feat(bigquery): add url.full attribute to span tracing by ldetmer · Pull Request #12176 · googleapis/google-cloud-java

ldetmer · 2026-03-23T19:32:16Z

This PR adds the url.full attribute to span tracing. It redacts any credentials from the url itself, including query params using a predefined set of key words standardized by rust here.

example trace

gemini-code-assist · 2026-03-23T19:32:39Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances BigQuery's HTTP request telemetry by introducing a url.full attribute to span traces. This attribute captures the complete URL of the HTTP request, but critically, it includes robust redaction mechanisms to prevent sensitive information, such as credentials in the URL path and specific query parameters, from being exposed in the traces. This improves observability while maintaining security and privacy.

Highlights

Enhanced HTTP Request Tracing: Introduced the url.full attribute to HTTP request tracing spans, providing a complete URL for observability.
Sensitive Data Redaction: Implemented robust redaction logic to remove sensitive information, such as credentials in the URL path and specific query parameters (e.g., AWSAccessKeyId, Signature), from the url.full attribute before it is recorded in traces.
Refactored Tracing Initialization: Modified the addInitialHttpAttributesToSpan method to directly accept the HttpRequest object, enabling access to the full URL for sanitization.
Comprehensive Unit Testing: Added new unit tests to thoroughly verify that both query parameters and URL path credentials are correctly redacted, ensuring the security and privacy of traced URLs.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request adds the url.full attribute to span tracing for BigQuery HTTP requests, which is a valuable addition for observability. The implementation correctly redacts sensitive information from query parameters and user info in the URL. My review includes a few suggestions to improve the implementation and testing:

Refactoring the URL sanitization logic to use the GenericUrl API instead of regular expressions for better robustness.
Improving a test case to be more specific.
A minor Javadoc style improvement.
Overall, this is a good change that enhances telemetry.

...igquery/src/main/java/com/google/cloud/bigquery/telemetry/HttpTracingRequestInitializer.java

...ery/src/test/java/com/google/cloud/bigquery/telemetry/HttpTracingRequestInitializerTest.java

…loud/bigquery/telemetry/HttpTracingRequestInitializer.java Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

lqiu96 · 2026-03-23T21:11:07Z

...igquery/src/main/java/com/google/cloud/bigquery/telemetry/HttpTracingRequestInitializer.java

+    // redact credentials sent as part of the address
+    if (clone.getUserInfo() != null) {
+      clone.setUserInfo("REDACTED:REDACTED");
+    }


qq, when does this happen? I don't think that credentials are ever part of the url itself. At least in my mind, I would think the auth-library would only attach the creds as headers.

Could a user somehow override the url, or even create their own auth mechanism that does append it to the url? It makes sense that we don't support this use case, but I would feel more comfortable leaving this in, just in case in the future we allow this type of authorization. It would be easy to miss redacting from telemetry. But also happy to bring up in the chat if you think we should leave it out.

To be honest, I don't really know. I thought this was added because BQ had a specific case where it was in the URL. I guess a possibility would be something like Basic Auth like http://username:password@bigquery.googleapis.com:443, but I don't know if the server would accept that even if the user override the endpoint with that value.

I don't think it hurts to have as it would probably do nothing in most cases.

This was not for a specific use case, but this was a requirement to make sure we sanitize the url to open telemetry standards.

...igquery/src/main/java/com/google/cloud/bigquery/telemetry/HttpTracingRequestInitializer.java

lqiu96

LGTM, added a few questions.

jinseopkim0 · 2026-03-24T14:37:47Z

...igquery/src/main/java/com/google/cloud/bigquery/telemetry/HttpTracingRequestInitializer.java

  public static final AttributeKey<String> URL_TEMPLATE = AttributeKey.stringKey("url.template");
  public static final AttributeKey<String> URL_DOMAIN = AttributeKey.stringKey("url.domain");


I noticed URL_TEMPLATE and URL_DOMAIN are not set in this PR. Is this WAI?

