Merge pull request #5810 from getsentry/feat/data-collection-query-params

feat(http): [Data Collection 12] Apply query parameter policy

Author: adinauer

sentry-apollo-3/src/main/java/io/sentry/apollo3/SentryApollo3HttpInterceptor.kt

@@ -160,7 +160,7 @@ constructor(
     operationType: String?,
     operationId: String?,
   ): ISpan {
-    val urlDetails = UrlUtils.parse(request.url)
+    val urlDetails = UrlUtils.parse(request.url, scopes.options.dataCollectionResolver)
     val method = request.method.name
 
     val operation = if (operationType != null) "http.graphql.$operationType" else "http.graphql"
@@ -232,7 +232,13 @@ constructor(
       span.finish()
     }
 
-    val breadcrumb = Breadcrumb.http(request.url, request.method.name, statusCode)
+    val breadcrumb =
+      Breadcrumb.http(
+        request.url,
+        request.method.name,
+        statusCode,
+        scopes.options.dataCollectionResolver,
+      )
 
     request.body?.contentLength.ifHasValidLength { contentLength ->
       breadcrumb.setData("request_body_size", contentLength)
@@ -351,7 +357,7 @@ constructor(
       // url will be: https://api.github.com/users/getsentry/repos/
       // ideally we'd like a parameterized url: https://api.github.com/users/{user}/repos/
       // but that's not possible
-      val urlDetails = UrlUtils.parse(request.url)
+      val urlDetails = UrlUtils.parse(request.url, scopes.options.dataCollectionResolver)
 
       // return if its not a target match
       if (!PropagationTargetsUtils.contain(failedRequestTargets, urlDetails.urlOrFallback)) {

sentry-apollo-4/src/main/java/io/sentry/apollo4/SentryApollo4HttpInterceptor.kt

@@ -159,7 +159,7 @@ constructor(
     operationType: String?,
     operationId: String?,
   ): ISpan {
-    val urlDetails = UrlUtils.parse(request.url)
+    val urlDetails = UrlUtils.parse(request.url, scopes.options.dataCollectionResolver)
     val method = request.method.name
 
     val operation = if (operationType != null) "http.graphql.$operationType" else "http.graphql"
@@ -231,7 +231,13 @@ constructor(
       span.finish()
     }
 
-    val breadcrumb = Breadcrumb.http(request.url, request.method.name, statusCode)
+    val breadcrumb =
+      Breadcrumb.http(
+        request.url,
+        request.method.name,
+        statusCode,
+        scopes.options.dataCollectionResolver,
+      )
 
     request.body?.contentLength.ifHasValidLength { contentLength ->
       breadcrumb.setData("request_body_size", contentLength)
@@ -350,7 +356,7 @@ constructor(
       // url will be: https://api.github.com/users/getsentry/repos/
       // ideally we'd like a parameterized url: https://api.github.com/users/{user}/repos/
       // but that's not possible
-      val urlDetails = UrlUtils.parse(request.url)
+      val urlDetails = UrlUtils.parse(request.url, scopes.options.dataCollectionResolver)
 
       // return if it's not a target match
       if (!PropagationTargetsUtils.contain(failedRequestTargets, urlDetails.urlOrFallback)) {

sentry-apollo/src/main/java/io/sentry/apollo/SentryApolloInterceptor.kt

@@ -198,7 +198,12 @@ class SentryApolloInterceptor(
         val httpRequest = httpResponse.request()
 
         val breadcrumb =
-          Breadcrumb.http(httpRequest.url().toString(), httpRequest.method(), httpResponse.code())
+          Breadcrumb.http(
+            httpRequest.url().toString(),
+            httpRequest.method(),
+            httpResponse.code(),
+            scopes.options.dataCollectionResolver,
+          )
 
         httpRequest.body()?.contentLength().ifHasValidLength { contentLength ->
           breadcrumb.setData("request_body_size", contentLength)

