Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Default `EventScrubber` uses `recursive=False`, so nested denylist keys are not scrubbed |

Aperta
#7,620 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
65/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
python
Ambito
security

Direzione di ricerca

The issue is in sentry_sdk/scrubber.py where EventScrubber.init sets recursive=False by default. Review sentry_sdk/client.py to see how the scrubber is instantiated. Write a test that creates an event with a nested denylist key (like under 'extra') and verify it's not scrubbed with the default, then is scrubbed after setting recursive=True. Check if there are performance concerns with deep recursion and consider limiting to known containers.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Bug Python Waiting for: Product Owner

Static review of public source at commit 85e7ce66fcca. No traffic was sent to any Sentry environment.

EventScrubber only walks nested dict/list values when recursive=True, and that flag defaults to False:

sentry_sdk/scrubber.py:

class EventScrubber:
    def __init__(
        self,
        denylist: "Optional[List[str]]" = None,
        recursive: bool = False,
        ...
    ) -> None:

if isinstance(k, str) and k.lower() in self.denylist:
    d[k] = AnnotatedValue.substituted_because_contains_sensitive_data()
elif self.recursive:
    self.scrub_dict(v)
    self.scrub_list(v)

The default client wires a scrubber without enabling recursion:

sentry_sdk/client.py:

rv["event_scrubber"] = EventScrubber(
    send_default_pii=False
    if rv["send_default_pii"] is None
    else rv["send_default_pii"]
)

Top-level keys such as authorization are scrubbed; the same key nested under extra, request.data, or breadcrumb data is not. Integrators who assume “Sentry scrubs secrets by default” get shallow coverage only.

Suggested change:

  • Default recursive=True on EventScrubber, or pass recursive=True from the client bootstrap.
  • If recursion cost is the concern, recurse only into known containers (extra, request.data, breadcrumb data, frame vars) rather than the whole event.
  • Document the flag next to send_default_pii in the scrubbing guide.

Severity: low–medium data-protection hardening (secret leakage via nested event fields). No proof-of-concept; no events were submitted.

Happy to send a focused PR + regression test with a nested denylist key if useful.

Lingua principale
Python
Stelle
2.2k
Fork
672
Merge medio
22h 47m
PR unite (30g)
224

Guida per i contributori

Apri la guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di getsentry/sentry-python

Tutte le issue di getsentry/sentry-python

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.