feat(pii): collect request information

src/DataCollection/KeyValueDataFilter.php

@@ -96,7 +96,14 @@ public static function filterKeyValueData(array $data, array $behavior): ?array
         /** @mago-ignore analysis:mixed-assignment */
         foreach ($data as $key => $value) {
             $key = (string) $key;
-            $filtered[$key] = self::shouldFilterValue($key, $behavior) ? '[Filtered]' : $value;
+
+            if (self::shouldFilterValue($key, $behavior)) {
+                $filtered[$key] = '[Filtered]';
+            } elseif (\is_array($value)) {
+                $filtered[$key] = self::filterKeyValueData($value, $behavior);
+            } else {
+                $filtered[$key] = $value;
+            }
         }
 
         return $filtered;

src/DataCollection/RequestDataCollector.php

@@ -0,0 +1,177 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Sentry\DataCollection;
+
+/**
+ * @internal
+ */
+final class RequestDataCollector
+{
+    /**
+     * Headers sanitized by the legacy request integration when
+     * `send_default_pii` is disabled.
+     */
+    public const DEFAULT_PII_SANITIZE_HEADERS = [
+        'authorization',
+        'proxy-authorization',
+        'cookie',
+        'set-cookie',
+        'x-forwarded-for',
+        'x-real-ip',
+    ];
+
+    /**
+     * @var DataCollectionOptions|null
+     */
+    private $dataCollection;
+
+    /**
+     * @var bool
+     */
+    private $sendDefaultPii;
+
+    /**
+     * @var string[]
+     */
+    private $piiSanitizeHeaders;
+
+    /**
+     * @param DataCollectionOptions|null $dataCollection     The data collection configuration, or null to preserve legacy behavior
+     * @param bool                       $sendDefaultPii     The legacy `send_default_pii` value
+     * @param string[]                   $piiSanitizeHeaders Lowercase header names sanitized in legacy mode
+     */
+    public function __construct(
+        ?DataCollectionOptions $dataCollection,
+        bool $sendDefaultPii,
+        array $piiSanitizeHeaders = self::DEFAULT_PII_SANITIZE_HEADERS
+    ) {
+        $this->dataCollection = $dataCollection;
+        $this->sendDefaultPii = $sendDefaultPii;
+        $this->piiSanitizeHeaders = $piiSanitizeHeaders;
+    }
+
+    public function usesDataCollection(): bool
+    {
+        return $this->dataCollection !== null;
+    }
+
+    public function shouldCollectUserInfo(): bool
+    {
+        if ($this->dataCollection === null) {
+            return $this->sendDefaultPii;
+        }
+
+        return $this->dataCollection->shouldCollectUserInfo();
+    }
+
+    public function collectQueryString(string $queryString): ?string
+    {
+        if ($this->dataCollection === null) {
+            return $queryString !== '' ? $queryString : null;
+        }
+
+        if ($queryString === '') {
+            return null;
+        }
+
+        return KeyValueDataFilter::filterQueryString(
+            $queryString,
+            $this->dataCollection->getUrlQueryParams()
+        );
+    }
+
+    /**
+     * @param array<array-key, mixed> $cookies
+     *
+     * @return array<array-key, mixed>|null
+     */
+    public function collectCookies(array $cookies): ?array
+    {
+        if ($this->dataCollection === null) {
+            return $this->sendDefaultPii ? $cookies : null;
+        }
+
+        return KeyValueDataFilter::filterKeyValueData(
+            $cookies,
+            $this->dataCollection->getCookies()
+        );
+    }
+
+    /**
+     * @param array<array-key, string[]> $headers
+     *
+     * @return array<array-key, string[]>|null
+     */
+    public function collectHeaders(array $headers): ?array
+    {
+        if ($this->dataCollection === null) {
+            return $this->sendDefaultPii ? $headers : $this->sanitizeLegacyHeaders($headers);
+        }
+
+        return KeyValueDataFilter::filterHeaders(
+            $headers,
+            $this->dataCollection->getHttpHeaders()['request']
+        );
+    }
+
+    public function shouldCollectRequestBody(): bool
+    {
+        if ($this->dataCollection === null) {
+            // Legacy request body collection is controlled by max_request_body_size.
+            return true;
+        }
+
+        return \in_array('incomingRequest', $this->dataCollection->getHttpBodies(), true);
+    }
+
+    /**
+     * @param mixed $body
+     *
+     * @return mixed
+     */
+    public function collectRequestBody($body)
+    {
+        if (empty($body) || !$this->shouldCollectRequestBody()) {
+            return null;
+        }
+
+        if ($this->dataCollection === null) {
+            return $body;
+        }
+
+        if (!\is_array($body)) {
+            return '[Filtered]';
+        }
+
+        return KeyValueDataFilter::filterKeyValueData($body, [
+            'mode' => 'denyList',
+            'terms' => [],
+        ]);
+    }
+
+    /**
+     * @param array<array-key, string[]> $headers
+     *
+     * @return array<string, string[]>
+     */
+    private function sanitizeLegacyHeaders(array $headers): array
+    {
+        $sanitized = [];
+
+        foreach ($headers as $name => $values) {
+            $name = (string) $name;
+
+            if (\in_array(strtolower($name), $this->piiSanitizeHeaders, true)) {
+                foreach ($values as $headerLine => $headerValue) {
+                    $values[$headerLine] = '[Filtered]';
+                }
+            }
+
+            $sanitized[$name] = $values;
+        }
+
+        return $sanitized;
+    }
+}

