Skip to content
Merged
Show file tree
Hide file tree
Changes from 11 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions composer.json
Original file line number Diff line number Diff line change
Expand Up @@ -27,8 +27,7 @@
"ext-mbstring": "*",
"ext-curl": "*",
"guzzlehttp/psr7": "^1.8.4|^2.1.1",
"psr/log": "^1.0|^2.0|^3.0",
"symfony/options-resolver": "^4.4.30|^5.0.11|^6.0|^7.0"
"psr/log": "^1.0|^2.0|^3.0"
},
"require-dev": {
"friendsofphp/php-cs-fixer": "^3.4",
Expand Down
5 changes: 0 additions & 5 deletions phpstan-baseline.neon
Original file line number Diff line number Diff line change
Expand Up @@ -25,11 +25,6 @@ parameters:
count: 1
path: src/Dsn.php

-
message: "#^Property Sentry\\\\Integration\\\\RequestIntegration\\:\\:\\$options \\(array\\{pii_sanitize_headers\\: array\\<string\\>\\}\\) does not accept array\\.$#"
count: 1
path: src/Integration/RequestIntegration.php

-
message: "#^Parameter \\#2 \\.\\.\\.\\$values of function sprintf expects bool\\|float\\|int\\|string\\|null, mixed given\\.$#"
count: 1
Expand Down
2 changes: 1 addition & 1 deletion src/CheckInStatus.php
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
/**
* This enum represents all the possible status of a check in.
*/
final class CheckInStatus implements \Stringable
final class CheckInStatus
{
/**
* @var string The value of the enum instance
Expand Down
2 changes: 1 addition & 1 deletion src/Dsn.php
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
*
* @author Stefano Arlandini <[email protected]>
*/
final class Dsn implements \Stringable
final class Dsn
{
/**
* @var string Regex to match the organization ID in the host.
Expand Down
2 changes: 1 addition & 1 deletion src/Event.php
Original file line number Diff line number Diff line change
Expand Up @@ -802,7 +802,7 @@ public function setExceptions(array $exceptions): self
{
foreach ($exceptions as $exception) {
if (!$exception instanceof ExceptionDataBag) {
throw new \UnexpectedValueException(\sprintf('Expected an instance of the "%s" class. Got: "%s".', ExceptionDataBag::class, get_debug_type($exception)));
throw new \UnexpectedValueException(\sprintf('Expected an instance of the "%s" class. Got: "%s".', ExceptionDataBag::class, \gettype($exception)));
}
}

Expand Down
8 changes: 4 additions & 4 deletions src/EventHint.php
Original file line number Diff line number Diff line change
Expand Up @@ -56,19 +56,19 @@ public static function fromArray(array $hintData): self
$extra = $hintData['extra'] ?? [];

if ($exception !== null && !$exception instanceof \Throwable) {
throw new \InvalidArgumentException(\sprintf('The value of the "exception" field must be an instance of a class implementing the "%s" interface. Got: "%s".', \Throwable::class, get_debug_type($exception)));
throw new \InvalidArgumentException(\sprintf('The value of the "exception" field must be an instance of a class implementing the "%s" interface. Got: "%s".', \Throwable::class, \gettype($exception)));
}

if ($mechanism !== null && !$mechanism instanceof ExceptionMechanism) {
throw new \InvalidArgumentException(\sprintf('The value of the "mechanism" field must be an instance of the "%s" class. Got: "%s".', ExceptionMechanism::class, get_debug_type($mechanism)));
throw new \InvalidArgumentException(\sprintf('The value of the "mechanism" field must be an instance of the "%s" class. Got: "%s".', ExceptionMechanism::class, \gettype($mechanism)));
}

if ($stacktrace !== null && !$stacktrace instanceof Stacktrace) {
throw new \InvalidArgumentException(\sprintf('The value of the "stacktrace" field must be an instance of the "%s" class. Got: "%s".', Stacktrace::class, get_debug_type($stacktrace)));
throw new \InvalidArgumentException(\sprintf('The value of the "stacktrace" field must be an instance of the "%s" class. Got: "%s".', Stacktrace::class, \gettype($stacktrace)));
}

if (!\is_array($extra)) {
throw new \InvalidArgumentException(\sprintf('The value of the "extra" field must be an array. Got: "%s".', get_debug_type($extra)));
throw new \InvalidArgumentException(\sprintf('The value of the "extra" field must be an array. Got: "%s".', \gettype($extra)));
}

