sentry-ruby-core 6.6.2 → 7.0.0

data/lib/sentry/configuration.rb

@@ -16,6 +16,7 @@ require "sentry/logger"
 require "sentry/structured_logger"
 require "sentry/log_event_buffer"
 require "sentry/metric_event_buffer"
+require "sentry/data_collection"
 
 module Sentry
   class Configuration
@@ -132,6 +133,7 @@ module Sentry
     attr_accessor :max_breadcrumbs
 
     # Number of lines of code context to capture, or nil for none
+    # @deprecated Use {#data_collection} and `frame_context_lines` instead.
     # @return [Integer, nil]
     attr_accessor :context_lines
 
@@ -167,8 +169,14 @@ module Sentry
     alias inspect_exception_causes_for_exclusion? inspect_exception_causes_for_exclusion
 
     # Whether to capture local variables from the raised exception's frame. Default is false.
+    # @deprecated Use {#data_collection} and `stack_frame_variables` instead.
     # @return [Boolean]
-    attr_accessor :include_local_variables
+    attr_reader :include_local_variables
+
+    def include_local_variables=(value)
+      @include_local_variables = value
+      @data_collection.backfill_stack_frame_variables(self)
+    end
 
     # Whether to capture events and traces into Spotlight. Default is false.
     # If you set this to true, Sentry will send events and traces to the local
@@ -209,6 +217,7 @@ module Sentry
     attr_accessor :propagate_traces
 
     # Array of rack env parameters to be included in the event sent to sentry.
+    # @deprecated Use `data_collection.http_headers.request` to control request data collection instead.
     # @return [Array<String>]
     attr_accessor :rack_env_whitelist
 
@@ -232,8 +241,14 @@ module Sentry
     # - request body
     # - query string
     # will not be sent to Sentry.
+    # @deprecated Use {#data_collection} instead.
     # @return [Boolean]
-    attr_accessor :send_default_pii
+    attr_reader :send_default_pii
+
+    # Controls which categories of data may be collected.
+    # Replacement for send_default_pii.
+    # @return [DataCollection]
+    attr_accessor :data_collection
 
     # Capture queue time from X-Request-Start header set by reverse proxies.
     # Works with any Rack app behind Nginx, HAProxy, Heroku router, etc.
@@ -273,10 +288,6 @@ module Sentry
     # @return [Proc]
     attr_accessor :traces_sampler
 
-    # Enable Structured Logging
-    # @return [Boolean]
-    attr_accessor :enable_logs
-
     # Structured logging configuration.
     # @return [StructuredLoggingConfiguration]
     attr_reader :structured_logging
@@ -345,10 +356,6 @@ module Sentry
     # @return [Integer]
     attr_accessor :max_log_events
 
-    # Enable metrics collection, defaults to true
-    # @return [Boolean]
-    attr_accessor :enable_metrics
-
     # Maximum number of metric events to buffer before sending
     # @return [Integer]
     attr_accessor :max_metric_events
@@ -389,6 +396,24 @@ module Sentry
     # @return [Boolean]
     attr_accessor :strict_trace_continuation
 
+    # Which execution primitive owns the SDK's current hub.
+    #
+    # [+:thread+ (default)] Store the hub in thread-local storage. Correct for
+    #   thread-based servers (Puma, Unicorn) and background processors (Sidekiq,
+    #   Resque). Every fiber on a thread shares one hub.
+    # [+:fiber+] Store the hub in Fiber Storage (Ruby 3.2+). Each fiber gets its
+    #   own hub, so concurrent requests on a fiber-based server (Falcon/async)
+    #   are isolated instead of sharing and corrupting one another's scope. A
+    #   fiber or thread started from another inherits its context and trace, but
+    #   its own scope changes stay local. Requested on a Ruby without Fiber
+    #   Storage (< 3.2), the SDK logs a warning and falls back to +:thread+.
+    #
+    # @return [Symbol]
+    attr_reader :hub_isolation_level
+
+    # Isolation levels the SDK understands for hub storage.
+    ISOLATION_LEVELS = %i[thread fiber].freeze
+
     # these are not config options
     # @!visibility private
     attr_reader :errors, :gem_specs
@@ -509,6 +534,7 @@ module Sentry
     def initialize
       run_callbacks(:before, :initialize)
 
