fix!: replace cgi with uri for encode and decode

api/lib/opentelemetry/baggage/propagation/text_map_propagator.rb

@@ -4,7 +4,7 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-require 'cgi'
+require 'uri'
 
 module OpenTelemetry
   module Baggage
@@ -63,7 +63,7 @@ def extract(carrier, context: Context.current, getter: Context::Propagation.text
               # the W3C spec where it's referred to as properties. We preserve
               # the properties (as-is) so that they can be propagated elsewhere.
               kv, meta = entry.split(';', 2)
-              k, v = kv.split('=').map!(&CGI.method(:unescape))
+              k, v = kv.split('=').map!(&URI.method(:decode_uri_component))
               builder.set_value(k, v, metadata: meta)
             end
           end
@@ -99,7 +99,7 @@ def encode(baggage)
         end
 
         def encode_value(key, entry)
-          result = +"#{CGI.escape(key.to_s)}=#{CGI.escape(entry.value.to_s)}"
+          result = +"#{URI.encode_uri_component(key.to_s)}=#{URI.encode_uri_component(entry.value.to_s)}"
           # We preserve metadata received on extract and assume it's already formatted
           # for transport. It's sent as-is without further processing.
           result << ";#{entry.metadata}" if entry.metadata

exporter/otlp-http/lib/opentelemetry/exporter/otlp/http/trace_exporter.rb

@@ -270,7 +270,7 @@ def parse_headers(raw)
             raise ArgumentError, ERROR_MESSAGE_INVALID_HEADERS if entries.empty?
 
             entries.each_with_object({}) do |entry, headers|
-              k, v = entry.split('=', 2).map(&CGI.method(:unescape))
+              k, v = entry.split('=', 2).map(&URI.method(:decode_uri_component))
               begin
                 k = k.to_s.strip
                 v = v.to_s.strip

exporter/otlp-logs/lib/opentelemetry/exporter/otlp/logs/logs_exporter.rb

@@ -361,7 +361,7 @@ def parse_headers(raw)
             raise ArgumentError, ERROR_MESSAGE_INVALID_HEADERS if entries.empty?
 
             entries.each_with_object({}) do |entry, headers|
-              k, v = entry.split('=', 2).map(&CGI.method(:unescape))
+              k, v = entry.split('=', 2).map(&URI.method(:decode_uri_component))
               begin
                 k = k.to_s.strip
                 v = v.to_s.strip

exporter/otlp-metrics/lib/opentelemetry/exporter/otlp/metrics/util.rb

@@ -74,7 +74,7 @@ def parse_headers(raw)
             raise ArgumentError, ERROR_MESSAGE_INVALID_HEADERS if entries.empty?
 
             entries.each_with_object({}) do |entry, headers|
-              k, v = entry.split('=', 2).map(&CGI.method(:unescape))
+              k, v = entry.split('=', 2).map(&URI.method(:decode_uri_component))
               begin
                 k = k.to_s.strip
                 v = v.to_s.strip

exporter/otlp/lib/opentelemetry/exporter/otlp/exporter.rb

@@ -450,7 +450,7 @@ def parse_headers(raw)
           raise ArgumentError, ERROR_MESSAGE_INVALID_HEADERS if entries.empty?
 
           entries.each_with_object({}) do |entry, headers|
-            k, v = entry.split('=', 2).map(&CGI.method(:unescape))
+            k, v = entry.split('=', 2).map(&URI.method(:decode_uri_component))
             begin
               k = k.to_s.strip
               v = v.to_s.strip

propagator/jaeger/lib/opentelemetry/propagator/jaeger/text_map_propagator.rb

@@ -4,7 +4,7 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-require 'cgi'
+require 'uri'
 
 # OpenTelemetry is an open source observability framework, providing a
 # general-purpose API, SDK, and related tools required for the instrumentation
@@ -75,7 +75,7 @@ def inject(carrier, context: Context.current, setter: Context::Propagation.text_
           setter.set(carrier, IDENTITY_KEY, trace_span_identity_value)
           OpenTelemetry::Baggage.values(context: context).each do |key, value|
             baggage_key = 'uberctx-' + key
-            encoded_value = CGI.escape(value)
+            encoded_value = URI.encode_uri_component(value)
             setter.set(carrier, baggage_key, encoded_value)
           end
           carrier
@@ -110,7 +110,7 @@ def context_with_extracted_baggage(carrier, context, getter)
               next unless baggage_key
 
               raw_value = getter.get(carrier, carrier_key)
-              value = CGI.unescape(raw_value)
+              value = URI.decode_uri_component(raw_value)
               b.set_value(baggage_key, value)
             end
           end

propagator/jaeger/test/text_map_propagator_test.rb

@@ -259,7 +259,7 @@ def create_context(trace_id:,
       end
       carrier = {}
       propagator.inject(carrier, context: context)
-      _(carrier['uberctx-key1']).must_equal('value+1+%2F+blah')
+      _(carrier['uberctx-key1']).must_equal('value%201%20%2F%20blah')
     end
 
     it 'injects to rack keys' do