Skip to content

fix(scrubber): Scrub request bodies that are JSON arrays - #7561

Draft
Om-singhaI wants to merge 1 commit into
getsentry:masterfrom
Om-singhaI:fix/scrub-top-level-array-request-body
Draft

Om-singhaI wants to merge 1 commit into
getsentry:masterfrom
Om-singhaI:fix/scrub-top-level-array-request-body

Conversation

@Om-singhaI

Copy link
Copy Markdown

Description

scrub_request only calls scrub_dict on event["request"]["data"], and scrub_dict returns immediately for anything that isn't a dict. So a body that parses to a top level JSON array is skipped entirely and every secret in it ships in the clear. It happens under the default scrubber, no config needed.

scrub_list already handles this shape. Its docstring says it walks a list and any nested lists and calls scrub_dict on every dictionary it finds, and scrub_dict already hands nested lists to it when recursive is on. It just was never called on the request body.

What changed:

  • scrub_request now calls scrub_dict and then scrub_list on event["request"]["data"]. Each one ignores the type it doesn't handle, so dict bodies behave exactly as before.
  • Two tests in tests/test_scrubber.py, one for a list body under the default scrubber and one for a dict nested inside a list body with recursive=True.

One thing worth your call: scrub_list recurses into nested lists no matter what recursive is set to, so [[{"password": "x"}]] now gets filtered where today it isn't. That only ever filters more, never less. If you'd rather keep the shallow path exact I can gate the call on self.recursive instead.

Issues

resolves: #7543

Testing

  • pytest tests/test_scrubber.py 13 passed, was 11 passed on master
  • pytest tests/integrations/wsgi/test_wsgi.py 76 passed
  • checking out only sentry_sdk/scrubber.py from master and rerunning: both new tests fail, assert {'data': [{'token': 'secret', ...}]} == {'data': [{'token': '[Filtered]', ...}]}
  • ruff check and ruff format --check clean on sentry_sdk/scrubber.py and tests/test_scrubber.py
  • Flask repro from the issue, array body goes from [{"password": "hunter2", "user": "a"}] to [{"password": "[Filtered]", "user": "a"}], object body unchanged at {"password": "[Filtered]", "user": "a"}

scrub_request only called scrub_dict on event["request"]["data"], and
scrub_dict returns immediately for anything that is not a dict, so a
request body parsed as a top level JSON array was never scrubbed. Call
the existing scrub_list helper on the body as well.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

EventScrubber doesn't scrub a request body that's a top level JSON array

1 participant