Skip to content

feat(asgi): Gate client IP/user info behind data_collection config#6841

Merged
ericapisani merged 58 commits into
masterfrom
py-2586-gate-user-data
Jul 22, 2026
Merged

feat(asgi): Gate client IP/user info behind data_collection config#6841
ericapisani merged 58 commits into
masterfrom
py-2586-gate-user-data

feat(asgi): Gate client IP/user info behind data_collection config

0f58e13
Select commit
Loading
Failed to load commit list.
@sentry/warden / warden completed Jul 17, 2026 in 0s

3 issues

Medium

client_options may be unbound when scope type is not http/websocket - `sentry_sdk/integrations/_asgi_common.py:152-153`

In both _get_request_data and _get_request_attributes, client_options = sentry_sdk.get_client().options is assigned only inside the if ty in ("http", "websocket") block, but is later referenced unconditionally when client/asgi_scope_client is truthy. If a scope with ty other than http/websocket carries a client entry, has_data_collection_enabled(client_options) raises NameError. In practice only http/websocket ASGI scopes carry a client key (lifespan scopes do not), so this path is largely unreachable with spec-compliant servers, but it is a latent regression: the prior code branched on should_send_default_pii() and did not depend on client_options.

Also found at:

  • sentry_sdk/integrations/_asgi_common.py:233-235
client_options may be unbound when scope type is not http/websocket - `sentry_sdk/integrations/_asgi_common.py:233-235`

In _get_request_attributes, client_options = sentry_sdk.get_client().options is assigned only inside the if ty in ("http", "websocket") block, but is referenced unconditionally in the client-address block (if has_data_collection_enabled(client_options)). If the ASGI scope carries a truthy client key while ty is neither http nor websocket, Python raises UnboundLocalError. The same defect exists in _get_request_data. Per the ASGI spec, client is normally only present on http/websocket scopes, so reachability requires a non-standard scope, but the code is not defensively guarded.

Also found at:

  • sentry_sdk/integrations/_asgi_common.py:152-155
async test missing @pytest.mark.asyncio marker under strict asyncio mode - `tests/integrations/asgi/test_asgi.py:1017`

test_get_request_data_query_string_data_collection was converted to an async def but lacks the @pytest.mark.asyncio marker; under strict asyncio mode this parametrized test's body never runs and its assertions are silently skipped. Add @pytest.mark.asyncio above it like the sibling tests.

4 skills analyzed
Skill Findings Duration Cost
security-review 0 3m 47s $0.37
code-review 1 1m $0.70
find-bugs 2 4m 16s $1.22
skill-scanner 0 1m 5s $0.12

⏱ 10m 9s · 824.8k in / 51.6k out · $2.41