feat(sanic): Add sentry.is_localhost for inbound filters

Author: sentrivana

sentry_sdk/integrations/sanic.py

@@ -25,6 +25,7 @@
     ensure_integration_enabled,
     event_from_exception,
     has_data_collection_enabled,
+    is_localhost,
     parse_version,
     reraise,
 )
@@ -182,6 +183,16 @@ async def _context_enter(request: "Request") -> None:
     scope.clear_breadcrumbs()
     scope.add_event_processor(_make_request_processor(weak_request))
 
+    scope.set_attribute(
+        SPANDATA.SENTRY_IS_LOCALHOST,
+        is_localhost(
+            client_ip=request.remote_addr or None,
+            url_host=urlsplit(request.url).hostname,
+            host_header=request.headers.get("host"),
+            forwarded_host_header=request.headers.get("x-forwarded-host"),
+        ),
+    )
+
     if is_span_streaming_enabled:
         integration = client.get_integration(SanicIntegration)
         if (

sentry_sdk/utils.py

@@ -2229,7 +2229,7 @@ def _is_localhost(
 
     Based on the logic in relay's localhost filter.
     """
-    if client_ip is not None and client_ip in _LOCAL_IPS:
+    if client_ip is not None and client_ip.strip("[]") in _LOCAL_IPS:
         return True
 
     # URL host uses subdomain-aware matching

tests/integrations/sanic/test_sanic.py

@@ -889,3 +889,57 @@ def test_remote_addr_data_collection(
         assert event["request"]["env"] == {"REMOTE_ADDR": ""}
     else:
         assert "env" not in event["request"]
+
+
+@pytest.mark.skipif(
+    not PERFORMANCE_SUPPORTED, reason="Performance not supported on this Sanic version"
+)
+@pytest.mark.parametrize(
+    "forwarded_for, host_header, is_localhost",
+    [
+        # Loopback IP
+        ("127.0.0.1", "example.com", True),
+        # IPv6 loopback (quoted brackets per RFC 7239)
+        ('"[::1]"', "example.com", True),
+        # Localhost host header with non-local IP
+        ("203.0.113.50", "localhost:8000", True),
+        # Non-local everything
+        ("203.0.113.50", "example.com", False),
+    ],
+)
+def test_is_localhost_span_attribute(
+    sentry_init, app, capture_items, forwarded_for, host_header, is_localhost
+):
+    app.config.FORWARDED_SECRET = "test"
+
+    @app.route("/child-span")
+    def child_span_handler_localhost(request):
+        with sentry_sdk.traces.start_span(name="child-span"):
+            pass
+        return response.text("ok")
+
+    sentry_init(
+        integrations=[SanicIntegration()],
+        default_integrations=False,
+        traces_sample_rate=1.0,
+        trace_lifecycle="stream",
+    )
+
+    items = capture_items("span")
+
+    c = get_client(app)
+    with c as client:
+        client.get(
+            "/child-span",
+            headers={
+                "Forwarded": f"for={forwarded_for};secret=test",
+                "Host": host_header,
+            },
+        )
+
+    sentry_sdk.flush()
+
+    child_span, server_span = [item.payload for item in items]
+
+    assert server_span["attributes"]["sentry.is_localhost"] is is_localhost
+    assert child_span["attributes"]["sentry.is_localhost"] is is_localhost

tests/test_utils.py

@@ -1422,6 +1422,9 @@ def test_package_version_is_none():
         ({"client_ip": "10.0.0.1"}, False),
         ({"client_ip": "8.8.8.8"}, False),
         ({"client_ip": "::2"}, False),
+        # Bracketed IPv6 (e.g. from Sanic's Forwarded header parsing)
+        ({"client_ip": "[::1]"}, True),
+        ({"client_ip": "[::2]"}, False),
         # URL host (subdomain-aware matching)
         ({"url_host": "localhost"}, True),
         ({"url_host": "127.0.0.1"}, True),