feat(aiohttp): Apply data_collection filtering to URL query strings by ericapisani · Pull Request #6833 · getsentry/sentry-python

ericapisani · 2026-07-16T18:00:46Z

Use the new data_collection settings to filter url.query and related
span attributes for both the aiohttp server and client integrations,
falling back to should_send_default_pii() when data_collection is not
configured.

Refs #6743
Refs #6743

…n config `_filter_headers` previously used a hardcoded sensitive-header tuple and a `send_default_pii`/`use_annotated_value` toggle. It now delegates to `_apply_key_value_collection_filtering` from `sentry_sdk.data_collection`, so header scrubbing respects the new `data_collection.http_headers.request` allowlist/denylist/off configuration. Cookie and set-cookie headers are always redacted regardless of mode. Drops the now-unused `use_annotated_value` parameter from all call sites. Work to scrub cookies in a more granular way will be tackled as part of PY-2581/#6741. Fixes PY-2584 Fixes #6744

… _experiments property in the client

…still being needed for the url attribute

…ures The new lambda_functions_with_embedded_sdk fixture directories were missing the .gitignore that the other fixtures use to keep everything except index.py untracked. As a result, certifi and urllib3 packages installed by the test setup got committed, and ruff failed CI linting against them since they're unmodified third-party code. Add the missing .gitignore to each new fixture directory and remove the committed vendored packages; they are regenerated automatically at test time via `uv pip install --target`.

…tarlette, litestar, starlite Extends the granular cookie collection controls (data_collection.cookies) to _wsgi_common, starlette, litestar, and starlite, matching the behavior already used elsewhere. Falls back to should_send_default_pii() when data_collection is not configured for cookies. HTTP "Cookie" and "set-cookie" headers will continue to be completely filtered with the "[Filtered]" value. Fixes PY-2581 Fixes #6741

…de is off Previously the async request extractors attached an empty cookies dict when the data_collection cookies mode was off, while sync route handlers omitted it entirely. Make all integrations consistent by not attaching the cookies field at all when filtering yields no cookies.

…n config `_filter_headers` previously used a hardcoded sensitive-header tuple and a `send_default_pii`/`use_annotated_value` toggle. It now delegates to `_apply_key_value_collection_filtering` from `sentry_sdk.data_collection`, so header scrubbing respects the new `data_collection.http_headers.request` allowlist/denylist/off configuration. Cookie and set-cookie headers are always redacted regardless of mode. Drops the now-unused `use_annotated_value` parameter from all call sites. Work to scrub cookies in a more granular way will be tackled as part of PY-2581/#6741. Fixes PY-2584 Fixes #6744

… _experiments property in the client

…still being needed for the url attribute

…ures The new lambda_functions_with_embedded_sdk fixture directories were missing the .gitignore that the other fixtures use to keep everything except index.py untracked. As a result, certifi and urllib3 packages installed by the test setup got committed, and ruff failed CI linting against them since they're unmodified third-party code. Add the missing .gitignore to each new fixture directory and remove the committed vendored packages; they are regenerated automatically at test time via `uv pip install --target`.

…ntry/sentry-python into py-2584-update-wsgi-filter-headers

…tarlette, litestar, starlite Extends the granular cookie collection controls (data_collection.cookies) to _wsgi_common, starlette, litestar, and starlite, matching the behavior already used elsewhere. Falls back to should_send_default_pii() when data_collection is not configured for cookies. HTTP "Cookie" and "set-cookie" headers will continue to be completely filtered with the "[Filtered]" value. Fixes PY-2581 Fixes #6741

…de is off Previously the async request extractors attached an empty cookies dict when the data_collection cookies mode was off, while sync route handlers omitted it entirely. Make all integrations consistent by not attaching the cookies field at all when filtering yields no cookies.

…into py-2581-cookies

The streaming path no longer emits a client span when there is no current span (#6810), so unpack only the server span.

