replay: add sensitive content widget to default masking

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## Unreleased
+
+### Features
+
+- Add [SensitiveContent](https://main-api.flutter.dev/flutter/widgets/SensitiveContent-class.html) widget to default masking ([#2989](https://github.com/getsentry/sentry-dart/pull/2989))
+
 ## 9.9.2
 
 ### Fixes

packages/dart/lib/src/event_processor/enricher/flutter_runtime.dart

@@ -73,4 +73,60 @@ abstract class FlutterVersion {
   static const String? dartVersion = bool.hasEnvironment('FLUTTER_DART_VERSION')
       ? String.fromEnvironment('FLUTTER_DART_VERSION')
       : null;
+
+  /// Parses [version] into components for comparison.
+  ///
+  /// Returns `null` if the version string is malformed.
+  ///
+  /// Examples:
+  /// - "3.33.0" -> FlutterVersionComponents(3, 33)
+  /// - "4.0.0-pre.1" -> FlutterVersionComponents(4, 0)
+  /// - "3.24" -> FlutterVersionComponents(3, 24)
+  /// - "invalid" -> null
+  static FlutterVersionComponents? parseComponents(String version) {
+    final dot = version.indexOf('.');
+    if (dot == -1) return null;
+
+    final major = int.tryParse(version.substring(0, dot));
+    if (major == null) return null;
+
+    final nextDot = version.indexOf('.', dot + 1);
+    final minorEnd = nextDot == -1 ? version.length : nextDot;
+    final minor = int.tryParse(version.substring(dot + 1, minorEnd));
+    if (minor == null) return null;
+
+    return FlutterVersionComponents(major, minor);
+  }
+}
+
+/// Parsed Flutter version components for comparison.
+class FlutterVersionComponents {
+  final int major;
+  final int minor;
+
+  const FlutterVersionComponents(this.major, this.minor);
+
+  /// Returns `true` if this version meets or exceeds the minimum requirement.
+  ///
+  /// Example:
+  /// ```dart
+  /// final version = FlutterVersion.parseComponents('3.33.0');
+  /// if (version?.meetsMinimum(3, 33) ?? false) {
+  ///   // Flutter 3.33+ feature available
+  /// }
+  /// ```
+  bool meetsMinimum(int minMajor, int minMinor) =>
+      major > minMajor || (major == minMajor && minor >= minMinor);
+
+  @override
+  bool operator ==(Object other) =>
+      other is FlutterVersionComponents &&
+      other.major == major &&
+      other.minor == minor;
+
+  @override
+  int get hashCode => Object.hash(major, minor);
+
+  @override
+  String toString() => 'FlutterVersionComponents($major, $minor)';
 }

packages/dart/test/event_processor/enricher/flutter_runtime_test.dart

@@ -0,0 +1,167 @@
+import 'package:sentry/src/event_processor/enricher/flutter_runtime.dart';
+import 'package:test/test.dart';
+
+void main() {
+  group('FlutterVersionComponents', () {
+    test('stores major and minor correctly', () {
+      const components = FlutterVersionComponents(3, 33);
+      expect(components.major, 3);
+      expect(components.minor, 33);
+    });
+
+    test('equality works correctly', () {
+      const a = FlutterVersionComponents(3, 33);
+      const b = FlutterVersionComponents(3, 33);
+      const c = FlutterVersionComponents(3, 32);
+
+      expect(a, equals(b));
+      expect(a, isNot(equals(c)));
+    });
+
+    test('hashCode is consistent with equality', () {
+      const a = FlutterVersionComponents(3, 33);
+      const b = FlutterVersionComponents(3, 33);
+
+      expect(a.hashCode, equals(b.hashCode));
+    });
+
+    test('toString returns readable format', () {
+      const components = FlutterVersionComponents(3, 33);
+      expect(components.toString(), 'FlutterVersionComponents(3, 33)');
+    });
+
+    group('meetsMinimum', () {
+      test('returns false when major is less than threshold', () {
+        expect(
+            const FlutterVersionComponents(2, 99).meetsMinimum(3, 0), isFalse);
+        expect(
+            const FlutterVersionComponents(2, 0).meetsMinimum(3, 33), isFalse);
+      });
+
+      test('returns false when major equals but minor is less than threshold',
+          () {
+        expect(
+            const FlutterVersionComponents(3, 32).meetsMinimum(3, 33), isFalse);
+        expect(
+            const FlutterVersionComponents(3, 0).meetsMinimum(3, 33), isFalse);
+      });
+
+      test('returns true when major equals and minor equals threshold', () {
+        expect(
+            const FlutterVersionComponents(3, 33).meetsMinimum(3, 33), isTrue);
+        expect(const FlutterVersionComponents(4, 0).meetsMinimum(4, 0), isTrue);
+      });
+
+      test('returns true when major equals and minor exceeds threshold', () {
+        expect(
+            const FlutterVersionComponents(3, 34).meetsMinimum(3, 33), isTrue);
+        expect(
+            const FlutterVersionComponents(3, 99).meetsMinimum(3, 33), isTrue);
+      });
+
+      test('returns true when major exceeds threshold', () {
+        expect(
+            const FlutterVersionComponents(4, 0).meetsMinimum(3, 33), isTrue);
+        expect(
+            const FlutterVersionComponents(5, 0).meetsMinimum(3, 99), isTrue);
+        expect(
+            const FlutterVersionComponents(10, 0).meetsMinimum(3, 33), isTrue);
+      });
+
+      test('works with various threshold values', () {
+        // Testing different thresholds
+        expect(const FlutterVersionComponents(2, 5).meetsMinimum(2, 5), isTrue);
+        expect(
+            const FlutterVersionComponents(2, 4).meetsMinimum(2, 5), isFalse);
+        expect(const FlutterVersionComponents(1, 0).meetsMinimum(1, 0), isTrue);
+        expect(
+            const FlutterVersionComponents(0, 0).meetsMinimum(0, 1), isFalse);
+      });
+    });
+  });
+
+  group('FlutterVersion.parseVersion', () {
+    test('parses standard version format (major.minor.patch)', () {
+      final result = FlutterVersion.parseComponents('3.33.0');
+      expect(result, isNotNull);
+      expect(result!.major, 3);
+      expect(result.minor, 33);
+    });
+
+    test('parses version with pre-release suffix', () {
+      final result = FlutterVersion.parseComponents('3.33.0-pre.123');
+      expect(result, isNotNull);
+      expect(result!.major, 3);
+      expect(result.minor, 33);
+    });
+
+    test('parses version with build metadata', () {
+      final result = FlutterVersion.parseComponents('3.33.0+hotfix.1');
+      expect(result, isNotNull);
+      expect(result!.major, 3);
+      expect(result.minor, 33);
+    });
+
+    test('parses major.minor only (no patch)', () {
+      final result = FlutterVersion.parseComponents('4.0');
+      expect(result, isNotNull);
+      expect(result!.major, 4);
+      expect(result.minor, 0);
+    });
+
+    test('parses version with large numbers', () {
+      final result = FlutterVersion.parseComponents('10.100.999');
+      expect(result, isNotNull);
+      expect(result!.major, 10);
+      expect(result.minor, 100);
+    });
+
+    test('returns null for single number (no dot)', () {
+      expect(FlutterVersion.parseComponents('3'), isNull);
+    });
+
+    test('returns null for non-numeric major', () {
+      expect(FlutterVersion.parseComponents('abc.33.0'), isNull);
+    });
+
+    test('returns null for non-numeric minor', () {
+      expect(FlutterVersion.parseComponents('3.abc.0'), isNull);
+    });
+
+    test('returns null for empty string', () {
+      expect(FlutterVersion.parseComponents(''), isNull);
+    });
+
+    test('returns null for dot only', () {
+      expect(FlutterVersion.parseComponents('.'), isNull);
+    });
+
+    test('returns null for leading dot', () {
+      expect(FlutterVersion.parseComponents('.33.0'), isNull);
+    });
+
+    test('returns null for minor with hyphen suffix without patch', () {
+      // "3.33-beta" -> "33-beta" is not a valid integer
+      expect(FlutterVersion.parseComponents('3.33-beta'), isNull);
+    });
+
+    test('parses version where minor ends at patch separator', () {
+      // "3.33.0-beta" -> major=3, minor=33
+      final result = FlutterVersion.parseComponents('3.33.0-beta');
+      expect(result, isNotNull);
+      expect(result!.major, 3);
+      expect(result.minor, 33);
+    });
+
+    test('handles version 0.0.0', () {
+      final result = FlutterVersion.parseComponents('0.0.0');
+      expect(result, isNotNull);
+      expect(result!.major, 0);
+      expect(result.minor, 0);
+    });
+
+    test('returns null for malformed version', () {
+      expect(FlutterVersion.parseComponents('invalid'), isNull);
+    });
+  });
+}

packages/flutter/lib/src/sentry_privacy_options.dart

@@ -5,6 +5,9 @@ import 'package:meta/meta.dart';
 import '../sentry_flutter.dart';
 import 'screenshot/masking_config.dart';
 import 'screenshot/widget_filter.dart';
+// ignore: implementation_imports
+import 'package:sentry/src/event_processor/enricher/flutter_runtime.dart'
+    as flutter_runtime;
 
 /// Configuration of the experimental privacy feature.
 class SentryPrivacyOptions {
@@ -75,6 +78,11 @@ class SentryPrivacyOptions {
       ));
     }
 
+    const flutterVersion = flutter_runtime.FlutterVersion.version;
+    if (flutterVersion != null) {
+      _maybeAddSensitiveContentRule(rules, flutterVersion);
+    }
+
     // In Debug mode, check if users explicitly mask (or unmask) widgets that
     // look like they should be masked, e.g. Videos, WebViews, etc.
     if (runtimeChecker.isDebugMode()) {
@@ -172,6 +180,75 @@ class SentryPrivacyOptions {
       };
 }
 
+/// Minimum Flutter version required for SensitiveContent widget support.
+const _sensitiveContentMinMajor = 3;
+const _sensitiveContentMinMinor = 33;
+
+/// Determines if the SensitiveContent masking rule should be added
+/// based on parsed version components.
+///
+/// Returns `false` if [components] is `null` (malformed version string).
+@visibleForTesting
+bool shouldAddSensitiveContentRule(
+    flutter_runtime.FlutterVersionComponents? components) {
+  return components?.meetsMinimum(
+          _sensitiveContentMinMajor, _sensitiveContentMinMinor) ??
+      false;
+}
+
+/// Detects if a widget is a SensitiveContent widget at runtime.
+///
+/// Uses dynamic property access to check for the `sensitivity` property,
+/// which is unique to the SensitiveContent widget. This approach works in
+/// obfuscated builds where type names are mangled.
+///
+/// Returns `true` if the widget has a `sensitivity` property that is an
+/// [Enum] (as expected from SensitiveContent widget).
+@visibleForTesting
+bool isSensitiveContentWidget(Widget widget) {
+  try {
+    final dynamic dynWidget = widget;
+    final sensitivity = dynWidget.sensitivity;
+    // The property must exist AND be an Enum to be considered SensitiveContent.
+    // This check is done at runtime (not via assert) to ensure consistent
+    // behavior in both debug and release modes.
+    if (sensitivity is! Enum) {
+      return false;
+    }
+    return true;
+  } catch (_) {
+    // Property not found – not a SensitiveContent widget.
+    return false;
+  }
+}
+
+/// Adds a masking rule for the [SensitiveContent] widget.
+///
+/// The rule masks any widget that exposes a `sensitivity` property which is an
+/// [Enum]. This is how the [SensitiveContent] widget can be detected
+/// without depending on its type directly (which would fail to compile on
+/// older Flutter versions).
+void _maybeAddSensitiveContentRule(
+    List<SentryMaskingRule> rules, String flutterVersion) {
+  final components =
+      flutter_runtime.FlutterVersion.parseComponents(flutterVersion);
+  if (!shouldAddSensitiveContentRule(components)) {
+    return;
+  }
+
+  SentryMaskingDecision maskSensitiveContent(Element element, Widget widget) {
+    return isSensitiveContentWidget(widget)
+        ? SentryMaskingDecision.mask
+        : SentryMaskingDecision.continueProcessing;
+  }
+
+  rules.add(SentryMaskingCustomRule<Widget>(
+    callback: maskSensitiveContent,
+    name: 'SensitiveContent',
+    description: 'Mask SensitiveContent widget.',
+  ));
+}
+
 SentryMaskingDecision _maskImagesExceptAssets(Element element, Image widget) {
   final image = widget.image;
   if (image is AssetBundleImageProvider) {