$hint->exception = $exception;
Expand Down
2 changes: 1 addition & 1 deletion src/EventId.php
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
*
* @author Stefano Arlandini <[email protected]>
*/
final class EventId implements \Stringable
final class EventId
{
/**
* @var string The ID
Expand Down
2 changes: 1 addition & 1 deletion src/EventType.php
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
*
* @author Stefano Arlandini <[email protected]>
*/
final class EventType implements \Stringable
final class EventType
{
/**
* @var string The value of the enum instance
Expand Down
2 changes: 1 addition & 1 deletion src/FrameBuilder.php
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ private function getFunctionArguments(array $backtraceFrame): array
} else {
$reflectionFunction = new \ReflectionMethod($backtraceFrame['class'], '__call');
}
} elseif ($backtraceFrame['function'] !== '__lambda_func' && !str_starts_with($backtraceFrame['function'], '{closure') && \function_exists($backtraceFrame['function'])) {
} elseif ($backtraceFrame['function'] !== '__lambda_func' && strpos($backtraceFrame['function'], '{closure') !== 0 && \function_exists($backtraceFrame['function'])) {
$reflectionFunction = new \ReflectionFunction($backtraceFrame['function']);
}
} catch (\ReflectionException $e) {
Expand Down
2 changes: 1 addition & 1 deletion src/Integration/IntegrationRegistry.php
Original file line number Diff line number Diff line change
Expand Up @@ -123,7 +123,7 @@ private function getIntegrationsToSetup(Options $options): array
$integrations = $userIntegrations($defaultIntegrations);

if (!\is_array($integrations)) {
throw new \UnexpectedValueException(\sprintf('Expected the callback set for the "integrations" option to return a list of integrations. Got: "%s".', get_debug_type($integrations)));
throw new \UnexpectedValueException(\sprintf('Expected the callback set for the "integrations" option to return a list of integrations. Got: "%s".', \gettype($integrations)));
}
}

Expand Down
25 changes: 10 additions & 15 deletions src/Integration/RequestIntegration.php
Original file line number Diff line number Diff line change
Expand Up @@ -9,12 +9,11 @@
use Sentry\Event;
use Sentry\Exception\JsonException;
use Sentry\Options;
use Sentry\SentryOptionResolver;
use Sentry\SentrySdk;
use Sentry\State\Scope;
use Sentry\UserDataBag;
use Sentry\Util\JSON;
use Symfony\Component\OptionsResolver\Options as SymfonyOptions;
use Symfony\Component\OptionsResolver\OptionsResolver;

/**
* This integration collects information from the request and attaches them to
Expand Down Expand Up @@ -68,10 +67,6 @@ final class RequestIntegration implements IntegrationInterface

/**
* @var array<string, mixed> The options
*
* @psalm-var array{
* pii_sanitize_headers: string[]
* }
*/
private $options;

Expand All @@ -80,14 +75,10 @@ final class RequestIntegration implements IntegrationInterface
*
* @param RequestFetcherInterface|null $requestFetcher PSR-7 request fetcher
* @param array<string, mixed> $options The options
*
* @psalm-param array{
* pii_sanitize_headers?: string[]
* } $options
*/
public function __construct(?RequestFetcherInterface $requestFetcher = null, array $options = [])
{
$resolver = new OptionsResolver();
$resolver = new SentryOptionResolver();

$this->configureOptions($resolver);

Expand Down Expand Up @@ -178,6 +169,10 @@ private function sanitizeHeaders(array $headers): array
// Cast the header name into a string, to avoid errors on numeric headers
$name = (string) $name;

if (!\is_array($this->options['pii_sanitize_headers'])) {
break;
}

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Header Sanitization Fails When Option Isn't Array

The sanitizeHeaders method's defensive check for pii_sanitize_headers is inside the loop. If the option isn't an array, the break statement exits prematurely, leading to incomplete or no header sanitization and potential PII exposure. This check also runs inefficiently on every iteration.

Fix in Cursor Fix in Web

if (!\in_array(strtolower($name), $this->options['pii_sanitize_headers'], true)) {
continue;
}
Expand Down Expand Up @@ -298,14 +293,14 @@ private function isRequestBodySizeWithinReadBounds(int $requestBodySize, string
/**
* Configures the options of the client.
*
* @param OptionsResolver $resolver The resolver for the options
* @param SentryOptionResolver $resolver The resolver for the options
*/
private function configureOptions(OptionsResolver $resolver): void
private function configureOptions(SentryOptionResolver $resolver): void
{
$resolver->setDefault('pii_sanitize_headers', self::DEFAULT_SENSITIVE_HEADERS);
$resolver->setAllowedTypes('pii_sanitize_headers', 'string[]');
$resolver->setNormalizer('pii_sanitize_headers', static function (SymfonyOptions $options, array $value): array {
$resolver->setNormalizer('pii_sanitize_headers', static function (array $value): array {
return array_map('strtolower', $value);
});
$resolver->setDefault('pii_sanitize_headers', self::DEFAULT_SENSITIVE_HEADERS);
}
}
2 changes: 1 addition & 1 deletion src/MonitorScheduleUnit.php
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@

namespace Sentry;

final class MonitorScheduleUnit implements \Stringable
final class MonitorScheduleUnit
{
/**
* @var string The value of the enum instance
Expand Down
Loading
Loading