feat(integrations): apply data_collection cookie filtering to wsgi, starlette, litestar, starlite (#6797)

Extends the granular cookie collection controls
(data_collection.cookies)
to _wsgi_common, starlette, litestar, and starlite, matching the
behavior
already used elsewhere. Falls back to should_send_default_pii() when
data_collection is not configured for cookies.

HTTP "Cookie" and "set-cookie" headers will continue to be completely
filtered
with the "[Filtered]" value.

Fixes PY-2581
Fixes #6741

Author: ericapisani

sentry_sdk/integrations/_wsgi_common.py

@@ -89,7 +89,14 @@ def extract_into_event(self, event: "Event") -> None:
         content_length = self.content_length()
         request_info = event.get("request", {})
 
-        if should_send_default_pii():
+        if has_data_collection_enabled(client.options):
+            cookies = _apply_key_value_collection_filtering(
+                items=dict(self.cookies()),
+                behaviour=client.options["data_collection"]["cookies"],
+            )
+            if cookies:
+                request_info["cookies"] = cookies
+        elif should_send_default_pii():
             request_info["cookies"] = dict(self.cookies())
 
         if not request_body_within_bounds(client, content_length):

sentry_sdk/integrations/fastapi.py

@@ -6,7 +6,6 @@
 import sentry_sdk
 from sentry_sdk.consts import SPANDATA
 from sentry_sdk.integrations import DidNotEnable
-from sentry_sdk.scope import should_send_default_pii
 from sentry_sdk.traces import StreamedSpan, get_current_span
 from sentry_sdk.tracing import SOURCE_FOR_STYLE, TransactionSource
 from sentry_sdk.tracing_utils import has_span_streaming_enabled
@@ -118,7 +117,7 @@ def event_processor(event: "Event", hint: "Dict[str, Any]") -> "Event":
             # Extract information from request
             request_info = event.get("request", {})
             if info:
-                if "cookies" in info and should_send_default_pii():
+                if "cookies" in info:
                     request_info["cookies"] = info["cookies"]
                 if "data" in info:
                     request_info["data"] = info["data"]

sentry_sdk/integrations/litestar.py

@@ -3,6 +3,7 @@
 
 import sentry_sdk
 from sentry_sdk.consts import OP, SPANDATA
+from sentry_sdk.data_collection import _apply_key_value_collection_filtering
 from sentry_sdk.integrations import (
     _DEFAULT_FAILED_REQUEST_STATUS_CODES,
     DidNotEnable,
@@ -16,6 +17,7 @@
 from sentry_sdk.utils import (
     ensure_integration_enabled,
     event_from_exception,
+    has_data_collection_enabled,
     transaction_from_function,
 )
 
@@ -279,7 +281,8 @@ def patch_http_route_handle() -> None:
     async def handle_wrapper(
         self: "HTTPRoute", scope: "HTTPScope", receive: "Receive", send: "Send"
     ) -> None:
-        if sentry_sdk.get_client().get_integration(LitestarIntegration) is None:
+        client = sentry_sdk.get_client()
+        if client.get_integration(LitestarIntegration) is None:
             return await old_handle(self, scope, receive, send)
 
         sentry_scope = sentry_sdk.get_isolation_scope()
@@ -318,7 +321,14 @@ async def handle_wrapper(
         def event_processor(event: "Event", _: "Hint") -> "Event":
             request_info = event.get("request", {})
             request_info["content_length"] = len(scope.get("_body", b""))
-            if should_send_default_pii():
+            if has_data_collection_enabled(client.options):
+                cookies = _apply_key_value_collection_filtering(
+                    items=extracted_request_data["cookies"],
+                    behaviour=client.options["data_collection"]["cookies"],
+                )
+                if cookies:
+                    request_info["cookies"] = cookies
+            elif should_send_default_pii():
                 request_info["cookies"] = extracted_request_data["cookies"]
             if request_data is not None:
                 request_info["data"] = request_data

