Skip to content

Conversation

@lightsta1ker
Copy link

Addresses #7937

@lightsta1ker lightsta1ker changed the title [WIP] Updating uninstrumented dice example [WIP] Updating dice example based on Updated Specification for the reference application Oct 30, 2025
@lightsta1ker lightsta1ker marked this pull request as ready for review October 30, 2025 17:43
@lightsta1ker lightsta1ker requested a review from a team as a code owner October 30, 2025 17:43
@lightsta1ker lightsta1ker changed the title [WIP] Updating dice example based on Updated Specification for the reference application Updating dice example based on Updated Specification for the reference application Oct 31, 2025
Comment on lines 103 to 107
if player == "" {
logger.DebugContext(r.Context(), "anonymous player rolled", results)
} else {
msg = "Anonymous player is rolling the dice"
logger.DebugContext(r.Context(), "player=%s rolled %v", player, results)
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we use log attributes?

msg = "Anonymous player is rolling the dice"
logger.DebugContext(r.Context(), "player=%s rolled %v", player, results)
}
logger.InfoContext(r.Context(), " %s %s -> 200 OK", r.Method, r.URL.String())
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is it what other languages are doing? I do not see such requirements in https://opentelemetry.io/docs/getting-started/reference-application-specification/ apart from "an INFO-level message for each HTTP request with a status code <400".

This could simply be

Suggested change
logger.InfoContext(r.Context(), " %s %s -> 200 OK", r.Method, r.URL.String())
logger.InfoContext(r.Context(), "Some player rolled a dice.")

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@svrnm, maybe you have some recommendation.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've just kept the "200 OK" to fullfill the "an INFO-level message for each HTTP request with a status code <400". . But it could simply be the above suggestion. Will update.

// Check if rolls is a number.
rolls, err := strconv.Atoi(rollsParam)
if err != nil {
w.WriteHeader(http.StatusBadRequest)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what about Content-Type?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thought of leaving it to the defaults as it's a simple app and not explicitly specified in the reference. But I will set application/json as that's how the app responds.

if rolls <= 0 {
err := errors.New("rolls must be positive")
span.RecordError(err)
logger.ErrorContext(ctx, "error", "error", err)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't the caller already logging the error ?

Suggested change
logger.ErrorContext(ctx, "error", "error", err)

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, Yes. The caller does log the same error at line 100

logger.ErrorContext(r.Context(), err.Error())

I think, this line was from earlier that escaped refactor. Will update.

@pellared
Copy link
Member

pellared commented Nov 4, 2025

@lightsta1ker, I won't have time to review it further until I am back from KubeCon NA. Hopefully other @open-telemetry/go-approvers are going to help with reviews.

@lightsta1ker
Copy link
Author

Sure, @pellared . Thank you for the review & suggestions!

return []int{val}, nil
}

results := make([]int, rolls)

Check failure

Code scanning / CodeQL

Slice memory allocation with excessive size value High

This memory allocation depends on a
user-provided value
.
return []int{rollOnce()}, nil
}

results := make([]int, rolls)

Check failure

Code scanning / CodeQL

Slice memory allocation with excessive size value High

This memory allocation depends on a
user-provided value
.
@pellared

This comment was marked as resolved.

@lightsta1ker

This comment was marked as resolved.

Comment on lines 134 to 137
rollsAttr := attribute.Int("rolls", rolls)
span.SetAttributes(rollsAttr)
rollCnt.Add(ctx, 1, metric.WithAttributes(rollsAttr))
outcomeHist.Record(ctx, int64(val))
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we consolidate the logic of this part? Currently, it contains the same logic twice.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, the loop handles rolls == 1 just fine. Thank you, will update.

Copy link
Member

@flc1125 flc1125 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The normative review is completed, with additional notes:

According to the specification requirements, support for the OTLP exporter is needed. Currently, this part is not yet supported, but I believe it can be fully implemented through a separate PR.

// Parse query parameters.
rollsParam := r.URL.Query().Get("rolls")
player := r.URL.Query().Get("player")
maxRolls := 1000 // Arbitrary limit to prevent Slice memory allocation with excessive size value.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From a performance perspective, this is a good configuration.

However, I am considering that since the specification does not mention this situation and it is just an example.

Therefore, extreme cases can be temporarily ignored. I recommend removing it to comply with the specification.

Copy link
Member

@pellared pellared Nov 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I kindly disagree. We should not have vulnerabilities in examples. People are using them for learning purposes.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The codeQL CI check picked up the vulnerability. I would like to keep the example vulnerability free as well.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it can be kept, but defining it as a constant is a better choice.

if err != nil || rolls > maxRolls {
// Signals invalid input (<=0).
w.WriteHeader(http.StatusInternalServerError)
logger.ErrorContext(r.Context(), err.Error())
Copy link
Member

@flc1125 flc1125 Nov 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since the condition if err != nil || rolls > maxRolls { implies that err might be nil.

Of course, once maxRolls is removed, this issue is naturally resolved.

@flc1125
Copy link
Member

flc1125 commented Nov 11, 2025

@lightsta1ker We still have some issues to resolve, including CI checks.

@lightsta1ker
Copy link
Author

@flc1125 I thought those checks were not relevant to this PR as it's not customer facing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants