fix: reject traceparent headers with unsupported versions (#241)

This addresses a regression introduced in #178, where traceparent
headers containing unsupported characters were not properly rejected and
were incorrectly treated as valid.

[APMAPI-1599]

Author: dmehala

src/datadog/w3c_propagation.cpp

@@ -33,6 +33,11 @@ auto verboten(int lowest_ascii, int highest_ascii,
   };
 }
 
+constexpr bool is_hexdiglc(const char c) {
+  return (c >= '0' && c <= '9') || (c >= 'a' && c <= 'f') ||
+         (c >= 'A' && c <= 'F');
+}
+
 // Populate the specified `result` with data extracted from the "traceparent"
 // entry of the specified `headers`. Return `nullopt` on success. Return a value
 // for the `tags::internal::w3c_extraction_error` tag if an error occurs.
@@ -59,6 +64,8 @@ Optional<std::string> extract_traceparent(ExtractedData& result,
 
           beg = i + 1;
           internal_state = state::trace_id;
+        } else if (!is_hexdiglc(traceparent[i])) {
+          return "invalid_version";
         }
       } break;
 

test/test_tracer.cpp

@@ -755,6 +755,19 @@ TEST_TRACER("span extraction") {
         {__LINE__, "invalid: non hex trace tag ID",
          "00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-xy", // traceparent
          "malformed_traceflags"}, // expected_error_tag_value
+
+        {
+            __LINE__,
+            "invalid: non supported character in trace version 1/x",
+            ".0-12345678901234567890123456789012-1234567890123456-01",
+            "invalid_version",
+        },
+        {
+            __LINE__,
+            "invalid: non supported character in trace version 2/x",
+            "0.-12345678901234567890123456789012-1234567890123456-01",
+            "invalid_version"
+        },
     }));
     // clang-format on