make sure host header is not filtered when being added to the url

Author: ericapisani

sentry_sdk/integrations/_asgi_common.py

@@ -115,10 +115,13 @@ def _get_request_data(
     if ty in ("http", "websocket"):
         request_data["method"] = asgi_scope.get("method")
 
-        request_data["headers"] = headers = _filter_headers(
-            _get_headers(asgi_scope),
+        headers = _get_headers(asgi_scope)
+
+        request_data["headers"] = _filter_headers(
+            headers,
             use_annotated_value=False,
         )
+
         request_data["query_string"] = _get_query(asgi_scope)
 
         request_data["url"] = _get_url(
@@ -149,8 +152,10 @@ def _get_request_attributes(
         if asgi_scope.get("method"):
             attributes["http.request.method"] = asgi_scope["method"].upper()
 
-        headers = _filter_headers(_get_headers(asgi_scope))
-        for header, value in headers.items():
+        headers = _get_headers(asgi_scope)
+
+        filtered_headers = _filter_headers(headers, use_annotated_value=False)
+        for header, value in filtered_headers.items():
             attributes[f"http.request.header.{header.lower()}"] = value
 
         if should_send_default_pii():

sentry_sdk/integrations/_wsgi_common.py

@@ -23,6 +23,7 @@
 
     from sentry_sdk._types import Event, HttpStatusCodeRange
 
+
 SENSITIVE_ENV_KEYS = (
     "REMOTE_ADDR",
     "HTTP_X_FORWARDED_FOR",
@@ -212,7 +213,7 @@ def _is_json_content_type(ct: "Optional[str]") -> bool:
 def _filter_headers(
     headers: "Mapping[str, str]",
     use_annotated_value: bool = True,
-) -> "Mapping[str, Union[str, AnnotatedValue]]":
+) -> "Mapping[str, Union[AnnotatedValue, str]]":
     client_options = sentry_sdk.get_client().options
 
     if has_data_collection_enabled(client_options):

tests/integrations/asgi/test_asgi.py

@@ -5,7 +5,13 @@
 
 import sentry_sdk
 from sentry_sdk import capture_message
-from sentry_sdk.integrations._asgi_common import _get_headers, _get_ip
+from sentry_sdk.integrations._asgi_common import (
+    _get_headers,
+    _get_ip,
+    _get_request_attributes,
+    _get_request_data,
+    _RootPathInPath,
+)
 from sentry_sdk.integrations.asgi import SentryAsgiMiddleware, _looks_like_asgi3
 from sentry_sdk.tracing import TransactionSource
 
@@ -831,6 +837,61 @@ def test_get_headers():
     }
 
 
+def test_get_request_data_url_with_filtered_host(sentry_init):
+    # allowlist mode in data collection that does not allow "host" scrubs the host header value,
+    # but the reported URL must still resolve via rather than embedding the substituted "[Filtered]" value.
+    sentry_init(
+        _experiments={
+            "data_collection": {
+                "http_headers": {"request": {"mode": "allowlist", "terms": []}}
+            }
+        }
+    )
+
+    scope = {
+        "type": "http",
+        "method": "GET",
+        "scheme": "http",
+        "server": ("example.com", 80),
+        "path": "/foo",
+        "query_string": b"",
+        "headers": [(b"host", b"example.com")],
+    }
+
+    request_data = _get_request_data(scope, _RootPathInPath.EXCLUDED)
+
+    assert request_data["headers"]["host"] == "[Filtered]"
+    assert request_data["url"] == "http://example.com/foo"
+
+
+def test_get_request_attributes_url_with_filtered_host(sentry_init):
+    # As with _get_request_data, an allowlist mode that does not allow "host"
+    # scrubs the host header value, but "url.full" must still resolve rather than embedding the substituted value.
+    sentry_init(
+        send_default_pii=True,
+        _experiments={
+            "data_collection": {
+                "http_headers": {"request": {"mode": "allowlist", "terms": []}}
+            }
+        },
+    )
+
+    scope = {
+        "type": "http",
+        "method": "GET",
+        "scheme": "http",
+        "server": ("example.com", 80),
+        "path": "/foo",
+        "query_string": b"somevalue=123",
+        "headers": [(b"host", b"example.com")],
+    }
+
+    attributes = _get_request_attributes(scope, _RootPathInPath.EXCLUDED)
+
+    assert attributes["http.request.header.host"] == "[Filtered]"
+    assert attributes["url.full"] == "http://example.com/foo?somevalue=123"
+
+
 @pytest.mark.asyncio
 @pytest.mark.parametrize(
     "request_url,transaction_style,expected_transaction_name,expected_transaction_source",