[Bug]: Invalid Variable Substitution in Configuration Files

[AlphaOne1]

Component

Config

Describe the issue you're facing

In the current implementation the environment variable substitution does not follow the specification found in https://opentelemetry.io/docs/specs/otel/configuration/data-model/. Specifically it does not obey the rule that substitution can only occur in YAML values. Further, according to the published specification examples, injected YAML-structured content leads to errors rather than correctly escaped/formatted strings.

Case 1: Invalid Replacement in Key Part
input: "${KEY_VAR}: value"
env: map[string]string{"KEY_VAR": "dynamic_key"}
want: "dynamic_key: value"

Case 2: Error on perceived YAML injection
input: "key: ${MALICIOUS_VAR}"
env: map[string]string{"MALICIOUS_VAR": "value\nkey2: injected"}
wantErr: true

Expected behavior

Case 1: No Replacement in Key Part
input: "${KEY_VAR}: value",
env: map[string]string{"KEY_VAR": "dynamic_key"},
want: "${KEY_VAR}: value",

Case 2: YAML inside variable in value part
input: "key: ${MALICIOUS_VAR}"
env: map[string]string{"MALICIOUS_VAR": "value\nkey2: injected"}
want: "key: 'value\nkey2: injected'"

Steps to Reproduce

If the test cases of the master branch are run, they pass with the wrong wanted outcomes.

Operating System

Windows 11

Device Architecture

x86_64

Go Version

1.25

Component Version

go.opentelemetry.io/contrib/otelconf master

[pellared]

CC @codeboten

[jack-berg]

I suspect this is for compatibility with collector substitution? If yes, the difference in substitution between collector and declarative config spec is known and intentional. The go implementation is in an interesting position because declarative config is used within the collector and outside the collector. Maybe this suggests a special flag which enables less restrictive substitution to match the collector semantics, which are disabled by default outside of the collector. Can discuss more on the issue.

Maybe I'm reading into it too much and the implementation just needs to be further restricted?

Left a similar comment here.