,71 @@ func New(members ...Member) (Baggage, error) {
 // defined (reading left-to-right) will be the only one kept. This diverges
 // from the W3C Baggage specification which allows duplicate list-members, but
 // conforms to the OpenTelemetry Baggage specification.
+//
+// If the baggage-string exceeds the maximum allowed members (64) or bytes
+// (8192), members are dropped until the limits are satisfied and an error is
+// returned along with the partial result.
+//
+// Invalid members are skipped and the error is returned along with the
+// partial result containing the valid members.
 func Parse(bStr string) (Baggage, error) {
 	if bStr == "" {
 		return Baggage{}, nil
 	}
 
-	if n := len(bStr); n > maxBytesPerBaggageString {
-		return Baggage{}, fmt.Errorf("%w: %d", errBaggageBytes, n)
-	}
-
 	b := make(baggage.List)
+	sizes := make(map[string]int) // Track per-key byte sizes
+	var totalBytes int
+	var truncateErr error
 	for memberStr := range strings.SplitSeq(bStr, listDelimiter) {
+		// Check member count limit.
+		if len(b) >= maxMembers {
+			truncateErr = errors.Join(truncateErr, errMemberNumber)
+			break
+		}
+
 		m, err := parseMember(memberStr)
 		if err != nil {
-			return Baggage{}, err
+			truncateErr = errors.Join(truncateErr, err)
+			continue // skip invalid member, keep processing
 		}
+
+		// Check byte size limit.
+		// Account for comma separator between members.
+		memberBytes := len(m.String())
+		_, existingKey := b[m.key]
+		if !existingKey && len(b) > 0 {
+			memberBytes++ // comma separator only for new keys
+		}
+
+		// Calculate new totalBytes if we add/overwrite this key
+		var newTotalBytes int
+		if oldSize, exists := sizes[m.key]; exists {
+			// Overwriting existing key: subtract old size, add new size
+			newTotalBytes = totalBytes - oldSize + memberBytes
+		} else {
+			// New key
+			newTotalBytes = totalBytes + memberBytes
+		}
+
+		if newTotalBytes > maxBytesPerBaggageString {
+			truncateErr = errors.Join(truncateErr, errBaggageBytes)
+			break
+		}
+
 		// OpenTelemetry resolves duplicates by last-one-wins.
 		b[m.key] = baggage.Item{
 			Value:      m.value,
 			Properties: m.properties.asInternal(),
 		}
+		sizes[m.key] = memberBytes
+		totalBytes = newTotalBytes
 	}
 
-	// OpenTelemetry does not allow for duplicate list-members, but the W3C
-	// specification does. Now that we have deduplicated, ensure the baggage
-	// does not exceed list-member limits.
-	if len(b) > maxMembers {
-		return Baggage{}, errMemberNumber
+	if len(b) == 0 {
+		return Baggage{}, truncateErr
 	}
-
-	return Baggage{b}, nil
+	return Baggage{b}, truncateErr
 }
 
 // Member returns the baggage list-member identified by key.

baggage/baggage_test.go

@@ -257,28 +257,34 @@ func key(n int) string {
 }
 
 func TestNewBaggageErrorTooManyBytes(t *testing.T) {
-	m := make([]Member, (maxBytesPerBaggageString/maxBytesPerMembers)+1)
+	// Create members that together exceed maxBytesPerBaggageString.
+	// Each member needs key + "=" so use keys that sum to > 8192 bytes.
+	keySize := maxBytesPerBaggageString / maxMembers
+	m := make([]Member, maxMembers)
 	for i := range m {
-		m[i] = Member{key: key(maxBytesPerMembers), hasData: true}
+		m[i] = Member{key: key(keySize), hasData: true}
 	}
-	_, err := New(m...)
+	b, err := New(m...)
 	assert.ErrorIs(t, err, errBaggageBytes)
+	// Partial result should contain members that fit within the byte limit.
+	assert.Positive(t, b.Len(), "should return partial baggage")
+	assert.LessOrEqual(t, len(b.String()), maxBytesPerBaggageString, "partial baggage should be within byte limit")
 }
 
 func TestNewBaggageErrorTooManyMembers(t *testing.T) {
 	m := make([]Member, maxMembers+1)
 	for i := range m {
 		m[i] = Member{key: fmt.Sprintf("%d", i), hasData: true}
 	}
-	_, err := New(m...)
+	b, err := New(m...)
 	assert.ErrorIs(t, err, errMemberNumber)
+	// Partial result should contain exactly maxMembers.
+	assert.Equal(t, maxMembers, b.Len(), "should return first %d members", maxMembers)
 }
 
 func TestBaggageParse(t *testing.T) {
 	tooLarge := key(maxBytesPerBaggageString + 1)
 
