Issue #3630202: Add settings to stop sending request headers and URL query strings to Sentry

Daniel Pernoldrequested to merge
issue/raven-3630202:3630202-request-headers-query-string into 7.x

Adds settings that control which request headers and URL query strings the PHP SDK sends to Sentry.

Settings, in the PHP section of the Sentry settings:

  • "Send request headers to Sentry" (send_request_headers) with "Allowed request headers" (request_header_allow_list).
  • "Send URL query strings to Sentry" (send_query_string) with "Allowed query parameters" (query_param_allow_list).

How they map to the SDK's data collection options (http_headers.request, url_query_params):

  • Unchecked: mode off.
  • Checked, with an allow list: mode allowList with the list as terms, like the cookie allow list. The values of other headers and parameters are replaced by [Filtered].
  • Checked, with an empty list: mode denyList, so all values are sent except those with sensitive names.

Default allow lists (terms match parts of names, as in the SDK):

  • Request headers: accept, cache-control, content-length, content-type, host, if-modified-since, if-none-match, origin, pragma, referer, sec-ch-ua, sec-fetch, user-agent, x-requested-with.
  • Query parameters, as used by Drupal core: _drupal_ajax, _format, _wrapper_format, ajax_form, ajax_page_state, check_logged_in, destination, items_per_page, order, page, sort.

The URL query parameter policy also applies to:

  • the Referer header (SanitizeIntegration);
  • request_uri and referer of the log context, which are sent as extra data and log attributes (Raven::log()).

Both go through the SDK's HttpUrlCollector (helper SanitizeIntegration::collectUrl()), as the request URL does.

A post-update function adds the four settings to existing sites: both checked, with the default allow lists.

Not included: the browser SDK. Its dataCollection.urlQueryParams only takes effect in the 11.x branch (see the issue).

Tests (Drupal 11.4, PHP 8.4, sentry/sentry 4.34):

  • Unit test RequestDataCollectionTest: it captures the event of a logged error in a before_send callback for five combinations (everything, allow lists, no query strings, no headers, neither). It checks request.url, request.query_string, request.headers and the extra data. All five fail without the change.
  • The unit tests and the kernel test pass; PHPStan reports nothing new.
  • A temporary kernel test (not committed) checked that the install config matches the schema and that the post-update function sets the four keys.

Issue: https://www.drupal.org/i/3630202

Text generated with AI

Edited by Daniel Pernold

Merge request reports