+      self.data_collection = DataCollection.new
       self.app_dirs_pattern = APP_DIRS_PATTERN
       self.debug = Sentry::Utils::EnvHelper.env_to_bool(ENV["SENTRY_DEBUG"])
       self.background_worker_threads = (processor_count / 2.0).ceil
@@ -519,6 +545,7 @@ module Sentry
       self.breadcrumbs_logger = []
       self.context_lines = 3
       self.include_local_variables = false
+
       self.environment = environment_from_env
       self.enabled_environments = nil
       self.exclude_loggers = []
@@ -541,6 +568,7 @@ module Sentry
       self.capture_queue_time = true
       self.org_id = nil
       self.strict_trace_continuation = false
+      self.hub_isolation_level = :thread
 
       spotlight_env = ENV["SENTRY_SPOTLIGHT"]
       spotlight_bool = Sentry::Utils::EnvHelper.env_to_bool(spotlight_env, strict: true)
@@ -559,8 +587,6 @@ module Sentry
       self.std_lib_logger_filter = nil
       self.rack_env_whitelist = RACK_ENV_WHITELIST_DEFAULT
       self.traces_sampler = nil
-      self.enable_logs = false
-      self.enable_metrics = true
 
       self.profiler_class = Sentry::Profiler
       self.profiles_sample_interval = DEFAULT_PROFILES_SAMPLE_INTERVAL
@@ -577,6 +603,8 @@ module Sentry
 
       yield(self) if block_given?
 
+      log_deprecations
+
       run_callbacks(:after, :configured)
     end
 
@@ -602,6 +630,11 @@ module Sentry
       @dsn = init_dsn(value)
     end
 
+    def send_default_pii=(value)
+      @send_default_pii = value
+      self.data_collection = DataCollection.backfill(self)
+    end
+
     alias server= dsn=
 
     def release=(value)
@@ -610,6 +643,23 @@ module Sentry
       @release = value
     end
 
+    def hub_isolation_level=(level)
+      level = level.to_sym if level.respond_to?(:to_sym)
+
+      unless ISOLATION_LEVELS.include?(level)
+        raise ArgumentError, "hub_isolation_level must be one of #{ISOLATION_LEVELS.inspect}, got #{level.inspect}"
+      end
+
+      # :fiber relies on Fiber Storage (Ruby 3.2+); downgrade so the hub is never
+      # asked to call Fiber[] on a Ruby that lacks it.
+      if level == :fiber && !fiber_storage_available?
+        log_warn("hub_isolation_level :fiber requires Ruby 3.2+ Fiber Storage; falling back to :thread on Ruby #{RUBY_VERSION}.")
+        level = :thread
+      end
+
+      @hub_isolation_level = level
+    end
+
     def breadcrumbs_logger=(logger)
       loggers =
         if logger.is_a?(Array)
@@ -768,6 +818,14 @@ module Sentry
       end
     end
 
+    # @api private
+    def log_deprecations
+      log_warn("`send_default_pii` is deprecated; use `data_collection` instead.") if self.send_default_pii
+      log_warn("`include_local_variables` is deprecated; use `data_collection.stack_frame_variables` instead.") if include_local_variables
+      log_warn("`context_lines` is deprecated; use `data_collection.frame_context_lines` instead.") if context_lines != 3
+      log_warn("`rack_env_whitelist` is deprecated; use `data_collection.http_headers.request` to control request data collection instead.") if rack_env_whitelist != RACK_ENV_WHITELIST_DEFAULT
+    end
+
     # @api private
     def stacktrace_builder
       @stacktrace_builder ||= StacktraceBuilder.new(
@@ -806,6 +864,10 @@ module Sentry
 
     private
 
+    def fiber_storage_available?
+      ::Fiber.respond_to?(:[]) && ::Fiber.respond_to?(:[]=)
+    end
+
     def init_dsn(dsn_string)
       return if dsn_string.nil? || dsn_string.empty?
 

