fix(tracing): redact tracer config in logs

[aryanmehrotra]

Description:

The v1.61.0 release PR (#4246) fails its CodeQL check with 6 high-severity go/clear-text-logging alerts (#179–#184), all in pkg/gofr/otel.go. This PR clears them. The CodeQL workflow that scans PRs from forks is split out into #4248, because it needs a repo settings change before it can merge.

Tracer config in logs

CodeQL traces the taint back to dbresolver's Get("DB_PASSWORD"). That value comes back through the shared config.Config interface, so CodeQL treats every Config.Get result as a password. Most alerts of this kind in the repo have been dismissed as false positives, and 3 of these 6 are the same log lines as alerts #114–#116, which were dismissed before #4205 moved them.

One of the risks is real, though. Before #4205, TRACER_URL could only be host:port. Now https://user:token@collector:4317 is valid, and https://zipkin/api/v2/spans?api-key=… always was. Every tracer startup log printed the URL as-is.

Log line	Before	After
Exporting traces to <exporter> at <url> (otlp/jaeger)	raw URL + raw TRACE_EXPORTER	redactURL(url) + the matched constant (otlp / jaeger)
Exporting traces to zipkin at <url>	raw URL	redactURL(url)
Exporting traces to GoFr at <url>	raw URL	redactURL(url)
TRACER_INSECURE is ignored for TRACER_URL=…	raw URL	redactURL(url)
traces are exported to … over plaintext with headers	raw URL	redactURL(url)
invalid TRACER_INSECURE …	echoed the value	names the key and the accepted values
unsupported TRACE_EXPORTER …	echoed the value	lists otlp, jaeger, zipkin or gofr

redactURL swaps userinfo and the query string for REDACTED instead of dropping them, so the log still shows that something was set there. It also drops the fragment. For a schemeless user:pass@host:port, it replaces everything before the last @. The value passed to the exporter itself is unchanged.

What changes for users: the two error messages no longer echo the bad value. The redacted URLs show REDACTED where credentials were. Nothing changes for an endpoint without credentials, which is what every existing test uses.

Breaking Changes (if applicable):

None to the API. Two log messages no longer include the configured value (see table).

Additional Information:

• Test_redactURL: 10 cases (userinfo, token-only userinfo, query, fragment, schemeless userinfo, unparsable input, and cases that stay unchanged).
• Test_initTracer_doesNotLogCredentials runs the real initTracer path for otlp, jaeger (with an ignored TRACER_INSECURE), an invalid TRACER_INSECURE, zipkin and gofr. It asserts the redacted line is in stdout/stderr and the secret is not.
• Mutation-checked: removing redaction from the zipkin log, from the otlp log, from the query branch, or from the schemeless branch fails 4–5 tests each time.
• go test ./pkg/gofr/: pass. golangci-lint --new-from-rev=origin/development: 0 issues. actionlint and typos: clean.
• Not in scope: alerts Update Lintes, Workflow Readme and Tests #172/resolve linters #173 (go/path-injection, datasource/file/local_fs.go) are already open on main and predate this release.
• After merge, this commit needs to reach release/v1.61.0 (cherry-pick, or re-cut the branch) for Release/v1.61.0 #4246's check to go green.

Checklist:

• I have formatted my code using goimport and golangci-lint.
• All new code is covered by unit tests.
• This PR does not decrease the overall code coverage.
• I have reviewed the code comments and documentation for clarity.

[Umang01-hash]

Verified independently at ddb19c1 — fuzzed redactURL and ran a live server, not just read the diff.

• All 5 URL log sites route through redactURL; the two value-echo lines now log static text. No breaking API change; gofmt/build/vet clean, golangci-lint --new-from-rev 0 issues.
• Live E2E: TRACER_URL=https://user:token@localhost:4317 logs https://REDACTED@localhost:4317 (secret absent). Mutation on the zipkin line fails Test_initTracer.../zipkin_query_key — tests are non-vacuous.

One LOW, non-blocking (inline). Also worth confirming in CI: otel.go:66 (unchanged) still echoes the raw TRACER_RATIO via the strconv error — not a credential, but check it isn't one of the 6 CodeQL alerts, else one survives.

Merge-ordering: this is on pre-#4206 otel.go; if the registry refactor lands first, redactURL + the log sites move into traces/exporters and this needs a rebase.

LGTM.

[aryanmehrotra]

Thanks for checking it live. Replies to the two non-inline points:

TRACER_RATIO (otel.go:66): not one of the 6 alerts. From the CodeQL SARIF for development, the go/clear-text-logging results in otel.go are at lines 174, 207, 269, 290, 293 (×2), plus 319 and 334, which were already dismissed. None is at 66. This PR's CodeQL check passes, and none of #179–#184 has an instance on the PR merge ref. The ratio is a float, so I left that line alone.

Merge order with #4206: agreed. #4206 is still open against development. Whichever lands second rebases: if #4206 goes first, redactURL, redactUnparsedURL and the 5 log sites move into traces/exporters with their tests. This one is also needed on release/v1.61.0 to unblock #4246, so merging it first keeps the release path simpler.

[Umang01-hash]

Verified locally: redaction wraps only log args (connection endpoint untouched), all endpoint-log sites route through redactURL, auth headers never logged, no exported-API change. Ran an adversarial bypass sweep (userinfo/query/encoded/IPv6/scheme-relative/uppercase/opaque) — no credential leak. Live E2E with a credential-bearing TRACER_URL + TRACER_AUTH_KEY: neither leaks, log shows https://REDACTED@…. gofmt/vet/lint clean, tests fail-on-revert. Just a few optional nits.