fix(plug): broader scrubbing by solnic · Pull Request #1070 · getsentry/sentry-elixir

solnic · 2026-05-26T11:23:52Z

Broadens the default %Plug.Conn{} scrubbing and adds a :scrubber config
option to control which :private keys survive. Since v13.1.1.

scrub/1 on a conn now also: clears req_cookies and assigns, scrubs body_params/query_params, and reduces private to an allow-list (drops everything else, notably :plug_session).
New :private_allow_list strategy + default_private_allow_list/0 (Phoenix routing/render metadata).
New :scrubber config option; PlugContext wires it into the per-request scrubber.

New `scrubber` config

This is a top-level key with nested settings because we will need more features eventually once updated "PII handling" spec settles.

config :sentry,
  scrubber: [
    # Defaults to Sentry.Scrubber.default_private_allow_list()
    conn_private_allow_list: [:phoenix_controller, :phoenix_action, :my_custom_key]
  ]

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6d0f0fc. Configure here.}

sentry · 2026-06-08T10:34:18Z

        # when no :url_scrubber is configured, fall back to the no-op
        # default_url_scrubber/1 rather than Sentry.Scrubber's scrubbing default.
        |> Keyword.put_new(:url_scrubber, {__MODULE__, :default_url_scrubber, []})
+        |> Keyword.put(:private_allow_list, Sentry.Config.scrubber()[:conn_private_allow_list])


Bug: The use of Keyword.put bypasses a fallback default for scrubber options, creating a fragile pattern that could crash if a nil config value is ever introduced.
_{Severity: LOW}

Suggested Fix

Replace Keyword.put with Keyword.put_new in plug_context.ex. This will ensure that the option is only set if it's not already present, allowing the fallback default in Sentry.Scrubber.new/1 to be used correctly and making the code more robust against potential nil values from the configuration.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not valid. Location: lib/sentry/plug_context.ex#L158 Potential issue: The code in `plug_context.ex` uses `Keyword.put` to unconditionally set the `:private_allow_list` option for the scrubber. This bypasses the fallback default value defined in `sentry/scrubber.ex`. While current configuration validation prevents `Sentry.Config.scrubber()[:conn_private_allow_list]` from being `nil`, this pattern is fragile. If a `nil` value were ever passed (e.g., due to a future refactoring or a configuration initialization issue), it would propagate to `Map.take/2` in the scrubber, causing a `FunctionClauseError` because the key would be present with a `nil` value, and the default would not be used.

Also affects:

lib/sentry/scrubber.ex:328~328

lib/sentry/scrubber.ex:549~549

_{Did we get this right? 👍 / 👎 to inform future reviews.}

Expand the default @scrubbable_conn_fields so scrub/1 also clears req_cookies and assigns, scrubs body_params and query_params with the default sensitive keys, and reduces private to an allow-list of framework metadata — in addition to today's cookies/req_headers/params. assigns is cleared wholesale because auth libraries (Guardian, Pow, Coherence) routinely store decoded tokens, full user structs, and password hashes there, where no key-based heuristic redacts safely. private mixes sensitive data (the decoded session under :plug_session, Guardian's raw JWT) with high-signal framework routing metadata, so it uses the :private_allow_list strategy: Phoenix routing/render keys are retained (configurable via :scrub_conn_private_allow_list) and everything else is dropped. This keeps the most useful triage breadcrumb — which controller/action failed — without leaking secrets. Expressed entirely through the strategy-aware attribute and the allow-list mechanism from earlier commits — no changes to scrub/1 dispatch or to the consumers (Sentry.PlugContext and Sentry.PlugCapture both funnel through Sentry.Scrubber.scrub/1). The PlugContext request-interface payload is unchanged (it reads back only params/cookies/req_headers); the broadening manifests on the PlugCapture ActionClauseError conn path. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…q_cookies scrubbing Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Broadened conn scrubbing now clears req_cookies, so the session cookie value no longer appears in the inspected conn captured into frame vars. Restore the cookie-value assertion alongside the auth-header one. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

solnic force-pushed the refa/consolidate-plug-scrubber-access branch 3 times, most recently from dbe6f3d to 8408dda Compare May 28, 2026 10:59

solnic mentioned this pull request May 29, 2026

refa(plug): consolidate access to the plug scrubber #1069

Merged

solnic force-pushed the fix/broaden-conn-scrubber branch 2 times, most recently from 4b61f38 to 2cf2586 Compare June 1, 2026 09:38

