Skip to content

fix(asgi): Gate query string and client IP behind send_default_pii

666e6fb
Select commit
Loading
Failed to load commit list.
Open

fix(asgi): Gate query string and client IP behind send_default_pii #6501

fix(asgi): Gate query string and client IP behind send_default_pii
666e6fb
Select commit
Loading
Failed to load commit list.
@sentry/warden / warden completed Jun 4, 2026 in 4m 19s

5 issues

High

`url.full` accidentally gated behind `should_send_default_pii()`, missing in default config - `sentry_sdk/integrations/_asgi_common.py:130`

url.full is not PII (it's the URL path, not the query string), but it's now inside the if should_send_default_pii(): block, so it will never be set when PII is disabled — breaking span URL attribution in the default configuration.

`NameError` when non-http/websocket ASGI scope is processed with PII enabled - `sentry_sdk/integrations/_asgi_common.py:133`

When asgi_scope['type'] is not 'http' or 'websocket' (e.g. 'lifespan') and should_send_default_pii() is True, headers is undefined at headers.get('host') because it is only assigned inside the if ty in ('http', 'websocket'): block.

Medium

`url.full` accidentally gated behind `should_send_default_pii()` - `sentry_sdk/integrations/_asgi_common.py:129`

url.full is now only collected when PII is enabled, but _get_url explicitly does not include the query string (per its docstring: "without also including the querystring"), so it is not PII and should always be collected like other standard span attributes.

Low

`headers` referenced outside its defining `if ty` block, causing potential `NameError` - `sentry_sdk/integrations/_asgi_common.py:130`

If _get_request_attributes is called with an ASGI scope whose type is not "http" or "websocket" (e.g. a future or custom type) and should_send_default_pii() is True, headers will be undefined when headers.get("host") is evaluated at line 130.

`_get_request_attributes` references unbound `headers` for non-http/websocket scopes when PII is enabled

In sentry_sdk/integrations/_asgi_common.py (_get_request_attributes), the local headers is only assigned inside the if ty in ("http", "websocket"): block (line ~120), but the subsequent if should_send_default_pii(): block references headers.get("host") unconditionally when building url.full. For any ASGI scope type other than http/websocket (e.g., custom/proprietary scope types passed through the middleware), this raises NameError: name 'headers' is not defined. Reachability in practice is low because the ASGI spec only defines http, websocket, and lifespan, and lifespan is short-circuited in asgi.py:_run_app before reaching _get_request_attributes. Additionally, attempting to compute url.full for non-HTTP scope types is semantically questionable and likely should also be gated by the ty check.

4 skills analyzed
Skill Findings Duration Cost
security-review 0 1m 3s $0.19
code-review 2 1m 21s $0.43
find-bugs 3 3m 19s $0.75
skill-scanner 0 1.6s $0.03

⏱ 5m 45s · 430.3k in / 27.9k out · $1.40