src/Integration/RequestIntegration.php

@@ -6,6 +6,7 @@
 
 use Psr\Http\Message\ServerRequestInterface;
 use Psr\Http\Message\UploadedFileInterface;
+use Sentry\DataCollection\RequestDataCollector;
 use Sentry\Event;
 use Sentry\Exception\JsonException;
 use Sentry\Options;
@@ -48,19 +49,6 @@ final class RequestIntegration implements IntegrationInterface
         'always' => \PHP_INT_MAX,
     ];
 
-    /**
-     * This constant defines the default list of headers that may contain
-     * sensitive data and that will be sanitized if sending PII is disabled.
-     */
-    private const DEFAULT_SENSITIVE_HEADERS = [
-        'Authorization',
-        'Proxy-Authorization',
-        'Cookie',
-        'Set-Cookie',
-        'X-Forwarded-For',
-        'X-Real-IP',
-    ];
-
     /**
      * @var RequestFetcherInterface PSR-7 request fetcher
      */
@@ -128,69 +116,72 @@ private function processEvent(Event $event, Options $options): void
             return;
         }
 
+        $collector = new RequestDataCollector(
+            $options->getDataCollection(),
+            $options->shouldSendDefaultPii(),
+            $this->options['pii_sanitize_headers']
+        );
+        $queryString = $collector->collectQueryString($request->getUri()->getQuery());
+
         $requestData = [
-            'url' => (string) $request->getUri(),
+            'url' => $collector->usesDataCollection()
+                ? (string) $request->getUri()->withQuery($queryString ?? '')
+                : (string) $request->getUri(),
             'method' => $request->getMethod(),
         ];
 
-        if ($request->getUri()->getQuery()) {
-            $requestData['query_string'] = $request->getUri()->getQuery();
+        if ($queryString !== null) {
+            $requestData['query_string'] = $queryString;
         }
 
-        if ($options->shouldSendDefaultPii()) {
-            $serverParams = $request->getServerParams();
+        if ($collector->shouldCollectUserInfo()) {
+            $this->addRequestUserInfo($event, $request, $requestData);
+        }
 
-            if (!empty($serverParams['REMOTE_ADDR'])) {
-                $user = $event->getUser();
-                $requestData['env']['REMOTE_ADDR'] = $serverParams['REMOTE_ADDR'];
+        $cookies = $collector->collectCookies($request->getCookieParams());
 
-                if ($user === null) {
-                    $user = UserDataBag::createFromUserIpAddress($serverParams['REMOTE_ADDR']);
-                } elseif ($user->getIpAddress() === null) {
-                    $user->setIpAddress($serverParams['REMOTE_ADDR']);
-                }
+        if ($cookies !== null) {
+            $requestData['cookies'] = $cookies;
+        }
 
-                $event->setUser($user);
-            }
+        $headers = $collector->collectHeaders($request->getHeaders());
 
-            $requestData['cookies'] = $request->getCookieParams();
-            $requestData['headers'] = $request->getHeaders();
-        } else {
-            $requestData['headers'] = $this->sanitizeHeaders($request->getHeaders());
+        if ($headers !== null) {
+            $requestData['headers'] = $headers;
         }
 
-        $requestBody = $this->captureRequestBody($options, $request);
+        if ($collector->shouldCollectRequestBody()) {
+            $requestBody = $collector->collectRequestBody($this->captureRequestBody($options, $request));
 
-        if (!empty($requestBody)) {
-            $requestData['data'] = $requestBody;
+            if ($requestBody !== null) {
+                $requestData['data'] = $requestBody;
+            }
         }
 
