pass allow/denylists

Author: s1gr1d

dev-packages/node-integration-tests/suites/tracing/http-client-spans/fetch-headers-to-span-attributes/instrument.mjs

@@ -7,11 +7,17 @@ Sentry.init({
   release: '1.0',
   tracesSampleRate: 1.0,
   transport: loggingTransport,
+  dataCollection: {
+    httpHeaders: {
+      request: { deny: ['x-tenant-id'] },
+      response: { deny: ['content-length'] },
+    },
+  },
   integrations: [
     Sentry.nativeNodeFetchIntegration({
       headersToSpanAttributes: {
-        requestHeaders: ['x-test-header', 'authorization'],
-        responseHeaders: ['x-powered-by'],
+        requestHeaders: ['x-test-header', 'authorization', 'x-tenant-id'],
+        responseHeaders: ['x-powered-by', 'content-length'],
       },
     }),
   ],

dev-packages/node-integration-tests/suites/tracing/http-client-spans/fetch-headers-to-span-attributes/scenario.mjs

@@ -3,6 +3,6 @@ import * as Sentry from '@sentry/node';
 // eslint-disable-next-line @typescript-eslint/no-floating-promises
 Sentry.startSpan({ name: 'test_transaction' }, async () => {
   await fetch(`${process.env.SERVER_URL}/api/v0`, {
-    headers: { 'x-test-header': 'test-value', authorization: 'Bearer super-secret' },
+    headers: { 'x-test-header': 'test-value', authorization: 'Bearer super-secret', 'x-tenant-id': 'acme-corp' },
   });
 });

dev-packages/node-integration-tests/suites/tracing/http-client-spans/fetch-headers-to-span-attributes/test.ts

@@ -29,9 +29,12 @@ describe('outgoing fetch spans - headers to span attributes', () => {
                 origin: 'auto.http.node_fetch',
                 data: expect.objectContaining({
                   'http.request.header.x-test-header': ['test-value'],
-                  // Listed in `headersToSpanAttributes`, but the denylist still wins.
+                  // Listed in `headersToSpanAttributes`, but the built-in denylist still wins.
                   'http.request.header.authorization': ['[Filtered]'],
+                  // Listed in `headersToSpanAttributes`, but denied via `dataCollection.httpHeaders`.
+                  'http.request.header.x-tenant-id': ['[Filtered]'],
                   'http.response.header.x-powered-by': ['Express'],
+                  'http.response.header.content-length': ['[Filtered]'],
                 }),
               }),
             ]),

packages/core/src/index.ts

@@ -76,11 +76,7 @@ export {
   _INTERNAL_shouldSkipAiProviderWrapping,
   _INTERNAL_clearAiProviderSkips,
 } from './utils/ai/providerSkip';
-export {
-  filterKeyValueData as _INTERNAL_filterKeyValueData,
-  shouldFilterDataKey as _INTERNAL_shouldFilterDataKey,
-} from './utils/data-collection/filterKeyValueData';
-export { FILTERED_VALUE as _INTERNAL_FILTERED_VALUE } from './utils/data-collection/filtering-snippets';
+export { filterKeyValueData as _INTERNAL_filterKeyValueData } from './utils/data-collection/filterKeyValueData';
 export { filterCookies as _INTERNAL_filterCookies } from './utils/data-collection/filterCookies';
 export { filterQueryParams as _INTERNAL_filterQueryParams } from './utils/data-collection/filterQueryParams';
 export { filterCollectedUrl, filterCollectedUrlQuery } from './utils/data-collection/filterCollectedUrl';

packages/core/src/utils/data-collection/filterCookies.ts

@@ -8,6 +8,8 @@ import { filterKeyValueData } from './filterKeyValueData';
  *
  * When individual cookies can be parsed, each key-value pair is filtered
  * independently. When parsing fails, the entire string is replaced with `[Filtered]`.
+ * A nameless segment inside an otherwise parseable string (`"opaque-blob; theme=dark"`) is
+ * dropped, since a record key cannot carry a `[Filtered]` marker without leaking the token.
  */
 export function filterCookies(cookieString: string, behavior: CollectBehavior): Record<string, string> | string {
   if (behavior === false) {

packages/core/test/lib/utils/data-collection/filterCookies.test.ts

@@ -84,6 +84,21 @@ describe('filterCookies', () => {
     });
   });
 
+  // Intended behavior for the cookie parsing consolidation follow-up: `Set-Cookie` attributes are
+  // metadata, not cookies, so they must not show up as key-value pairs. Marked `fails` until the
+  // shared parser handles them.
+  describe('Set-Cookie attribute handling (known gaps)', () => {
+    it.fails('does not report Set-Cookie attributes as cookie pairs', () => {
+      expect(filterCookies('sid=1; Max-Age=3600; Path=/', true)).toEqual({ sid: '[Filtered]' });
+    });
+
+    it.fails('does not report Expires/Domain attributes as cookie pairs', () => {
+      expect(filterCookies('theme=dark; Expires=Wed, 21 Oct 2026 07:28:00 GMT; Domain=example.com', true)).toEqual({
+        theme: 'dark',
+      });
+    });
+  });
+
   describe('edge cases', () => {
     it('handles cookies with = in the value', () => {
       const result = filterCookies('data=base64==; theme=light', true);