sentry_sdk/integrations/starlette.py

@@ -10,6 +10,7 @@
 import sentry_sdk
 from sentry_sdk._types import OVER_SIZE_LIMIT_SUBSTITUTE
 from sentry_sdk.consts import OP, SPANDATA
+from sentry_sdk.data_collection import _apply_key_value_collection_filtering
 from sentry_sdk.integrations import (
     _DEFAULT_FAILED_REQUEST_STATUS_CODES,
     DidNotEnable,
@@ -35,6 +36,7 @@
     capture_internal_exceptions,
     ensure_integration_enabled,
     event_from_exception,
+    has_data_collection_enabled,
     nullcontext,
     parse_version,
     transaction_from_function,
@@ -719,8 +721,15 @@ def __init__(self: "StarletteRequestExtractor", request: "Request") -> None:
     def extract_cookies_from_request(
         self: "StarletteRequestExtractor",
     ) -> "Optional[Dict[str, Any]]":
+        client_options = sentry_sdk.get_client().options
         cookies: "Optional[Dict[str, Any]]" = None
-        if should_send_default_pii():
+
+        if has_data_collection_enabled(client_options):
+            cookies = _apply_key_value_collection_filtering(
+                items=self.cookies(),
+                behaviour=client_options["data_collection"]["cookies"],
+            )
+        elif should_send_default_pii():
             cookies = self.cookies()
 
         return cookies
@@ -734,7 +743,14 @@ async def extract_request_info(
 
         with capture_internal_exceptions():
             # Add cookies
-            if should_send_default_pii():
+            if has_data_collection_enabled(client.options):
+                cookies = _apply_key_value_collection_filtering(
+                    items=self.cookies(),
+                    behaviour=client.options["data_collection"]["cookies"],
+                )
+                if cookies:
+                    request_info["cookies"] = cookies
+            elif should_send_default_pii():
                 request_info["cookies"] = self.cookies()
 
             # If there is no body, just return the cookies

sentry_sdk/integrations/starlite.py

@@ -2,6 +2,7 @@
 
 import sentry_sdk
 from sentry_sdk.consts import OP, SPANDATA
+from sentry_sdk.data_collection import _apply_key_value_collection_filtering
 from sentry_sdk.integrations import DidNotEnable, Integration
 from sentry_sdk.integrations.asgi import SentryAsgiMiddleware
 from sentry_sdk.scope import should_send_default_pii
@@ -10,6 +11,7 @@
 from sentry_sdk.utils import (
     ensure_integration_enabled,
     event_from_exception,
+    has_data_collection_enabled,
     nullcontext,
     transaction_from_function,
 )
@@ -227,7 +229,8 @@ def patch_http_route_handle() -> None:
     async def handle_wrapper(
         self: "HTTPRoute", scope: "HTTPScope", receive: "Receive", send: "Send"
     ) -> None:
-        if sentry_sdk.get_client().get_integration(StarliteIntegration) is None:
+        client = sentry_sdk.get_client()
+        if client.get_integration(StarliteIntegration) is None:
             return await old_handle(self, scope, receive, send)
 
         sentry_scope = sentry_sdk.get_isolation_scope()
@@ -265,7 +268,14 @@ async def handle_wrapper(
         def event_processor(event: "Event", _: "Hint") -> "Event":
             request_info = event.get("request", {})
             request_info["content_length"] = len(scope.get("_body", b""))
-            if should_send_default_pii():
+            if has_data_collection_enabled(client.options):
+                cookies = _apply_key_value_collection_filtering(
+                    items=extracted_request_data["cookies"],
+                    behaviour=client.options["data_collection"]["cookies"],
+                )
+                if cookies:
+                    request_info["cookies"] = cookies
+            elif should_send_default_pii():
                 request_info["cookies"] = extracted_request_data["cookies"]
             if request_data is not None:
                 request_info["data"] = request_data

tests/integrations/django/test_data_scrubbing.py

@@ -99,3 +99,118 @@ def test_scrub_django_custom_session_cookies_filtered(
         "csrf_secret": "[Filtered]",
         "foo": "bar",
     }
+
+
+@pytest.mark.forked
+@pytest_mark_django_db_decorator()
+@pytest.mark.parametrize(
+    "cookies_to_set, data_collection, expected_cookies",
+    [
+        pytest.param(
+            {"sessionid": "123", "csrftoken": "456", "foo": "bar"},
+            {"cookies": {"mode": "off"}},
+            None,
+            id="off",
+        ),
+        pytest.param(
+            {"sessionid": "123", "csrftoken": "456", "foo": "bar"},
+            {"cookies": {"mode": "denylist"}},
+            {
+                "sessionid": "[Filtered]",
+                "csrftoken": "[Filtered]",
+                "foo": "bar",
+            },
+            id="denylist-default",
+        ),
+        pytest.param(
+            {"sessionid": "123", "csrftoken": "456", "foo": "bar"},
+            {"cookies": {"mode": "denylist", "terms": ["foo"]}},
+            {
+                "sessionid": "[Filtered]",
+                "csrftoken": "[Filtered]",
+                "foo": "[Filtered]",
+            },
+            id="denylist-extra-terms",
+        ),
+        pytest.param(
+            {"sessionid": "123", "csrftoken": "456", "foo": "bar", "bar": "baz"},
+            {"cookies": {"mode": "allowlist", "terms": ["foo"]}},
+            {
+                "sessionid": "[Filtered]",
+                "csrftoken": "[Filtered]",
+                "foo": "bar",
+                "bar": "[Filtered]",
+            },
+            id="allowlist",
+        ),
+        pytest.param(
+            {"sessionid": "123", "csrftoken": "456", "foo": "bar", "bar": "baz"},
+            {"cookies": {"mode": "allowlist", "terms": ["sessionid", "foo"]}},
+            {
+                "sessionid": "[Filtered]",
+                "csrftoken": "[Filtered]",
+                "foo": "bar",
+                "bar": "[Filtered]",
+            },
+            id="allowlist-cannot-override-sensitive",
+        ),
+        pytest.param(
+            {"sessionid": "123", "csrftoken": "456", "foo": "bar"},
+            {},
+            {
+                "sessionid": "[Filtered]",
+                "csrftoken": "[Filtered]",
+                "foo": "bar",
+            },
+            id="cookies-omitted-defaults-to-denylist",
+        ),
+    ],
+)
+def test_data_collection_cookies(
+    sentry_init,
+    client,
+    capture_items,
+    cookies_to_set,
+    data_collection,
+    expected_cookies,
+):
+    sentry_init(
+        integrations=[DjangoIntegration()],
+        _experiments={"data_collection": data_collection},
+    )
+    items = capture_items("event")
+    for name, value in cookies_to_set.items():
+        werkzeug_set_cookie(client, "localhost", name, value)
+    client.get(reverse("view_exc"))
+
+    (event,) = (item.payload for item in items if item.type == "event")
+    if expected_cookies is None:
+        assert "cookies" not in event["request"]
+    else:
+        assert event["request"]["cookies"] == expected_cookies
+
+
+@pytest.mark.forked
+@pytest_mark_django_db_decorator()
+def test_data_collection_cookies_precedence_over_send_default_pii(
+    sentry_init, client, capture_items
+):
+    # ``data_collection`` is the single source of truth: even with
+    # ``send_default_pii=False``, the configured cookie behaviour still applies.
+    sentry_init(
+        integrations=[DjangoIntegration()],
+        send_default_pii=False,
+        _experiments={"data_collection": {"cookies": {"mode": "denylist"}}},
+    )
+    items = capture_items("event")
+    werkzeug_set_cookie(client, "localhost", "sessionid", "123")
+    werkzeug_set_cookie(client, "localhost", "csrftoken", "456")
+    werkzeug_set_cookie(client, "localhost", "foo", "bar")
+    client.get(reverse("view_exc"))
+
+    (event,) = (item.payload for item in items if item.type == "event")
+    assert event["request"]["cookies"] == {
+        "sessionid": "[Filtered]",
+        "csrftoken": "[Filtered]",
+        "foo": "bar",
+    }