From a66938308f42284e40f537b98d3d4e0a1f2adac3 Mon Sep 17 00:00:00 2001 From: itsmehotpants Date: Sat, 25 Jul 2026 07:57:46 +0000 Subject: [PATCH 1/2] Fix BaggageBuilder.put() silently accepting empty string keys MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Per the W3C Baggage spec (ยง3 definition), a baggage-name must be a non-empty token. An empty string key is therefore invalid and should be ignored, not stored and later propagated downstream. The W3CBaggagePropagator.isValidBaggageKey() already correctly rejects empty keys when *parsing* incoming headers. This change closes the same gap on the *programmatic* builder path so that calling Baggage.builder().put("", value).build() is a no-op, consistent with how null keys are handled today. - ImmutableBaggage.Builder.put(): add key.isEmpty() guard - BaggageBuilder.java: document the empty-key contract in Javadoc - ImmutableBaggageTest: correct put_keyEmpty to assert the right behaviour; add put_keyEmpty_withMetadata variant Fixes #8657 --- .../io/opentelemetry/api/baggage/BaggageBuilder.java | 4 ++++ .../opentelemetry/api/baggage/ImmutableBaggage.java | 2 +- .../api/baggage/ImmutableBaggageTest.java | 11 ++++++++++- 3 files changed, 15 insertions(+), 2 deletions(-) diff --git a/api/all/src/main/java/io/opentelemetry/api/baggage/BaggageBuilder.java b/api/all/src/main/java/io/opentelemetry/api/baggage/BaggageBuilder.java index 5cf6c7891b3..612541dea4c 100644 --- a/api/all/src/main/java/io/opentelemetry/api/baggage/BaggageBuilder.java +++ b/api/all/src/main/java/io/opentelemetry/api/baggage/BaggageBuilder.java @@ -15,6 +15,10 @@ public interface BaggageBuilder { /** * Adds the key/value pair and metadata regardless of whether the key is present. * + *

Per the W3C Baggage spec, a + * baggage-name must be a non-empty token. Calls with a {@code null} or empty {@code key}, a + * {@code null} {@code value}, or a {@code null} {@code entryMetadata} are silently ignored. + * * @param key the {@code String} key which will be set. * @param value the {@code String} value to set for the given key. * @param entryMetadata the {@code BaggageEntryMetadata} metadata to set for the given key. diff --git a/api/all/src/main/java/io/opentelemetry/api/baggage/ImmutableBaggage.java b/api/all/src/main/java/io/opentelemetry/api/baggage/ImmutableBaggage.java index d628e89b282..dcefe2a310c 100644 --- a/api/all/src/main/java/io/opentelemetry/api/baggage/ImmutableBaggage.java +++ b/api/all/src/main/java/io/opentelemetry/api/baggage/ImmutableBaggage.java @@ -69,7 +69,7 @@ static class Builder implements BaggageBuilder { @Override public BaggageBuilder put(String key, String value, BaggageEntryMetadata entryMetadata) { - if ((key == null) || (value == null) || (entryMetadata == null)) { + if ((key == null) || key.isEmpty() || (value == null) || (entryMetadata == null)) { return this; } data.add(key); diff --git a/api/all/src/test/java/io/opentelemetry/api/baggage/ImmutableBaggageTest.java b/api/all/src/test/java/io/opentelemetry/api/baggage/ImmutableBaggageTest.java index a10d2ca1902..041744f9850 100644 --- a/api/all/src/test/java/io/opentelemetry/api/baggage/ImmutableBaggageTest.java +++ b/api/all/src/test/java/io/opentelemetry/api/baggage/ImmutableBaggageTest.java @@ -114,8 +114,17 @@ void put_keyUnprintableChars() { @Test void put_keyEmpty() { BaggageBuilder builder = ONE_ENTRY.toBuilder(); + Baggage built = builder.build(); builder.put("", "value"); - assertThat(builder.build().getEntryValue("")).isEqualTo("value"); + assertThat(builder.build()).isEqualTo(built); + } + + @Test + void put_keyEmpty_withMetadata() { + BaggageBuilder builder = ONE_ENTRY.toBuilder(); + Baggage built = builder.build(); + builder.put("", "value", TMD); + assertThat(builder.build()).isEqualTo(built); } @Test From 0b9a55683a01a94ee6d83478dc7bf24391fda0f9 Mon Sep 17 00:00:00 2001 From: itsmehotpants Date: Sun, 26 Jul 2026 12:24:02 +0000 Subject: [PATCH 2/2] trigger CLA recheck