feat(wsgi): Gate client IP/user info behind data_collection config

sentry_sdk/client.py

@@ -63,6 +63,7 @@
     get_sdk_name,
     get_type_name,
     handle_in_app,
+    has_data_collection_enabled,
     has_logs_enabled,
     has_metrics_enabled,
     logger,
@@ -351,12 +352,20 @@
 
     rv["data_collection"] = _resolve_data_collection(rv)
 
-    if rv["event_scrubber"] is None:
+    # Do not add the event scrubber if data collection is enabled as it can remove data that's
+    # collected under data collection config
+    if not has_data_collection_enabled(rv) and rv["event_scrubber"] is None:
         rv["event_scrubber"] = EventScrubber(
             send_default_pii=False
             if rv["send_default_pii"] is None
             else rv["send_default_pii"]
         )
+    elif has_data_collection_enabled(rv) and rv["event_scrubber"]:
+        warnings.warn(
+            "Event scrubbers are not enabled when data collection configuration is provided. Ignoring event_scrubber...",
+            stacklevel=2,
+        )
+        rv["event_scrubber"] = None
 
     if rv["socket_options"] and not isinstance(rv["socket_options"], list):
         logger.warning(

sentry_sdk/integrations/_asgi_common.py

@@ -115,6 +115,7 @@ def _get_request_data(
     """
     request_data: "Dict[str, Any]" = {}
     ty = asgi_scope["type"]
+    client_options = sentry_sdk.get_client().options
     if ty in ("http", "websocket"):
         request_data["method"] = asgi_scope.get("method")
 
@@ -125,7 +126,6 @@ def _get_request_data(
             use_annotated_value=False,
         )
 
-        client_options = sentry_sdk.get_client().options
         if has_data_collection_enabled(client_options):
             qs = _get_query(asgi_scope)
             if qs:
@@ -148,8 +148,12 @@ def _get_request_data(
         )
 
     client = asgi_scope.get("client")
-    if client and should_send_default_pii():
-        request_data["env"] = {"REMOTE_ADDR": _get_ip(asgi_scope)}
+    if client:
+        if has_data_collection_enabled(client_options):
+            if client_options["data_collection"]["user_info"]:
+                request_data["env"] = {"REMOTE_ADDR": _get_ip(asgi_scope)}
+        elif should_send_default_pii():
+            request_data["env"] = {"REMOTE_ADDR": _get_ip(asgi_scope)}
 
     return request_data
 
@@ -164,6 +168,7 @@ def _get_request_attributes(
     attributes: "dict[str, Any]" = {}
 
     ty = asgi_scope["type"]
+    client_options = sentry_sdk.get_client().options
     if ty in ("http", "websocket"):
         if asgi_scope.get("method"):
             attributes["http.request.method"] = asgi_scope["method"].upper()
@@ -174,7 +179,6 @@ def _get_request_attributes(
         for header, value in filtered_headers.items():
             attributes[f"http.request.header.{header.lower()}"] = value
 
-        client_options = sentry_sdk.get_client().options
         if has_data_collection_enabled(client_options):
             filtered_query_string = None
             query = _get_query(asgi_scope)
@@ -226,9 +230,14 @@ def _get_request_attributes(
                 else url_without_query_string
             )
 
-    client = asgi_scope.get("client")
-    if client and should_send_default_pii():
-        ip = _get_ip(asgi_scope)
-        attributes["client.address"] = ip
+    asgi_scope_client = asgi_scope.get("client")
+    if asgi_scope_client:
+        if has_data_collection_enabled(client_options):
+            if client_options["data_collection"]["user_info"]:
+                ip = _get_ip(asgi_scope)
+                attributes["client.address"] = ip
+        elif should_send_default_pii():
+            ip = _get_ip(asgi_scope)
+            attributes["client.address"] = ip
 
     return attributes

sentry_sdk/integrations/aws_lambda.py

@@ -11,6 +11,7 @@
 import sentry_sdk
 from sentry_sdk.api import continue_trace
 from sentry_sdk.consts import OP
+from sentry_sdk.data_collection import _apply_key_value_collection_filtering
 from sentry_sdk.integrations import Integration
 from sentry_sdk.integrations._wsgi_common import _filter_headers
 from sentry_sdk.integrations.cloud_resource_context import (
@@ -27,6 +28,7 @@
     capture_internal_exceptions,
     ensure_integration_enabled,
     event_from_exception,
+    has_data_collection_enabled,
     logger,
     reraise,
 )
@@ -164,10 +166,20 @@ def sentry_handler(
                     "httpMethod"
                 ]
 