data/lib/sentry/data_collection/key_value_collection.rb

@@ -0,0 +1,136 @@
+# frozen_string_literal: true
+
+module Sentry
+  class DataCollection
+    # Configuration for key-value data collection.
+    class KeyValueCollection
+      FILTERED_VALUE = "[Filtered]"
+
+      # Keys from this list are ALWAYS filtered, regardless of :mode
+      SENSITIVE_DENY_LIST = %w[
+        auth
+        token
+        secret
+        session
+        password
+        passwd
+        pwd
+        key
+        jwt
+        bearer
+        sso
+        saml
+        csrf
+        xsrf
+        credentials
+        sid
+        identity
+        cookie
+        set-cookie
+      ].freeze
+
+      # Additional terms applied to cookie names only. These cover common
+      # opaque session, identity-provider, and load-balancer cookies without
+      # making the general header denylist overly broad.
+      SENSITIVE_COOKIE_NAME_DENY_LIST = %w[
+        .sid
+        sessid
+        remember
+        oidc
+        pkce
+        nonce
+        __secure-
+        __host-
+        awsalb
+        awselb
+        akamai
+        __stripe
+        cognito
+        firebase
+        supabase
+        sb-
+        mfa
+        2fa
+      ].freeze
+
+      # `mode` controls whether values are collected:
+      # - `:off` disables collection.
+      # - `:deny_list` collects values except those matching `terms`.
+      # - `:allow_list` collects only values matching `terms`.
+      # Boolean values are accepted as shorthand for `:deny_list` and `:off`.
+      # @return [:off, :deny_list, :allow_list]
+      attr_reader :mode
+
+      # `terms` contains the keys or patterns used by the selected mode.
+      # @return [Array<String, Regexp>, nil]
+      attr_reader :terms
+
+      def initialize(mode:, terms:)
+        self.mode = mode
+        self.terms = terms
+      end
+
+      def mode=(mode)
+        @mode = case mode
+        when true then :deny_list
+        when false, nil then :off
+        else mode
+        end
+      end
+
+      # Converts the boolean shorthand into a collection configuration.
+      def self.from(value)
+        return new(mode: value, terms: nil) if value.equal?(true) || value.equal?(false) || value.nil?
+
+        value
+      end
+
+      def terms=(terms)
+        @terms = terms&.map { |term| term.is_a?(Regexp) ? term : term.to_s.downcase }
+          &.reject { |term| !term.is_a?(Regexp) && term.strip.empty? }
+      end
+
+      # Applies this collection configuration without changing the input hash.
+      # Keys are retained whenever the category is collected; values that are not
+      # safe to send are replaced with FILTERED_VALUE.
+      #
+      # @param values [Hash] key-value data to filter
+      # @return [Hash] a new filtered hash, or an empty hash when collection is off
+      def filter(values, cookie: false)
+        return {} if mode == :off
+
+        values.each_with_object({}) do |(key, value), filtered|
+          filtered[key] = safe_value?(key, cookie: cookie) ? value : FILTERED_VALUE
+        end
+      end
+
+      private
+
+      def safe_value?(key, cookie: false)
+        key_string = key.to_s
+        key_downcase = key_string.downcase
+        return false if sensitive?(key_downcase, cookie: cookie)
+
+        case mode
+        when :deny_list
+          !matches_any_term?(key_string, key_downcase)
+        when :allow_list
+          matches_any_term?(key_string, key_downcase)
+        else
+          false
+        end
+      end
+
+      def sensitive?(key, cookie: false)
+        SENSITIVE_DENY_LIST.any? { |term| key.include?(term) } ||
+          (cookie && SENSITIVE_COOKIE_NAME_DENY_LIST.any? { |term| key.include?(term) })
+      end
+
+      def matches_any_term?(key, key_downcase)
+        @terms&.any? do |term|
+          term.is_a?(Regexp) ? term.match?(key) : key_downcase.include?(term)
+        end
+      end
+    end
+  end
+end