solnic force-pushed the refa/consolidate-plug-scrubber-access branch 2 times, most recently from 4b4dd34 to e05c35a Compare June 3, 2026 12:35

solnic force-pushed the fix/broaden-conn-scrubber branch from 2cf2586 to 67cf7dd Compare June 3, 2026 12:35

solnic changed the base branch from refa/consolidate-plug-scrubber-access to fix/scrub-sensitive-data-from-stacktraces June 3, 2026 12:35

solnic force-pushed the fix/broaden-conn-scrubber branch from 67cf7dd to 7b02f6c Compare June 3, 2026 12:46

solnic force-pushed the fix/scrub-sensitive-data-from-stacktraces branch 2 times, most recently from 03dd2d1 to 9240a03 Compare June 3, 2026 13:38

solnic force-pushed the fix/broaden-conn-scrubber branch from 7b02f6c to 613318d Compare June 3, 2026 13:38

solnic force-pushed the fix/scrub-sensitive-data-from-stacktraces branch from 9240a03 to 587cfb4 Compare June 4, 2026 10:26

solnic force-pushed the fix/broaden-conn-scrubber branch 4 times, most recently from c3da499 to 72a3430 Compare June 4, 2026 14:59

solnic force-pushed the fix/scrub-sensitive-data-from-stacktraces branch from 3631906 to 1f52d72 Compare June 5, 2026 08:34

solnic force-pushed the fix/broaden-conn-scrubber branch from 72a3430 to 0fe1d7a Compare June 5, 2026 08:35

solnic marked this pull request as ready for review June 5, 2026 10:00

cursor Bot reviewed Jun 5, 2026

View reviewed changes

Comment thread lib/sentry/scrubber.ex

solnic force-pushed the fix/scrub-sensitive-data-from-stacktraces branch from 32d8cf6 to 5c7697d Compare June 5, 2026 12:04

solnic force-pushed the fix/broaden-conn-scrubber branch from 0fe1d7a to 2b3f068 Compare June 5, 2026 12:04

solnic force-pushed the fix/scrub-sensitive-data-from-stacktraces branch from 5c7697d to 4ee788a Compare June 8, 2026 08:49

solnic force-pushed the fix/broaden-conn-scrubber branch from 2b3f068 to 6d0f0fc Compare June 8, 2026 08:49

cursor Bot reviewed Jun 8, 2026

View reviewed changes

Comment thread lib/sentry/scrubber.ex

whatyouhide approved these changes Jun 8, 2026

View reviewed changes

sentry Bot reviewed Jun 8, 2026

View reviewed changes

solnic force-pushed the fix/scrub-sensitive-data-from-stacktraces branch from 4ee788a to 73a3f74 Compare June 8, 2026 12:20

solnic force-pushed the fix/broaden-conn-scrubber branch 3 times, most recently from 6f79afb to 945df7a Compare June 8, 2026 13:22

Base automatically changed from fix/scrub-sensitive-data-from-stacktraces to master June 8, 2026 13:26

solnic and others added 4 commits June 8, 2026 13:27

test(plug): cover default params, private allow-list, assigns, and re…

0a2b3b0

…q_cookies scrubbing Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

refa(scrubber): handle body_params the same as params

565c6ab

solnic force-pushed the fix/broaden-conn-scrubber branch from 945df7a to 823f9ae Compare June 8, 2026 13:27

solnic merged commit e3a4c91 into master Jun 8, 2026
15 checks passed

solnic deleted the fix/broaden-conn-scrubber branch June 8, 2026 13:36

github-actions Bot mentioned this pull request Jun 8, 2026

[skill-drift] fix(sentry-elixir-sdk): add v13.1-13.2 config options getsentry/sentry-for-ai#160

Merged

github-actions Bot mentioned this pull request Jun 15, 2026

[skill-drift] update(sentry-elixir-sdk): bump version to v13.2.0 getsentry/sentry-for-ai#170

Merged

Navigation Menu

Repository navigation

fix(plug): broader scrubbing - #1070

fix(plug): broader scrubbing#1070
solnic merged 4 commits into
masterfrom
fix/broaden-conn-scrubber

solnic commented May 26, 2026 •

edited

Loading

Uh oh!

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

sentry Bot Jun 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

solnic commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

New scrubber config

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sentry Bot Jun 8, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

solnic commented May 26, 2026 •

edited

Loading

New `scrubber` config