Skip to content

fix(asgi): Gate query string and client IP behind send_default_pii

666e6fb
Select commit
Loading
Failed to load commit list.
Open

fix(asgi): Gate query string and client IP behind send_default_pii #6501

fix(asgi): Gate query string and client IP behind send_default_pii
666e6fb
Select commit
Loading
Failed to load commit list.
@sentry/warden / warden: find-bugs completed Jun 4, 2026 in 4m 11s

3 issues

find-bugs: Found 3 issues (1 medium, 2 low)

Medium

`url.full` accidentally gated behind `should_send_default_pii()` - `sentry_sdk/integrations/_asgi_common.py:129`

url.full is now only collected when PII is enabled, but _get_url explicitly does not include the query string (per its docstring: "without also including the querystring"), so it is not PII and should always be collected like other standard span attributes.

Low

`headers` referenced outside its defining `if ty` block, causing potential `NameError` - `sentry_sdk/integrations/_asgi_common.py:130`

If _get_request_attributes is called with an ASGI scope whose type is not "http" or "websocket" (e.g. a future or custom type) and should_send_default_pii() is True, headers will be undefined when headers.get("host") is evaluated at line 130.

`_get_request_attributes` references unbound `headers` for non-http/websocket scopes when PII is enabled

In sentry_sdk/integrations/_asgi_common.py (_get_request_attributes), the local headers is only assigned inside the if ty in ("http", "websocket"): block (line ~120), but the subsequent if should_send_default_pii(): block references headers.get("host") unconditionally when building url.full. For any ASGI scope type other than http/websocket (e.g., custom/proprietary scope types passed through the middleware), this raises NameError: name 'headers' is not defined. Reachability in practice is low because the ASGI spec only defines http, websocket, and lifespan, and lifespan is short-circuited in asgi.py:_run_app before reaching _get_request_attributes. Additionally, attempting to compute url.full for non-HTTP scope types is semantically questionable and likely should also be gated by the ty check.


⏱ 3m 19s · 301.2k in / 17.0k out · $0.74

Annotations

Check warning on line 129 in sentry_sdk/integrations/_asgi_common.py

See this annotation in the file changed.

@sentry-warden sentry-warden / warden: find-bugs

`url.full` accidentally gated behind `should_send_default_pii()`

`url.full` is now only collected when PII is enabled, but `_get_url` explicitly does not include the query string (per its docstring: "without also including the querystring"), so it is not PII and should always be collected like other standard span attributes.