Add max baggage length as limitation

CHANGELOG.md

@@ -79,6 +79,7 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 - Fix race condition in `FixedSizeReservoir` in `go.opentelemetry.io/otel/sdk/metric/exemplar` by reverting #7447. (#8249)
 - Fix counting of spans and logs in self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`, `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`, `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`, and `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. (#8254)
 - Drop conflicting scope attributes named `name`, `version`, or `schema_url` from metric labels in `go.opentelemetry.io/otel/exporters/prometheus`, preserving the dedicated `otel_scope_name`, `otel_scope_version`, and `otel_scope_schema_url` labels. (#8264)
+- Enforce the 8192-byte baggage size limit during extraction/parsing, changing behavior when the limit is exceeded in `go.opentelemetry.io/otel/baggage` and `go.opentelemetry.io/otel/propagation`. (#8222)
 
 <!-- Released section -->
 <!-- Don't change this section unless doing release -->

baggage/baggage.go

@@ -14,6 +14,10 @@ import (
 )
 
 const (
+	maxParseErrors = 5
+
+	// W3C Baggage specification limits.
+	// https://www.w3.org/TR/baggage/#limits
 	maxMembers               = 64
 	maxBytesPerBaggageString = 8192
 
@@ -493,9 +497,15 @@ func New(members ...Member) (Baggage, error) {
 // from the W3C Baggage specification which allows duplicate list-members, but
 // conforms to the OpenTelemetry Baggage specification.
 //
-// If the baggage-string exceeds the maximum allowed members (64) or bytes
-// (8192), members are dropped until the limits are satisfied and an error is
-// returned along with the partial result.
+// If the raw baggage-string exceeds the maximum allowed bytes (8192), an
+// empty Baggage and an error are returned.
+//
+// Otherwise, members are parsed left-to-right and accumulated until one of
+// the following conditions is reached, at which point parsing stops and an
+// error is returned alongside the partial result:
+//   - accepting the next member would cause the encoded baggage to exceed
+//     8192 bytes, or
+//   - the baggage already contains 64 distinct keys.
 //
 // Invalid members are skipped and the error is returned along with the
 // partial result containing the valid members.
@@ -504,9 +514,14 @@ func Parse(bStr string) (Baggage, error) {
 		return Baggage{}, nil
 	}
 
+	if n := len(bStr); n > maxBytesPerBaggageString {
+		return Baggage{}, fmt.Errorf("%w: %d", errBaggageBytes, n)
+	}
+
 	b := make(baggage.List)
 	sizes := make(map[string]int) // Track per-key byte sizes
 	var totalBytes int
+	var parseErrors int
 	var truncateErr error
 	for memberStr := range strings.SplitSeq(bStr, listDelimiter) {
 		// Check member count limit.
@@ -517,7 +532,10 @@ func Parse(bStr string) (Baggage, error) {
 
 		m, err := parseMember(memberStr)
 		if err != nil {
-			truncateErr = errors.Join(truncateErr, err)
+			parseErrors++
+			if parseErrors <= maxParseErrors {
+				truncateErr = errors.Join(truncateErr, err)
+			}
 			continue // skip invalid member, keep processing
 		}
 
@@ -553,6 +571,10 @@ func Parse(bStr string) (Baggage, error) {
 		totalBytes = newTotalBytes
 	}
 
+	if dropped := parseErrors - maxParseErrors; dropped > 0 {
+		truncateErr = errors.Join(truncateErr, fmt.Errorf("and %d more invalid member(s)", dropped))
+	}
+
 	if len(b) == 0 {
 		return Baggage{}, truncateErr
 	}

