fix(asgi): Gate query string and client IP behind send_default_pii #6501
3 issues
find-bugs: Found 3 issues (1 medium, 2 low)
Medium
`url.full` accidentally gated behind `should_send_default_pii()` - `sentry_sdk/integrations/_asgi_common.py:129`
url.full is now only collected when PII is enabled, but _get_url explicitly does not include the query string (per its docstring: "without also including the querystring"), so it is not PII and should always be collected like other standard span attributes.
Low
`headers` referenced outside its defining `if ty` block, causing potential `NameError` - `sentry_sdk/integrations/_asgi_common.py:130`
If _get_request_attributes is called with an ASGI scope whose type is not "http" or "websocket" (e.g. a future or custom type) and should_send_default_pii() is True, headers will be undefined when headers.get("host") is evaluated at line 130.
`_get_request_attributes` references unbound `headers` for non-http/websocket scopes when PII is enabled
In sentry_sdk/integrations/_asgi_common.py (_get_request_attributes), the local headers is only assigned inside the if ty in ("http", "websocket"): block (line ~120), but the subsequent if should_send_default_pii(): block references headers.get("host") unconditionally when building url.full. For any ASGI scope type other than http/websocket (e.g., custom/proprietary scope types passed through the middleware), this raises NameError: name 'headers' is not defined. Reachability in practice is low because the ASGI spec only defines http, websocket, and lifespan, and lifespan is short-circuited in asgi.py:_run_app before reaching _get_request_attributes. Additionally, attempting to compute url.full for non-HTTP scope types is semantically questionable and likely should also be gated by the ty check.
⏱ 3m 19s · 301.2k in / 17.0k out · $0.74
Annotations
Check warning on line 129 in sentry_sdk/integrations/_asgi_common.py
sentry-warden / warden: find-bugs
`url.full` accidentally gated behind `should_send_default_pii()`
`url.full` is now only collected when PII is enabled, but `_get_url` explicitly does not include the query string (per its docstring: "without also including the querystring"), so it is not PII and should always be collected like other standard span attributes.