Skip to content

fix(core): Filter query params in url.full on request data and navigate errors - #23143

Merged
chargome merged 2 commits into
developfrom
fix/filter-url-full-in-requestdata-and-navigate
Aug 7, 2026
Merged

fix(core): Filter query params in url.full on request data and navigate errors#23143
chargome merged 2 commits into
developfrom
fix/filter-url-full-in-requestdata-and-navigate

Conversation

@chargome

@chargome chargome commented Aug 7, 2026

Copy link
Copy Markdown
Member

Two sites set url.full from a raw URL, so query params reached Sentry despite dataCollection.urlQueryParams.

Follow-up to #23061, which added the URL filtering. Found by the lint rule in the PR stacked on top of this one 😄 .

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

size-limit report 📦

Path Size % Change Change
@sentry/browser 30.34 kB - -
@sentry/browser - with treeshaking flags 28.55 kB - -
@sentry/browser - with treeshaking flags tracing without tracing 26.86 kB - -
@sentry/browser (incl. Tracing) 47.81 kB - -
@sentry/browser (incl. Tracing + Span Streaming) 47.82 kB - -
@sentry/browser (incl. Tracing, Profiling) 52.55 kB - -
@sentry/browser (incl. Tracing, Replay) 87.19 kB - -
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 76.62 kB - -
@sentry/browser (incl. Tracing, Replay with Canvas) 91.91 kB - -
@sentry/browser (incl. Tracing, Replay, Feedback) 104.56 kB - -
@sentry/browser (incl. Feedback) 47.68 kB - -
@sentry/browser (incl. sendFeedback) 35.17 kB - -
@sentry/browser (incl. FeedbackAsync) 40.34 kB - -
@sentry/browser (incl. Metrics) 31.41 kB - -
@sentry/browser (incl. Logs) 31.66 kB - -
@sentry/browser (incl. Metrics & Logs) 32.32 kB - -
@sentry/react 32.15 kB - -
@sentry/react (incl. Tracing) 50.06 kB - -
@sentry/vue 35.45 kB - -
@sentry/vue (incl. Tracing) 49.82 kB - -
@sentry/svelte 30.37 kB - -
CDN Bundle 32.34 kB - -
CDN Bundle (incl. Tracing) 48.13 kB - -
CDN Bundle (incl. Logs, Metrics) 33.88 kB - -
CDN Bundle (incl. Tracing, Logs, Metrics) 49.46 kB - -
CDN Bundle (incl. Replay, Logs, Metrics) 73.23 kB - -
CDN Bundle (incl. Tracing, Replay) 85.74 kB - -
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) 87.02 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback) 91.56 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) 92.86 kB - -
CDN Bundle - uncompressed 95.88 kB - -
CDN Bundle (incl. Tracing) - uncompressed 143.58 kB - -
CDN Bundle (incl. Logs, Metrics) - uncompressed 100.5 kB - -
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed 147.56 kB - -
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed 225.2 kB - -
CDN Bundle (incl. Tracing, Replay) - uncompressed 262.84 kB - -
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed 266.81 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 276.55 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed 280.5 kB - -
@sentry/nextjs (client) 52.62 kB - -
@sentry/sveltekit (client) 48.26 kB - -
@sentry/core/server 65.77 kB +0.01% +6 B 🔺
@sentry/core/browser 52 kB +0.03% +14 B 🔺
@sentry/node 119.43 kB +0.03% +24 B 🔺
@sentry/node/import (ESM hook with diagnostics-channel injection) 0 B added added
@sentry/node - without tracing 83.41 kB +0.03% +25 B 🔺
@sentry/aws-serverless 92.74 kB +0.03% +25 B 🔺
@sentry/cloudflare (withSentry) - minified 214.89 kB +0.03% +63 B 🔺
@sentry/cloudflare (withSentry) 530.77 kB +0.04% +162 B 🔺

View base workflow run

@chargome
chargome marked this pull request as ready for review August 7, 2026 10:30
@chargome
chargome requested a review from a team as a code owner August 7, 2026 10:30
@chargome
chargome requested review from Lms24, mydea, nicohrubec and s1gr1d and removed request for a team, mydea and s1gr1d August 7, 2026 10:30
…gate errors

Two sites set `url.full` from a raw URL, so query params reached Sentry even
though `dataCollection.urlQueryParams` was configured to filter them.

`requestDataIntegration` filtered `url.query` on the segment span but left
`url.full` untouched, so the same span carried both the filtered and the
unfiltered query string. On the react-router client, the `url.full` reported for
a failed navigate came from the app's own navigate target, which can include a
query.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@chargome
chargome force-pushed the fix/filter-url-full-in-requestdata-and-navigate branch from 9cfe5d6 to 962995a Compare August 7, 2026 10:50
Comment thread packages/react-router/src/client/createClientInstrumentation.ts
Comment thread packages/core/src/integrations/requestdata.ts
`addNormalizedRequestDataToEvent` filtered cookies, headers and `query_string`
but spread the raw URL into `event.request.url`, so an error event carried the
query string even with `dataCollection.urlQueryParams: false` — the same secret
the SDK had just dropped from `query_string`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@chargome
chargome merged commit 99254bb into develop Aug 7, 2026
268 of 271 checks passed
@chargome
chargome deleted the fix/filter-url-full-in-requestdata-and-navigate branch August 7, 2026 13:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants