sentry-ruby 6.7.0 → 7.1.0

data/lib/sentry/data_collection/key_value_collection.rb

@@ -0,0 +1,136 @@
+# frozen_string_literal: true
+
+module Sentry
+  class DataCollection
+    # Configuration for key-value data collection.
+    class KeyValueCollection
+      FILTERED_VALUE = "[Filtered]"
+
+      # Keys from this list are ALWAYS filtered, regardless of :mode
+      SENSITIVE_DENY_LIST = %w[
+        auth
+        token
+        secret
+        session
+        password
+        passwd
+        pwd
+        key
+        jwt
+        bearer
+        sso
+        saml
+        csrf
+        xsrf
+        credentials
+        sid
+        identity
+        cookie
+        set-cookie
+      ].freeze
+
+      # Additional terms applied to cookie names only. These cover common
+      # opaque session, identity-provider, and load-balancer cookies without
+      # making the general header denylist overly broad.
+      SENSITIVE_COOKIE_NAME_DENY_LIST = %w[
+        .sid
+        sessid
+        remember
+        oidc
+        pkce
+        nonce
+        __secure-
+        __host-
+        awsalb
+        awselb
+        akamai
+        __stripe
+        cognito
+        firebase
+        supabase
+        sb-
+        mfa
+        2fa
+      ].freeze
+
+      # `mode` controls whether values are collected:
+      # - `:off` disables collection.
+      # - `:deny_list` collects values except those matching `terms`.
+      # - `:allow_list` collects only values matching `terms`.
+      # Boolean values are accepted as shorthand for `:deny_list` and `:off`.
+      # @return [:off, :deny_list, :allow_list]
+      attr_reader :mode
+
+      # `terms` contains the keys or patterns used by the selected mode.
+      # @return [Array<String, Regexp>, nil]
+      attr_reader :terms
+
+      def initialize(mode:, terms:)
+        self.mode = mode
+        self.terms = terms
+      end
+
+      def mode=(mode)
+        @mode = case mode
+        when true then :deny_list
+        when false, nil then :off
+        else mode
+        end
+      end
+
+      # Converts the boolean shorthand into a collection configuration.
+      def self.from(value)
+        return new(mode: value, terms: nil) if value.equal?(true) || value.equal?(false) || value.nil?
+
+        value
+      end
+
+      def terms=(terms)
+        @terms = terms&.map { |term| term.is_a?(Regexp) ? term : term.to_s.downcase }
+          &.reject { |term| !term.is_a?(Regexp) && term.strip.empty? }
+      end
+
+      # Applies this collection configuration without changing the input hash.
+      # Keys are retained whenever the category is collected; values that are not
+      # safe to send are replaced with FILTERED_VALUE.
+      #
+      # @param values [Hash] key-value data to filter
+      # @return [Hash] a new filtered hash, or an empty hash when collection is off
+      def filter(values, cookie: false)
+        return {} if mode == :off
+
+        values.each_with_object({}) do |(key, value), filtered|
+          filtered[key] = safe_value?(key, cookie: cookie) ? value : FILTERED_VALUE
+        end
+      end
+
+      private
+
+      def safe_value?(key, cookie: false)
+        key_string = key.to_s
+        key_downcase = key_string.downcase
+        return false if sensitive?(key_downcase, cookie: cookie)
+
+        case mode
+        when :deny_list
+          !matches_any_term?(key_string, key_downcase)
+        when :allow_list
+          matches_any_term?(key_string, key_downcase)
+        else
+          false
+        end
+      end
+
+      def sensitive?(key, cookie: false)
+        SENSITIVE_DENY_LIST.any? { |term| key.include?(term) } ||
+          (cookie && SENSITIVE_COOKIE_NAME_DENY_LIST.any? { |term| key.include?(term) })
+      end
+
+      def matches_any_term?(key, key_downcase)
+        @terms&.any? do |term|
+          term.is_a?(Regexp) ? term.match?(key) : key_downcase.include?(term)
+        end
+      end
+    end
+  end
+end

data/lib/sentry/data_collection.rb

@@ -0,0 +1,203 @@
+# frozen_string_literal: true
+
+require "sentry/data_collection/key_value_collection"
+
+module Sentry
+  class DataCollection
+    # Configuration for the categories of data collected by the SDK.
+    # Replacement for send_default_pii.
+    # Spec: https://develop.sentry.dev/sdk/foundations/client/data-collection/
+    #
+    # @example Configure data collection
+    #   Sentry.init do |config|
+    #     data_collection = config.data_collection
+    #     data_collection.user_info = true
+    #     data_collection.cookies.mode = :deny_list
+    #     data_collection.cookies.terms = ["session", "token"]
+    #     data_collection.http_headers.request.mode = :deny_list
+    #     data_collection.http_headers.request.terms = nil
+    #     data_collection.http_headers.response.mode = :allow_list
+    #     data_collection.http_headers.response.terms = ["my_special_header"]
+    #     data_collection.http_bodies = [:incoming_request]
+    #     data_collection.url_query_params.mode = :allow_list
+    #     data_collection.url_query_params.terms = ["page", "limit"]
+    #     data_collection.graphql.document = true
+    #     data_collection.graphql.variables = true
+    #     data_collection.database_query_data = true
+    #     data_collection.queues = true
+    #     data_collection.stack_frame_variables = true
+    #     data_collection.frame_context_lines = 5
+    #   end
+
+    MODES = %i[off deny_list allow_list].freeze
+
+    PII_HEADER_SNIPPETS = %w[forwarded -ip _ip remote via _user -user].freeze
+
+    BODY_TYPES = %i[
+      incoming_request
+      outgoing_request
+      incoming_response
+      outgoing_response
+    ].freeze
+
+    class HttpHeaders
+      # @return [KeyValueCollection]
+      attr_reader :request
+
+      # @return [KeyValueCollection]
+      attr_reader :response
+
+      def initialize(request:, response:)
+        self.request = request
+        self.response = response
+      end
+
+      def request=(value)
+        @request = KeyValueCollection.from(value)
+      end
+
+      def response=(value)
+        @response = KeyValueCollection.from(value)
+      end
+    end
+
+    class GraphQL
+      # @return [Boolean]
+      attr_accessor :document
+
+      # @return [Boolean]
+      attr_accessor :variables
+
+      def initialize(document:, variables:)
+        @document = document
+        @variables = variables
+      end
+    end
+
+    # @return [Boolean]
+    # @default `true`
+    attr_accessor :user_info
+
+    # @return [Boolean, KeyValueCollection]
+    # A boolean is shorthand for `mode: :deny_list` (`true`) or `mode: :off` (`false`).
+    # @default `mode: :deny_list, terms: nil`
+    attr_reader :cookies
+
+    # @return [HttpHeaders]
+    # @default request and response use `mode: :deny_list, terms: nil`
+    attr_accessor :http_headers
+
+    # @return [Array<Symbol>] containing values from BODY_TYPES
+    # @default `nil` (all valid body types)
+    attr_accessor :http_bodies
+
+    # @return [Boolean, KeyValueCollection]
+    # A boolean is shorthand for `mode: :deny_list` (`true`) or `mode: :off` (`false`).
+    # @default `mode: :deny_list, terms: nil`
+    attr_reader :url_query_params
+
+    # @return [Boolean]
+    # @default `true`
+    attr_accessor :database_query_data
+
+    # @return [GraphQL]
+    # @default `document: true, variables: true`
+    attr_accessor :graphql
+
+    # @return [Boolean]
+    # @default `true`
+    attr_accessor :queues
+
+    # @return [Boolean, KeyValueCollection]
+    # A boolean is shorthand for `mode: :deny_list` (`true`) or `mode: :off` (`false`).
+    # @default `false` (Ruby-specific to avoid TracePoint overhead)
+    attr_reader :stack_frame_variables
+
+    # @return [Integer]
+    # @default `3`
+    attr_accessor :frame_context_lines
+
+    # Filters key-value data using the default sensitive denylist.
+    def self.filter(values)
+      default_filter.filter(values, cookie: false)
+    end
+
+    def self.default_filter
+      @default_filter ||= KeyValueCollection.new(mode: :deny_list, terms: nil)
+    end
+
+    # Builds data collection settings compatible with the legacy send_default_pii
+    # configuration.
+    def self.backfill(configuration)
+      data_collection = new
+      data_collection.backfill_stack_frame_variables(configuration)
+      return data_collection if configuration.send_default_pii
+
+      # TODO-neel-data map to exact ruby behaviour for backwards compat behavior
+      data_collection.user_info = false
+      data_collection.cookies.mode = :off
+      data_collection.http_headers.request.mode = :deny_list
+      data_collection.http_headers.request.terms = PII_HEADER_SNIPPETS
+      data_collection.http_headers.response.mode = :deny_list
+      data_collection.http_headers.response.terms = PII_HEADER_SNIPPETS
+      data_collection.http_bodies = []
+      data_collection.url_query_params.mode = :off
+      data_collection.graphql.document = false
+      data_collection.graphql.variables = false
+      data_collection.database_query_data = false
+      data_collection.queues = false
+      data_collection.frame_context_lines = configuration.context_lines
+      data_collection
+    end
+
+    def initialize
+      @user_info = true
+      self.cookies = KeyValueCollection.new(mode: :deny_list, terms: nil)
+      @http_headers = HttpHeaders.new(
+        request: KeyValueCollection.new(mode: :deny_list, terms: nil),
+        response: KeyValueCollection.new(mode: :deny_list, terms: nil)
+      )
+      @http_bodies = BODY_TYPES.dup
+      self.url_query_params = KeyValueCollection.new(mode: :deny_list, terms: nil)
+      @database_query_data = true
+      @graphql = GraphQL.new(document: true, variables: true)
+      @queues = true
+      self.stack_frame_variables = false
+      @frame_context_lines = 3
+    end
+
+    # Copies the legacy stack frame variable configuration.
+    def backfill_stack_frame_variables(configuration)
+      self.stack_frame_variables = configuration.include_local_variables
+    end
+
+    # Returns whether stack frame local variables should be captured.
+    def collect_stack_frame_variables?
+      stack_frame_variables.mode != :off
+    end
+
+    def stack_frame_variables=(value)
+      @stack_frame_variables = KeyValueCollection.from(value)
+    end
+
+    def cookies=(value)
+      @cookies = KeyValueCollection.from(value)
+    end
+
+    def url_query_params=(value)
+      @url_query_params = KeyValueCollection.from(value)
+    end
+
+    # Returns whether incoming HTTP request bodies should be collected.
+    # nil implies all BODY_TYPES according to spec
+    def collect_incoming_http_body?
+      http_bodies.nil? || http_bodies.include?(:incoming_request)
+    end
+
+    # Returns whether outgoing HTTP request bodies should be collected.
+    # nil implies all BODY_TYPES according to spec
+    def collect_outgoing_http_body?
+      http_bodies.nil? || http_bodies.include?(:outgoing_request)
+    end
+  end
+end

data/lib/sentry/debug_structured_logger.rb

@@ -8,8 +8,7 @@ require "delegate"
 module Sentry
   # DebugStructuredLogger is a logger that captures structured log events to a file for debugging purposes.
   #
-  # It can optionally also send log events to Sentry via the normal structured logger if logging
-  # is enabled.
+  # It also sends log events to Sentry via the normal structured logger.
   class DebugStructuredLogger < SimpleDelegator
     DEFAULT_LOG_FILE_PATH = File.join("log", "sentry_debug_logs.log")
 
@@ -68,12 +67,7 @@ module Sentry
     private
 
     def initialize_backend(configuration)
-      if configuration.enable_logs
-        StructuredLogger.new(configuration)
-      else
-        # Create a no-op logger if logging is disabled
-        NoOpLogger.new
-      end
+      StructuredLogger.new(configuration)
     end
 
     def initialize_log_file(log_file_path)
@@ -83,12 +77,5 @@ module Sentry
 
       log_file
     end
-
-    # No-op logger for when structured logging is disabled
-    class NoOpLogger
-      %i[trace debug info warn error fatal log].each do |method|
-        define_method(method) { |*args, **kwargs| nil }
-      end
-    end
   end
 end

data/lib/sentry/error_event.rb

@@ -32,7 +32,12 @@ module Sentry
         @extra.merge!(exception.sentry_context)
       end
 
-      @exception = Sentry::ExceptionInterface.build(exception: exception, stacktrace_builder: @stacktrace_builder, mechanism: mechanism)
+      @exception = Sentry::ExceptionInterface.build(
+        exception: exception,
+        stacktrace_builder: @stacktrace_builder,
+        mechanism: mechanism,
+        data_collection: @data_collection
+      )
     end
   end
 end

data/lib/sentry/event.rb

@@ -28,7 +28,7 @@ module Sentry
 
     MAX_MESSAGE_SIZE_IN_BYTES = 1024 * 8
 
-    SKIP_INSPECTION_ATTRIBUTES = [:@modules, :@stacktrace_builder, :@send_default_pii, :@trusted_proxies, :@rack_env_whitelist]
+    SKIP_INSPECTION_ATTRIBUTES = [:@modules, :@stacktrace_builder, :@data_collection, :@trusted_proxies, :@rack_env_whitelist]
 
     include CustomInspection
 
@@ -73,7 +73,7 @@ module Sentry
       @modules = configuration.gem_specs if configuration.send_modules
 
       # configuration options to help events process data
-      @send_default_pii = configuration.send_default_pii
+      @data_collection = configuration.data_collection
       @trusted_proxies = configuration.trusted_proxies
       @stacktrace_builder = configuration.stacktrace_builder
       @rack_env_whitelist = configuration.rack_env_whitelist
@@ -103,7 +103,7 @@ module Sentry
       unless request || env.empty?
         add_request_interface(env)
 
-        user[:ip_address] ||= calculate_real_ip_from_rack(env) if @send_default_pii
+        user[:ip_address] ||= calculate_real_ip_from_rack(env) if @data_collection.user_info
 
         if request_id = Utils::RequestId.read_from(env)
           tags[:request_id] = request_id
@@ -127,7 +127,11 @@ module Sentry
     private
 
     def add_request_interface(env)
-      @request = Sentry::RequestInterface.new(env: env, send_default_pii: @send_default_pii, rack_env_whitelist: @rack_env_whitelist)
+      @request = Sentry::RequestInterface.new(
+        env: env,
+        data_collection: @data_collection,
+        rack_env_whitelist: @rack_env_whitelist
+      )
     end
 
     def serialize_attributes

data/lib/sentry/excon/middleware.rb

@@ -61,14 +61,9 @@ module Sentry
         url = env[:scheme] + "://" + env[:hostname] + env[:path]
         result = { method: env[:method].to_s.upcase, url: url }
 
-        if Sentry.configuration.send_default_pii
-          result[:query] = env[:query]
-
-          # Handle excon 1.0.0+
-          result[:query] = build_nested_query(result[:query]) unless result[:query].is_a?(String)
-
-          result[:body] = env[:body]
-        end
+        query = filter_query_params(env[:query])
+        result[:query] = query if query
+        result[:body] = env[:body] if Sentry.configuration.data_collection.collect_outgoing_http_body?
 
         result
       end

data/lib/sentry/faraday.rb

@@ -14,10 +14,13 @@ module Sentry
 
         # Ensure that we attach instrumentation only if the adapter is not net/http
         # because if is is, then the net/http instrumentation will take care of it
-        if builder.adapter.name != "Faraday::Adapter::NetHttp"
+        if builder.adapter.name != "Faraday::Adapter::NetHttp" &&
+            !builder.locked? &&
+            !builder.instance_variable_defined?(:@sentry_patched)
           # Make sure that it's going to be the first middleware so that it can capture
           # the entire request processing involving other middlewares
           builder.insert(0, ::Faraday::Request::Instrumentation, name: OP_NAME, instrumenter: Instrumenter.new)
+          builder.instance_variable_set(:@sentry_patched, true)
         end
       end
     end
@@ -59,10 +62,9 @@ module Sentry
         url = env[:url].scheme + "://" + env[:url].host + env[:url].path
         result = { method: env[:method].to_s.upcase, url: url }
 
-        if Sentry.configuration.send_default_pii
-          result[:query] = env[:url].query
-          result[:body] = env[:body]
-        end
+        query = filter_query_params(env[:url].query)
+        result[:query] = query if query
+        result[:body] = env[:body] if Sentry.configuration.data_collection.collect_outgoing_http_body?
 
         result
       end

data/lib/sentry/hub.rb

@@ -7,6 +7,7 @@ require "sentry/session"
 module Sentry
   class Hub
     include ArgumentCheckingHelper
+    include CallbackHelper
 
     MUTEX = Mutex.new
 
@@ -224,7 +225,7 @@ module Sentry
     end
 
     def capture_log_event(message, **options)
-      return unless current_client && current_client.configuration.enable_logs
+      return unless current_client
 
       event = current_client.event_from_log(message, **options)
 
@@ -240,9 +241,10 @@ module Sentry
     # @param value [Numeric] the metric value
     # @param unit [String, nil] (optional) the metric unit
     # @param attributes [Hash, nil] (optional) additional attributes for the metric
+    # @param integration [String, Symbol, nil] (optional) registered integration emitting the metric
     # @return [void]
-    def capture_metric(name:, type:, value:, unit: nil, attributes: nil)
-      return unless current_client&.configuration.enable_metrics
+    def capture_metric(name:, type:, value:, unit: nil, attributes: nil, integration: nil)
+      return unless current_client
 
       metric = MetricEvent.new(
         name: name,
@@ -250,6 +252,7 @@ module Sentry
         type: type,
         unit: unit,
         attributes: attributes&.dup,
+        integration_meta: Sentry.integrations[integration.to_s]
       )
 
       current_client.buffer_metric_event(metric, current_scope)
@@ -294,7 +297,11 @@ module Sentry
       return unless configuration.enabled_in_current_env?
 
       if before_breadcrumb = current_client.configuration.before_breadcrumb
-        breadcrumb = before_breadcrumb.call(breadcrumb, hint)
+        breadcrumb = safe_dispatch_callback(
+          "before_breadcrumb",
+          before_breadcrumb,
+          [breadcrumb, hint]
+        )
       end
 
       return unless breadcrumb

data/lib/sentry/integrable.rb

@@ -32,5 +32,17 @@ module Sentry
       options[:hint][:integration] = integration_name
       Sentry.capture_check_in(slug, status, **options, &block)
     end
+
+    def count(name, value: 1, attributes: nil)
+      Sentry.metrics.count(name, value: value, attributes: attributes, integration: integration_name)
+    end
+
+    def gauge(name, value, unit: nil, attributes: nil)
+      Sentry.metrics.gauge(name, value, unit: unit, attributes: attributes, integration: integration_name)
+    end
+
+    def distribution(name, value, unit: nil, attributes: nil)
+      Sentry.metrics.distribution(name, value, unit: unit, attributes: attributes, integration: integration_name)
+    end
   end
 end

data/lib/sentry/interfaces/exception.rb

@@ -25,15 +25,21 @@ module Sentry
     # @see SingleExceptionInterface#build_with_stacktrace
     # @see SingleExceptionInterface#initialize
     # @param mechanism [Mechanism]
+    # @param data_collection [DataCollection]
     # @return [ExceptionInterface]
-    def self.build(exception:, stacktrace_builder:, mechanism:)
+    def self.build(exception:, stacktrace_builder:, mechanism:, data_collection:)
       exceptions = Sentry::Utils::ExceptionCauseChain.exception_to_array(exception).reverse
       processed_backtrace_ids = Set.new
 
       exceptions = exceptions.map do |e|
         if e.backtrace && !processed_backtrace_ids.include?(e.backtrace.object_id)
           processed_backtrace_ids << e.backtrace.object_id
-          SingleExceptionInterface.build_with_stacktrace(exception: e, stacktrace_builder: stacktrace_builder, mechanism: mechanism)
+          SingleExceptionInterface.build_with_stacktrace(
+            exception: e,
+            stacktrace_builder: stacktrace_builder,
+            mechanism: mechanism,
+            data_collection: data_collection
+          )
         else
           SingleExceptionInterface.new(exception: exception, mechanism: mechanism)
         end