Skip to content

Commit 581cab4

Browse files
s1gr1ds1gr1d
authored
feat(core)!: Gate incoming HTTP body capture on dataCollection.httpBodies (#22834)
Gates incoming request body capture on `dataCollection.httpBodies.includes('incomingRequest')` across all server SDKs. An explicit `maxRequestBodySize` option still overrides the gate. closes #21258
1 parent 6e5513e commit 581cab4

10 files changed

Lines changed: 116 additions & 23 deletions

File tree

‎dev-packages/node-integration-tests/suites/express/with-http/maxIncomingRequestBodySize/instrument-small.mjs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,5 +7,6 @@ Sentry.init({
77
release: '1.0',
88
tracesSampleRate: 1.0,
99
transport: loggingTransport,
10+
dataCollection: { httpBodies: [] },
1011
integrations: [Sentry.httpIntegration({ maxIncomingRequestBodySize: 'small' })],
1112
});

‎dev-packages/node-integration-tests/suites/express/with-http/maxIncomingRequestBodySize/test.ts‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,34 @@ describe('express with httpIntegration and not defined maxIncomingRequestBodySiz
6060
});
6161
});
6262

63+
describe('express with httpIntegration, disabled httpBodies, and explicit maxIncomingRequestBodySize', () => {
64+
afterAll(() => {
65+
cleanupChildProcesses();
66+
});
67+
68+
createEsmAndCjsTests(__dirname, 'scenario.mjs', 'instrument-small.mjs', (createRunner, test) => {
69+
test('captures request bodies because the explicit size overrides dataCollection.httpBodies', async () => {
70+
const runner = createRunner()
71+
.expect({
72+
transaction: {
73+
transaction: 'POST /test-body-size',
74+
request: {
75+
data: JSON.stringify(generatePayload(MAX_SMALL)),
76+
},
77+
},
78+
})
79+
.start();
80+
81+
await runner.makeRequest('post', '/test-body-size', {
82+
headers: { 'Content-Type': 'application/json' },
83+
data: JSON.stringify(generatePayload(MAX_SMALL)),
84+
});
85+
86+
await runner.completed();
87+
});
88+
});
89+
});
90+
6391
describe('express with httpIntegration and maxIncomingRequestBodySize: "none"', () => {
6492
afterAll(() => {
6593
cleanupChildProcesses();

‎packages/cloudflare/src/integrations/httpServer.ts‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -42,14 +42,14 @@ export interface HttpServerIntegrationOptions {
4242

4343
interface HttpServerIntegrationInstance {
4444
name: string;
45-
maxRequestBodySize: MaxRequestBodySize;
45+
maxRequestBodySize: MaxRequestBodySize | undefined;
4646
ignoreRequestBody?: (url: string, request: Request) => boolean;
4747
}
4848

4949
const _httpServerIntegration = ((options: HttpServerIntegrationOptions = {}): HttpServerIntegrationInstance => {
5050
return {
5151
name: INTEGRATION_NAME,
52-
maxRequestBodySize: options.maxRequestBodySize ?? 'medium',
52+
maxRequestBodySize: options.maxRequestBodySize,
5353
ignoreRequestBody: options.ignoreRequestBody,
5454
};
5555
}) satisfies IntegrationFn;
@@ -85,11 +85,12 @@ export async function captureIncomingRequestBody(client: Client, request: Reques
8585
return;
8686
}
8787

88-
// TODO(v11): Gate incoming request body capture on `dataCollection.httpBodies` (capture only when
89-
// `'incomingRequest'` is listed) instead of defaulting to `'medium'`.
90-
const maxRequestBodySize = integration.maxRequestBodySize;
88+
const configuredBodySize = integration.maxRequestBodySize;
89+
const effectiveBodySize: MaxRequestBodySize =
90+
configuredBodySize ??
91+
(client.getDataCollectionOptions().httpBodies.includes('incomingRequest') ? 'medium' : 'none');
9192

92-
if (maxRequestBodySize === 'none') {
93+
if (effectiveBodySize === 'none') {
9394
return;
9495
}
9596

@@ -104,5 +105,5 @@ export async function captureIncomingRequestBody(client: Client, request: Reques
104105
}
105106

106107
const isolationScope = getIsolationScope();
107-
await captureBodyFromWinterCGRequest(request, isolationScope, maxRequestBodySize);
108+
await captureBodyFromWinterCGRequest(request, isolationScope, effectiveBodySize);
108109
}

