fix(asgi): Gate query string and client IP behind send_default_pii #6501
2 issues
code-review: Found 2 issues (2 high)
High
`url.full` accidentally gated behind `should_send_default_pii()`, missing in default config - `sentry_sdk/integrations/_asgi_common.py:130`
url.full is not PII (it's the URL path, not the query string), but it's now inside the if should_send_default_pii(): block, so it will never be set when PII is disabled — breaking span URL attribution in the default configuration.
`NameError` when non-http/websocket ASGI scope is processed with PII enabled - `sentry_sdk/integrations/_asgi_common.py:133`
When asgi_scope['type'] is not 'http' or 'websocket' (e.g. 'lifespan') and should_send_default_pii() is True, headers is undefined at headers.get('host') because it is only assigned inside the if ty in ('http', 'websocket'): block.
⏱ 1m 21s · 95.2k in / 7.3k out · $0.42
Annotations
Check failure on line 130 in sentry_sdk/integrations/_asgi_common.py
sentry-warden / warden: code-review
`url.full` accidentally gated behind `should_send_default_pii()`, missing in default config
`url.full` is not PII (it's the URL path, not the query string), but it's now inside the `if should_send_default_pii():` block, so it will never be set when PII is disabled — breaking span URL attribution in the default configuration.
Check failure on line 133 in sentry_sdk/integrations/_asgi_common.py
sentry-warden / warden: code-review
`NameError` when non-http/websocket ASGI scope is processed with PII enabled
When `asgi_scope['type']` is not `'http'` or `'websocket'` (e.g. `'lifespan'`) and `should_send_default_pii()` is `True`, `headers` is undefined at `headers.get('host')` because it is only assigned inside the `if ty in ('http', 'websocket'):` block.