feat(core)!: Gate incoming HTTP body capture on dataCollection.httpBodies

[s1gr1d]

Gates incoming request body capture on dataCollection.httpBodies.includes('incomingRequest')
across all server SDKs. An explicit maxRequestBodySize option still overrides the gate.

closes#21258

[github-actions]

size-limit report 📦

Path	Size	% Change	Change
@sentry/browser	29.82 kB	+0.02%	+3 B 🔺
@sentry/browser - with treeshaking flags	28.02 kB	+0.01%	+2 B 🔺
@sentry/browser (incl. Tracing)	47.08 kB	-0.01%	-1 B 🔽
@sentry/browser (incl. Tracing + Span Streaming)	47.09 kB	-0.01%	-1 B 🔽
@sentry/browser (incl. Tracing, Profiling)	51.82 kB	-	-
@sentry/browser (incl. Tracing, Replay)	86.39 kB	+0.01%	+3 B 🔺
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags	75.83 kB	+0.01%	+2 B 🔺
@sentry/browser (incl. Tracing, Replay with Canvas)	91.11 kB	+0.01%	+3 B 🔺
@sentry/browser (incl. Tracing, Replay, Feedback)	103.76 kB	+0.01%	+2 B 🔺
@sentry/browser (incl. Feedback)	47.14 kB	+0.01%	+1 B 🔺
@sentry/browser (incl. sendFeedback)	34.66 kB	+0.01%	+3 B 🔺
@sentry/browser (incl. FeedbackAsync)	39.77 kB	+0.01%	+2 B 🔺
@sentry/browser (incl. Metrics)	30.89 kB	-	-
@sentry/browser (incl. Logs)	31.12 kB	+0.01%	+1 B 🔺
@sentry/browser (incl. Metrics & Logs)	31.8 kB	+0.02%	+6 B 🔺
@sentry/react	31.61 kB	+0.04%	+11 B 🔺
@sentry/react (incl. Tracing)	49.33 kB	+0.01%	+2 B 🔺
@sentry/vue	34.74 kB	+0.01%	+2 B 🔺
@sentry/vue (incl. Tracing)	49.05 kB	+0.02%	+6 B 🔺
@sentry/svelte	29.86 kB	+0.01%	+2 B 🔺
CDN Bundle	31.87 kB	-	-
CDN Bundle (incl. Tracing)	47.45 kB	+0.02%	+5 B 🔺
CDN Bundle (incl. Logs, Metrics)	33.42 kB	+0.01%	+3 B 🔺
CDN Bundle (incl. Tracing, Logs, Metrics)	48.83 kB	+0.01%	+1 B 🔺
CDN Bundle (incl. Replay, Logs, Metrics)	72.78 kB	+0.01%	+3 B 🔺
CDN Bundle (incl. Tracing, Replay)	85.08 kB	+0.01%	+3 B 🔺
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)	86.38 kB	+0.01%	+2 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback)	90.85 kB	+0.01%	+5 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)	92.16 kB	+0.01%	+3 B 🔺
CDN Bundle - uncompressed	95.11 kB	+0.08%	+73 B 🔺
CDN Bundle (incl. Tracing) - uncompressed	142.34 kB	+0.06%	+73 B 🔺
CDN Bundle (incl. Logs, Metrics) - uncompressed	99.82 kB	+0.08%	+73 B 🔺
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed	146.32 kB	+0.05%	+73 B 🔺
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed	224.58 kB	+0.04%	+73 B 🔺
CDN Bundle (incl. Tracing, Replay) - uncompressed	261.6 kB	+0.03%	+73 B 🔺
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed	265.56 kB	+0.03%	+73 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	275.3 kB	+0.03%	+73 B 🔺
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed	279.26 kB	+0.03%	+73 B 🔺
@sentry/nextjs (client)	51.92 kB	+0.01%	+3 B 🔺
@sentry/sveltekit (client)	47.51 kB	+0.01%	+3 B 🔺
@sentry/core/server	79.62 kB	+0.04%	+29 B 🔺
@sentry/core/browser	51.59 kB	+0.01%	+3 B 🔺
@sentry/node	121.3 kB	+0.02%	+22 B 🔺
@sentry/node/import (ESM hook with diagnostics-channel injection)	166 B	-	-
@sentry/node - without tracing	84.79 kB	+0.03%	+20 B 🔺
@sentry/aws-serverless	93.05 kB	+0.03%	+26 B 🔺
@sentry/cloudflare (withSentry) - minified	197.74 kB	+0.08%	+150 B 🔺
@sentry/cloudflare (withSentry)	486.09 kB	+0.07%	+314 B 🔺

View base workflow run

[isaacs]

Implementation looks great!

The test failures are pretty straightforward to fix, it looks like there are some that got missed that assert the old behavior. This patch should fix it, if I'm understanding the intent correctly: https://gist.github.com/isaacs/9897e925123d1ce714b4f20d2a589077

I notice that the Deno.serve() integration at packages/deno/src/integrations/deno-serve.ts doesn't send httpBodies at all, even if it is enabled. I think that means it's technically satisfying the spec, but it might be a nice addition to make it send them as well when enabled. That would require refactoring core's captureBodyFromWinterCGRequest method. That can be a subsequent feature addition though, even post-v11, since it's not technically a bug or spec violation, just a pre-existing inconsistency.

[s1gr1d]

Deno doesn't send httpBodies at all, even if it is enabled.
This can be done in a follow-up (created an issue): #22858

Thanks for the gist! I still wanted to take a look at the failed tests but then worked on other things in the meantime. However, your provided gist does not test the new behavior of collecting HTTP bodies by default. I added the tests now, but with the correct assertions.