Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Default `EventScrubber` uses `recursive=False`, so nested denylist keys are not scrubbed |

Abierto
#7,620 1 comentario 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
65/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
python
Área
security

Línea de trabajo

The issue is in sentry_sdk/scrubber.py where EventScrubber.init sets recursive=False by default. Review sentry_sdk/client.py to see how the scrubber is instantiated. Write a test that creates an event with a nested denylist key (like under 'extra') and verify it's not scrubbed with the default, then is scrubbed after setting recursive=True. Check if there are performance concerns with deep recursion and consider limiting to known containers.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Bug Python Waiting for: Product Owner

Static review of public source at commit 85e7ce66fcca. No traffic was sent to any Sentry environment.

EventScrubber only walks nested dict/list values when recursive=True, and that flag defaults to False:

sentry_sdk/scrubber.py:

class EventScrubber:
    def __init__(
        self,
        denylist: "Optional[List[str]]" = None,
        recursive: bool = False,
        ...
    ) -> None:

if isinstance(k, str) and k.lower() in self.denylist:
    d[k] = AnnotatedValue.substituted_because_contains_sensitive_data()
elif self.recursive:
    self.scrub_dict(v)
    self.scrub_list(v)

The default client wires a scrubber without enabling recursion:

sentry_sdk/client.py:

rv["event_scrubber"] = EventScrubber(
    send_default_pii=False
    if rv["send_default_pii"] is None
    else rv["send_default_pii"]
)

Top-level keys such as authorization are scrubbed; the same key nested under extra, request.data, or breadcrumb data is not. Integrators who assume “Sentry scrubs secrets by default” get shallow coverage only.

Suggested change:

  • Default recursive=True on EventScrubber, or pass recursive=True from the client bootstrap.
  • If recursion cost is the concern, recurse only into known containers (extra, request.data, breadcrumb data, frame vars) rather than the whole event.
  • Document the flag next to send_default_pii in the scrubbing guide.

Severity: low–medium data-protection hardening (secret leakage via nested event fields). No proof-of-concept; no events were submitted.

Happy to send a focused PR + regression test with a nested denylist key if useful.

Lenguaje dominante
Python
Estrellas
2.2k
Forks
672
Merge medio
22 h 47 min
PR fusionados (30 d)
224

Guía de contribución

Abrir la guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de getsentry/sentry-python

Todos los issues de getsentry/sentry-python

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.