fix(serializer): Don't call __iter__ on arbitrary sequences

sentry_sdk/serializer.py

@@ -1,6 +1,7 @@
 import math
 import sys
-from collections.abc import Mapping, Sequence, Set
+from array import array
+from collections.abc import Mapping
 from datetime import datetime
 from typing import TYPE_CHECKING
 
@@ -53,7 +54,7 @@ def add_global_repr_processor(processor: "ReprProcessor") -> None:
     global_repr_processors.append(processor)
 
 
-sequence_types: "List[type]" = [Sequence, Set]
+sequence_types: "List[type]" = [tuple, list, set, frozenset, array]
 
 
 def add_repr_sequence_type(ty: type) -> None:

tests/test_serializer.py

@@ -1,4 +1,5 @@
 import re
+from array import array
 
 import pytest
 
@@ -180,3 +181,41 @@ def test_max_value_length(body_normalizer):
     result = body_normalizer(data, max_value_length=max_value_length)
 
     assert len(result["key"]) == max_value_length
+
+
+def test_serialize_local_vars():
+    # This was added to make sure we don't try to iterate over instances of
+    # custom classes with an __iter__ method due to potential side effects
+    class Custom:
+        def __init__(self, items):
+            self.items = items
+
+        def __len__(self):
+            return self.items.__len__()
+
+        def __getitem__(self, item):
+            return self.items.__getitem__(item)
+
+        def __iter__(self):
+            raise ValueError
+
+    local_vars = {
+        "str": "123",
+        "bytes": b"123",
+        "list": [1, 2, 3],
+        "set": {1, 2, 3},
+        "frozenset": frozenset([1, 2, 3]),
+        "array": array("l", [1, 2, 3]),
+        "custom": Custom([1, 2, 3]),
+    }
+
+    result = serialize(local_vars, is_vars=True)
+    assert result["str"] == "'123'"
+    assert result["bytes"] == "b'123'"
+    assert result["list"] == ["1", "2", "3"]
+    assert sorted(result["set"]) == ["1", "2", "3"]
+    assert sorted(result["frozenset"]) == ["1", "2", "3"]
+    assert result["array"] == ["1", "2", "3"]
+    assert result["custom"].startswith(
+        "<tests.test_serializer.test_serialize_local_vars.<locals>.Custom object at"
+    )