‎packages/cloudflare/test/request.test.ts‎

Lines changed: 63 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import { beforeAll, beforeEach, describe, expect, onTestFinished, test, vi } fro
88
import { setAsyncLocalStorageAsyncContextStrategy } from '../src/async';
99
import type { CloudflareOptions } from '../src/client';
1010
import { CloudflareClient } from '../src/client';
11+
import { httpServerIntegration } from '../src/integrations/httpServer';
1112
import { wrapRequestHandler } from '../src/request';
1213

1314
const MOCK_OPTIONS: CloudflareOptions = {
@@ -206,18 +207,14 @@ describe('withSentry', () => {
206207
expect(sentryEvent.contexts?.culture).toEqual({ timezone: 'UTC' });
207208
});
208209

209-
// TODO(v11): Body capture should be gated on `dataCollection.httpBodies` (only capture when
210-
// `'incomingRequest'` is listed). Until then we keep the historical behavior of capturing
211-
// incoming request bodies by default at `'medium'`, consistent with the Node SDK.
212-
test('captures request body with default integration (medium size)', async () => {
210+
test('captures request body by default (all body types included by default)', async () => {
213211
let sentryEvent: Event = {};
214212
const context = createMockExecutionContext();
215213

216214
await wrapRequestHandler(
217215
{
218216
options: {
219217
...MOCK_OPTIONS,
220-
// Default integrations include httpServerIntegration with 'medium' default
221218
beforeSend(event) {
222219
sentryEvent = event;
223220
return null;
@@ -241,6 +238,67 @@ describe('withSentry', () => {
241238
);
242239
});
243240

241+
test('does not capture request body when dataCollection.httpBodies excludes incomingRequest', async () => {
242+
let sentryEvent: Event = {};
243+
const context = createMockExecutionContext();
244+
245+
await wrapRequestHandler(
246+
{
247+
options: {
248+
...MOCK_OPTIONS,
249+
dataCollection: { httpBodies: [] },
250+
beforeSend(event) {
251+
sentryEvent = event;
252+
return null;
253+
},
254+
},
255+
request: new Request('https://example.com', {
256+
method: 'POST',
257+
headers: { 'content-type': 'application/json' },
258+
body: JSON.stringify({ username: 'test', data: 'value' }),
259+
}),
260+
context,
261+
},
262+
() => {
263+
SentryCore.captureMessage('request body');
264+
return new Response('test');
265+
},
266+
);
267+
268+
expect(sentryEvent.sdkProcessingMetadata?.normalizedRequest?.data).toBeUndefined();
269+
});
270+
271+
test('explicit maxRequestBodySize overrides dataCollection.httpBodies', async () => {
272+
let sentryEvent: Event = {};
273+
const context = createMockExecutionContext();
274+
275+
await wrapRequestHandler(
276+
{
277+
options: {
278+
...MOCK_OPTIONS,
279+
dataCollection: { httpBodies: [] },
280+
integrations: [httpServerIntegration({ maxRequestBodySize: 'medium' })],
281+
beforeSend(event) {
282+
sentryEvent = event;
283+
return null;
284+
},
285+
},
286+
request: new Request('https://example.com', {
287+
method: 'POST',
288+
headers: { 'content-type': 'application/json' },
289+
body: JSON.stringify({ key: 'value' }),
290+
}),
291+
context,
292+
},
293+
() => {
294+
SentryCore.captureMessage('request body');
295+
return new Response('test');
296+
},
297+
);
298+
299+
expect(sentryEvent.sdkProcessingMetadata?.normalizedRequest?.data).toEqual(JSON.stringify({ key: 'value' }));
300+
});
301+
244302
// TODO(v11): Cookies should be attached (subject to denylist filtering) by default. Until then we keep the
245303
// historical Cloudflare behavior of not attaching cookies unless the user explicitly opts in.
246304
test('does not capture cookies by default', async () => {

‎packages/core/src/integrations/http/server-subscription.ts‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -108,14 +108,18 @@ export function instrumentServer(options: HttpInstrumentationOptions, server: Ht
108108
const url = request.url || '/';
109109
const normalizedRequest = httpRequestToRequestData(request);
110110
const {
111-
maxRequestBodySize = 'medium',
111+
maxRequestBodySize: configuredBodySize,
112112
ignoreRequestBody,
113113
sessions = true,
114114
sessionFlushingDelayMS = 60_000,
115115
} = options;
116116

117-
if (maxRequestBodySize !== 'none' && !ignoreRequestBody?.(url, request)) {
118-
patchRequestToCaptureBody(request, isolationScope, maxRequestBodySize, INTEGRATION_NAME);
117+
const effectiveBodySize =
118+
configuredBodySize ??
119+
(client.getDataCollectionOptions().httpBodies.includes('incomingRequest') ? 'medium' : 'none');
120+
121+
if (effectiveBodySize !== 'none' && !ignoreRequestBody?.(url, request)) {
122+
patchRequestToCaptureBody(request, isolationScope, effectiveBodySize, INTEGRATION_NAME);
119123
}
120124

