ISSUE-2674 Strip sensitive data from the url

instrumentation-api-semconv/src/main/java/io/opentelemetry/instrumentation/api/instrumenter/http/HttpClientAttributesExtractor.java

@@ -54,7 +54,21 @@ public static <REQUEST, RESPONSE> HttpClientAttributesExtractorBuilder<REQUEST,
   @Override
   public void onStart(AttributesBuilder attributes, Context parentContext, REQUEST request) {
     super.onStart(attributes, parentContext, request);
-    internalSet(attributes, SemanticAttributes.HTTP_URL, getter.url(request));
+    internalSet(attributes, SemanticAttributes.HTTP_URL, stripSensitiveData(getter.url(request)));
+  }
+
+  @Nullable
+  private static String stripSensitiveData(@Nullable String url) {
+    if (url == null || url.isEmpty()) {
+      return url;
+    }
+
+    // replace username & password
+    if(url.contains("@")) {
+      return url.substring(0, url.indexOf("//")+2) + url.substring(url.indexOf("@")+1);
+    } else {
+      return url;
+    }
   }
 
   @Override

instrumentation-api-semconv/src/test/java/io/opentelemetry/instrumentation/api/instrumenter/http/HttpClientAttributesExtractorTest.java

@@ -140,6 +140,21 @@ void normal() {
                 asList("654", "321")));
   }
 
+  @Test
+  public void stripBasicAuthTest() {
+    Map<String, String> request = new HashMap<>();
+    request.put("url", "https://user1:[email protected]");
+
+    HttpClientAttributesExtractor<Map<String, String>, Map<String, String>> extractor =
+        HttpClientAttributesExtractor.builder(new TestHttpClientAttributesGetter()).build();
+
+    AttributesBuilder attributes = Attributes.builder();
+    extractor.onStart(attributes, Context.root(), request);
+
+    assertThat(attributes.build())
+        .containsOnly(entry(SemanticAttributes.HTTP_URL, "https://github.com"));
+  }
+
   @Test
   void invalidStatusCode() {
     Map<String, String> request = new HashMap<>();