Redact OTLP header and Datadog key configs in telemetry

buildSrc/src/main/kotlin/datadog/gradle/plugin/config/ParseV2SupportedConfigurationsTask.kt

@@ -59,7 +59,8 @@ abstract class ParseV2SupportedConfigurationsTask  @Inject constructor(
           configMap["type"] as? String,
           configMap["default"] as? String,
           (configMap["aliases"] as? List<String>) ?: emptyList(),
-          (configMap["propertyKeys"] as? List<String>) ?: emptyList()
+          (configMap["propertyKeys"] as? List<String>) ?: emptyList(),
+          configMap["sensitive"] as? Boolean ?: false
         )
       }
     }
@@ -81,6 +82,10 @@ abstract class ParseV2SupportedConfigurationsTask  @Inject constructor(
       }
     }.toMap()
 
+    val sensitiveKeys: Set<String> = supported.flatMap { (canonical, configList) ->
+      configList.filter { it.sensitive }.flatMap { listOf(canonical) + it.aliases }
+    }.toSet()
+
     // Build the output .java path from the fully-qualified class name
     val pkgName = finalClassName.substringBeforeLast('.', "")
     val pkgPath = pkgName.replace('.', File.separatorChar)
@@ -97,7 +102,8 @@ abstract class ParseV2SupportedConfigurationsTask  @Inject constructor(
       aliases,
       aliasMapping,
       deprecated,
-      reversePropertyKeysMap
+      reversePropertyKeysMap,
+      sensitiveKeys
     )
   }
 
@@ -109,7 +115,8 @@ abstract class ParseV2SupportedConfigurationsTask  @Inject constructor(
     aliases: Map<String, List<String>>,
     aliasMapping: Map<String, String>,
     deprecated: Map<String, String>,
-    reversePropertyKeysMap: Map<String, String>
+    reversePropertyKeysMap: Map<String, String>,
+    sensitiveKeys: Set<String>
   ) {
     val outFile = File(outputPath)
     outFile.parentFile?.mkdirs()
@@ -118,13 +125,16 @@ abstract class ParseV2SupportedConfigurationsTask  @Inject constructor(
       out.println("package $packageName;")
       out.println()
       out.println("import java.util.HashMap;")
+      out.println("import java.util.HashSet;")
       out.println("import java.util.List;")
       out.println("import java.util.Map;")
+      out.println("import java.util.Set;")
       out.println("import static java.util.Arrays.asList;")
       out.println("import static java.util.Collections.emptyList;")
       out.println("import static java.util.Collections.singletonList;")
       out.println("import static java.util.Collections.unmodifiableList;")
       out.println("import static java.util.Collections.unmodifiableMap;")
+      out.println("import static java.util.Collections.unmodifiableSet;")
       out.println()
       out.println("public final class $className {")
       out.println()
@@ -138,12 +148,15 @@ abstract class ParseV2SupportedConfigurationsTask  @Inject constructor(
       out.println()
       out.println("  public static final Map<String, String> REVERSE_PROPERTY_KEYS_MAP;")
       out.println()
+      out.println("  public static final Set<String> SENSITIVE_KEYS;")
+      out.println()
       out.println("  static {")
       out.println("    SUPPORTED = initSupported();")
       out.println("    ALIASES = initAliases();")
       out.println("    ALIAS_MAPPING = initAliasMapping();")
       out.println("    DEPRECATED = initDeprecated();")
       out.println("    REVERSE_PROPERTY_KEYS_MAP = initReversePropertyKeysMap();")
+      out.println("    SENSITIVE_KEYS = initSensitiveKeys();")
       out.println("  }")
       out.println()
 