         $event->setRequest($requestData);
     }
 
     /**
-     * Removes headers containing potential PII.
-     *
-     * @param array<array-key, string[]> $headers Array containing request headers
-     *
-     * @return array<string, string[]>
+     * @param array<string, mixed> $requestData
      */
-    private function sanitizeHeaders(array $headers): array
+    private function addRequestUserInfo(Event $event, ServerRequestInterface $request, array &$requestData): void
     {
-        foreach ($headers as $name => $values) {
-            // Cast the header name into a string, to avoid errors on numeric headers
-            $name = (string) $name;
+        $serverParams = $request->getServerParams();
 
-            if (!\in_array(strtolower($name), $this->options['pii_sanitize_headers'], true)) {
-                continue;
-            }
+        if (empty($serverParams['REMOTE_ADDR'])) {
+            return;
+        }
 
-            foreach ($values as $headerLine => $headerValue) {
-                $headers[$name][$headerLine] = '[Filtered]';
-            }
+        $user = $event->getUser();
+        $requestData['env'] = ['REMOTE_ADDR' => $serverParams['REMOTE_ADDR']];
+
+        if ($user === null) {
+            $user = UserDataBag::createFromUserIpAddress($serverParams['REMOTE_ADDR']);
+        } elseif ($user->getIpAddress() === null) {
+            $user->setIpAddress($serverParams['REMOTE_ADDR']);
         }
 
-        return $headers;
+        $event->setUser($user);
     }
 
     /**
@@ -309,6 +300,6 @@ private function configureOptions(OptionsResolver $resolver): void
         $resolver->setNormalizer('pii_sanitize_headers', static function (array $value): array {
             return array_map('strtolower', $value);
         });
-        $resolver->setDefault('pii_sanitize_headers', self::DEFAULT_SENSITIVE_HEADERS);
+        $resolver->setDefault('pii_sanitize_headers', RequestDataCollector::DEFAULT_PII_SANITIZE_HEADERS);
     }
 }

src/Options.php

@@ -352,9 +352,9 @@ public function setContextLines(?int $contextLines): self
         return $this->updateOptions(['context_lines' => $contextLines]);
     }
 
-    public function getDataCollection(): DataCollectionOptions
+    public function getDataCollection(): ?DataCollectionOptions
     {
-        /** @var DataCollectionOptions $dataCollection */
+        /** @var DataCollectionOptions|null $dataCollection */
         $dataCollection = $this->options['data_collection'];
 
         return $dataCollection;
@@ -1267,7 +1267,7 @@ private function configureOptions(OptionsResolver $resolver): void
         $resolver->setAllowedTypes('capture_silenced_errors', 'bool');
         $resolver->setAllowedTypes('max_request_body_size', 'string');
         $resolver->setAllowedTypes('class_serializers', 'array');
-        $resolver->setAllowedTypes('data_collection', ['array', DataCollectionOptions::class]);
+        $resolver->setAllowedTypes('data_collection', ['null', 'array', DataCollectionOptions::class]);
 
         $resolver->setAllowedValues('max_request_body_size', ['none', 'never', 'small', 'medium', 'always']);
         $resolver->setAllowedValues('dsn', \Closure::fromCallable([$this, 'validateDsnOption']));
@@ -1376,7 +1376,7 @@ private function configureOptions(OptionsResolver $resolver): void
             'capture_silenced_errors' => false,
             'max_request_body_size' => 'medium',
             'class_serializers' => [],
-            'data_collection' => new DataCollectionOptions(),
+            'data_collection' => null,
         ]);
     }
 
@@ -1427,11 +1427,11 @@ private function normalizeSpotlightUrl(string $url): string
     }
 
     /**
-     * @param array<string, mixed>|DataCollectionOptions $value
+     * @param array<string, mixed>|DataCollectionOptions|null $value
      */
-    private function normalizeDataCollectionOption($value): DataCollectionOptions
+    private function normalizeDataCollectionOption($value): ?DataCollectionOptions
     {
-        if ($value instanceof DataCollectionOptions) {
+        if ($value === null || $value instanceof DataCollectionOptions) {
             return $value;
         }
 

src/functions.php

@@ -45,7 +45,7 @@
  *         queues?: bool,
  *         stack_frame_variables?: bool|array{mode?: "off"|"denyList"|"allowList", terms?: array<string>},
  *         frame_context_lines?: int,
- *     },
+ *     }|null,
  *     default_integrations?: bool,
  *     dsn?: string|bool|Dsn|null,
  *     enable_logs?: bool,