baggage/baggage_test.go

@@ -528,8 +528,7 @@ func TestBaggageParse(t *testing.T) {
 		{
 			name: "invalid baggage string: too large",
 			in:   tooLarge,
-			// tooLarge is a single key without "=", so parseMember fails
-			err: errInvalidMember,
+			err:  errBaggageBytes,
 		},
 		{
 			name: "baggage string with too many members keeps first 64",
@@ -544,31 +543,26 @@ func TestBaggageParse(t *testing.T) {
 			err: errMemberNumber,
 		},
 		{
-			name: "baggage string exceeds byte limit returns partial result",
+			name: "baggage string at max size is accepted",
 			in: func() string {
-				// Create members that collectively exceed maxBytesPerBaggageString.
-				// Each member: "kN=" + value. We use values large enough that
-				// a few members fit but the total exceeds 8192 bytes.
+				// Create a baggage string of exactly maxBytesPerBaggageString.
+				// 3 members: "k0=" + 2727v + "," + "k1=" + 2727v + "," + "k2=" + 2727v
+				// = 3*(3+2727) + 2 = 8192
+				val := strings.Repeat("v", 2727)
 				var parts []string
-				val := strings.Repeat("v", 2000)
-				for i := range 10 {
+				for i := range 3 {
 					parts = append(parts, fmt.Sprintf("k%d=%s", i, val))
 				}
 				return strings.Join(parts, ",")
 			}(),
 			want: func() baggage.List {
-				// Only members that fit within 8192 bytes should be kept.
-				// Each member is ~2003 bytes ("kN=" + 2000 "v"s), plus comma.
-				// 4 members = 4*2003 + 3 commas = 8015 bytes (fits).
-				// 5 members = 5*2003 + 4 commas = 10019 bytes (exceeds).
 				b := make(baggage.List)
-				val := strings.Repeat("v", 2000)
-				for i := range 4 {
+				val := strings.Repeat("v", 2727)
+				for i := range 3 {
 					b[fmt.Sprintf("k%d", i)] = baggage.Item{Value: val}
 				}
 				return b
 			}(),
-			err: errBaggageBytes,
 		},
 		{
 			name: "percent-encoded octet sequences do not match the UTF-8 encoding scheme",
@@ -1272,3 +1266,57 @@ func BenchmarkMemberString(b *testing.B) {
 		_ = member.String()
 	}
 }
+
+func BenchmarkParseOversized(b *testing.B) {
+	// 1MB oversized baggage string.
+	oversized := strings.Repeat("k=v,", 250000)
+
+	b.ReportAllocs()
+
+	for b.Loop() {
+		_, _ = Parse(oversized)
+	}
+}
+
+func TestParseErrorCap(t *testing.T) {
+	// Build a baggage string with many invalid members (no '=' delimiter).
+	// All within the 8192 byte limit.
+	var parts []string
+	for i := range 20 {
+		parts = append(parts, fmt.Sprintf("bad%d", i))
+	}
+	// Add one valid member so the baggage is not empty.
+	parts = append(parts, "good=val")
+	bStr := strings.Join(parts, ",")
+
+	b, err := Parse(bStr)
+	assert.ErrorIs(t, err, errInvalidMember)
+	assert.Equal(t, 1, b.Len(), "should return the valid member")
+
+	// Count the number of joined errors.
+	errs := err.Error()
+	invalidCount := strings.Count(errs, "invalid baggage list-member")
+	assert.Equal(t, maxParseErrors, invalidCount,
+		"should cap individual parse errors at maxParseErrors")
+	assert.Contains(t, errs, "and 15 more invalid member(s)")
+}
+
+func TestParseErrorCapAllInvalid(t *testing.T) {
+	// All members invalid, no valid members. Exercises the len(b)==0
+	// return path with a capped error message.
+	var parts []string
+	for i := range 20 {
+		parts = append(parts, fmt.Sprintf("bad%d", i))
+	}
+	bStr := strings.Join(parts, ",")
+
+	b, err := Parse(bStr)
+	assert.ErrorIs(t, err, errInvalidMember)
+	assert.Equal(t, 0, b.Len(), "should return empty baggage")
+
+	errs := err.Error()
+	invalidCount := strings.Count(errs, "invalid baggage list-member")
+	assert.Equal(t, maxParseErrors, invalidCount,
+		"should cap individual parse errors at maxParseErrors")
+	assert.Contains(t, errs, "and 15 more invalid member(s)")
+}

propagation/baggage.go

@@ -5,6 +5,8 @@ package propagation // import "go.opentelemetry.io/otel/propagation"
 
 import (
 	"context"
+	"errors"
+	"fmt"
 
 	"go.opentelemetry.io/otel/baggage"
 	"go.opentelemetry.io/otel/internal/errorhandler"
@@ -13,9 +15,12 @@ import (
 const (
 	baggageHeader = "baggage"
 
+	maxParseErrors = 5
+
 	// W3C Baggage specification limits.
 	// https://www.w3.org/TR/baggage/#limits
-	maxMembers = 64
+	maxMembers               = 64
+	maxBytesPerBaggageString = 8192
 )
 
 // Baggage is a propagator that supports the W3C Baggage format.
@@ -72,10 +77,35 @@ func extractMultiBaggage(parent context.Context, carrier ValuesGetter) context.C
 	}
 
 	var members []baggage.Member
-	for _, bStr := range bVals {
+	var totalBytes int
+	var parseErrors int
+	var truncateErr error
+	for i, bStr := range bVals {
+		if i > 0 {
+			totalBytes++ // comma separator between combined header values
+		}
+		totalBytes += len(bStr)
+		if totalBytes > maxBytesPerBaggageString {
+			parseErrors++
+			if parseErrors <= maxParseErrors {
+				truncateErr = errors.Join(
+					truncateErr,
+					fmt.Errorf(
+						"baggage: aggregate header size %d exceeds %d byte limit",
+						totalBytes,
+						maxBytesPerBaggageString,
+					),
+				)
+			}
+			break
+		}
+
 		currBag, err := baggage.Parse(bStr)
 		if err != nil {
-			errorhandler.GetErrorHandler().Handle(err)
+			parseErrors++
+			if parseErrors <= maxParseErrors {
+				truncateErr = errors.Join(truncateErr, err)
+			}
 		}
 		if currBag.Len() == 0 {
 			continue
@@ -86,10 +116,18 @@ func extractMultiBaggage(parent context.Context, carrier ValuesGetter) context.C
 		}
 	}
 
+	if dropped := parseErrors - maxParseErrors; dropped > 0 {
+		truncateErr = errors.Join(truncateErr, fmt.Errorf("and %d more error(s)", dropped))
+	}
+
 	b, err := baggage.New(members...)
 	if err != nil {
-		errorhandler.GetErrorHandler().Handle(err)
+		truncateErr = errors.Join(truncateErr, err)
 	}
+	if truncateErr != nil {
+		errorhandler.GetErrorHandler().Handle(truncateErr)
+	}
+
 	if b.Len() == 0 {
 		return parent
 	}