sentry-ktor-client/src/main/java/io/sentry/ktorClient/SentryKtorClientUtils.kt

@@ -25,7 +25,7 @@ internal object SentryKtorClientUtils {
     request: HttpRequest,
     response: HttpResponse,
   ) {
-    val urlDetails = UrlUtils.parse(request.url.toString())
+    val urlDetails = UrlUtils.parse(request.url.toString(), scopes.options.dataCollectionResolver)
 
     val mechanism = Mechanism().apply { type = "SentryKtorClientPlugin" }
     val exception =
@@ -116,7 +116,12 @@ internal object SentryKtorClientUtils {
     endTimestamp: SentryDate?,
   ) {
     val breadcrumb =
-      Breadcrumb.http(request.url.toString(), request.method.value, response.status.value)
+      Breadcrumb.http(
+        request.url.toString(),
+        request.method.value,
+        response.status.value,
+        scopes.options.dataCollectionResolver,
+      )
     breadcrumb.setData(
       SpanDataConvention.HTTP_RESPONSE_CONTENT_LENGTH_KEY,
       response.contentLength(),

sentry-okhttp/src/main/java/io/sentry/okhttp/SentryOkHttpEvent.kt

@@ -34,7 +34,7 @@ internal class SentryOkHttpEvent(private val scopes: IScopes, private val reques
   private var method: String
 
   init {
-    val urlDetails = UrlUtils.parse(request.url.toString())
+    val urlDetails = UrlUtils.parse(request.url.toString(), scopes.options.dataCollectionResolver)
     url = urlDetails.urlOrFallback
     method = request.method
 
@@ -62,7 +62,7 @@ internal class SentryOkHttpEvent(private val scopes: IScopes, private val reques
    * due to interceptors.
    */
   fun setRequest(request: Request) {
-    val urlDetails = UrlUtils.parse(request.url.toString())
+    val urlDetails = UrlUtils.parse(request.url.toString(), scopes.options.dataCollectionResolver)
     url = urlDetails.urlOrFallback
 
     val host: String = request.url.host
@@ -78,8 +78,8 @@ internal class SentryOkHttpEvent(private val scopes: IScopes, private val reques
       breadcrumb.setData("url", urlDetails.url!!)
     }
     breadcrumb.setData("method", method.uppercase())
-    if (urlDetails.query != null) {
-      breadcrumb.setData("http.query", urlDetails.query!!)
+    urlDetails.query?.let {
+      breadcrumb.setData("http.query", it)
     }
     if (urlDetails.fragment != null) {
       breadcrumb.setData("http.fragment", urlDetails.fragment!!)

sentry-okhttp/src/main/java/io/sentry/okhttp/SentryOkHttpInterceptor.kt

@@ -81,7 +81,7 @@ public open class SentryOkHttpInterceptor(
   override fun intercept(chain: Interceptor.Chain): Response {
     var request = chain.request()
 
-    val urlDetails = UrlUtils.parse(request.url.toString())
+    val urlDetails = UrlUtils.parse(request.url.toString(), scopes.options.dataCollectionResolver)
     val url = urlDetails.urlOrFallback
     val method = request.method
 
@@ -235,7 +235,13 @@ public open class SentryOkHttpInterceptor(
     startTimestamp: Long,
     networkDetailData: NetworkRequestData?,
   ) {
-    val breadcrumb = Breadcrumb.http(request.url.toString(), request.method, code)
+    val breadcrumb =
+      Breadcrumb.http(
+        request.url.toString(),
+        request.method,
+        code,
+        scopes.options.dataCollectionResolver,
+      )
 
