ref(integrations): route HTTP header filtering through data collection config#6788
1 issue
find-bugs: Found 1 issue (1 medium)
Medium
IP-revealing request headers no longer scrubbed once data_collection is enabled - `sentry_sdk/integrations/_asgi_common.py:120-124`
When _experiments["data_collection"] is set, _filter_headers routes header scrubbing through the resolved http_headers.request denylist, which lacks IP-related terms. As a result, client-IP-revealing headers such as x-forwarded-for and x-real-ip are now captured in request data, even though the legacy send_default_pii=False path scrubbed them via SENSITIVE_HEADERS. This is a PII/information-disclosure regression that is inconsistent with the SDK still gating env.REMOTE_ADDR/client.address collection on should_send_default_pii().
⏱ 6m 28s · 631.5k in / 42.1k out · $2.40
Annotations
Check warning on line 124 in sentry_sdk/integrations/_asgi_common.py
sentry-warden / warden: find-bugs
IP-revealing request headers no longer scrubbed once data_collection is enabled
When `_experiments["data_collection"]` is set, `_filter_headers` routes header scrubbing through the resolved `http_headers.request` denylist, which lacks IP-related terms. As a result, client-IP-revealing headers such as `x-forwarded-for` and `x-real-ip` are now captured in request data, even though the legacy `send_default_pii=False` path scrubbed them via `SENSITIVE_HEADERS`. This is a PII/information-disclosure regression that is inconsistent with the SDK still gating `env.REMOTE_ADDR`/`client.address` collection on `should_send_default_pii()`.