Skip to content

Sanitize sensitive data from URLs (span desc, span data, crumbs, client errors)#1327

Merged
marandaneto merged 44 commits into
mainfrom
feat/remove-sensitive-data-from-urls
Mar 27, 2023
Merged

Sanitize sensitive data from URLs (span desc, span data, crumbs, client errors)#1327
marandaneto merged 44 commits into
mainfrom
feat/remove-sensitive-data-from-urls

Conversation

@denrase

@denrase denrase commented Mar 14, 2023 •
edited
Loading

Copy link
Copy Markdown
Collaborator

📜 Description

  • Redact authority if present
  • Remove authorization, Authorization, cookies, Cookies, cookie, Cookie header fields
  • Remove query and framgnet from url
  • Add query and fragment as data to span and requests

💡 Motivation and Context

Fixes #1171

Based on the implementation of getsentry/sentry-java#2365

💚 How did you test it?

Unit tests

📝 Checklist

  • I reviewed submitted code
  • I added tests to verify changes
  • No new PII added or SDK only sends newly added PII if sendDefaultPii is enabled
  • I updated the docs if needed
  • All tests passing
  • No breaking changes

Whats next?

In the spec the field is called Cookies, but elsewhere i have found it defined as Cookie. Opted to remove both versions for now.

@denrase
denrase changed the base branch from main to v7.0.0 March 14, 2023 08:56
@github-actions

github-actions Bot commented Mar 14, 2023 •
edited
Loading

Copy link
Copy Markdown
Contributor
Messages
📖 Do not forget to update Sentry-docs with your feature once the pull request gets approved.

Generated by 🚫 dangerJS against 4327595

@codecov

codecov Bot commented Mar 14, 2023 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

Patch coverage: 100.00% and project coverage change: -0.04 ⚠️

Comparison is base (df16b96) 89.78% compared to head (4327595) 89.74%.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #1327      +/-   ##
==========================================
- Coverage   89.78%   89.74%   -0.04%     
==========================================
  Files         177       59     -118     
  Lines        5676     2009    -3667     
==========================================
- Hits         5096     1803    -3293     
+ Misses        580      206     -374
Impacted Files Coverage Δ
dio/lib/src/breadcrumb_client_adapter.dart 82.60% <100.00%> (+2.60%) ⬆️
dio/lib/src/sentry_transformer.dart 96.15% <100.00%> (+1.70%) ⬆️
dio/lib/src/tracing_client_adapter.dart 88.00% <100.00%> (+2.28%) ⬆️

... and 118 files with indirect coverage changes

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

@denrase denrase changed the title Remove authority from URLs sent to Sentry - Sanitize sensitive data from URLs (span desc, span data, crumbs, client errors) Mar 14, 2023
@denrase denrase changed the title - Sanitize sensitive data from URLs (span desc, span data, crumbs, client errors) Sanitize sensitive data from URLs (span desc, span data, crumbs, client errors) Mar 14, 2023
@denrase
denrase marked this pull request as ready for review March 14, 2023 14:38
Base automatically changed from v7.0.0 to main March 15, 2023 12:41
marandaneto
marandaneto reviewed Mar 20, 2023
View reviewed changes
Comment thread flutter/lib/sentry_flutter.dart
marandaneto
marandaneto approved these changes Mar 22, 2023
View reviewed changes

@marandaneto marandaneto left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks @adinauer
@denrase after addressing #1327 (comment) and making CI happy, we can merge it :)

marandaneto
marandaneto reviewed Mar 27, 2023
View reviewed changes
Comment thread CHANGELOG.md
@marandaneto

marandaneto commented Mar 27, 2023 •
edited
Loading

Copy link
Copy Markdown
Contributor

@denrase please run the formatter.
Btw #1357

@marandaneto
marandaneto enabled auto-merge (squash) March 27, 2023 10:17
@marandaneto
marandaneto merged commit 24f71aa into main Mar 27, 2023
@marandaneto
marandaneto deleted the feat/remove-sensitive-data-from-urls branch March 27, 2023 11:51
@vlazdra vlazdra mentioned this pull request Apr 27, 2023
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@adinauer adinauer adinauer approved these changes
@brustolin brustolin Awaiting requested review from brustolin
@krystofwoldrich krystofwoldrich Awaiting requested review from krystofwoldrich
+1 more reviewer
@marandaneto marandaneto marandaneto approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Sanitize sensitive data from URLs (span desc, span data, crumbs, client errors)

3 participants

@denrase @marandaneto @adinauer