feat(asgi): Gate client IP/user info behind data_collection config#6841
1 issue
code-review: Found 1 issue (1 medium)
Medium
client_options may be unbound when scope type is not http/websocket - `sentry_sdk/integrations/_asgi_common.py:152-153`
In both _get_request_data and _get_request_attributes, client_options = sentry_sdk.get_client().options is assigned only inside the if ty in ("http", "websocket") block, but is later referenced unconditionally when client/asgi_scope_client is truthy. If a scope with ty other than http/websocket carries a client entry, has_data_collection_enabled(client_options) raises NameError. In practice only http/websocket ASGI scopes carry a client key (lifespan scopes do not), so this path is largely unreachable with spec-compliant servers, but it is a latent regression: the prior code branched on should_send_default_pii() and did not depend on client_options.
Also found at:
sentry_sdk/integrations/_asgi_common.py:233-235
⏱ 1m · 183.9k in / 12.0k out · $0.70
Annotations
Check warning on line 153 in sentry_sdk/integrations/_asgi_common.py
sentry-warden / warden: code-review
client_options may be unbound when scope type is not http/websocket
In both `_get_request_data` and `_get_request_attributes`, `client_options = sentry_sdk.get_client().options` is assigned only inside the `if ty in ("http", "websocket")` block, but is later referenced unconditionally when `client`/`asgi_scope_client` is truthy. If a scope with `ty` other than http/websocket carries a `client` entry, `has_data_collection_enabled(client_options)` raises `NameError`. In practice only http/websocket ASGI scopes carry a `client` key (lifespan scopes do not), so this path is largely unreachable with spec-compliant servers, but it is a latent regression: the prior code branched on `should_send_default_pii()` and did not depend on `client_options`.
Check warning on line 235 in sentry_sdk/integrations/_asgi_common.py
sentry-warden / warden: code-review
[DVQ-38F] client_options may be unbound when scope type is not http/websocket (additional location)
In both `_get_request_data` and `_get_request_attributes`, `client_options = sentry_sdk.get_client().options` is assigned only inside the `if ty in ("http", "websocket")` block, but is later referenced unconditionally when `client`/`asgi_scope_client` is truthy. If a scope with `ty` other than http/websocket carries a `client` entry, `has_data_collection_enabled(client_options)` raises `NameError`. In practice only http/websocket ASGI scopes carry a `client` key (lifespan scopes do not), so this path is largely unreachable with spec-compliant servers, but it is a latent regression: the prior code branched on `should_send_default_pii()` and did not depend on `client_options`.