fix(instrumentation-http): skip malformed forwarded headers

[pmlanger]

Which problem is this PR solving?

Skips malformed forwarded headers instead of throwing an uncaught exception.

Fixes #5095

Short description of the changes

Introduce parseForwardedHeader in experimental/packages/opentelemetry-instrumentation-http/src/utils.ts which wraps forwarded-parse and returns an empty array on any caught exception.

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

First, wrote a test that broke the instrumentation in the expected way (throwing ParseError: Unexpected end of input).
Then, fixed it and confirmed the test passes.

Checklist:

• Followed the style guidelines of this project
• Unit tests have been added
• Documentation has been updated

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: pmlanger (bc159fb)

[omBratteng]

I think this would solve an issue we stumbled upon, where the forwarded header contains a base64 encoded value that ends with a =, and technically makes it malformed.

Could you add a test case for this value?

for=127.0.0.1;host=something.vercel.app;proto=https;sig=0QmVhcmVyIDc3MGNlY2M5YTIyZjJmNTg1ZGNlOTQ1NTUzMTIwMGFkMmZhOGEzZGNiM2M2NWQ4ZDk2ZGI5MDExMDkzMjkwYWM=;exp=1730556049

[pmlanger]

@omBratteng not sure there's much value adding tests for different kinds of malformed Forwarded headers.
fwiw, forwarded-parse throws on your input:

> fp = require('forwarded-parse')
[Function: parse]
> fp('for=127.0.0.1;host=something.vercel.app;proto=https;sig=0QmVhcmVyIDc3MGNlY2M5YTIyZjJmNTg1ZGNlOTQ1NTUzMTIwMGFkMmZhOGEzZGNiM2M2NWQ4ZDk2ZGI5MDExMDkzMjkwYWM=;exp=1730556049')
Uncaught ParseError: Unexpected character '=' at index 152
    at parse (/Users/philipp.langer/dev/opentelemetry-js/node_modules/forwarded-parse/index.js:121:17) {
  input: 'for=127.0.0.1;host=something.vercel.app;proto=https;sig=0QmVhcmVyIDc3MGNlY2M5YTIyZjJmNTg1ZGNlOTQ1NTUzMTIwMGFkMmZhOGEzZGNiM2M2NWQ4ZDk2ZGI5MDExMDkzMjkwYWM=;exp=1730556049'

so it should be covered by this fix as well.

[pichlermarc]

looks good - thanks for taking care of this 👍

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 93.18%. Comparing base (ce5bbfb) to head (bc159fb).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5099   +/-   ##
=======================================
  Coverage   93.18%   93.18%           
=======================================
  Files         315      315           
  Lines        8086     8086           
  Branches     1617     1617           
=======================================
  Hits         7535     7535           
  Misses        551      551           

[kiyaGu]

@pichlermarc is it possible to know when this will be released? One of our app uses the version with the issue and we are wondering either downgrade or wait for the new release - Thanks

[pichlermarc]

@kiyaGu I published it just now (@opentelemetry/[email protected], GitHub Release)