Filter WSGI request event and span query strings through the data_collection.url_query_params behaviour (denylist/allowlist/off) instead of gating query string capture solely on send_default_pii. This brings WSGI-based integrations in line with the data collection spec's handling of cookies and headers. Rename the data_collection field query_params to url_query_params to match the updated data collection spec, which distinguishes URL query params from other key-value data (cookies, headers). Update the DataCollection/DataCollectionUserOptions TypedDicts, resolution logic in data_collection.py, and all WSGI/Flask/Django test coverage accordingly. Refs PY-2583

…orm with what is shown in the data collection spec

Filter query string parameters in the ASGI request data and span attributes according to the data_collection.url_query_params config, mirroring the existing WSGI behaviour. Falls back to the legacy send_default_pii check when data_collection is not enabled. Refs PY-2583 Refs #6743

Use the new data_collection settings to filter url.query and related span attributes for both the aiohttp server and client integrations, falling back to should_send_default_pii() when data_collection is not configured. Refs PY-2583 Refs #6743

linear-code · 2026-07-16T18:00:50Z

PY-2583

github-actions · 2026-07-16T18:11:42Z

Codecov Results 📊

✅ 93960 passed | ⏭️ 6304 skipped | Total: 100264 | Pass Rate: 93.71% | Execution Time: 327m 7s

📊 Comparison with Base Branch

Metric	Change
Total Tests	📈 +263
Passed Tests	📈 +263
Failed Tests	📉 -1
Skipped Tests	📈 +1

All tests are passing successfully.

✅ Patch coverage is 92.31%. Project has 2478 uncovered lines.
✅ Project coverage is 89.75%. Comparing base (base) to head (head).

Files with missing lines (1)

File	Patch %	Lines
sentry_sdk/integrations/aiohttp.py	92.31%	⚠️ 2 Missing and 5 partials

Coverage diff

@@            Coverage Diff             @@
##          main       #PR       +/-##
==========================================
+ Coverage    89.74%    89.75%    +0.01%
==========================================
  Files          193       193         —
  Lines        24149     24167       +18
  Branches      8430      8446       +16
==========================================
+ Hits         21670     21689       +19
- Misses        2479      2478        -1
- Partials      1391      1392        +1

Generated by Codecov Action

sentrivana

Nice!

sentrivana · 2026-07-22T11:06:19Z

                        url_attributes = {}
-                        if should_send_default_pii():
+                        if has_data_collection_enabled(client.options):
+                            url_attributes["url.full"] = "%s://%s%s" % (


I know this is just copied from the should_send_default_pii branch, but I've just realized it's wrong: url.full should contain the query and it doesn't.

Probably makes more sense to fix this afterwards, when this stack has been merged. I'll make an issue for it.

Thanks! 🙏🏻

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 407ad17. Configure here.}

sentry-warden · 2026-07-22T18:18:14Z

@@ -5,6 +5,9 @@
 import sentry_sdk
 from sentry_sdk.api import continue_trace
 from sentry_sdk.consts import OP, SPANDATA, SPANSTATUS


Legacy client span leaks unfiltered query strings when data_collection is configured

The legacy (non-streaming) client span path stores the raw query string without applying _apply_data_collection_filtering_to_query_string, so sensitive parameters bypass the user-configured data_collection filters.

Evidence

_apply_data_collection_filtering_to_query_string is imported at line 7 for use in the streaming span path.

In the streaming client path (on_request_start, ~line 400), parsed_url.query is filtered before being stored in attributes["url.query"].

In the legacy client else branch at line 428, legacy_span.set_data(SPANDATA.HTTP_QUERY, parsed_url.query) stores the raw, unfiltered query string regardless of data_collection settings.

The new tests added in test_aiohttp.py (test_client_url_query_data_collection_span_streaming) only exercise the streaming path with trace_lifecycle="stream", leaving the legacy path uncovered.

