fix(router): stop logging secrets in ext_proc request logs

[Kyosuke Konishi (konippi)]

Part of #103.

Stops the router (ext_proc) request path from writing secrets to logs.

This PR was prepared in part with the assistance of generative AI.

• Tests pass
• Appropriate changes to documentation are included in the PR

[Bowei Du (bowei)]

The ext_proc changes look ok. If you split that into its own PR, I can review and merge that.

[Kyosuke Konishi (konippi)]

Bowei Du (@bowei)
Thanks! Scoped this down to just the ext_proc changes.

The other two pieces are split out:

• KubernetesClaims slog allowlist → its own PR (fix(k8sjwt): redact sensitive claims from logs #224).
• gRPC interceptor payload logging → dropped, since Support actortemplate secret env #20 already redacts env via sanitizeForLog.

[Bowei Du (bowei)]

Do you want to use url.Parse to avoid potential edge cases?

[Kyosuke Konishi (konippi)]

I tried both. For :path, cutting at the first ? removes exactly the query, which is the secret vector here.

url.Parse doesn't improve that for this use and adds downsides:

• It errors on e.g. control chars, so it needs a fallback — and a fallback that logs the raw value would leak the query. strings.Cut is total, so there's no error path that can fall through to logging the secret.
• It reinterprets //host/path as authority and silently drops it.

Given that, my inclination would be to keep strings.Cut — but I'm very open to using url.Parse if you'd prefer. Let me know what you think.

[Bowei Du (bowei)]

Actually, do we need this change?

I think interpreting the path: coming from Envoy would add some additional non-obvious semantics to this code. If we maintain that we pass the Envoy argument through unchanged, this will be much simpler to explain how this works.

[Bowei Du (bowei)]

Is there a security issue that you are trying to fix?

[Kyosuke Konishi (konippi)]

Yes — the :path query string can carry secrets (tokens, OAuth codes, etc.; CWE-598), and m.path gets persisted into the statusz QueryRecorder, which is served unauthenticated. That's the leak I'm closing.

You're right that the parser shouldn't reinterpret :path. I've reverted newRequestMetadata to pass Envoy's :path through verbatim and moved the query-stripping to the sink (redactPath in AddRouterRequest) — same "redact at the sink" approach as sanitizeForLog.

[Bowei Du (bowei)]

One comment on the path change. Otherwise looks ok