parse_qs decodes percent-encoded query values, but reconstruction with f"{key}={item}" does not re-encode them, so characters like &, =, spaces, or % in the original values produce a malformed/ambiguous query string. Consider using urlencode() to re-encode the filtered pairs.

Also found at:

• sentry_sdk/integrations/wsgi.py:379-384

_apply_data_collection_filtering_to_query_string parses the query string with parse_qs, which percent-decodes keys and values and splits on &/=, then rebuilds the string with plain f"{key}={item}" joined by & without re-encoding. Decoded values containing &/= split into extra apparent params, so a sensitive value that was scrubbed to [Filtered] under one key can reappear intact when it was embedded (URL-encoded) inside another kept key's value. Benign percent-encoded values (e.g. q=hello%20world) are also silently corrupted in the reported query string.

Also found at:

• sentry_sdk/data_collection.py:107-116

When data_collection is configured, the if has_data_collection_enabled(...) branch is taken and never adds client.address, so client IP is silently dropped on spans even when user_info is enabled — a regression from the should_send_default_pii() path which set it.

init_kwargs.pop("_experiments", {}) mutates the shared parametrize param dict, so a re-run of the same param (e.g. via pytest-rerunfailures/flaky) would no longer see _experiments and silently exercise the wrong configuration (the data_collection config would be dropped and the assertion would check a different code path than intended).