Flask integration Scrubbing Sensitive Data override parameters to `AnnotatedValue` object by reference

[ninochang]

How do you use Sentry?

Sentry Saas (sentry.io)

Version

1.22.2

Steps to Reproduce

1. Setup with docker-compose as following

• docker-compose.yaml

version: '3.6'

services:
  web: 
    image: a901002666/sentry-example
    command: flask run --host 0.0.0.0 --port 8000 --reload
    env_file:
      - .env
    ports:
      - 8000:8000

• .env

SENTRY_DSN=${YOUR_DSN}

2. Run docker-compose up
3. POST request to localhost:8000/

curl --location --request POST 'http://localhost:8000/' \
--header 'Content-Type: application/json' \
--data-raw '{
    "password": "temp1234"
}'

---

The image is a simple flask application has code.

• app.py

import os
import sentry_sdk
import sentry_sdk.integrations.flask

from flask import Flask, request, current_app

sentry_sdk.init(
    traces_sample_rate=1.0,
    integrations=[
        sentry_sdk.integrations.flask.FlaskIntegration(),
    ],
)


app = Flask(__name__)

@app.route("/", methods={'POST'})
def hello_world():
    print('before', request.get_json())
    current_app.logger.error('debug example')
    print('after', request.get_json())
    return "<p>Hello, World!</p>"

Expected Result

Look at console has 2 print() call, between the 2 has a logger.error() which will trigger sentry-sdk report.
expect result should be.

flask-web-1  | before {'password': 'temp1234'}
flask-web-1  | [2023-05-14 11:52:14,330] ERROR in app: debug example
flask-web-1  | after {'password': 'temp1234'}

My expectation is that sentry-sdk should do the scrubbing on data send to report, not affecting data still processing by flask.

Actual Result

But you'll actually get

flask-web-1  | before {'password': 'temp1234'}
flask-web-1  | [2023-05-14 11:52:14,330] ERROR in app: debug example
flask-web-1  | after {'password': <sentry_sdk.utils.AnnotatedValue object at 0xffff91d01ff0>}

The request.get_json() result had been mocked by sentry-sdk.

[antonpirker]

Hey @ninochang !

Thanks for reporting this.
Yes, Sentry replaces sensitive information with AnnotadedValue before sending it over the wire.
But Sentry should also not change the request in the Flask app. This is definitely something we need to fix.

[ninochang]

Hi @antonpirker, thanks for reply !
I somehow have code like this and it seems work.

class EventScrubber(sentry_sdk.scrubber.EventScrubber):
    def scrub_dict(self, d):
        if not isinstance(d, dict):
            return

        _d = d.copy()
        return super(_d)


sentry_sdk.init(
    event_scrubber=EventScrubber(),
    integrations=[
        sentry_sdk.integrations.flask.FlaskIntegration(),
    ],
)

But I'm not quiet sure why, the d = d.copy() shouldn't affect the reference of origin d.

Is this consider a acceptable temporary fix solution ?

[sentrivana]

Hey @ninochang, the workaround looks good to me. It's basically what we'll have to do for the proper fix, just in different places. So if it works, go for it.

[sentrivana]

Releasing the fix for this today.