     // Track request and response body sizes for the breadcrumb
     request.body?.contentLength().ifHasValidLength {

sentry-okhttp/src/main/java/io/sentry/okhttp/SentryOkHttpUtils.kt

@@ -21,7 +21,7 @@ internal object SentryOkHttpUtils {
     // url will be: https://api.github.com/users/getsentry/repos/
     // ideally we'd like a parameterized url: https://api.github.com/users/{user}/repos/
     // but that's not possible
-    val urlDetails = UrlUtils.parse(request.url.toString())
+    val urlDetails = UrlUtils.parse(request.url.toString(), scopes.options.dataCollectionResolver)
 
     val mechanism = Mechanism().apply { type = "SentryOkHttpInterceptor" }
     val exception =

sentry-okhttp/src/test/java/io/sentry/okhttp/SentryOkHttpInterceptorTest.kt

@@ -504,6 +504,26 @@ class SentryOkHttpInterceptorTest {
       )
   }
 
+  @Test
+  fun `data collection filters failed request query parameters`() {
+    val sut =
+      fixture.getSut(
+        captureFailedRequests = true,
+        httpStatusCode = 500,
+        optionsConfiguration = { it.dataCollection.setUserInfo(false) },
+      )
+
+    sut.newCall(getRequest(url = "/hello?name=value&token=secret")).execute()
+
+    verify(fixture.scopes)
+      .captureEvent(
+        check {
+          assertEquals("name=value&token=[Filtered]", it.request!!.queryString)
+        },
+        any<Hint>(),
+      )
+  }
+
   @Test
   fun `captures an error event with request body size`() {
     val sut = fixture.getSut(captureFailedRequests = true, httpStatusCode = 500)

sentry-openfeign/src/main/java/io/sentry/openfeign/SentryFeignClient.java

@@ -73,7 +73,8 @@ public Response execute(final @NotNull Request request, final @NotNull Request.O
       final @NotNull SpanOptions spanOptions = new SpanOptions();
       spanOptions.setOrigin(TRACE_ORIGIN);
       ISpan span = activeSpan.startChild("http.client", null, spanOptions);
-      final @NotNull UrlUtils.UrlDetails urlDetails = UrlUtils.parse(request.url());
+      final @NotNull UrlUtils.UrlDetails urlDetails =
+          UrlUtils.parse(request.url(), scopes.getOptions().getDataCollectionResolver());
       final @NotNull String method = request.httpMethod().name();
       span.setDescription(method + " " + urlDetails.getUrlOrFallback());
       span.setData(SpanDataConvention.HTTP_METHOD_KEY, method.toUpperCase(Locale.ROOT));
@@ -158,7 +159,8 @@ private void addBreadcrumb(final @NotNull Request request, final @Nullable Respo
         Breadcrumb.http(
             request.url(),
             request.httpMethod().name(),
-            response != null ? response.status() : null);
+            response != null ? response.status() : null,
+            scopes.getOptions().getDataCollectionResolver());
     breadcrumb.setData("request_body_size", request.body() != null ? request.body().length : 0);
     if (response != null && response.body() != null && response.body().length() != null) {
       breadcrumb.setData("response_body_size", response.body().length());

sentry-servlet-jakarta/src/main/java/io/sentry/servlet/jakarta/SentryRequestHttpServletRequestProcessor.java

@@ -36,9 +36,11 @@ public SentryRequestHttpServletRequestProcessor(
     final Request sentryRequest = new Request();
     sentryRequest.setMethod(httpRequest.getMethod());
     final @NotNull UrlUtils.UrlDetails urlDetails =
-        UrlUtils.parse(httpRequest.getRequestURL().toString());
+        UrlUtils.parse(httpRequest.getRequestURL().toString(), options.getDataCollectionResolver());
     urlDetails.applyToRequest(sentryRequest);
-    sentryRequest.setQueryString(httpRequest.getQueryString());
+    sentryRequest.setQueryString(
+        UrlUtils.filterQueryParams(
+            httpRequest.getQueryString(), options.getDataCollectionResolver()));
     sentryRequest.setHeaders(resolveHeadersMap(httpRequest));
 
     event.setRequest(sentryRequest);