_{Identified by Warden find-bugs · EJW-8M7}

ericapisani added 30 commits July 8, 2026 15:36

Merge branch 'master' into py-2584-update-wsgi-filter-headers

5e9f610

Make changes to adjust to the data collection option being within the…

a590c8e

… _experiments property in the client

fix test

16ed0c8

make sure host header is not filtered when being added to the url

486f0bc

add test coverage for edge case around host header being dropped but …

7d14a81

…still being needed for the url attribute

add aws lambda test coverage

bb98334

add test coverage within the wsgi test file

951c408

update tornado test

ec6f520

Make changes to adjust to the data collection option being within the…

d0bae90

… _experiments property in the client

fix test

a6c4688

make sure host header is not filtered when being added to the url

d7b378b

add test coverage for edge case around host header being dropped but …

52c2da1

…still being needed for the url attribute

add aws lambda test coverage

aa645d7

add test coverage within the wsgi test file

d717172

Merge branch 'py-2584-update-wsgi-filter-headers' of github.com:getse…

c7f590f

…ntry/sentry-python into py-2584-update-wsgi-filter-headers

update tornado test

326d796

Merge branch 'master' into py-2584-update-wsgi-filter-headers

e9f0e20

Merge branch 'py-2581-cookies' of github.com:getsentry/sentry-python …

48f7c7b

…into py-2581-cookies

Merge branch 'py-2584-update-wsgi-filter-headers' into py-2581-cookies

621d79b

test(aiohttp): Expect single span in streaming passthrough test

3d7bddb

The streaming path no longer emits a client span when there is no current span (#6810), so unpack only the server span.

Merge branch 'py-2584-update-wsgi-filter-headers' into py-2581-cookies

fad2292

ericapisani added 6 commits July 15, 2026 15:56

Merge branch 'py-2581-cookies' into py-2583-query-parameters

e6e7148

lint

1f9bce7

Do not encode what is added to event/span attributes in order to conf…

fad0c9a

…orm with what is shown in the data collection spec

lint

3f0bc2a

ericapisani marked this pull request as ready for review July 16, 2026 18:04

ericapisani requested a review from a team as a code owner July 16, 2026 18:04

sentrivana approved these changes Jul 22, 2026

View reviewed changes

Base automatically changed from py-2583-query-params-asgi to master July 22, 2026 17:46

Merge branch 'master' into py-2583-query-params-aiohttp

407ad17

cursor Bot reviewed Jul 22, 2026

View reviewed changes

Comment thread tests/integrations/aiohttp/test_aiohttp.py Outdated

address CR comments within aiohttp

b6b6e1e

ericapisani merged commit 260677e into master Jul 22, 2026
141 checks passed

ericapisani deleted the py-2583-query-params-aiohttp branch July 22, 2026 18:08

sentry-warden Bot reviewed Jul 22, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(aiohttp): Apply data_collection filtering to URL query strings#6833

feat(aiohttp): Apply data_collection filtering to URL query strings#6833
ericapisani merged 38 commits into
masterfrom
py-2583-query-params-aiohttp

ericapisani commented Jul 16, 2026 •

edited

Loading

Uh oh!

linear-code Bot commented Jul 16, 2026

Uh oh!

github-actions Bot commented Jul 16, 2026 •

edited

Loading

Uh oh!

sentrivana left a comment

Uh oh!

sentrivana Jul 22, 2026

Uh oh!

sentrivana Jul 22, 2026

Uh oh!

ericapisani Jul 22, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Uh oh!

sentry-warden Bot Jul 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ericapisani commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

linear-code Bot commented Jul 16, 2026

Uh oh!

github-actions Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Results 📊

📊 Comparison with Base Branch

Uh oh!

sentrivana left a comment

Choose a reason for hiding this comment

Uh oh!

sentrivana Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

sentrivana Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

ericapisani Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

sentry-warden Bot Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ericapisani commented Jul 16, 2026 •

edited

Loading

github-actions Bot commented Jul 16, 2026 •

edited

Loading