fix(starlette): Stop eagerly consuming request bodies for streamed spans - #6282
Conversation
Sorry, something went wrong.
Codecov Results 📊✅ 88720 passed | ⏭️ 6019 skipped | Total: 94739 | Pass Rate: 93.65% | Execution Time: 300m 2s 📊 Comparison with Base Branch
All tests are passing successfully. ✅ Patch coverage is 93.55%. Project has 2360 uncovered lines.
@@ Coverage Diff @@
## main #PR +/-##
==========================================
+ Coverage 89.87% 89.90% +0.03%
==========================================
Files 192 192 —
Lines 23343 23369 +26
Branches 8030 8038 +8
==========================================
+ Hits 20979 21009 +30
- Misses 2364 2360 -4
- Partials 1327 1329 +2Generated by Codecov Action |
Sorry, something went wrong.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 9d2157e. Configure here.
Sorry, something went wrong.
| assert parsed_form_attribute.keys() == PARSED_FORM.keys() | ||
| assert parsed_form_attribute["username"] == PARSED_FORM["username"] | ||
| assert parsed_form_attribute["password"] == "hello123" | ||
| assert parsed_form_attribute["photo"] == "[Unparsable]" |
There was a problem hiding this comment.
Streamed-span request body attribute stores sensitive form fields (e.g. password) without PII scrubbing
In the streaming-span code path, _wrap_async_handler writes the result of _get_cached_request_body_attribute directly into the SPANDATA.HTTP_REQUEST_BODY_DATA span attribute via current_span._segment.set_attribute(...). _get_cached_request_body_attribute serialises raw request._json / request._form values with json.dumps() and applies no sensitive-field filtering, so a password field is persisted as its plaintext value. The equivalent event/transaction path scrubs the same field to "[Filtered]" because events pass through EventScrubber.scrub_event, but standalone streamed span items are not run through the event scrubber, so the attribute is emitted unredacted. An inline comment in the new test acknowledges the gap: sanitization is deferred to before_send_span hooks that do not yet exist.
Evidence- _get_cached_request_body_attribute (starlette.py ~L484) builds the body from request._json / request._form via json.dumps() with no call to any scrubbing/denylist helper.
- _wrap_async_handler (starlette.py ~L569) writes this directly: current_span._segment.set_attribute(SPANDATA.HTTP_REQUEST_BODY_DATA, request_body).
- EventScrubber.scrub_event (scrubber.py L170) only scrubs spans nested inside an event payload; standalone streamed span items never pass through it, so password is not redacted on the span path.
- The new test test_formdata_request_body asserts the streamed span keeps parsed_form_attribute["password"] == "hello123" while the event path asserts password == "[Filtered]", documenting the divergence.
- The test comment explicitly notes sanitization "will need to happen within the before_send_span hooks", confirming the redaction is not yet implemented.
Identified by Warden code-review · HBD-YV3
Sorry, something went wrong.
…ans (getsentry#6282) Only attach cached request bodies to streamed spans to avoid eagerly consuming the request body. Use the `_json` and `_form` attributes instead of `json()` and `form()` accessors so the SDK does not consume the body. If neither `_json` nor `_form` exists, either the request body is not JSON/FormData or the endpoint did not yet access the request body. In that case, omit the request body attribute.
Description
Only attach cached request bodies to streamed spans to avoid relying on an eagerly consumed request body. Use the _json and _form attributes instead of json() and form() accessors to ensure that the request body is not consumed by the SDK.
Note: by using _json and _form directly we can no longer distinguish between raw data payloads and payloads that were not cached on the Request object. The attribute is therefore omitted if the request body is not cached, since the endpoint may not have accessed it.
The integration can still cause application hangs if middleware or handlers deprive the receive() callable instead of using Starlette accessors. Reliance on the overly ambitious request body access is only eliminated for streamed spans (and only persists for errors with the change).
Issues
Reminders