🤖 I have created a release *beep* *boop* --- <details><summary>1.83.0</summary> ## [1.83.0](v1.82.0...v1.83.0) (2026-04-07) ### Features * [aiplatform] [Memorystore for Redis Cluster] Add support for ([0bd7666](0bd7666)) * [aiplatform] Add container_spec to Reasoning Engine public protos ([0bd7666](0bd7666)) * [aiplatform] Add container_spec to Reasoning Engine public protos ([0bd7666](0bd7666)) * [aiplatform] Add container_spec to Reasoning Engine public protos ([3ba3854](3ba3854)) * [aiplatform] Add container_spec to Reasoning Engine public protos ([3ba3854](3ba3854)) * [aiplatform] add evaluation metrics and autorater configuration to ([0bd7666](0bd7666)) * [backupdr] Adding new workload specific fields for AlloyDB ([6344cb0](6344cb0)) * [ces] update public libraries for CES v1 ([6344cb0](6344cb0)) * [ces] update public libraries for CES v1beta ([0bd7666](0bd7666)) * [ces] update public libraries for CES v1beta ([0bd7666](0bd7666)) * [chat] Addition of Section and SectionItem APIs ([0bd7666](0bd7666)) * [chat] Support app authentication with admin-consent scopes for ([0bd7666](0bd7666)) * [databasecenter] A new value `SUB_RESOURCE_TYPE_READ_POOL` is ([6344cb0](6344cb0)) * [dataflow] Add Pausing/Yaml capabilities to public protos ([3ba3854](3ba3854)) * [dataflow] add sha256 field to Package proto ([0bd7666](0bd7666)) * [dataflow] add sha256 field to Package proto ([3ba3854](3ba3854)) * [dataform] add folders and teamFolders related changes to v1 ([6344cb0](6344cb0)) * [datalineage] add configmanagement v1 module ([#12355](#12355)) ([2def625](2def625)) * [datamanager] add INVALID_MERCHANT_ID to the ErrorReason enum for ([6344cb0](6344cb0)) * [dialogflow-cx] updated v3 dialogflow client libraries with ([6344cb0](6344cb0)) * [dialogflow] updated v2 dialogflow client libraries ([6344cb0](6344cb0)) * [dialogflow] updated v2beta1 dialogflow client libraries ([6344cb0](6344cb0)) * [dlp] added support for detecting key-value pairs in client ([e5e22ed](e5e22ed)) * [document-ai] Added a fields for image and table annotation output ([0bd7666](0bd7666)) * [geocode] new module for geocode ([#12343](#12343)) ([474efb1](474efb1)) * [netapp] Add ONTAP passthrough APIs ([6344cb0](6344cb0)) * [network-security] Publish proto definitions for AuthzPolicy, ([6344cb0](6344cb0)) * [redis-cluster] [Memorystore for Redis Cluster] Add support for ([0bd7666](0bd7666)) * [redis-cluster] [Memorystore for Redis Cluster] Add support for ([3ba3854](3ba3854)) * [redis-cluster] [Memorystore for Redis Cluster] Add support for ([3ba3854](3ba3854)) * [securesourcemanager] Add CustomHostConfig to configure custom ([6344cb0](6344cb0)) * [storage] populate the `persisted_data_checksums` field with ([e5e22ed](e5e22ed)) * [texttospeech] Support safety settings for Gemini voices and ([0bd7666](0bd7666)) * [texttospeech] Support safety settings for Gemini voices and ([0bd7666](0bd7666)) * [texttospeech] Support safety settings for Gemini voices and ([0bd7666](0bd7666)) * [texttospeech] Support safety settings for Gemini voices and ([0bd7666](0bd7666)) * [translate] A new field `mime_type` is added to message ([e5e22ed](e5e22ed)) * [valkey] [Memorystore for Valkey] Add support for Flexible CA ([0bd7666](0bd7666)) * [valkey] [Memorystore for Valkey] Add support for Flexible CA ([0bd7666](0bd7666)) * [valkey] [Memorystore for Valkey] Add support for Flexible CA ([3ba3854](3ba3854)) * Add getProjectId getter for ComputeEngineCredentials ([#1833](#1833)) ([0a7895a](0a7895a)) * **bigguery:** add url.domain to span tracing ([#12208](#12208)) ([6f79c2d](6f79c2d)) * **bigquery observability:** add version attribute to span tracing ([#12132](#12132)) ([95c3eb8](95c3eb8)) * **bigquery:** add gcp.resource.destination.id for span tracing ([#12134](#12134)) ([5f31ded](5f31ded)) * **bigquery:** add opentelemetry W3C Trace Context to headers ([#12203](#12203)) ([965761a](965761a)) * **bigquery:** add resend attribute to span tracing + integration tests ([#12313](#12313)) ([167722d](167722d)) * **bigquery:** add url.full attribute to span tracing ([#12176](#12176)) ([7fdf9ff](7fdf9ff)) * **bigquery:** add url.template to span tracing ([#12181](#12181)) ([30f8afb](30f8afb)) * **bigquery:** added error attributes to span tracing ([#12115](#12115)) ([863d23b](863d23b)) * Extract resource name from unary requests for tracing ([#4159](#4159)) ([23b16b7](23b16b7)) * **gapic-generator-java:** Extract resource name heuristicly ([#12207](#12207)) ([f46480a](f46480a)) * **gax:** Actionable Errors Logging API Tracer ([#12202](#12202)) ([8d23279](8d23279)) * **gax:** Add error attributes to golden signal metrics. ([#12564](#12564)) ([063dfe5](063dfe5)) * **gax:** add utility for logging actionable errors ([#4144](#4144)) ([54fb8a5](54fb8a5)) * **gax:** Implement trace context extraction and injection with integration test ([#12625](#12625)) ([6675310](6675310)) * **observability:** Implement gcp.client.service attribute ([#12315](#12315)) ([e99812f](e99812f)) * **observability:** implement url.domain attribute ([#12316](#12316)) ([0a865bf](0a865bf)) * **sdk-platform-java:** Add CompositeTracer and CompositeTracerFactory. ([#12321](#12321)) ([4b5e8af](4b5e8af)) * Switch Eef metrics to using built in open telemetry ([#4385](#4385)) ([759bb22](759bb22)) ### Bug Fixes * Add error attributes to logging ([#12685](#12685)) ([a9198ee](a9198ee)) * **bq jdbc:** allow & ignore unknown parameters ([#12352](#12352)) ([2332ff1](2332ff1)) * **bq jdbc:** ensure getMoreResults() always moves the cursor ([#12353](#12353)) ([ac1f0f4](ac1f0f4)) * **ci:** consolidate duplicate yaml keys in github actions workflows ([#12306](#12306)) ([f644a19](f644a19)) * Clean up attributes for traces and metrics ([#12677](#12677)) ([914f97f](914f97f)) * fix getLong on NUMERIC ([#2420](#2420)) ([75ec5c2](75ec5c2)) * **gax:** Implement lazy resource name evaluation in ApiTracerContext ([#12618](#12618)) ([5e47749](5e47749)) * Handle null server address ([#12184](#12184)) ([435dd8c](435dd8c)) * **hermetic-build:** do not add release please comments on vertexai poms ([#12559](#12559)) ([5e161a7](5e161a7)) * **o11y:** create noop tracer when artifact ID is not set ([#12307](#12307)) ([630d83d](630d83d)) * **o11y:** do not record error.type in successful runs ([#12620](#12620)) ([28eebf0](28eebf0)) * **o11y:** remove `gpc.client.language` attribute ([#12621](#12621)) ([40d2e43](40d2e43)) * **oauth2:** mask sensitive tokens in HTTP logs ([#1900](#1900)) ([3e4ccb7](3e4ccb7)) * **release:** add Version.java as extra files in release-please ([#12617](#12617)) ([f5101d9](f5101d9)) * **spanner:** enforce READY-only location aware routing and add endpoint lifecycle management ([ecb86fd](ecb86fd)) * **spanner:** enforce READY-only location aware routing and add endpoint lifecycle management ([#12678](#12678)) ([ca9edb9](ca9edb9)) * **spanner:** improve grpc-gcp affinity cleanup and location-aware retries ([a157c2f](a157c2f)) * **spanner:** improve grpc-gcp affinity cleanup and location-aware retries ([#12682](#12682)) ([aca0428](aca0428)) * use dynamic tracer name instead of hardcoded gax-java ([#12190](#12190)) ([dea24db](dea24db)) ### Dependencies * bump jackson version to 2.18.3 ([#12351](#12351)) ([50304c1](50304c1)) * update dependencies.txt for grpc-gcp to 1.9.2 ([#4164](#4164)) ([f336fdc](f336fdc)) * update dependency com.google.apis:google-api-services-storage to v1-rev20260204-2.0.0 ([#1750](#1750)) ([340ecbe](340ecbe)) * update dependency com.google.apis:google-api-services-storage to v1-rev20260204-2.0.0 ([#3519](#3519)) ([1531107](1531107)) * update dependency com.google.cloud:google-cloud-storage to v2.64.1 ([#1752](#1752)) ([8fb6935](8fb6935)) * update dependency com.google.cloud:sdk-platform-java-config to v3.58.0 ([#1751](#1751)) ([9cc3e22](9cc3e22)) * update dependency com.google.cloud:sdk-platform-java-config to v3.58.0 ([#3523](#3523)) ([26d772a](26d772a)) * update dependency node to v24 ([#3509](#3509)) ([f308477](f308477)) * update gcr.io/cloud-devrel-public-resources/storage-testbench docker tag to v0.62.0 ([#3526](#3526)) ([ca29d5e](ca29d5e)) * update googleapis/sdk-platform-java action to v2.68.0 ([#3522](#3522)) ([abae1ac](abae1ac)) ### Reverts * ci: only run default list of graalvm tests if too many modules are touched ([#12292](#12292)) ([92bcdf4](92bcdf4)) ### Documentation * [dataplex] Change Dataplex library from `ALPHA` to `GA` ([6344cb0](6344cb0)) * [run] An existing repeated string field custom_audiences is marked ([015d9a1](015d9a1)) * **hermetic-build:** improve usability of development guide ([#12362](#12362)) ([5944127](5944127)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: chingor13 <chingor@google.com>