-            if should_send_default_pii() and "queryStringParameters" in request_data:
+            if "queryStringParameters" in request_data:
                 qs = request_data["queryStringParameters"]
                 if qs:
-                    additional_attributes["url.query"] = urlencode(qs)
+                    if has_data_collection_enabled(client.options):
+                        filtered_qs = _apply_key_value_collection_filtering(
+                            items=qs,
+                            behaviour=client.options["data_collection"][
+                                "url_query_params"
+                            ],
+                        )
+                        if filtered_qs:
+                            additional_attributes["url.query"] = urlencode(filtered_qs)
+                    elif should_send_default_pii():
+                        additional_attributes["url.query"] = urlencode(qs)
 
             sampling_context = {
                 "aws_event": aws_event,
@@ -409,7 +421,18 @@ def event_processor(
         request["url"] = _get_url(aws_event, aws_context)
 
         if "queryStringParameters" in aws_event:
-            request["query_string"] = aws_event["queryStringParameters"]
+            query_string = aws_event["queryStringParameters"]
+            client_options = sentry_sdk.get_client().options
+            if has_data_collection_enabled(client_options):
+                if query_string:
+                    filtered_qs = _apply_key_value_collection_filtering(
+                        items=query_string,
+                        behaviour=client_options["data_collection"]["url_query_params"],
+                    )
+                    if filtered_qs:
+                        request["query_string"] = filtered_qs
+            else:
+                request["query_string"] = query_string
 
         if "headers" in aws_event:
             request["headers"] = _filter_headers(aws_event["headers"])

sentry_sdk/integrations/gcp.py

@@ -8,6 +8,7 @@
 import sentry_sdk
 from sentry_sdk.api import continue_trace
 from sentry_sdk.consts import OP
+from sentry_sdk.data_collection import _apply_data_collection_filtering_to_query_string
 from sentry_sdk.integrations import Integration
 from sentry_sdk.integrations._wsgi_common import _filter_headers
 from sentry_sdk.integrations.cloud_resource_context import CLOUD_PROVIDER
@@ -20,6 +21,7 @@
     TimeoutThread,
     capture_internal_exceptions,
     event_from_exception,
+    has_data_collection_enabled,
     logger,
     reraise,
 )
@@ -100,10 +102,20 @@ def sentry_func(
             if hasattr(gcp_event, "method"):
                 additional_attributes["http.request.method"] = gcp_event.method
 
-            if should_send_default_pii() and hasattr(gcp_event, "query_string"):
-                additional_attributes["url.query"] = gcp_event.query_string.decode(
-                    "utf-8", errors="replace"
-                )
+            if hasattr(gcp_event, "query_string"):
+                query_string = gcp_event.query_string.decode("utf-8", errors="replace")
+                if query_string:
+                    if has_data_collection_enabled(client.options):
+                        filtered_qs = _apply_data_collection_filtering_to_query_string(
+                            query_string=query_string,
+                            behaviour=client.options["data_collection"][
+                                "url_query_params"
+                            ],
+                        )
+                        if filtered_qs:
+                            additional_attributes["url.query"] = filtered_qs
+                    elif should_send_default_pii():
+                        additional_attributes["url.query"] = query_string
 
             sampling_context = {
                 "gcp_env": {
@@ -235,9 +247,18 @@ def event_processor(event: "Event", hint: "Hint") -> "Optional[Event]":
             request["method"] = gcp_event.method
 
         if hasattr(gcp_event, "query_string"):
-            request["query_string"] = gcp_event.query_string.decode(
-                "utf-8", errors="replace"
-            )
+            query_string = gcp_event.query_string.decode("utf-8", errors="replace")
+            client_options = sentry_sdk.get_client().options
+            if has_data_collection_enabled(client_options):
+                if query_string:
+                    filtered_qs = _apply_data_collection_filtering_to_query_string(
+                        query_string=query_string,
+                        behaviour=client_options["data_collection"]["url_query_params"],
+                    )
+                    if filtered_qs:
+                        request["query_string"] = filtered_qs
+            else:
+                request["query_string"] = query_string
 
         if hasattr(gcp_event, "headers"):
             request["headers"] = _filter_headers(gcp_event.headers)

