安全: 修复凭据、遥测与账号数据清理风险

internal/tracing/flamego.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/flamego/flamego"
 
+	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/propagation"
 	semconv "go.opentelemetry.io/otel/semconv/v1.12.0"
 	oteltrace "go.opentelemetry.io/otel/trace"
@@ -31,16 +32,39 @@ func Middleware(service string, opts ...Option) flamego.Handler {
 			c.Request().Request = c.Request().Request.WithContext(savedCtx)
 		}()
 
+		request := c.Request().Request
 		ctx := cfg.Propagators.Extract(savedCtx, propagation.HeaderCarrier(c.Request().Header))
+		method := request.Method
+		if method == "" {
+			method = http.MethodGet
+		}
+		httpAttrs := []attribute.KeyValue{
+			semconv.HTTPMethodKey.String(method),
+			semconv.HTTPTargetKey.String(request.URL.Path),
+		}
+		if service != "" {
+			httpAttrs = append(httpAttrs, semconv.HTTPServerNameKey.String(service))
+		}
+		if request.TLS != nil {
+			httpAttrs = append(httpAttrs, semconv.HTTPSchemeHTTPS)
+		} else {
+			httpAttrs = append(httpAttrs, semconv.HTTPSchemeHTTP)
+		}
+		switch request.ProtoMajor {
+		case 1:
+			httpAttrs = append(httpAttrs, semconv.HTTPFlavorKey.String(fmt.Sprintf("1.%d", request.ProtoMinor)))
+		case 2:
+			httpAttrs = append(httpAttrs, semconv.HTTPFlavorHTTP20)
+		}
 		opts := []oteltrace.SpanStartOption{
-			oteltrace.WithAttributes(semconv.NetAttributesFromHTTPRequest("tcp", c.Request().Request)...),
-			oteltrace.WithAttributes(semconv.EndUserAttributesFromHTTPRequest(c.Request().Request)...),
-			oteltrace.WithAttributes(semconv.HTTPServerAttributesFromHTTPRequest(service, "", c.Request().Request)...),
+			oteltrace.WithAttributes(semconv.NetAttributesFromHTTPRequest("tcp", request)...),
+			oteltrace.WithAttributes(semconv.EndUserAttributesFromHTTPRequest(request)...),
+			oteltrace.WithAttributes(httpAttrs...),
 			oteltrace.WithSpanKind(oteltrace.SpanKindServer),
 		}
 		// span 名只取 URL.Path，不含 query string：
 		// RequestURI 会把 ?t=<问题token>、找回密码 ?code= 等私密参数原样写入 trace。
-		spanName := c.Request().URL.Path
+		spanName := request.URL.Path
 		if spanName == "" {
 			spanName = fmt.Sprintf("HTTP %s route not found", c.Request().Method)
 		}