-	tooLargeMember := key(maxBytesPerMembers + 1)
-
 	m := make([]string, maxMembers+1)
 	for i := range m {
 		m[i] = fmt.Sprintf("a%d=", i)
@@ -468,7 +474,11 @@ func TestBaggageParse(t *testing.T) {
 		{
 			name: "invalid member: empty",
 			in:   "foo=,,bar=",
-			err:  errInvalidMember,
+			want: baggage.List{
+				"foo": {},
+				"bar": {},
+			},
+			err: errInvalidMember,
 		},
 		{
 			name: "invalid member: no key",
@@ -518,17 +528,47 @@ func TestBaggageParse(t *testing.T) {
 		{
 			name: "invalid baggage string: too large",
 			in:   tooLarge,
-			err:  errBaggageBytes,
+			// tooLarge is a single key without "=", so parseMember fails
+			err: errInvalidMember,
 		},
 		{
-			name: "invalid baggage string: member too large",
-			in:   tooLargeMember,
-			err:  errMemberBytes,
+			name: "baggage string with too many members keeps first 64",
+			in:   tooManyMembers,
+			want: func() baggage.List {
+				b := make(baggage.List)
+				for i := range maxMembers {
+					b[fmt.Sprintf("a%d", i)] = baggage.Item{Value: ""}
+				}
+				return b
+			}(),
+			err: errMemberNumber,
 		},
 		{
-			name: "invalid baggage string: too many members",
-			in:   tooManyMembers,
-			err:  errMemberNumber,
+			name: "baggage string exceeds byte limit returns partial result",
+			in: func() string {
+				// Create members that collectively exceed maxBytesPerBaggageString.
+				// Each member: "kN=" + value. We use values large enough that
+				// a few members fit but the total exceeds 8192 bytes.
+				var parts []string
+				val := strings.Repeat("v", 2000)
+				for i := range 10 {
+					parts = append(parts, fmt.Sprintf("k%d=%s", i, val))
+				}
+				return strings.Join(parts, ",")
+			}(),
+			want: func() baggage.List {
+				// Only members that fit within 8192 bytes should be kept.
+				// Each member is ~2003 bytes ("kN=" + 2000 "v"s), plus comma.
+				// 4 members = 4*2003 + 3 commas = 8015 bytes (fits).
+				// 5 members = 5*2003 + 4 commas = 10019 bytes (exceeds).
+				b := make(baggage.List)
+				val := strings.Repeat("v", 2000)
+				for i := range 4 {
+					b[fmt.Sprintf("k%d", i)] = baggage.Item{Value: val}
+				}
+				return b
+			}(),
+			err: errBaggageBytes,
 		},
 		{
 			name: "percent-encoded octet sequences do not match the UTF-8 encoding scheme",

internal/errorhandler/errorhandler.go

@@ -0,0 +1,96 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+// Package errorhandler provides the global error handler for OpenTelemetry.
+//
+// This package has no OTel dependencies, allowing it to be imported by any
+// package in the module without creating import cycles.
+package errorhandler // import "go.opentelemetry.io/otel/internal/errorhandler"
+
+import (
+	"errors"
+	"log"
+	"sync"
+	"sync/atomic"
+)
+
+// ErrorHandler handles irremediable events.
+type ErrorHandler interface {
+	// Handle handles any error deemed irremediable by an OpenTelemetry
+	// component.
+	Handle(error)
+}
+
+type ErrDelegator struct {
+	delegate atomic.Pointer[ErrorHandler]
+}
+
+// Compile-time check that delegator implements ErrorHandler.
+var _ ErrorHandler = (*ErrDelegator)(nil)
+
+func (d *ErrDelegator) Handle(err error) {
+	if eh := d.delegate.Load(); eh != nil {
+		(*eh).Handle(err)
+		return
+	}
+	log.Print(err)
+}
+
+// setDelegate sets the ErrorHandler delegate.
+func (d *ErrDelegator) setDelegate(eh ErrorHandler) {
+	d.delegate.Store(&eh)
+}
+
+type errorHandlerHolder struct {
+	eh ErrorHandler
+}
+
+var (
+	globalErrorHandler       = defaultErrorHandler()
+	delegateErrorHandlerOnce sync.Once
+)
+
+// GetErrorHandler returns the global ErrorHandler instance.
+//
+// The default ErrorHandler instance returned will log all errors to STDERR
+// until an override ErrorHandler is set with SetErrorHandler. All
+// ErrorHandler returned prior to this will automatically forward errors to
+// the set instance instead of logging.
+//
+// Subsequent calls to SetErrorHandler after the first will not forward errors
+// to the new ErrorHandler for prior returned instances.
+func GetErrorHandler() ErrorHandler {
+	return globalErrorHandler.Load().(errorHandlerHolder).eh
+}
+
+// SetErrorHandler sets the global ErrorHandler to h.
+//
+// The first time this is called all ErrorHandler previously returned from
+// GetErrorHandler will send errors to h instead of the default logging
+// ErrorHandler. Subsequent calls will set the global ErrorHandler, but not
+// delegate errors to h.
+func SetErrorHandler(h ErrorHandler) {
+	current := GetErrorHandler()
+
+	if _, cOk := current.(*ErrDelegator); cOk {
+		if _, ehOk := h.(*ErrDelegator); ehOk && current == h {
+			// Do not assign to the delegate of the default ErrDelegator to be
+			// itself.
+			log.Print(errors.New("no ErrorHandler delegate configured"), " ErrorHandler remains its current value.")
+			return
+		}
+	}
+
+	delegateErrorHandlerOnce.Do(func() {
+		if def, ok := current.(*ErrDelegator); ok {
+			def.setDelegate(h)
+		}
+	})
+	globalErrorHandler.Store(errorHandlerHolder{eh: h})
+}
+
+func defaultErrorHandler() *atomic.Value {
+	v := &atomic.Value{}
+	v.Store(errorHandlerHolder{eh: &ErrDelegator{}})
+	return v
+}