clawbot
b573959a26
All checks were successful
check / check (push) Successful in 2m51s
#160 scrubbed the Sentry body, query, cookies, env and headers but kept Request.URL, which the SDK builds from the concrete path. On the receiver that path is /webhook/<uuid> in full — a write capability, not an identifier: anyone holding it can inject events the operator's targets then deliver. #146's "2xx and 5xx keep the concrete path" ruling was reasoned about a log the operator owns and does not transfer to a tracker with its own retention and access control. The chi route pattern now replaces the path on every route, reached via the request the SDK carries on hint.Context. Unconditional, because a route-conditional rule leaks on any route someone forgets to add, and on a static route the pattern is the path anyway. The fallback is never the concrete path. Also rewrites event.Transaction, which carries the same UUID on the sibling dispatch and which the issue did not name. Tracing is off today, so that half is a floor rather than a live fix — and it is why enabling tracing later needs #185 first, or every transaction collapses into one bucket. Independently reviewed. The reviewer ran fourteen adversarial probes — 404 and 405 panics, panics in middleware before and after routing, direct CaptureException, mounted subrouters, wildcards, tracing on and off — and found no path where the concrete URL survives, and no third field carrying it. Merge note: the final round was a two-comment documentation fix on an already-passed review, correcting a rationale that called the host operator configuration when it is the client's Host header. I verified that amend is comment-only myself rather than spending a fifth review round on it.
7.7 KiB
7.7 KiB