@@ -218,6 +231,16 @@ abstract class ParseV2SupportedConfigurationsTask  @Inject constructor(
       }
       out.println("    return unmodifiableMap(reversePropertyKeysMapping);")
       out.println("  }")
+      out.println()
+
+      // initSensitiveKeys()
+      out.println("  private static Set<String> initSensitiveKeys() {")
+      out.println("    Set<String> sensitiveKeys = new HashSet<>();")
+      for (key in sensitiveKeys.toSortedSet()) {
+        out.printf("    sensitiveKeys.add(\"%s\");\n", esc(key))
+      }
+      out.println("    return unmodifiableSet(sensitiveKeys);")
+      out.println("  }")
       out.println("}")
     }
   }
@@ -258,5 +281,6 @@ private data class SupportedConfigurationItem(
   val type: String?,
   val default: String?,
   val aliases: List<String>,
-  val propertyKeys: List<String>
+  val propertyKeys: List<String>,
+  val sensitive: Boolean
 )

buildSrc/src/test/kotlin/datadog/gradle/plugin/config/ParseV2SupportedConfigurationsTest.kt

@@ -4,6 +4,7 @@ import datadog.gradle.plugin.GradleFixture
 import org.gradle.testkit.runner.BuildResult
 import org.gradle.testkit.runner.TaskOutcome
 import org.junit.jupiter.api.Assertions.assertEquals
+import org.junit.jupiter.api.Assertions.assertFalse
 import org.junit.jupiter.api.Assertions.assertTrue
 import org.junit.jupiter.api.Test
 import java.io.File
@@ -26,6 +27,7 @@ class ParseV2SupportedConfigurationsTest : GradleFixture() {
     assertTrue(content.contains("public static final Map<String, String> ALIAS_MAPPING;"))
     assertTrue(content.contains("public static final Map<String, String> DEPRECATED;"))
     assertTrue(content.contains("public static final Map<String, String> REVERSE_PROPERTY_KEYS_MAP;"))
+    assertTrue(content.contains("public static final Set<String> SENSITIVE_KEYS;"))
 
     assertTrue(content.contains("private static Map<String, List<SupportedConfiguration>> initSupported()"))
     assertTrue(content.contains("private static void initSupported1(Map<String, List<SupportedConfiguration>> supportedMap)"))
@@ -34,14 +36,15 @@ class ParseV2SupportedConfigurationsTest : GradleFixture() {
     assertTrue(content.contains("private static Map<String, String> initAliasMapping()"))
     assertTrue(content.contains("private static Map<String, String> initDeprecated()"))
     assertTrue(content.contains("private static Map<String, String> initReversePropertyKeysMap()"))
+    assertTrue(content.contains("private static Set<String> initSensitiveKeys()"))
 
     assertContainsSupportedConfig(
       content,
       key = "DD_ACTION_EXECUTION_ID",
       version = "A",
       type = "string",
       default = "null",
-      aliases = emptyList(),
+      aliases = listOf("DD_LEGACY_ACTION_EXECUTION_ID"),
       propertyKeys = listOf("property.key")
     )
 
@@ -63,7 +66,7 @@ class ParseV2SupportedConfigurationsTest : GradleFixture() {
       aliases = listOf("DD_ALIAS")
     )
 
-    assertTrue(content.contains("""aliasesMap.put("DD_ACTION_EXECUTION_ID", emptyList())"""))
+    assertTrue(content.contains("""aliasesMap.put("DD_ACTION_EXECUTION_ID", singletonList("DD_LEGACY_ACTION_EXECUTION_ID"))"""))
     assertTrue(content.contains("""aliasesMap.put("DD_AGENTLESS_LOG_SUBMISSION_ENABLED", singletonList("DD_ALIAS"))"""))
 
     assertTrue(content.contains("""aliasMappingMap.put("DD_ALIAS", "DD_AGENTLESS_LOG_SUBMISSION_ENABLED")"""))
@@ -72,6 +75,10 @@ class ParseV2SupportedConfigurationsTest : GradleFixture() {
     assertTrue(content.contains("""deprecatedMap.put("legacy.setting", "No longer supported")"""))
 
     assertTrue(content.contains("""reversePropertyKeysMapping.put("property.key", "DD_ACTION_EXECUTION_ID")"""))
+
+    assertTrue(content.contains("""sensitiveKeys.add("DD_ACTION_EXECUTION_ID")"""))
+    assertTrue(content.contains("""sensitiveKeys.add("DD_LEGACY_ACTION_EXECUTION_ID")"""))
+    assertFalse(content.contains("""sensitiveKeys.add("DD_AGENTLESS_LOG_SUBMISSION_ENABLED")"""))
   }
 
   private fun runGradleTask(): Pair<BuildResult, File> {
@@ -85,8 +92,9 @@ class ParseV2SupportedConfigurationsTest : GradleFixture() {
               "version": "A",
               "type": "string",
               "default": null,
-              "aliases": [],
-              "propertyKeys": ["property.key"]
+              "aliases": ["DD_LEGACY_ACTION_EXECUTION_ID"],
+              "propertyKeys": ["property.key"],
+              "sensitive": true
             }
           ],
           "DD_AGENTLESS_LOG_SUBMISSION_ENABLED": [

internal-api/src/test/groovy/datadog/trace/api/ConfigCollectorTest.groovy

@@ -39,7 +39,7 @@ class ConfigCollectorTest extends DDSpecification {
     // ConfigProvider.getStringNotEmpty
     AppSecConfig.APPSEC_AUTOMATED_USER_EVENTS_TRACKING         | UserEventTrackingMode.EXTENDED.toString()
     // ConfigProvider.getStringExcludingSource
-    GeneralConfig.APPLICATION_KEY                              | "app-key"
+    DDTags.SERVICE                                             | "my-service"
     // ConfigProvider.getBoolean
     TraceInstrumentationConfig.RESOLVER_USE_URL_CACHES         | "true"
     // ConfigProvider.getInteger
@@ -184,11 +184,11 @@ class ConfigCollectorTest extends DDSpecification {
     ConfigCollector.get().collect()
 
     when:
-    ConfigCollector.get().put('DD_API_KEY', 'sensitive data', ConfigOrigin.ENV, ABSENT_SEQ_ID)
+    ConfigCollector.get().put('api-key', 'sensitive data', ConfigOrigin.ENV, ABSENT_SEQ_ID)
 
     then:
     def collected = ConfigCollector.get().collect()
-    collected.get(ConfigOrigin.ENV).get('DD_API_KEY').stringValue() == '<hidden>'
+    collected.get(ConfigOrigin.ENV).get('api-key').stringValue() == '<hidden>'
   }
 
   def "collects common setting default values"() {

metadata/supported-configurations.json

@@ -118,7 +118,8 @@
         "version": "A",
         "type": "string",
         "default": null,
-        "aliases": []
+        "aliases": [],
+        "sensitive": true
       }
     ],
     "DD_API_KEY_FILE": [
@@ -206,7 +207,8 @@
         "version": "A",
         "type": "string",
         "default": null,
-        "aliases": ["DD_APP_KEY"]
+        "aliases": ["DD_APP_KEY"],
+        "sensitive": true
       }
     ],
     "DD_APPLICATION_KEY_FILE": [
@@ -1022,7 +1024,8 @@
         "version": "A",
         "type": "string",
         "default": null,
-        "aliases": []
+        "aliases": [],
+        "sensitive": true
       }
     ],
     "DD_CRASHTRACKING_PROXY_PORT": [
@@ -2398,7 +2401,8 @@
         "version": "A",
         "type": "map",
         "default": null,
-        "aliases": []
+        "aliases": [],
+        "sensitive": true
       }
     ],
     "DD_OTLP_LOGS_PROTOCOL": [
@@ -2534,7 +2538,8 @@
         "version": "B",
         "type": "map",
         "default": null,
-        "aliases": []
+        "aliases": [],
+        "sensitive": true
       }
     ],
     "DD_OTLP_METRICS_PROTOCOL": [
@@ -2582,7 +2587,8 @@
         "version": "B",
         "type": "map",
         "default": null,
-        "aliases": []
+        "aliases": [],
+        "sensitive": true
       }
     ],
     "DD_OTLP_TRACES_PROTOCOL": [
@@ -3342,7 +3348,8 @@
         "version": "A",
         "type": "string",
         "default": null,
-        "aliases": []
+        "aliases": [],
+        "sensitive": true
       }
     ],
     "DD_PROFILING_PROXY_PORT": [
@@ -3726,7 +3733,8 @@
         "version": "A",
         "type": "string",
         "default": null,
-        "aliases": []
+        "aliases": [],
+        "sensitive": true
       }
     ],
     "DD_RUM_DEFAULT_PRIVACY_LEVEL": [
@@ -4126,7 +4134,8 @@
         "version": "A",
         "type": "string",
         "default": null,
-        "aliases": []
+        "aliases": [],
+        "sensitive": true
       }
     ],
     "DD_TEST_FAILED_TEST_REPLAY_ENABLED": [
@@ -11870,7 +11879,8 @@
         "version": "B",
         "type": "map",
         "default": null,
-        "aliases": []
+        "aliases": [],
+        "sensitive": true
       }
     ],
     "OTEL_EXPORTER_OTLP_PROTOCOL": [
@@ -11910,7 +11920,8 @@
         "version": "A",
         "type": "string",
         "default": null,
-        "aliases": []
+        "aliases": [],
+        "sensitive": true
       }
     ],
     "OTEL_EXPORTER_OTLP_LOGS_PROTOCOL": [
@@ -11950,7 +11961,8 @@
         "version": "B",
         "type": "string",
         "default": null,
-        "aliases": []
+        "aliases": [],
+        "sensitive": true
       }
     ],
     "OTEL_EXPORTER_OTLP_METRICS_PROTOCOL": [
@@ -12006,7 +12018,8 @@
         "version": "A",
         "type": "string",
         "default": null,
-        "aliases": []
+        "aliases": [],
+        "sensitive": true
       }
     ],
     "OTEL_EXPORTER_OTLP_TRACES_PROTOCOL": [

