feat(flask): Add span streaming support and request body capture #6264
1 issue
security-review: Found 1 issue (1 medium)
Medium
Request body with sensitive fields bypasses EventScrubber when written to streamed span attributes - `sentry_sdk/integrations/_wsgi_common.py:212-220`
When span streaming is enabled, _serialize_request_body_data serializes the full parsed request body (including form fields like password, token, api_key) into a span attribute that is sent via _capture_telemetry — a path that never calls EventScrubber.scrub_event, so denylist-matched fields are transmitted to Sentry unredacted. Apply event_scrubber.scrub_dict to the parsed body dict before serializing it, or scrub the deserialized attribute after the fact.
Also found at:
sentry_sdk/integrations/flask.py:220-230sentry_sdk/integrations/starlette.py:20
⏱ 3m 15s · 1.2M in / 30.0k out · $1.77
Annotations
Check warning on line 220 in sentry_sdk/integrations/_wsgi_common.py
sentry-warden / warden: security-review
Request body with sensitive fields bypasses EventScrubber when written to streamed span attributes
When span streaming is enabled, `_serialize_request_body_data` serializes the full parsed request body (including form fields like `password`, `token`, `api_key`) into a span attribute that is sent via `_capture_telemetry` — a path that never calls `EventScrubber.scrub_event`, so denylist-matched fields are transmitted to Sentry unredacted. Apply `event_scrubber.scrub_dict` to the parsed body dict before serializing it, or scrub the deserialized attribute after the fact.
Check warning on line 230 in sentry_sdk/integrations/flask.py
sentry-warden / warden: security-review
[W3M-9D6] Request body with sensitive fields bypasses EventScrubber when written to streamed span attributes (additional location)
When span streaming is enabled, `_serialize_request_body_data` serializes the full parsed request body (including form fields like `password`, `token`, `api_key`) into a span attribute that is sent via `_capture_telemetry` — a path that never calls `EventScrubber.scrub_event`, so denylist-matched fields are transmitted to Sentry unredacted. Apply `event_scrubber.scrub_dict` to the parsed body dict before serializing it, or scrub the deserialized attribute after the fact.
Check warning on line 20 in sentry_sdk/integrations/starlette.py
sentry-warden / warden: security-review
[W3M-9D6] Request body with sensitive fields bypasses EventScrubber when written to streamed span attributes (additional location)
When span streaming is enabled, `_serialize_request_body_data` serializes the full parsed request body (including form fields like `password`, `token`, `api_key`) into a span attribute that is sent via `_capture_telemetry` — a path that never calls `EventScrubber.scrub_event`, so denylist-matched fields are transmitted to Sentry unredacted. Apply `event_scrubber.scrub_dict` to the parsed body dict before serializing it, or scrub the deserialized attribute after the fact.