Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove authority from URLs sent to Sentry #2366

Merged
merged 15 commits into from
Jan 30, 2023

Conversation

adinauer
Copy link
Member

@adinauer adinauer commented Nov 15, 2022

📜 Description

Remove authority from URLs that are sent to Sentry, e.g. as span descriptions, breadcrumbs or requests.

💡 Motivation and Context

Fixes #2365

💚 How did you test it?

📝 Checklist

  • I reviewed the submitted code
  • I added tests to verify the changes
  • I updated the docs if needed
  • No breaking changes

🔮 Next steps

@github-actions
Copy link
Contributor

github-actions bot commented Nov 15, 2022

Messages
📖 Do not forget to update Sentry-docs with your feature once the pull request gets approved.

Generated by 🚫 dangerJS against 5254e47

@github-actions
Copy link
Contributor

github-actions bot commented Nov 15, 2022

Performance metrics 🚀

  Plain With Sentry Diff
Startup time 355.57 ms 390.90 ms 35.33 ms
Size 1.73 MiB 2.33 MiB 620.61 KiB

Previous results on branch: feat/remove-sensitive-data-from-urls

Startup times

Revision Plain With Sentry Diff
8fb596c 355.54 ms 438.55 ms 83.01 ms
46ba0df 346.57 ms 350.41 ms 3.84 ms
593148d 368.38 ms 413.20 ms 44.82 ms
15cc296 315.33 ms 419.94 ms 104.61 ms

App size

Revision Plain With Sentry Diff
8fb596c 1.73 MiB 2.33 MiB 620.61 KiB
46ba0df 1.73 MiB 2.33 MiB 621.15 KiB
593148d 1.73 MiB 2.33 MiB 621.15 KiB
15cc296 1.73 MiB 2.33 MiB 620.61 KiB

@codecov
Copy link

codecov bot commented Jan 20, 2023

Codecov Report

Base: 80.12% // Head: 80.18% // Increases project coverage by +0.05% 🎉

Coverage data is based on head (5254e47) compared to base (9ab45a7).
Patch coverage: 87.39% of modified lines in pull request are covered.

Additional details and impacted files
@@             Coverage Diff              @@
##               main    #2366      +/-   ##
============================================
+ Coverage     80.12%   80.18%   +0.05%     
- Complexity     3919     3943      +24     
============================================
  Files           322      323       +1     
  Lines         14796    14896     +100     
  Branches       1951     1966      +15     
============================================
+ Hits          11856    11944      +88     
- Misses         2171     2178       +7     
- Partials        769      774       +5     
Impacted Files Coverage Δ
...racing/SentrySpanClientHttpRequestInterceptor.java 0.00% <0.00%> (ø)
...racing/SentrySpanClientHttpRequestInterceptor.java 0.00% <0.00%> (ø)
.../io/sentry/apollo3/SentryApollo3HttpInterceptor.kt 79.77% <75.00%> (ø)
sentry/src/main/java/io/sentry/Breadcrumb.java 85.95% <85.71%> (-0.10%) ⬇️
sentry/src/main/java/io/sentry/util/UrlUtils.java 90.90% <90.90%> (ø)
...in/java/io/sentry/openfeign/SentryFeignClient.java 94.36% <100.00%> (+0.16%) ⬆️
...arta/SentryRequestHttpServletRequestProcessor.java 94.73% <100.00%> (+0.61%) ⬆️
...vlet/SentryRequestHttpServletRequestProcessor.java 94.73% <100.00%> (+0.61%) ⬆️
...o/sentry/spring/jakarta/SentryRequestResolver.java 94.73% <100.00%> (+0.29%) ⬆️
.../spring/jakarta/webflux/SentryRequestResolver.java 71.42% <100.00%> (+1.42%) ⬆️
... and 3 more

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

@adinauer adinauer changed the title Remove sensitive data from URLs sent to Sentry Remove authority from URLs sent to Sentry Jan 23, 2023
@adinauer adinauer marked this pull request as ready for review January 23, 2023 11:49
Copy link
Member

@cleptric cleptric left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just checked how the query and fragment are now set on the span/breadcrumb, LGTM!

Copy link
Member

@markushi markushi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice one, I like the extensive tests!

}

private static @NotNull String baseUrlOnly(final @NotNull String url) {
final int queryParamSeparatorIndex = url.indexOf("?");
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

l: Can't you use java built-in URL class here instead?
I haven't tried it but

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess you could reconstruct the base URL from parts retrieved from URL but imo that wouldn't be any better than the current code.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Alright, then let's keep it this way. I just checked a few exotic URLs (like example.com/?/path/?query=param) and your solution provides better output than the URL api 👍

return convertUrl(url);
}

public static @NotNull UrlDetails convertUrl(final @NotNull String url) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

l: I'm wondering if parse() or parseUrl() would suit better here

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No preference here. Can rename it if you want.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah I think it would fit better, but I'm definitely nit-picking here - if it's too much effort to refactor leave it as is 😅

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated

Comment on lines 8 to 12
import java.util.regex.Pattern;
import org.jetbrains.annotations.NotNull;
import org.jetbrains.annotations.Nullable;

public final class UrlUtils {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess we could mark this as @ApiStatus.Internal right?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

@adinauer adinauer merged commit 5fa24ec into main Jan 30, 2023
@adinauer adinauer deleted the feat/remove-sensitive-data-from-urls branch January 30, 2023 12:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Sanitize sensitive data from URLs sent to Sentry
4 participants