From ac9bd2c0551ab80fb42d18ab54a9f1af10a2f135 Mon Sep 17 00:00:00 2001
From: Pratik Mankawde <3397372+pratikmankawde@users.noreply.github.com>
Date: Tue, 28 Apr 2026 11:50:36 +0100
Subject: [PATCH] fix(telemetry): use span name constants and fix cardinality
 risk

- Use grpc_span::val::resourceExhausted constant instead of raw
  "resource_exhausted" string in GRPCServer.cpp
- Fix unbounded span name cardinality in RPCHandler.cpp error path:
  use fixed rpc_span::val::unknownCommand as span name instead of
  user-supplied cmdName (attacker-controlled input). The actual
  command is still captured in the xrpl.rpc.command attribute.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 src/xrpld/app/main/GRPCServer.cpp   | 4 ++--
 src/xrpld/rpc/detail/RPCHandler.cpp | 3 ++-
 src/xrpld/rpc/detail/RpcSpanNames.h | 1 +
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/xrpld/app/main/GRPCServer.cpp b/src/xrpld/app/main/GRPCServer.cpp
index 38557f75e5..7e5ee166a9 100644
--- a/src/xrpld/app/main/GRPCServer.cpp
+++ b/src/xrpld/app/main/GRPCServer.cpp
@@ -1,7 +1,7 @@
 #include <xrpld/app/main/GRPCServer.h>
-#include <xrpld/app/main/GrpcSpanNames.h>
 
 #include <xrpld/app/main/Application.h>
+#include <xrpld/app/main/GrpcSpanNames.h>
 #include <xrpld/core/ConfigSections.h>
 #include <xrpld/rpc/Context.h>
 #include <xrpld/rpc/GRPCHandlers.h>
@@ -178,7 +178,7 @@ GRPCServerImpl::CallData<Request, Response>::process(std::shared_ptr<JobQueue::C
         bool const isUnlimited = clientIsUnlimited();
         if (!isUnlimited && usage.disconnect(app_.getJournal("gRPCServer")))
         {
-            span.setError("resource_exhausted");
+            span.setError(grpc_span::val::resourceExhausted);
             grpc::Status const status{
                 grpc::StatusCode::RESOURCE_EXHAUSTED, "usage balance exceeds threshold"};
             responder_.FinishWithError(status, this);
diff --git a/src/xrpld/rpc/detail/RPCHandler.cpp b/src/xrpld/rpc/detail/RPCHandler.cpp
index 7717ba6a99..ff1a8a1054 100644
--- a/src/xrpld/rpc/detail/RPCHandler.cpp
+++ b/src/xrpld/rpc/detail/RPCHandler.cpp
@@ -216,7 +216,8 @@ doCommand(RPC::JsonContext& context, Json::Value& result)
             ? context.params[jss::command].asString()
             : context.params.isMember(jss::method) ? context.params[jss::method].asString()
                                                    : "unknown";
-        auto span = SpanGuard::span(TraceCategory::Rpc, rpc_span::prefix::command, cmdName);
+        auto span = SpanGuard::span(
+            TraceCategory::Rpc, rpc_span::prefix::command, rpc_span::val::unknownCommand);
         span.setAttribute(rpc_span::attr::command, cmdName.c_str());
         span.setError(get_error_info(error).token.c_str());
 
diff --git a/src/xrpld/rpc/detail/RpcSpanNames.h b/src/xrpld/rpc/detail/RpcSpanNames.h
index b7c2049b03..a8139f851a 100644
--- a/src/xrpld/rpc/detail/RpcSpanNames.h
+++ b/src/xrpld/rpc/detail/RpcSpanNames.h
@@ -157,6 +157,7 @@ using telemetry::attr_val::error;
 using telemetry::attr_val::success;
 inline constexpr auto admin = makeStr("admin");
 inline constexpr auto user = makeStr("user");
+inline constexpr auto unknownCommand = makeStr("unknown");
 }  // namespace val
 
 }  // namespace rpc_span