OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http

Summary @opentelemetry/instrumentation-http redacts sensitive URL query parameters on outgoing client spans but not on incoming server spans. The server-span path writes the raw query string verbatim into the url.query attribute, so credentials embedded in inbound request URLs — AWS presigned-URL...