packages/node/src/integrations/node-fetch/types.ts

@@ -87,7 +87,16 @@ export interface UndiciInstrumentationConfig<RequestType = UndiciRequest, Respon
   requestHook?: RequestHookFunction<RequestType>;
   /** Function called once response headers have been received */
   responseHook?: ResponseHookFunction<RequestType, ResponseType>;
-  /** Map the following HTTP headers to span attributes. */
+  /**
+   * Capture the listed HTTP headers as span attributes
+   * (`http.request.header.<name>` / `http.response.header.<name>`).
+   *
+   * Privacy filtering still applies to every header listed here. A header keeps its value only if
+   * `dataCollection.httpHeaders` permits it:
+   * - Sensitive names (`authorization`, `cookie`, ...) always show up as `[Filtered]`.
+   * - Names on the `deny` list show up as `[Filtered]`.
+   * - If an `allow` list is configured, a header must appear there as well, or it shows up as `[Filtered]`.
+   */
   headersToSpanAttributes?: {
     requestHeaders?: string[];
     responseHeaders?: string[];

packages/node/src/integrations/node-fetch/undici-instrumentation.ts

@@ -40,8 +40,7 @@ import {
   getUrlQuery,
   filterCollectedUrl,
   filterCollectedUrlQuery,
-  _INTERNAL_shouldFilterDataKey,
-  _INTERNAL_FILTERED_VALUE,
+  httpHeadersToSpanAttributes,
 } from '@sentry/core';
 import { addFetchRequestBreadcrumb, addTracePropagationHeadersToFetchRequest } from '../../utils/outgoingFetchRequest';
 import {
@@ -314,20 +313,21 @@ function onRequestHeaders(config: NodeFetchOptions, { request, socket }: Request
 
   // After hooks have been processed (which may modify request headers)
   // we can collect the headers based on the configuration
-  if (config.headersToSpanAttributes?.requestHeaders) {
+  const client = getClient();
+  if (config.headersToSpanAttributes?.requestHeaders && client) {
     const headersToAttribs = new Set(config.headersToSpanAttributes.requestHeaders.map(n => n.toLowerCase()));
     const headersMap = parseRequestHeaders(request);
 
+    const allowlisted: Record<string, string | string[]> = {};
     for (const [name, value] of headersMap.entries()) {
       if (headersToAttribs.has(name)) {
-        // An allowlist entry does not exempt a header from the denylist.
-        spanAttributes[`http.request.header.${name}`] = _INTERNAL_shouldFilterDataKey(name, true)
-          ? [_INTERNAL_FILTERED_VALUE]
-          : Array.isArray(value)
-            ? value
-            : [value];
+        allowlisted[name] = value;
       }
     }
+
+    // An entry in `headersToSpanAttributes` does not exempt a header from the `dataCollection`
+    // filtering, so the allowlisted subset goes through the same pipeline as any other header.
+    Object.assign(spanAttributes, httpHeadersToSpanAttributes(allowlisted, client.getDataCollectionOptions()));
   }
 
   span.setAttributes(spanAttributes);
@@ -360,30 +360,31 @@ function onResponseHeaders(config: NodeFetchOptions, { request, response }: Resp
     () => undefined,
   );
 
-  if (config.headersToSpanAttributes?.responseHeaders) {
+  const client = getClient();
+  if (config.headersToSpanAttributes?.responseHeaders && client) {
     const headersToAttribs = new Set<string>();
     config.headersToSpanAttributes?.responseHeaders.forEach(name => headersToAttribs.add(name.toLowerCase()));
 
+    const allowlisted: Record<string, string[]> = {};
     for (let idx = 0; idx < response.headers.length; idx = idx + 2) {
       const nameBuf = response.headers[idx];
       const valueBuf = response.headers[idx + 1];
       if (nameBuf === undefined || valueBuf === undefined) {
         continue;
       }
       const name = nameBuf.toString().toLowerCase();
-      const value = valueBuf;
 
       if (headersToAttribs.has(name)) {
-        const attrName = `http.response.header.${name}`;
-        if (_INTERNAL_shouldFilterDataKey(name, true)) {
-          spanAttributes[attrName] = [_INTERNAL_FILTERED_VALUE];
-        } else if (!Object.prototype.hasOwnProperty.call(spanAttributes, attrName)) {
-          spanAttributes[attrName] = [value.toString()];
-        } else {
-          (spanAttributes[attrName] as string[]).push(value.toString());
-        }
+        (allowlisted[name] ??= []).push(valueBuf.toString());
       }
     }
+
+    // An entry in `headersToSpanAttributes` does not exempt a header from the `dataCollection`
+    // filtering, so the allowlisted subset goes through the same pipeline as any other header.
+    Object.assign(
+      spanAttributes,
+      httpHeadersToSpanAttributes(allowlisted, client.getDataCollectionOptions(), 'response'),
+    );
   }
 
   span.setAttributes(spanAttributes);