ldetmer added 2 commits March 23, 2026 15:24

feat(bigquery): add url.full attribute to tracing span

b4eef51

clean up comment

3d0e648

gemini-code-assist bot reviewed Mar 23, 2026

View reviewed changes

ldetmer and others added 2 commits March 23, 2026 16:06

Update java-bigquery/google-cloud-bigquery/src/main/java/com/google/c…

0de32b2

…loud/bigquery/telemetry/HttpTracingRequestInitializer.java Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

replaced regex with query to get user info

ad972f7

ldetmer marked this pull request as ready for review March 23, 2026 20:10

ldetmer requested review from a team as code owners March 23, 2026 20:10

ldetmer requested review from jinseopkim0 and lqiu96 March 23, 2026 20:12

reformatted

3d3c8c3

lqiu96 reviewed Mar 23, 2026

View reviewed changes

...igquery/src/main/java/com/google/cloud/bigquery/telemetry/HttpTracingRequestInitializer.java Outdated Show resolved Hide resolved

lqiu96 approved these changes Mar 23, 2026

View reviewed changes

lqiu96 added kokoro:force-run Add this label to force Kokoro to re-run the tests. labels Mar 23, 2026

yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Mar 23, 2026

url should never be null, remove check

f36e832

jinseopkim0 reviewed Mar 24, 2026

View reviewed changes

ldetmer merged commit 7fdf9ff into main Mar 24, 2026
56 checks passed

ldetmer deleted the add-full-url branch March 24, 2026 15:27

ldetmer mentioned this pull request Mar 31, 2026

chore(version-update): release 1.83.0 #12327

Closed

This was referenced Apr 3, 2026

chore(rp-test): release 1.83.0 #12673

Closed

chore(rp-test): release 1.83.0 #12674

Closed

chore(auth-version): release 1.83.0 #12698

Closed

chore(main): release 1.83.0 #12128

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(bigquery): add url.full attribute to span tracing#12176

feat(bigquery): add url.full attribute to span tracing#12176
ldetmer merged 6 commits intomainfrom
add-full-url

ldetmer commented Mar 23, 2026

Uh oh!

gemini-code-assist bot commented Mar 23, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lqiu96 Mar 23, 2026 •

edited

Loading

Uh oh!

ldetmer Mar 23, 2026

Uh oh!

lqiu96 Mar 23, 2026

Uh oh!

ldetmer Mar 23, 2026

Uh oh!

Uh oh!

lqiu96 left a comment

Uh oh!

jinseopkim0 Mar 24, 2026

Uh oh!

ldetmer Mar 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		public static final AttributeKey<String> URL_TEMPLATE = AttributeKey.stringKey("url.template");
		public static final AttributeKey<String> URL_DOMAIN = AttributeKey.stringKey("url.domain");

Conversation

ldetmer commented Mar 23, 2026

Uh oh!

gemini-code-assist bot commented Mar 23, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lqiu96 Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ldetmer Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

lqiu96 Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

ldetmer Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

lqiu96 left a comment

Choose a reason for hiding this comment

Uh oh!

jinseopkim0 Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

ldetmer Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

lqiu96 Mar 23, 2026 •

edited

Loading