data/lib/sentry/data_collection.rb

@@ -0,0 +1,203 @@
+# frozen_string_literal: true
+
+require "sentry/data_collection/key_value_collection"
+
+module Sentry
+  class DataCollection
+    # Configuration for the categories of data collected by the SDK.
+    # Replacement for send_default_pii.
+    # Spec: https://develop.sentry.dev/sdk/foundations/client/data-collection/
+    #
+    # @example Configure data collection
+    #   Sentry.init do |config|
+    #     data_collection = config.data_collection
+    #     data_collection.user_info = true
+    #     data_collection.cookies.mode = :deny_list
+    #     data_collection.cookies.terms = ["session", "token"]
+    #     data_collection.http_headers.request.mode = :deny_list
+    #     data_collection.http_headers.request.terms = nil
+    #     data_collection.http_headers.response.mode = :allow_list
+    #     data_collection.http_headers.response.terms = ["my_special_header"]
+    #     data_collection.http_bodies = [:incoming_request]
+    #     data_collection.url_query_params.mode = :allow_list
+    #     data_collection.url_query_params.terms = ["page", "limit"]
+    #     data_collection.graphql.document = true
+    #     data_collection.graphql.variables = true
+    #     data_collection.database_query_data = true
+    #     data_collection.queues = true
+    #     data_collection.stack_frame_variables = true
+    #     data_collection.frame_context_lines = 5
+    #   end
+
+    MODES = %i[off deny_list allow_list].freeze
+
+    PII_HEADER_SNIPPETS = %w[forwarded -ip _ip remote via _user -user].freeze
+
+    BODY_TYPES = %i[
+      incoming_request
+      outgoing_request
+      incoming_response
+      outgoing_response
+    ].freeze
+
+    class HttpHeaders
+      # @return [KeyValueCollection]
+      attr_reader :request
+
+      # @return [KeyValueCollection]
+      attr_reader :response
+
+      def initialize(request:, response:)
+        self.request = request
+        self.response = response
+      end
+
+      def request=(value)
+        @request = KeyValueCollection.from(value)
+      end
+
+      def response=(value)
+        @response = KeyValueCollection.from(value)
+      end
+    end
+
+    class GraphQL
+      # @return [Boolean]
+      attr_accessor :document
+
+      # @return [Boolean]
+      attr_accessor :variables
+
+      def initialize(document:, variables:)
+        @document = document
+        @variables = variables
+      end
+    end
+
+    # @return [Boolean]
+    # @default `true`
+    attr_accessor :user_info
+
+    # @return [Boolean, KeyValueCollection]
+    # A boolean is shorthand for `mode: :deny_list` (`true`) or `mode: :off` (`false`).
+    # @default `mode: :deny_list, terms: nil`
+    attr_reader :cookies
+
+    # @return [HttpHeaders]
+    # @default request and response use `mode: :deny_list, terms: nil`
+    attr_accessor :http_headers
+
+    # @return [Array<Symbol>] containing values from BODY_TYPES
+    # @default `nil` (all valid body types)
+    attr_accessor :http_bodies
+
+    # @return [Boolean, KeyValueCollection]
+    # A boolean is shorthand for `mode: :deny_list` (`true`) or `mode: :off` (`false`).
+    # @default `mode: :deny_list, terms: nil`
+    attr_reader :url_query_params
+
+    # @return [Boolean]
+    # @default `true`
+    attr_accessor :database_query_data
+
+    # @return [GraphQL]
+    # @default `document: true, variables: true`
+    attr_accessor :graphql
+
+    # @return [Boolean]
+    # @default `true`
+    attr_accessor :queues
+
+    # @return [Boolean, KeyValueCollection]
+    # A boolean is shorthand for `mode: :deny_list` (`true`) or `mode: :off` (`false`).
+    # @default `false` (Ruby-specific to avoid TracePoint overhead)
+    attr_reader :stack_frame_variables
+
+    # @return [Integer]
+    # @default `3`
+    attr_accessor :frame_context_lines
+
+    # Filters key-value data using the default sensitive denylist.
+    def self.filter(values)
+      default_filter.filter(values, cookie: false)
+    end
+
+    def self.default_filter
+      @default_filter ||= KeyValueCollection.new(mode: :deny_list, terms: nil)
+    end
+
+    # Builds data collection settings compatible with the legacy send_default_pii
+    # configuration.
+    def self.backfill(configuration)
+      data_collection = new
+      data_collection.backfill_stack_frame_variables(configuration)
+      return data_collection if configuration.send_default_pii
+
+      # TODO-neel-data map to exact ruby behaviour for backwards compat behavior
+      data_collection.user_info = false
+      data_collection.cookies.mode = :off
+      data_collection.http_headers.request.mode = :deny_list
+      data_collection.http_headers.request.terms = PII_HEADER_SNIPPETS
+      data_collection.http_headers.response.mode = :deny_list
+      data_collection.http_headers.response.terms = PII_HEADER_SNIPPETS
+      data_collection.http_bodies = []
+      data_collection.url_query_params.mode = :off
+      data_collection.graphql.document = false
+      data_collection.graphql.variables = false
+      data_collection.database_query_data = false
+      data_collection.queues = false
+      data_collection.frame_context_lines = configuration.context_lines
+      data_collection
+    end
+
+    def initialize
+      @user_info = true
+      self.cookies = KeyValueCollection.new(mode: :deny_list, terms: nil)
+      @http_headers = HttpHeaders.new(
+        request: KeyValueCollection.new(mode: :deny_list, terms: nil),
+        response: KeyValueCollection.new(mode: :deny_list, terms: nil)
+      )
+      @http_bodies = BODY_TYPES.dup
+      self.url_query_params = KeyValueCollection.new(mode: :deny_list, terms: nil)
+      @database_query_data = true
+      @graphql = GraphQL.new(document: true, variables: true)
+      @queues = true
+      self.stack_frame_variables = false
+      @frame_context_lines = 3
+    end
+
+    # Copies the legacy stack frame variable configuration.
+    def backfill_stack_frame_variables(configuration)
+      self.stack_frame_variables = configuration.include_local_variables
+    end
+
+    # Returns whether stack frame local variables should be captured.
+    def collect_stack_frame_variables?
+      stack_frame_variables.mode != :off
+    end
+
+    def stack_frame_variables=(value)
+      @stack_frame_variables = KeyValueCollection.from(value)
+    end
+
+    def cookies=(value)
+      @cookies = KeyValueCollection.from(value)
+    end
+
+    def url_query_params=(value)
+      @url_query_params = KeyValueCollection.from(value)
+    end
+
+    # Returns whether incoming HTTP request bodies should be collected.
+    # nil implies all BODY_TYPES according to spec
+    def collect_incoming_http_body?
+      http_bodies.nil? || http_bodies.include?(:incoming_request)
+    end
+
+    # Returns whether outgoing HTTP request bodies should be collected.
+    # nil implies all BODY_TYPES according to spec
+    def collect_outgoing_http_body?
+      http_bodies.nil? || http_bodies.include?(:outgoing_request)
+    end
+  end
+end

data/lib/sentry/debug_structured_logger.rb

@@ -8,8 +8,7 @@ require "delegate"
 module Sentry
   # DebugStructuredLogger is a logger that captures structured log events to a file for debugging purposes.
   #
-  # It can optionally also send log events to Sentry via the normal structured logger if logging
-  # is enabled.
+  # It also sends log events to Sentry via the normal structured logger.
   class DebugStructuredLogger < SimpleDelegator
     DEFAULT_LOG_FILE_PATH = File.join("log", "sentry_debug_logs.log")
 
@@ -68,12 +67,7 @@ module Sentry
     private
 
     def initialize_backend(configuration)
-      if configuration.enable_logs
-        StructuredLogger.new(configuration)
-      else
-        # Create a no-op logger if logging is disabled
-        NoOpLogger.new
-      end
+      StructuredLogger.new(configuration)
     end
 
     def initialize_log_file(log_file_path)
@@ -83,12 +77,5 @@ module Sentry
 
       log_file
     end
-
-    # No-op logger for when structured logging is disabled
-    class NoOpLogger
-      %i[trace debug info warn error fatal log].each do |method|
-        define_method(method) { |*args, **kwargs| nil }
-      end
-    end
   end
 end

data/lib/sentry/envelope/item.rb

@@ -25,6 +25,13 @@ module Sentry
       end
     end
 
+    def self.byte_data_category(data_category)
+      case data_category
+      when "log_item" then "log_byte"
+      when "trace_metric" then "trace_metric_byte"
+      end
+    end
+
     def initialize(headers, payload)
       @headers = headers
       @payload = payload
@@ -33,6 +40,20 @@ module Sentry
       @size_limit = SIZE_LIMITS[type]
     end
 
