Skip to content

Remove authority from URLs sent to Sentry - #2366

Merged
adinauer merged 15 commits into
mainfrom
feat/remove-sensitive-data-from-urls
Jan 30, 2023
Merged

Remove authority from URLs sent to Sentry#2366
adinauer merged 15 commits into
mainfrom
feat/remove-sensitive-data-from-urls

Conversation

@adinauer

@adinaueradinauer commented Nov 15, 2022

Copy link
Copy Markdown
Member

📜 Description

Remove authority from URLs that are sent to Sentry, e.g. as span descriptions, breadcrumbs or requests.

💡 Motivation and Context

Fixes#2365

💚 How did you test it?

📝 Checklist

  • I reviewed the submitted code
  • I added tests to verify the changes
  • I updated the docs if needed
  • No breaking changes

🔮 Next steps

@github-actions

github-actionsBot commented Nov 15, 2022

Copy link
Copy Markdown
Contributor
Messages
📖Do not forget to update Sentry-docs with your feature once the pull request gets approved.

Generated by 🚫 dangerJS against 5254e47

@github-actions

github-actionsBot commented Nov 15, 2022

Copy link
Copy Markdown
Contributor

Performance metrics 🚀

PlainWith SentryDiff
Startup time355.57 ms390.90 ms35.33 ms
Size1.73 MiB2.33 MiB620.61 KiB

Previous results on branch: feat/remove-sensitive-data-from-urls

Startup times

RevisionPlainWith SentryDiff
8fb596c355.54 ms438.55 ms83.01 ms
46ba0df346.57 ms350.41 ms3.84 ms
593148d368.38 ms413.20 ms44.82 ms
15cc296315.33 ms419.94 ms104.61 ms

App size

RevisionPlainWith SentryDiff
8fb596c1.73 MiB2.33 MiB620.61 KiB
46ba0df1.73 MiB2.33 MiB621.15 KiB
593148d1.73 MiB2.33 MiB621.15 KiB
15cc2961.73 MiB2.33 MiB620.61 KiB

@codecov

codecovBot commented Jan 20, 2023

Copy link
Copy Markdown

Codecov Report

Base: 80.12% // Head: 80.18% // Increases project coverage by +0.05% 🎉

Coverage data is based on head (5254e47) compared to base (9ab45a7).
Patch coverage: 87.39% of modified lines in pull request are covered.

Additional details and impacted files
@@ Coverage Diff @@## main #2366 +/- ##
============================================
+ Coverage 80.12% 80.18% +0.05% - Complexity 3919 3943 +24 
============================================
Files 322 323 +1 Lines 14796 14896 +100 Branches 1951 1966 +15 ============================================
+ Hits 11856 11944 +88 - Misses 2171 2178 +7 - Partials 769 774 +5 
Impacted FilesCoverage Δ
...racing/SentrySpanClientHttpRequestInterceptor.java0.00% <0.00%> (ø)
...racing/SentrySpanClientHttpRequestInterceptor.java0.00% <0.00%> (ø)
.../io/sentry/apollo3/SentryApollo3HttpInterceptor.kt79.77% <75.00%> (ø)
sentry/src/main/java/io/sentry/Breadcrumb.java85.95% <85.71%> (-0.10%)⬇️
sentry/src/main/java/io/sentry/util/UrlUtils.java90.90% <90.90%> (ø)
...in/java/io/sentry/openfeign/SentryFeignClient.java94.36% <100.00%> (+0.16%)⬆️
...arta/SentryRequestHttpServletRequestProcessor.java94.73% <100.00%> (+0.61%)⬆️
...vlet/SentryRequestHttpServletRequestProcessor.java94.73% <100.00%> (+0.61%)⬆️
...o/sentry/spring/jakarta/SentryRequestResolver.java94.73% <100.00%> (+0.29%)⬆️
.../spring/jakarta/webflux/SentryRequestResolver.java71.42% <100.00%> (+1.42%)⬆️
... and 3 more

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

@adinaueradinauer changed the title Remove sensitive data from URLs sent to SentryRemove authority from URLs sent to SentryJan 23, 2023
@adinauer
adinauer marked this pull request as ready for review January 23, 2023 11:49

@cleptriccleptric left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just checked how the query and fragment are now set on the span/breadcrumb, LGTM!

@markushimarkushi left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice one, I like the extensive tests!

}

private static @NotNull String baseUrlOnly(final @NotNull String url) {
final int queryParamSeparatorIndex = url.indexOf("?");

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

l: Can't you use java built-in URL class here instead?
I haven't tried it but

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess you could reconstruct the base URL from parts retrieved from URL but imo that wouldn't be any better than the current code.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Alright, then let's keep it this way. I just checked a few exotic URLs (like example.com/?/path/?query=param) and your solution provides better output than the URL api 👍

return convertUrl(url);
}

public static @NotNull UrlDetails convertUrl(final @NotNull String url) {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

l: I'm wondering if parse() or parseUrl() would suit better here

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No preference here. Can rename it if you want.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah I think it would fit better, but I'm definitely nit-picking here - if it's too much effort to refactor leave it as is 😅

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated

Comment on lines +8 to +12
import java.util.regex.Pattern;
import org.jetbrains.annotations.NotNull;
import org.jetbrains.annotations.Nullable;

public final class UrlUtils {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess we could mark this as @ApiStatus.Internal right?

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

@adinauer
adinauer merged commit 5fa24ec into mainJan 30, 2023
@adinauer
adinauer deleted the feat/remove-sensitive-data-from-urls branch January 30, 2023 12:29
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Sanitize sensitive data from URLs sent to Sentry

4 participants

@adinauer@markushi@cleptric@vaind