Skip to content

fix(tornado): Gate url.full, url.path, url.query on send_default_pii#6664

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ericapisani merged 1 commit into from
Jun 26, 2026
+22 −7
Merged

fix(tornado): Gate url.full, url.path, url.query on send_default_pii #6664

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions sentry_sdk/integrations/tornado.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -197,10 +197,12 @@ def _get_request_attributes(request: "Any") -> "Dict[str, Any]":
for header, value in headers.items():
attributes[f"{SPANDATA.HTTP_REQUEST_HEADER}.{header.lower()}"] = value

if request.query:
attributes[SPANDATA.URL_QUERY] = request.query
if should_send_default_pii():
attributes[SPANDATA.URL_FULL] = request.full_url()
attributes["url.path"] = request.path

attributes[SPANDATA.URL_FULL] = request.full_url()
if request.query:
attributes[SPANDATA.URL_QUERY] = request.query

if request.protocol:
attributes[SPANDATA.NETWORK_PROTOCOL_NAME] = request.protocol
Expand Down
21 changes: 17 additions & 4 deletions tests/integrations/tornado/test_tornado.py
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -110,6 +110,7 @@ def test_basic(tornado_testcase, sentry_init, capture_events):
assert not sentry_sdk.get_isolation_scope()._tags


@pytest.mark.parametrize("send_pii", [True, False])
@pytest.mark.parametrize("span_streaming", [True, False])
@pytest.mark.parametrize(
"handler,code",
Expand All@@ -126,10 +127,12 @@ def test_transactions(
handler,
code,
span_streaming,
send_pii,
):
sentry_init(
integrations=[TornadoIntegration()],
traces_sample_rate=1.0,
send_default_pii=send_pii,
_experiments={"trace_lifecycle": "stream" if span_streaming else "static"},
)

Expand DownExpand Up@@ -185,11 +188,18 @@ def test_transactions(
assert server_segment["attributes"]["http.request.method"] == "POST"
assert server_segment["attributes"]["http.request.body.data"] == "heyoo"
assert server_segment["attributes"]["http.response.status_code"] == code
assert server_segment["attributes"]["url.query"] == "foo=bar"
assert server_segment["attributes"]["url.full"].endswith("/hi?foo=bar")
assert server_segment["attributes"]["url.full"].startswith("http://")
assert server_segment["status"] == ("ok" if code == 200 else "error")
assert client_segment["trace_id"] == server_segment["trace_id"]

if send_pii:
assert server_segment["attributes"]["url.query"] == "foo=bar"
assert server_segment["attributes"]["url.full"].endswith("/hi?foo=bar")
assert server_segment["attributes"]["url.full"].startswith("http://")
assert server_segment["attributes"]["url.path"] == "/hi"
else:
assert "url.query" not in server_segment["attributes"]
assert "url.full" not in server_segment["attributes"]
assert "url.path" not in server_segment["attributes"]
else:
if code == 200:
client_tx, server_tx = events
Expand DownExpand Up@@ -227,7 +237,7 @@ def test_transactions(

request = server_tx["request"]
host = request["headers"]["Host"]
assert server_tx["request"] == {
expected_request = {
"env": {"REMOTE_ADDR": "127.0.0.1"},
"headers": {
"Accept-Encoding": "gzip",
Expand All@@ -239,6 +249,9 @@ def test_transactions(
"data": {"heyoo": [""]},
"url": "http://{host}/hi".format(host=host),
}
if send_pii:
expected_request["cookies"] = {}
assert server_tx["request"] == expected_request

assert (
client_tx["contexts"]["trace"]["trace_id"]
Comment on lines 249 to 257

@sentrysentryBotJun 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The query_string is always included in the legacy event payload, regardless of the send_default_pii setting, potentially leaking PII.
Severity: HIGH

Suggested Fix

In the _make_event_processor function, wrap the assignment to request_info["query_string"] in a conditional that checks if should_send_default_pii() is true. Additionally, update the corresponding test case to assert that query_string is not present in the expected_request when send_pii is False.

Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: tests/integrations/tornado/test_tornado.py#L249-L257
Potential issue: The pull request correctly gates the `url.query` attribute for span
streaming behind the `send_default_pii` setting. However, for the legacy (non-streaming)
event format, the `query_string` is unconditionally added to the event's request payload
in the `_make_event_processor` function. This happens even when `send_default_pii` is
`False`, leading to a potential PII leak. The test suite for the legacy path fails to
assert that the `query_string` is absent when PII is disabled, which is why this issue
was not caught. This creates an inconsistency where span streaming correctly redacts
PII, but legacy events do not.

Did we get this right? 👍 / 👎 to inform future reviews.

Expand Down
Loading