121125
// Update the isolation scope, isolate this request

‎packages/core/src/utils/data-collection/defaultPiiToCollectionOptions.ts‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,8 @@ export function defaultPiiToCollectionOptions(sendDefaultPii?: boolean): Resolve
2626
userInfo: false,
2727
cookies: { deny: PII_HEADER_SNIPPETS },
2828
httpHeaders: { request: { deny: PII_HEADER_SNIPPETS }, response: { deny: PII_HEADER_SNIPPETS } },
29-
httpBodies: [],
29+
// Request bodies were governed by maxRequestBodySize, not sendDefaultPii, so preserve that behavior.
30+
httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
3031
urlQueryParams: { deny: PII_HEADER_SNIPPETS },
3132
// The GraphQL document has literal values redacted at collection time, so it was historically
3233
// always attached regardless of `sendDefaultPii`; keep it on to preserve that behavior.

‎packages/core/test/lib/utils/data-collection/defaultPiiToCollectionOptions.test.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ describe('defaultPiiToCollectionOptions', () => {
2525
request: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
2626
response: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
2727
},
28-
httpBodies: [],
28+
httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
2929
urlQueryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
3030
graphQL: { document: true, variables: true },
3131
genAI: { inputs: true, outputs: true },
@@ -43,7 +43,7 @@ describe('defaultPiiToCollectionOptions', () => {
4343
request: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
4444
response: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
4545
},
46-
httpBodies: [],
46+
httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
4747
urlQueryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
4848
graphQL: { document: true, variables: true },
4949
genAI: { inputs: true, outputs: true },
@@ -61,7 +61,7 @@ describe('defaultPiiToCollectionOptions', () => {
6161
request: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
6262
response: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
6363
},
64-
httpBodies: [],
64+
httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
6565
urlQueryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
6666
graphQL: { document: true, variables: true },
6767
genAI: { inputs: true, outputs: true },

‎packages/core/test/lib/utils/data-collection/resolveDataCollectionOptions.test.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ describe('resolveDataCollectionOptions', () => {
2121

2222
// sendDefaultPii undefined → restrictive bridge (backward compat; userInfo defaults to true only when dataCollection is set)
2323
expect(result.userInfo).toBe(false);
24-
expect(result.httpBodies).toEqual([]);
24+
expect(result.httpBodies).toEqual(['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse']);
2525
expect(result.genAI).toEqual({ inputs: true, outputs: true });
2626
// GraphQL documents are redacted at collection time, so they stay on to preserve legacy behavior.
2727
expect(result.graphQL).toEqual({ document: true, variables: true });
@@ -59,7 +59,7 @@ describe('resolveDataCollectionOptions', () => {
5959
const result = resolveDataCollectionOptions({ sendDefaultPii: false });
6060

6161
expect(result.userInfo).toBe(false);
62-
expect(result.httpBodies).toEqual([]);
62+
expect(result.httpBodies).toEqual(['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse']);
6363
expect(result.genAI).toEqual({ inputs: true, outputs: true });
6464
expect(result.graphQL).toEqual({ document: true, variables: true });
6565
expect(result.databaseQueryData).toBe(false);

‎packages/deno/src/integrations/http.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ const _denoHttpIntegration = ((options: DenoHttpIntegrationOptions = {}) => {
9999
spans: options.spans,
100100
ignoreStaticAssets: options.ignoreStaticAssets,
101101
ignoreIncomingRequests: options.ignoreIncomingRequests,
102-
maxRequestBodySize: options.maxRequestBodySize ?? 'medium',
102+
maxRequestBodySize: options.maxRequestBodySize,
103103
ignoreRequestBody: options.ignoreRequestBody,
104104
onSpanCreated: options.onIncomingSpanCreated,
105105
onSpanEnd: options.onIncomingSpanEnd,

‎packages/node/src/integrations/http/httpServerIntegration.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ const _httpServerIntegration = ((options: HttpServerIntegrationOptions = {}) =>
8383
const _options = {
8484
sessions: options.sessions ?? true,
8585
sessionFlushingDelayMS: options.sessionFlushingDelayMS ?? 60_000,
86-
maxRequestBodySize: options.maxRequestBodySize ?? 'medium',
86+
maxRequestBodySize: options.maxRequestBodySize,
8787
// Server spans are created by `httpServerSpansIntegration` via the
8888
// `httpServerRequest` client event + `_startSpanCallback`, not by the
8989
// core subscription helper. Explicitly opt out so the helper does not

0 commit comments

Comments
 (0)