clawbot
fb5a203896
All checks were successful
check / check (push) Successful in 2m49s
The Sentry SDK builds Request.URL as scheme://host/path from the concrete path, which on the receiver route is /webhook/<uuid> in full. That UUID is a write capability, not an identifier: anyone holding it can post events this service accepts and its targets then deliver. A third-party tracker has its own retention, access control and deletion policy, so the rule the local access log follows does not carry across that boundary. The BeforeSend hook now rebuilds the URL from the chi route pattern, on every route rather than by route list, since a route-conditional rule leaks on any route someone forgets to add. Scheme and host are kept and everything else in the URL is discarded rather than edited: the scheme is the CSRF TLS decision the header allowlist relies on, and the host is whatever the client's Host header carried, which the allowlisted Host header already sends anyway. The pattern is reachable only on the error dispatch, where sentryhttp puts the request on the context the client copies onto the hint. A finished span captures with a nil hint, so BeforeSendTransaction sees no context; there and wherever else the pattern is missing the path falls back to the literal /(redacted), never to the concrete path, and a URL that will not parse into a scheme is withheld whole. A transaction event's SDK-built "METHOD /path" name carries the same capability and is rewritten on the same terms.