Merge branch 'master' into sentry-sdk-2.0

Author: sentrivana

sentry_sdk/metrics.py

@@ -55,7 +55,7 @@
 
 _in_metrics = ContextVar("in_metrics", default=False)
 _sanitize_key = partial(re.compile(r"[^a-zA-Z0-9_/.-]+").sub, "_")
-_sanitize_value = partial(re.compile(r"[^\w\d_:/@\.{}\[\]$-]+", re.UNICODE).sub, "_")
+_sanitize_value = partial(re.compile(r"[^\w\d\s_:/@\.{}\[\]$-]+", re.UNICODE).sub, "")
 _set = set  # set is shadowed below
 
 GOOD_TRANSACTION_SOURCES = frozenset(

sentry_sdk/scrubber.py

@@ -57,20 +57,43 @@
 ]
 
 
-class EventScrubber:
-    def __init__(self, denylist=None):
-        # type: (Optional[List[str]]) -> None
+class EventScrubber(object):
+    def __init__(self, denylist=None, recursive=False):
+        # type: (Optional[List[str]], bool) -> None
         self.denylist = DEFAULT_DENYLIST if denylist is None else denylist
         self.denylist = [x.lower() for x in self.denylist]
+        self.recursive = recursive
+
+    def scrub_list(self, lst):
+        # type: (List[Any]) -> None
+        """
+        If a list is passed to this method, the method recursively searches the list and any
+        nested lists for any dictionaries. The method calls scrub_dict on all dictionaries
+        it finds.
+        If the parameter passed to this method is not a list, the method does nothing.
+        """
+        if not isinstance(lst, list):
+            return
+
+        for v in lst:
+            if isinstance(v, dict):
+                self.scrub_dict(v)
+            elif isinstance(v, list):
+                self.scrub_list(v)
 
     def scrub_dict(self, d):
         # type: (Dict[str, Any]) -> None
         if not isinstance(d, dict):
             return
 
-        for k in d.keys():
+        for k, v in d.items():
             if isinstance(k, str) and k.lower() in self.denylist:
                 d[k] = AnnotatedValue.substituted_because_contains_sensitive_data()
+            elif self.recursive:
+                if isinstance(v, dict):
+                    self.scrub_dict(v)
+                elif isinstance(v, list):
+                    self.scrub_list(v)
 
     def scrub_request(self, event):
         # type: (Event) -> None

tests/test_metrics.py

@@ -807,6 +807,8 @@ def test_tag_normalization(
     metrics.distribution("a", 1.0, tags={"foo-bar": "%$foo"}, timestamp=ts)
     metrics.distribution("b", 1.0, tags={"foo$$$bar": "blah{}"}, timestamp=ts)
     metrics.distribution("c", 1.0, tags={"foö-bar": "snöwmän"}, timestamp=ts)
+    metrics.distribution("d", 1.0, tags={"route": "GET /foo"}, timestamp=ts)
+
     Hub.current.flush()
 
     (envelope,) = envelopes
@@ -815,24 +817,27 @@ def test_tag_normalization(
     assert envelope.items[0].headers["type"] == "statsd"
     m = parse_metrics(envelope.items[0].payload.get_bytes())
 
-    assert len(m) == 3
+    assert len(m) == 4
     assert m[0][4] == {
-        "foo-bar": "_$foo",
+        "foo-bar": "$foo",
         "release": "fun-release@1.0.0",
         "environment": "not-fun-env",
     }
-
     assert m[1][4] == {
         "foo_bar": "blah{}",
         "release": "fun-release@1.0.0",
         "environment": "not-fun-env",
     }
-
     assert m[2][4] == {
         "fo_-bar": "snöwmän",
         "release": "fun-release@1.0.0",
         "environment": "not-fun-env",
     }
+    assert m[3][4] == {
+        "release": "fun-release@1.0.0",
+        "environment": "not-fun-env",
+        "route": "GET /foo",
+    }
 
 
 @minimum_python_37_with_gevent

tests/test_scrubber.py

@@ -169,3 +169,18 @@ def test_scrubbing_doesnt_affect_local_vars(sentry_init, capture_events):
     (frame,) = frames
     assert frame["vars"]["password"] == "[Filtered]"
     assert password == "cat123"
+
+
+def test_recursive_event_scrubber(sentry_init, capture_events):
+    sentry_init(event_scrubber=EventScrubber(recursive=True))
+    events = capture_events()
+    complex_structure = {
+        "deep": {
+            "deeper": [{"deepest": {"password": "my_darkest_secret"}}],
+        },
+    }
+
+    capture_event({"extra": complex_structure})
+
+    (event,) = events
+    assert event["extra"]["deep"]["deeper"][0]["deepest"]["password"] == "'[Filtered]'"