sentry_sdk/integrations/quart.py

@@ -5,6 +5,7 @@
 from typing import TYPE_CHECKING
 
 import sentry_sdk
+from sentry_sdk.data_collection import _apply_data_collection_filtering_to_query_string
 from sentry_sdk.integrations import DidNotEnable, Integration
 from sentry_sdk.integrations._wsgi_common import _filter_headers
 from sentry_sdk.integrations.asgi import SentryAsgiMiddleware
@@ -17,6 +18,8 @@
     capture_internal_exceptions,
     ensure_integration_enabled,
     event_from_exception,
+    has_data_collection_enabled,
+    parse_url,
 )
 
 if TYPE_CHECKING:
@@ -203,7 +206,39 @@ async def _request_websocket_started(app: "Quart", **kwargs: "Any") -> None:
 
             segment.set_attributes(header_attributes)
 
-            if should_send_default_pii():
+            client_options = sentry_sdk.get_client().options
+            filtered_query_string = None
+            if has_data_collection_enabled(client_options):
+                query_string = request_websocket.query_string.decode(
+                    "utf-8", errors="replace"
+                )
+                if query_string:
+                    filtered_query_string = (
+                        _apply_data_collection_filtering_to_query_string(
+                            query_string=query_string,
+                            behaviour=client_options["data_collection"][
+                                "url_query_params"
+                            ],
+                        )
+                    )
+                    if filtered_query_string:
+                        segment.set_attribute(
+                            "url.query",
+                            filtered_query_string,
+                        )
+
+                parsed_url = parse_url(request_websocket.url)
+                segment.set_attribute(
+                    "url.full",
+                    f"{parsed_url.url}?{filtered_query_string}"
+                    if filtered_query_string
+                    else parsed_url.url,
+                )
+
+                # TODO: Add the user properties that are seen in the branch below here once
+                # code is added to respect the `user_info` settings within the data collection
+                # configuration
+            elif should_send_default_pii():
                 segment.set_attribute("url.full", request_websocket.url)
                 segment.set_attribute(
                     "url.query",

sentry_sdk/integrations/wsgi.py

@@ -136,7 +136,14 @@ def __call__(
                             )
                             Scope.set_custom_sampling_context({"wsgi_environ": environ})
 
-                            if should_send_default_pii():
+                            if has_data_collection_enabled(client.options):
+                                if client.options["data_collection"]["user_info"]:
+                                    client_ip = get_client_ip(environ)
+                                    if client_ip:
+                                        scope.set_attribute(
+                                            SPANDATA.USER_IP_ADDRESS, client_ip
+                                        )
+                            elif should_send_default_pii():
                                 client_ip = get_client_ip(environ)
                                 if client_ip:
                                     scope.set_attribute(
@@ -243,9 +250,14 @@ def _get_environ(environ: "Dict[str, str]") -> "Iterator[Tuple[str, str]]":
     capture (server name, port and remote addr if pii is enabled).
     """
     keys = ["SERVER_NAME", "SERVER_PORT"]
-    if should_send_default_pii():
-        # make debugging of proxy setup easier. Proxy headers are
-        # in headers.
+    client_options = sentry_sdk.get_client().options
+
+    # make debugging of proxy setup easier. Proxy headers are
+    # in headers.
+    if has_data_collection_enabled(client_options):
+        if client_options["data_collection"]["user_info"]:
+            keys += ["REMOTE_ADDR"]
+    elif should_send_default_pii():
         keys += ["REMOTE_ADDR"]
 
     for key in keys:
@@ -364,7 +376,12 @@ def event_processor(event: "Event", hint: "Dict[str, Any]") -> "Event":
             # if the code below fails halfway through we at least have some data
             request_info = event.setdefault("request", {})
 
-            if should_send_default_pii():
+            if has_data_collection_enabled(client_options):
+                if client_options["data_collection"]["user_info"]:
+                    user_info = event.setdefault("user", {})
+                    if client_ip:
+                        user_info.setdefault("ip_address", client_ip)
+            elif should_send_default_pii():
                 user_info = event.setdefault("user", {})
                 if client_ip:
                     user_info.setdefault("ip_address", client_ip)
@@ -442,6 +459,11 @@ def _get_request_attributes(
 
         attributes["url.full"] = get_request_url(environ, use_x_forwarded_for)
 
+        if client_options["data_collection"]["user_info"]:
+            client_ip = get_client_ip(environ)
+            if client_ip:
+                attributes["client.address"] = client_ip
+
     elif should_send_default_pii():
         client_ip = get_client_ip(environ)
         if client_ip: