sentry-sanitizer 0.8.2 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '0521397fec4fd1c3fc13ea82b40c927ea565706d4d47e5bb6ad088e03a1eb7ef'
-  data.tar.gz: fa306a84451371f29f70c7f9afe4af569c1cf80cb201a3ac590e893fcb0d3a0e
+  metadata.gz: ed85a8f652fb2b3b54796967d622c65699a630543a2911ccfdd1c30cf74704c7
+  data.tar.gz: 2cc6ea9f662817521cc22663734ae392a48ca6fbab77a785897e97d64766c70b
 SHA512:
-  metadata.gz: fba88cdfacfcda7e2fb39bdfd086fae611aee595c48cd48338afb1f47258eb2e01ed7ac5ca3a31a7476ad843486837aefda467b968b02bcb6a96e4c3c5aa314e
-  data.tar.gz: 69e36efb3ef1cbe7ab2323697fdfe368b5ba66b8b05aa74ae7d7ebe9b10a0f94e76c273846f9a410c3495b1beb877bf9fd926c6cb119a7c2c42e8075309ce963
+  metadata.gz: 727f6686da725234549fda38f2125e530ace8f641a9ea95469a692edf28f8a07863aeded84c4226ad7871c836ccbb6d6c504b671b97ed818fc02808b45e89e5c
+  data.tar.gz: 47da7c136e56db35e7435ae5d579ebc19f00bb2e0fb575c9e1b5e41e984a710d6804a815aa662428341b2a3d8b46254a392a529d015b93b06447c581ce8ade3e

data/.github/workflows/ci-linux.yml

@@ -10,13 +10,14 @@ jobs:
     strategy:
       matrix:
         include:
-          - { ruby_version: 2.7 }
-          - { ruby_version: 3.0 }
-          - { ruby_version: 3.1 }
-          - { ruby_version: 3.2 }
-          - { ruby_version: 3.3 }
-          - { ruby_version: 3.4 }
-          - { ruby_version: jruby }
+          - { ruby_version: 3.3, sentry_version: "~> 6.0" }
+          - { ruby_version: 3.4, sentry_version: "~> 6.0" }
+          - { ruby_version: 3.4, sentry_version: "~> 7.0" }
+          - { ruby_version: 4.0, sentry_version: "~> 6.0" }
+          - { ruby_version: 4.0, sentry_version: "~> 7.0" }
+          - { ruby_version: jruby, sentry_version: "~> 6.0" }
+    env:
+      SENTRY_VERSION: ${{ matrix.sentry_version }}
     steps:
       - uses: actions/checkout@v1
 

data/.github/workflows/ci-macos.yml

@@ -10,13 +10,14 @@ jobs:
     strategy:
       matrix:
         include:
-          - { ruby_version: 2.7 }
-          - { ruby_version: 3.0 }
-          - { ruby_version: 3.1 }
-          - { ruby_version: 3.2 }
-          - { ruby_version: 3.3 }
-          - { ruby_version: 3.4 }
-          - { ruby_version: jruby }
+          - { ruby_version: 3.3, sentry_version: "~> 6.0" }
+          - { ruby_version: 3.4, sentry_version: "~> 6.0" }
+          - { ruby_version: 3.4, sentry_version: "~> 7.0" }
+          - { ruby_version: 4.0, sentry_version: "~> 6.0" }
+          - { ruby_version: 4.0, sentry_version: "~> 7.0" }
+          - { ruby_version: jruby, sentry_version: "~> 6.0" }
+    env:
+      SENTRY_VERSION: ${{ matrix.sentry_version }}
     steps:
       - uses: actions/checkout@v1
 
@@ -37,4 +38,3 @@ jobs:
         with:
           flag-name: ruby-${{ join(matrix.*, '-') }}
           parallel: true
-

data/.rubocop.yml

@@ -26,6 +26,12 @@ Metrics/ClassLength:
 Metrics/AbcSize:
   Enabled: false
 
+Metrics/CyclomaticComplexity:
+  Enabled: false
+
+Metrics/PerceivedComplexity:
+  Enabled: false
+
 Gemspec/RequiredRubyVersion:
   Enabled: false
 

data/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.9.0
+
+- Add `filter` option to pass a custom filter, e.g. `ActiveSupport::ParameterFilter` [#25](https://github.com/mrexox/sentry-sanitizer/pull/25)
+- `filter` can't be combined with `fields` or `mask`
+
+## 0.8.3
+
+- Add Sentry 7 support [#24](https://github.com/mrexox/sentry-sanitizer/pull/24)
+
+## 0.8.2
+
+- Sanitize breadcrumb data only if it's a Hash [#22](https://github.com/mrexox/sentry-sanitizer/pull/22)
+
 ## 0.8.1
 
 - Fix breadcrumb data[:body] == nil handling [#20](https://github.com/mrexox/sentry-sanitizer/pull/20)

data/Gemfile

@@ -7,11 +7,23 @@ git_source(:github) { |repo_name| "https://github.com/#{repo_name}" }
 # Specify your gem's dependencies in sentry-sanitizer.gemspec
 gemspec
 
+gem "sentry-ruby", ENV.fetch("SENTRY_VERSION", "~> 6.0")
+# sentry-ruby requires "logger" internally but only declares it as a dependency
+# itself from ~6.3.1/7.0 onwards; older sentry-ruby versions rely on it being a
+# stdlib default gem, which Ruby 4.0 no longer bundles by default.
+gem "logger"
+
 gem "base64"
+gem "cgi"
 gem "rubocop", "~> 1.28.2"
-gem "simplecov", require: false, group: :test
 
 gem "bundler", ">= 2.3"
 gem "rack"
 gem "rake", "~> 12"
 gem "rspec", "~> 3.0"
+
+group :test do
+  gem "activesupport", "~> 8.0"
+
+  gem "simplecov", require: false
+end

data/Gemfile.lock

@@ -1,18 +1,41 @@
 PATH
   remote: .
   specs:
-    sentry-sanitizer (0.8.2)
-      sentry-ruby (>= 5.3, < 7.0.0)
+    sentry-sanitizer (0.9.0)
+      sentry-ruby (>= 5.3, < 8.0.0)
 
 GEM
   remote: https://rubygems.org/
   specs:
+    activesupport (8.1.4)
+      base64
+      bigdecimal
+      concurrent-ruby (~> 1.0, >= 1.3.1)
+      connection_pool (>= 2.2.5)
+      drb
+      i18n (>= 1.6, < 2)
+      json
+      logger (>= 1.4.2)
+      minitest (>= 5.1)
+      securerandom (>= 0.3)
+      tzinfo (~> 2.0, >= 2.0.5)
+      uri (>= 0.13.1)
     ast (2.4.3)
     base64 (0.3.0)
-    bigdecimal (3.3.1)
-    concurrent-ruby (1.3.5)
+    bigdecimal (4.1.3)
+    cgi (0.5.2)
+    concurrent-ruby (1.3.8)
+    connection_pool (3.0.2)
     diff-lcs (1.5.0)
     docile (1.4.0)
+    drb (2.2.3)
+    i18n (1.15.2)
+      concurrent-ruby (~> 1.0)
+    json (3.0.2)
+    logger (1.7.0)
+    minitest (6.0.6)
+      drb (~> 2.0)
+      prism (~> 1.5)
     parallel (1.27.0)
     parser (3.3.10.0)
       ast (~> 2.4.1)
@@ -50,25 +73,34 @@ GEM
       parser (>= 3.3.7.2)
       prism (~> 1.4)
     ruby-progressbar (1.13.0)
-    sentry-ruby (6.1.1)
+    securerandom (0.4.1)
+    sentry-ruby (6.7.0)
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.0.2)
+      logger
     simplecov (0.18.5)
       docile (~> 1.1)
       simplecov-html (~> 0.11)
     simplecov-html (0.12.3)
+    tzinfo (2.0.6)
+      concurrent-ruby (~> 1.0)
     unicode-display_width (2.6.0)
+    uri (1.1.2)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
+  activesupport (~> 8.0)
   base64
   bundler (>= 2.3)
+  cgi
+  logger
   rack
   rake (~> 12)
   rspec (~> 3.0)
   rubocop (~> 1.28.2)
+  sentry-ruby (~> 6.0)
   sentry-sanitizer!
   simplecov
 

data/README.md

@@ -40,22 +40,27 @@ Add following lines to your Sentry configuration:
 Sentry.init do |config|
   # ... your configuration
 
-  # If using Rails
+  # Mask same fields as Rails does
   config.sanitize.fields = Rails.application.config.filter_parameters
-
-  # You can also pass custom array
+  # Or pass custom fields
   config.sanitize.fields = %w[password super_secret_token]
 
+  # Use custom filter (e.g. from activesupport).
+  # Must implement #filter(array_or_hash) and #filter_param(key, value)
+  # Don't set 'config.sanitize.fields' if using this.
+  config.sanitize.filter = ActiveSupport::ParameterFilter.new(
+    Rails.application.config.filter_parameters, mask: "[FILTERED]"
+  )
+
   # HTTP headers can be sanitized too (it is case insensitive)
   config.sanitize.http_headers = %w[Authorization X-Xsrf-Token]
-
-  # You can sanitize all HTTP headers with setting `true` value
+  # Mask all headers
   config.sanitize.http_headers = true
 
-  # You can sanitize all cookies with this setting
+  # Mask all cookies
   config.sanitize.cookies = true
 
-  # You can sanitize query string params for GET requests
+  # Parse and sanitize request query string
   config.sanitize.query_string = true
 
   # Sanitize breadcrumbs data[:body] payload (Setry::Net:HTTP)

data/bin/bundle

@@ -14,31 +14,31 @@ m = Module.new do
   module_function
 
   def invoked_as_script?
-    File.expand_path($0) == File.expand_path(__FILE__)
+    File.expand_path($PROGRAM_NAME) == File.expand_path(__FILE__)
   end
 
   def env_var_version
-    ENV["BUNDLER_VERSION"]
+    ENV.fetch("BUNDLER_VERSION", nil)
   end
 
   def cli_arg_version
     return unless invoked_as_script? # don't want to hijack other binstubs
     return unless "update".start_with?(ARGV.first || " ") # must be running `bundle update`
+
     bundler_version = nil
     update_index = nil
     ARGV.each_with_index do |a, i|
-      if update_index && update_index.succ == i && a =~ Gem::Version::ANCHORED_VERSION_PATTERN
-        bundler_version = a
-      end
+      bundler_version = a if update_index && update_index.succ == i && a =~ Gem::Version::ANCHORED_VERSION_PATTERN
       next unless a =~ /\A--bundler(?:[= ](#{Gem::Version::VERSION_PATTERN}))?\z/
-      bundler_version = $1
+
+      bundler_version = Regexp.last_match(1)
       update_index = i
     end
     bundler_version
   end
 
   def gemfile
-    gemfile = ENV["BUNDLE_GEMFILE"]
+    gemfile = ENV.fetch("BUNDLE_GEMFILE", nil)
     return gemfile if gemfile && !gemfile.empty?
 
     File.expand_path("../Gemfile", __dir__)
@@ -55,15 +55,17 @@ m = Module.new do
 
   def lockfile_version
     return unless File.file?(lockfile)
+
     lockfile_contents = File.read(lockfile)
     return unless lockfile_contents =~ /\n\nBUNDLED WITH\n\s{2,}(#{Gem::Version::VERSION_PATTERN})\n/
+
     Regexp.last_match(1)
   end
 
   def bundler_requirement
     @bundler_requirement ||=
       env_var_version || cli_arg_version ||
-        bundler_requirement_for(lockfile_version)
+      bundler_requirement_for(lockfile_version)
   end
 
   def bundler_requirement_for(version)
@@ -91,10 +93,12 @@ m = Module.new do
       gem "bundler", bundler_requirement
     end
     return if gem_error.nil?
+
     require_error = activation_error_handling do
       require "bundler/version"
     end
     return if require_error.nil? && Gem::Requirement.new(bundler_requirement).satisfied_by?(Gem::Version.new(Bundler::VERSION))
+
     warn "Activating bundler (#{bundler_requirement}) failed:\n#{gem_error.message}\n\nTo install the version of bundler this project requires, run `gem install bundler -v '#{bundler_requirement}'`"
     exit 42
   end
@@ -109,6 +113,4 @@ end
 
 m.load_bundler!
 
-if m.invoked_as_script?
-  load Gem.bin_path("bundler", "bundle")
-end
+load Gem.bin_path("bundler", "bundle") if m.invoked_as_script?

data/lib/sentry/sanitizer/cleaner.rb

@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
 require "json"
+require "sentry/sanitizer/filter"
 
 module Sentry
   module Sanitizer
     class Cleaner
-      DEFAULT_MASK = "[FILTERED]"
       DEFAULT_SENSITIVE_HEADERS = %w[
         Authorization
         X-Xsrf-Token
@@ -14,11 +14,16 @@ module Sentry
       private_constant :DEFAULT_SENSITIVE_HEADERS
 
       def initialize(config)
-        @fields = config.fields || []
+        @filter = config.filter || Filter.new(config.fields, mask: config.mask)
+
         @http_headers = config.http_headers || DEFAULT_SENSITIVE_HEADERS
+        @headers_filter = Filter.new(@http_headers, mask: config.mask) if @http_headers.is_a?(Array)
+
         @do_cookies = config.cookies || false
         @do_query_string = config.query_string || false
-        @mask = config.mask || DEFAULT_MASK
+
+        @mask = config.mask || Filter::DEFAULT_MASK
+
         @breadcrumbs_json_data_fields = config.breadcrumbs.json_data_fields || []
       end
 
@@ -79,20 +84,23 @@ module Sentry
         # ignore
       end
 
-      def sanitize_data(hash)
-        return hash unless hash.is_a? Hash
-        return hash unless fields.size.positive?
-
-        sanitize_value(hash, nil)
+      def sanitize_data(data)
+        case data
+        when Hash, Array
+          filter.filter(data)
+        else
+          data
+        end
       end
 
       private
 
-      attr_reader :fields,
+      attr_reader :filter,
+                  :headers_filter,
+                  :mask,
                   :http_headers,
                   :do_cookies,
                   :do_query_string,
-                  :mask,
                   :breadcrumbs_json_data_fields
 
       # Sanitize specified headers
@@ -101,15 +109,7 @@ module Sentry
         when TrueClass
           headers.transform_values { mask }
         when Array
-          return headers unless http_headers.size.positive?
-
-          http_headers_regex = sensitive_regexp(http_headers)
-
-          headers.keys.select { |key| key.match?(http_headers_regex) }.each do |key|
-            headers[key] = mask
-          end
-
-          headers
+          headers_filter.filter(headers)
         else
           headers
         end
@@ -125,59 +125,28 @@ module Sentry
 
       def sanitize_query_string(query_string)
         return query_string unless do_query_string
-        return query_string unless query_string.is_a? String
-
-        sanitized_array = query_string.split("&").map do |kv_pair|
-          k, v = kv_pair.split("=")
-          new_v = sanitize_string(k, v)
-
-          "#{k}=#{new_v}"
-        end
 
-        sanitized_array.join("&")
-      end
-
-      def sanitize_value(value, key)
-        case value
-        when Hash
-          sanitize_hash(key, value)
-        when Array
-          sanitize_array(key, value)
+        case query_string
         when String
-          sanitize_string(key, value)
+          sanitize_query_string_from_string(query_string)
+        when Hash
+          sanitize_data(query_string)
         else
-          value
+          query_string
         end
       end
 
-      def sanitize_hash(key, value)
-        if key&.match?(sensitive_fields)
-          mask
-        elsif value.frozen?
-          value.merge(value) { |k, v| sanitize_value(v, k) }
-        else
-          value.merge!(value) { |k, v| sanitize_value(v, k) }
-        end
-      end
+      # sentry-ruby >= 7 populates Request#query_string as a Hash (from Rack's
+      # parsed request.GET) instead of the raw query string.
+      def sanitize_query_string_from_string(query_string)
+        sanitized_array = query_string.split("&").map do |kv_pair|
+          k, v = kv_pair.split("=")
+          new_v = filter.filter_param(k, v)
 
-      def sanitize_array(key, value)
-        if value.frozen?
-          value.map { |val| sanitize_value(val, key) }
-        else
-          value.map! { |val| sanitize_value(val, key) }
+          "#{k}=#{new_v}"
         end
-      end
 
-      def sanitize_string(key, value)
-        key&.match?(sensitive_fields) ? mask : value
-      end
-
-      def sensitive_fields
-        @sensitive_fields ||= sensitive_regexp(fields)
-      end
-
-      def sensitive_regexp(fields)
-        Regexp.new(fields.map { |field| "\\b#{field}\\b" }.join("|"), "i")
+        sanitized_array.join("&")
       end
     end
   end

data/lib/sentry/sanitizer/configuration.rb

@@ -2,6 +2,7 @@
 
 require "sentry/configuration"
 require "sentry/sanitizer/cleaner"
+require "sentry/sanitizer/filter"
 require "sentry/sanitizer/configuration_mixin"
 
 module Sentry
@@ -43,6 +44,7 @@ module Sentry
       end
 
       attr_reader :fields,
+                  :filter,
                   :http_headers,
                   :cookies,
                   :query_string,
@@ -51,6 +53,7 @@ module Sentry
       def configured?
         [
           fields,
+          filter,
           http_headers,
           cookies,
           query_string,
@@ -63,11 +66,22 @@ module Sentry
       end
 
       def fields=(fields)
-        raise ArgumentError, "sanitize_fields must be array" unless fields.is_a? Array
+        raise ArgumentError, "fields must be array" unless fields.is_a? Array
+        raise ArgumentError, "specify either 'fields' or 'filter'" if filter
 
         @fields = fields
       end
 
+      def filter=(filter)
+        methods = Sanitizer::Filter.instance_methods(false)
+        implements = methods.all? { |method| filter.respond_to?(method) }
+        raise ArgumentError, "specify either 'fields' or 'filter'" if fields
+        raise ArgumentError, "mask can't be used when 'filter' is set" if mask
+        raise ArgumentError, "filter must implement #{methods.join(', ')}" unless implements
+
+        @filter = filter
+      end
+
       def http_headers=(headers)
         raise ArgumentError, "sanitize_http_headers must be array" unless [Array, TrueClass, FalseClass].include?(headers.class)
 
@@ -88,6 +102,7 @@ module Sentry
 
       def mask=(mask)
         raise ArgumentError, "mask must be string" unless mask.is_a?(String)
+        raise ArgumentError, "mask can't be used when 'filter' is set" if filter
 
         @mask = mask
       end

data/lib/sentry/sanitizer/configuration_mixin.rb

@@ -28,7 +28,7 @@ module Sentry
       #
       # @param [nil, #call] value
       #
-      def before_breadcrumb=(value) # rubocop:disable Metrics/CyclomaticComplexity
+      def before_breadcrumb=(value)
         raise ArgumentError, "before_breadcrumb must be callable (or nil to disable)" unless value.nil? || value == false || value.respond_to?(:call)
 
         return unless value

data/lib/sentry/sanitizer/filter.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+module Sentry
+  module Sanitizer
+    class Filter
+      DEFAULT_MASK = "[FILTERED]"
+
+      def initialize(fields, mask: nil)
+        @filters = compile_filters(fields || [])
+        @mask = mask || DEFAULT_MASK
+      end
+
+      def filter(params)
+        filters.nil? ? params : sanitize_value(nil, params)
+      end
+
+      def filter_param(key, value)
+        filters.nil? ? value : sanitize_value(key, value)
+      end
+
+      private
+
+      attr_reader :mask, :filters
+
+      def compile_filters(fields)
+        return nil if fields.size.zero?
+
+        Regexp.new(fields.map { |field| "\\b#{field}\\b" }.join("|"), "i")
+      end
+
+      def sanitize_value(key, value)
+        return mask if key&.match?(filters)
+
+        case value
+        when Hash
+          if value.frozen?
+            value.merge(value) { |k, v| sanitize_value(k, v) }
+          else
+            value.merge!(value) { |k, v| sanitize_value(k, v) }
+          end
+        when Array
+          if value.frozen?
+            value.map { |v| sanitize_value(key, v) }
+          else
+            value.map! { |v| sanitize_value(key, v) }
+          end
+        else
+          value
+        end
+      end
+    end
+  end
+end

data/lib/sentry/sanitizer/version.rb

@@ -2,6 +2,6 @@
 
 module Sentry
   module Sanitizer
-    VERSION = "0.8.2"
+    VERSION = "0.9.0"
   end
 end

data/sentry-sanitizer.gemspec

@@ -27,6 +27,6 @@ Gem::Specification.new do |spec|
 
   spec.require_paths = ["lib"]
 
-  spec.add_runtime_dependency "sentry-ruby", ">= 5.3", "< 7.0.0"
+  spec.add_runtime_dependency "sentry-ruby", ">= 5.3", "< 8.0.0"
   spec.metadata["rubygems_mfa_required"] = "true"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sentry-sanitizer
 version: !ruby/object:Gem::Version
-  version: 0.8.2
+  version: 0.9.0
 platform: ruby
 authors:
 - Valentine Kiselev
@@ -18,7 +18,7 @@ dependencies:
         version: '5.3'
     - - "<"
       - !ruby/object:Gem::Version
-        version: 7.0.0
+        version: 8.0.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -28,7 +28,7 @@ dependencies:
         version: '5.3'
     - - "<"
       - !ruby/object:Gem::Version
-        version: 7.0.0
+        version: 8.0.0
 description: Add missing sanitizing support for sentry-ruby (previous sentry-raven)
 email:
 - mrexox@outlook.com
@@ -59,6 +59,7 @@ files:
 - lib/sentry/sanitizer/cleaner.rb
 - lib/sentry/sanitizer/configuration.rb
 - lib/sentry/sanitizer/configuration_mixin.rb
+- lib/sentry/sanitizer/filter.rb
 - lib/sentry/sanitizer/version.rb
 - sentry-sanitizer.gemspec
 - tea.yml