utils/config-utils/src/main/java/datadog/trace/api/ConfigSetting.java

@@ -1,14 +1,11 @@
 package datadog.trace.api;
 
-import static datadog.trace.util.ConfigStrings.propertyNameToEnvironmentVariableName;
-import static datadog.trace.util.ConfigStrings.toEnvVar;
+import static datadog.trace.util.ConfigStrings.toCanonicalEnvVar;
 
-import java.util.Arrays;
+import datadog.trace.config.inversion.GeneratedSupportedConfigurations;
 import java.util.BitSet;
-import java.util.HashSet;
 import java.util.Map;
 import java.util.Objects;
-import java.util.Set;
 
 public final class ConfigSetting {
   public static final int DEFAULT_SEQ_ID = 1;
@@ -23,16 +20,6 @@ public final class ConfigSetting {
   /** The config ID associated with this setting, or {@code null} if not applicable. */
   public final String configId;
 
-  private static final Set<String> CONFIG_FILTER_LIST =
-      new HashSet<>(
-          Arrays.asList(
-              "DD_API_KEY",
-              "dd.api-key",
-              "dd.profiling.api-key",
-              "dd.profiling.apikey",
-              "test.agent.session.token",
-              "DD_TEST_AGENT_SESSION_TOKEN"));
-
   public static ConfigSetting of(String key, Object value, ConfigOrigin origin) {
     return new ConfigSetting(key, value, origin, ABSENT_SEQ_ID, null);
   }
@@ -51,20 +38,21 @@ public static ConfigSetting of(
     return new ConfigSetting(key, value, origin, seqId, configId);
   }
 
+  // Redact values of configs flagged "sensitive": true in metadata/supported-configurations.json.
   private ConfigSetting(String key, Object value, ConfigOrigin origin, int seqId, String configId) {
     this.key = key;
-    this.value = CONFIG_FILTER_LIST.contains(key) ? "<hidden>" : value;
+    this.value =
+        (value != null
+                && GeneratedSupportedConfigurations.SENSITIVE_KEYS.contains(toCanonicalEnvVar(key)))
+            ? "<hidden>"
+            : value;
     this.origin = origin;
     this.seqId = seqId;
     this.configId = configId;
   }
 
   public String normalizedKey() {
-    // OTel configurations should not be normalized with DD_
-    if (key.startsWith("otel.") || key.startsWith("OTEL_")) {
-      return toEnvVar(key);
-    }
-    return propertyNameToEnvironmentVariableName(key);
+    return toCanonicalEnvVar(key);
   }
 
   public String stringValue() {