Centralized way to configure custom instrumentation

[antonpirker]

Have a list of functions that can be passed to "sentry_sdk.init()". When the SDK starts it goes through the list and instruments all the functions in the list.

functions_to_trace = [
    {"qualified_name": "tests.test_basics._hello_world_counter"},
    {"qualified_name": "time.sleep"},
    {"qualified_name": "collections.Counter.most_common"},
]

sentry_sdk.init(
    dsn="...",
    traces_sample_rate=1.0,
    functions_to_trace=functions_to_trace,
)

Fixes #1963
Docs: getsentry/sentry-docs#6520
Fixes getsentry/team-webplatform-meta#19

[sl0thentr0py]

this import_module is a lot of magic, because

• you might accidentally run user code that was not supposed to run just because sentry needs to know what's in that namespace
• is also a potential security issue / injection vector since you're letting users specify arbitrary modules and then actually performing IO on them. This is basically an eval call and we should be very careful of introducing such things in our codebase.

[antonpirker]

Yes, true. If there is code executed on module load it could be have unintentional behavior.

But this optional and is only active when functions_to_trace is set.

What if we point out this concerns in the documentation, so people know about them when activating this feature?

[antonpirker]

@mitsuhiko can I get your opinion on this? Should we avoid putting import_module in the SDK (although it needs to be enabled by default)?

[mitsuhiko]

I’m okay with importing from strings. But I can’t say about the feature as such.

[antonpirker]

Are you saying you can not say anything about the feature, or are you saying that you are not okay with the feature @mitsuhiko ?

[antonpirker]

(On another note, @mdtro (Matthew T) said in slack: A note in the documentation is sufficient, imo. The list should be static or loaded from a secure source (no user or untrusted input).)

[antonpirker]

Documentation for this feature is here: getsentry/sentry-docs#6520

[davidgrohmann]

@antonpirker FYI the docs in getsentry/sentry-docs#6520 do not match your implementation in this PR
docs state that functions_to_trace is a list of strings, but you are expecting a list of dictionaries each with a "qualified_name" field

https://docs.sentry.io/platforms/python/performance/instrumentation/custom-instrumentation/?original_referrer=https%3A%2F%2Fwww.google.com%2F#define-span-creation-in-a-central-place

[sentrivana]

Hey @davidgrohmann, thanks for pointing that out. I'll fix the docs.