feat(asgi): Gate client IP/user info behind data_collection config#6841
3 issues
Medium
client_options may be unbound when scope type is not http/websocket - `sentry_sdk/integrations/_asgi_common.py:152-153`
In both _get_request_data and _get_request_attributes, client_options = sentry_sdk.get_client().options is assigned only inside the if ty in ("http", "websocket") block, but is later referenced unconditionally when client/asgi_scope_client is truthy. If a scope with ty other than http/websocket carries a client entry, has_data_collection_enabled(client_options) raises NameError. In practice only http/websocket ASGI scopes carry a client key (lifespan scopes do not), so this path is largely unreachable with spec-compliant servers, but it is a latent regression: the prior code branched on should_send_default_pii() and did not depend on client_options.
Also found at:
sentry_sdk/integrations/_asgi_common.py:233-235
client_options may be unbound when scope type is not http/websocket - `sentry_sdk/integrations/_asgi_common.py:233-235`
In _get_request_attributes, client_options = sentry_sdk.get_client().options is assigned only inside the if ty in ("http", "websocket") block, but is referenced unconditionally in the client-address block (if has_data_collection_enabled(client_options)). If the ASGI scope carries a truthy client key while ty is neither http nor websocket, Python raises UnboundLocalError. The same defect exists in _get_request_data. Per the ASGI spec, client is normally only present on http/websocket scopes, so reachability requires a non-standard scope, but the code is not defensively guarded.
Also found at:
sentry_sdk/integrations/_asgi_common.py:152-155
async test missing @pytest.mark.asyncio marker under strict asyncio mode - `tests/integrations/asgi/test_asgi.py:1017`
test_get_request_data_query_string_data_collection was converted to an async def but lacks the @pytest.mark.asyncio marker; under strict asyncio mode this parametrized test's body never runs and its assertions are silently skipped. Add @pytest.mark.asyncio above it like the sibling tests.
4 skills analyzed
| Skill | Findings | Duration | Cost |
|---|---|---|---|
| security-review | 0 | 3m 47s | $0.37 |
| code-review | 1 | 1m | $0.70 |
| find-bugs | 2 | 4m 16s | $1.22 |
| skill-scanner | 0 | 1m 5s | $0.12 |
⏱ 10m 9s · 824.8k in / 51.6k out · $2.41