+    def byte_data_category
+      self.class.byte_data_category(data_category)
+    end
+
+    def item_count
+      headers[:item_count] || 1
+    end
+
+    def lost_event_byte_size
+      return unless byte_data_category
+
+      (payload.is_a?(String) ? payload : JSON.generate(payload)).bytesize
+    end
+
     def to_s
       [JSON.generate(@headers), @payload.is_a?(String) ? @payload : JSON.generate(@payload)].join("\n")
     end

data/lib/sentry/error_event.rb

@@ -32,7 +32,12 @@ module Sentry
         @extra.merge!(exception.sentry_context)
       end
 
-      @exception = Sentry::ExceptionInterface.build(exception: exception, stacktrace_builder: @stacktrace_builder, mechanism: mechanism)
+      @exception = Sentry::ExceptionInterface.build(
+        exception: exception,
+        stacktrace_builder: @stacktrace_builder,
+        mechanism: mechanism,
+        data_collection: @data_collection
+      )
     end
   end
 end

data/lib/sentry/event.rb

@@ -28,7 +28,7 @@ module Sentry
 
     MAX_MESSAGE_SIZE_IN_BYTES = 1024 * 8
 
-    SKIP_INSPECTION_ATTRIBUTES = [:@modules, :@stacktrace_builder, :@send_default_pii, :@trusted_proxies, :@rack_env_whitelist]
+    SKIP_INSPECTION_ATTRIBUTES = [:@modules, :@stacktrace_builder, :@data_collection, :@trusted_proxies, :@rack_env_whitelist]
 
     include CustomInspection
 
@@ -73,7 +73,7 @@ module Sentry
       @modules = configuration.gem_specs if configuration.send_modules
 
       # configuration options to help events process data
-      @send_default_pii = configuration.send_default_pii
+      @data_collection = configuration.data_collection
       @trusted_proxies = configuration.trusted_proxies
       @stacktrace_builder = configuration.stacktrace_builder
       @rack_env_whitelist = configuration.rack_env_whitelist
@@ -103,7 +103,7 @@ module Sentry
       unless request || env.empty?
         add_request_interface(env)
 
-        user[:ip_address] ||= calculate_real_ip_from_rack(env) if @send_default_pii
+        user[:ip_address] ||= calculate_real_ip_from_rack(env) if @data_collection.user_info
 
         if request_id = Utils::RequestId.read_from(env)
           tags[:request_id] = request_id
@@ -127,7 +127,11 @@ module Sentry
     private
 
     def add_request_interface(env)
-      @request = Sentry::RequestInterface.new(env: env, send_default_pii: @send_default_pii, rack_env_whitelist: @rack_env_whitelist)
+      @request = Sentry::RequestInterface.new(
+        env: env,
+        data_collection: @data_collection,
+        rack_env_whitelist: @rack_env_whitelist
+      )
     end
 
     def serialize_attributes

data/lib/sentry/excon/middleware.rb

@@ -61,14 +61,9 @@ module Sentry
         url = env[:scheme] + "://" + env[:hostname] + env[:path]
         result = { method: env[:method].to_s.upcase, url: url }
 
-        if Sentry.configuration.send_default_pii
-          result[:query] = env[:query]
-
-          # Handle excon 1.0.0+
-          result[:query] = build_nested_query(result[:query]) unless result[:query].is_a?(String)
-
-          result[:body] = env[:body]
-        end
+        query = filter_query_params(env[:query])
+        result[:query] = query if query
+        result[:body] = env[:body] if Sentry.configuration.data_collection.collect_outgoing_http_body?
 
         result
       end

data/lib/sentry/faraday.rb

@@ -59,10 +59,9 @@ module Sentry
         url = env[:url].scheme + "://" + env[:url].host + env[:url].path
         result = { method: env[:method].to_s.upcase, url: url }
 
-        if Sentry.configuration.send_default_pii
-          result[:query] = env[:url].query
-          result[:body] = env[:body]
-        end
+        query = filter_query_params(env[:url].query)
+        result[:query] = query if query
+        result[:body] = env[:body] if Sentry.configuration.data_collection.collect_outgoing_http_body?
 
         result
       end