What is wrong. The Sentry hook in internal/server/sentry.go rebuilds an event's request URL from the route pattern so that /h/<uuid> never reaches Sentry, but sentryKeepsHeader keeps the Referer header verbatim, and a Referer can be an entrypoint URL. A sender that follows the README's nginx 308 from http:// to https:// sends the URL it was redirected from as its Referer (Go's HTTP client does this). A browser that opens /h/<uuid>/ gets the 404 page, whose stylesheet and script requests carry the full URL as Referer under strict-origin-when-cross-origin. An error event for any of those requests sends the entrypoint UUID, the webhook's secret, to the third-party service. The comment above sentryKeepsHeader reasons only about query parameters and misses the path.
What acceptable looks like. A Sentry event keeps at most the Referer's scheme and host, the same rule the access log gets in #534, reusing that reduction rather than writing a second one. The comment above sentryKeepsHeader and the README's Sentry passage (the list of headers sent) say so. A test next to the existing Sentry hook tests sends a receiver request whose Referer is the entrypoint URL and finds no UUID anywhere in the event.
Definition of done. No field of a Sentry event can carry an entrypoint path; the test above passes and fails without the change; the README and the comment match the code.
Builds after #534, which adds the access log's Referer rule.
Model: opus-5-5
**What is wrong.** The Sentry hook in `internal/server/sentry.go` rebuilds an event's request URL from the route pattern so that `/h/<uuid>` never reaches Sentry, but `sentryKeepsHeader` keeps the `Referer` header verbatim, and a Referer can be an entrypoint URL. A sender that follows the README's nginx `308` from `http://` to `https://` sends the URL it was redirected from as its Referer (Go's HTTP client does this). A browser that opens `/h/<uuid>/` gets the 404 page, whose stylesheet and script requests carry the full URL as Referer under `strict-origin-when-cross-origin`. An error event for any of those requests sends the entrypoint UUID, the webhook's secret, to the third-party service. The comment above `sentryKeepsHeader` reasons only about query parameters and misses the path.
**What acceptable looks like.** A Sentry event keeps at most the Referer's scheme and host, the same rule the access log gets in https://git.eeqj.de/sneak/webhooker/pulls/534, reusing that reduction rather than writing a second one. The comment above `sentryKeepsHeader` and the README's Sentry passage (the list of headers sent) say so. A test next to the existing Sentry hook tests sends a receiver request whose Referer is the entrypoint URL and finds no UUID anywhere in the event.
**Definition of done.** No field of a Sentry event can carry an entrypoint path; the test above passes and fails without the change; the README and the comment match the code.
Builds after https://git.eeqj.de/sneak/webhooker/pulls/534, which adds the access log's Referer rule.
Model: opus-5-5
clawbot
self-assigned this 2026-10-15 14:44:40 +02:00
Built in #549: a Sentry event now carries the Referer header as its scheme and host only, through the access log's own reduction, which internal/middleware now exports so the Sentry hook can call it. The comment above sentryKeepsHeader and the README's Sentry passage say so, and a test next to the existing Sentry hook tests sends a receiver request whose Referer is the entrypoint URL and finds no UUID in the event.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/webhooker/pulls/549: a Sentry event now carries the `Referer` header as its scheme and host only, through the access log's own reduction, which `internal/middleware` now exports so the Sentry hook can call it. The comment above `sentryKeepsHeader` and the README's Sentry passage say so, and a test next to the existing Sentry hook tests sends a receiver request whose `Referer` is the entrypoint URL and finds no UUID in the event.
Model: opus-5-5
Package decision for the rework of #549: the Referer reduction moves, unchanged, into a new package internal/referer, whose doc says it reduces a Referer to its scheme and host so a URL path never reaches a log line or an error report. The access log and the Sentry hook both call it there.
Model: opus-5-5
Package decision for the rework of https://git.eeqj.de/sneak/webhooker/pulls/549: the Referer reduction moves, unchanged, into a new package `internal/referer`, whose doc says it reduces a Referer to its scheme and host so a URL path never reaches a log line or an error report. The access log and the Sentry hook both call it there.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
What is wrong. The Sentry hook in
internal/server/sentry.gorebuilds an event's request URL from the route pattern so that/h/<uuid>never reaches Sentry, butsentryKeepsHeaderkeeps theRefererheader verbatim, and a Referer can be an entrypoint URL. A sender that follows the README's nginx308fromhttp://tohttps://sends the URL it was redirected from as its Referer (Go's HTTP client does this). A browser that opens/h/<uuid>/gets the 404 page, whose stylesheet and script requests carry the full URL as Referer understrict-origin-when-cross-origin. An error event for any of those requests sends the entrypoint UUID, the webhook's secret, to the third-party service. The comment abovesentryKeepsHeaderreasons only about query parameters and misses the path.What acceptable looks like. A Sentry event keeps at most the Referer's scheme and host, the same rule the access log gets in #534, reusing that reduction rather than writing a second one. The comment above
sentryKeepsHeaderand the README's Sentry passage (the list of headers sent) say so. A test next to the existing Sentry hook tests sends a receiver request whose Referer is the entrypoint URL and finds no UUID anywhere in the event.Definition of done. No field of a Sentry event can carry an entrypoint path; the test above passes and fails without the change; the README and the comment match the code.
Builds after #534, which adds the access log's Referer rule.
Model: opus-5-5
Built in #549: a Sentry event now carries the
Refererheader as its scheme and host only, through the access log's own reduction, whichinternal/middlewarenow exports so the Sentry hook can call it. The comment abovesentryKeepsHeaderand the README's Sentry passage say so, and a test next to the existing Sentry hook tests sends a receiver request whoseRefereris the entrypoint URL and finds no UUID in the event.Model: opus-5-5
Package decision for the rework of #549: the Referer reduction moves, unchanged, into a new package
internal/referer, whose doc says it reduces a Referer to its scheme and host so a URL path never reaches a log line or an error report. The access log and the Sentry hook both call it there.Model: opus-5-5