Malformed unicode header values may throw uncaught exception

### Summary When the `dd-trace-cpp` library fails to extract trace context due to malformed unicode, the library attempts to log the list of audited headers and their values using the `nlohmann` JSON library. This attempted logging may throw an uncaught exception. ### Details The code that introduced this logging was added in pull request [#72](https://github.com/DataDog/dd-trace-cpp/pull/72) and has been present in versions [v0.1.12](https://github.com/DataDog/dd-trace-cpp/releases/tag/v0.1.12), [v0.2.0](https://github.com/DataDog/dd-trace-cpp/releases/tag/v0.2.0), and [v0.2.1](https://github.com/DataDog/dd-trace-cpp/releases/tag/v0.2.1). For each key and value in the list of audited headers, a nlohmann::json instance is created as follows: ``` stream << nlohmann::json(it->first + ": " + it->second); ``` Here, `it->first` is the header name and `it->second` is the value. This code is problematic for several reasons: - An exception can be thrown by the JSON library while parsing the input. - An exception can be thrown by the implicit call to `dump()`. ### Impact This impacts any downstream applications that rely on `dd-trace-cpp` for tracing. ### Patches This vulnerability has been patched in `dd-trace-cpp` version [v0.2.2](https://github.com/DataDog/dd-trace-cpp/releases/tag/v0.2.2) (#132) ### Workarounds - Filter out header values that are not valid UTF-8 strings

CVSS 3.1

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Severity from

GitHub (reviewed advisory)

• github.com/DataDog/dd-trace-cpp/security/advisories/GHSA-rf3p-mg22-qv6w
• github.com/DataDog/dd-trace-cpp