diff --git a/CHANGELOG.md b/CHANGELOG.md index af426809518..ca9d3a7582a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,7 @@ **Features**: - Extend cookie scrubbing to response cookies. ([#6391](https://github.com/getsentry/relay/pull/6391)) +- Scrub numbered variants of sensitive cookies. ([#6392](https://github.com/getsentry/relay/pull/6392)) **Internal**: diff --git a/relay-pii/src/convert.rs b/relay-pii/src/convert.rs index b9c9e1fcc61..0327f7b4d08 100644 --- a/relay-pii/src/convert.rs +++ b/relay-pii/src/convert.rs @@ -1698,7 +1698,7 @@ THd+9FBxiHLGXNKhG/FRSyREXEt+NyYIf/0cyByc9tNksat794ddUqnLOg0vwSkv "contexts": { "trace": { "data": { - "http.request.header.cookie": "baz=quux; session=foobar; language=en; csrf=u32t4o3tb3gg43; foo=bar", + "http.request.header.cookie": "baz=quux; session__0=foobar; language=en; csrf=u32t4o3tb3gg43; foo=bar", "http.request.header.cookie.sentrysid": "foobar", "http.request.header.cookie.sudo": "foobar", "http.request.header.cookie.su": "foobar", @@ -1752,7 +1752,7 @@ THd+9FBxiHLGXNKhG/FRSyREXEt+NyYIf/0cyByc9tNksat794ddUqnLOg0vwSkv }, "spans": [{ "data": { - "http.request.header.cookie": "baz=quux; session=foobar; language=en; csrf=u32t4o3tb3gg43; foo=bar", + "http.request.header.cookie": "baz=quux; session__0=foobar; language=en; csrf=u32t4o3tb3gg43; foo=bar", "http.request.header.cookie.sentrysid": "foobar", "http.request.header.cookie.sudo": "foobar", "http.request.header.cookie.su": "foobar", @@ -1817,7 +1817,7 @@ THd+9FBxiHLGXNKhG/FRSyREXEt+NyYIf/0cyByc9tNksat794ddUqnLOg0vwSkv let mut data = SpanV2::from_value( serde_json::json!({ "attributes": { - "http.request.header.cookie": {"value": ["baz=quux", "session=foobar", "language=en", "csrf=u32t4o3tb3gg43", "foo=bar"]}, + "http.request.header.cookie": {"value": ["baz=quux", "session__0=foobar", "language=en", "csrf=u32t4o3tb3gg43", "foo=bar"]}, "http.request.header.cookie.sentrysid": {"value": "foobar"}, "http.request.header.cookie.sudo": {"value": "foobar"}, "http.request.header.cookie.su": {"value": "foobar"}, diff --git a/relay-pii/src/regexes.rs b/relay-pii/src/regexes.rs index 5de75902205..77e7e88977d 100644 --- a/relay-pii/src/regexes.rs +++ b/relay-pii/src/regexes.rs @@ -175,7 +175,7 @@ pub static SENSITIVE_COOKIE_NAMES: &[&str] = &[ static COOKIE_REGEX: LazyLock = LazyLock::new(|| { let variants = SENSITIVE_COOKIE_NAMES.join("|"); - let r = format!("(?i)\\b(?:{variants})=([^;]+)"); + let r = format!("(?i)\\b(?:(?:{variants})(?:__\\d+)?)=([^;]+)"); Regex::new(&r).unwrap() }); diff --git a/relay-pii/src/snapshots/relay_pii__convert__tests__span_cookie.snap b/relay-pii/src/snapshots/relay_pii__convert__tests__span_cookie.snap index 30bd8cfb1a8..f85e50e96f9 100644 --- a/relay-pii/src/snapshots/relay_pii__convert__tests__span_cookie.snap +++ b/relay-pii/src/snapshots/relay_pii__convert__tests__span_cookie.snap @@ -6,7 +6,7 @@ expression: data "contexts": { "trace": { "data": { - "http.request.header.cookie": "baz=quux; session=[Filtered]; language=en; csrf=[Filtered]; foo=bar", + "http.request.header.cookie": "baz=quux; session__0=[Filtered]; language=en; csrf=[Filtered]; foo=bar", "http.request.header.cookie.__session": "[Filtered]", "http.request.header.cookie._csrf": "[Filtered]", "http.request.header.cookie._iris_csrf": "[Filtered]", @@ -61,7 +61,7 @@ expression: data "spans": [ { "data": { - "http.request.header.cookie": "baz=quux; session=[Filtered]; language=en; csrf=[Filtered]; foo=bar", + "http.request.header.cookie": "baz=quux; session__0=[Filtered]; language=en; csrf=[Filtered]; foo=bar", "http.request.header.cookie.__session": "[Filtered]", "http.request.header.cookie._csrf": "[Filtered]", "http.request.header.cookie._iris_csrf": "[Filtered]", @@ -122,17 +122,17 @@ expression: data [ "@cookies:filter", "s", - 18, - 28 + 21, + 31 ], [ "@cookies:filter", "s", - 48, - 58 + 51, + 61 ] ], - "len": 67 + "len": 70 } }, "http.request.header.cookie.__session": { @@ -738,17 +738,17 @@ expression: data [ "@cookies:filter", "s", - 18, - 28 + 21, + 31 ], [ "@cookies:filter", "s", - 48, - 58 + 51, + 61 ] ], - "len": 67 + "len": 70 } }, "http.request.header.cookie.__session": { diff --git a/relay-pii/src/snapshots/relay_pii__convert__tests__span_v2_cookie.snap b/relay-pii/src/snapshots/relay_pii__convert__tests__span_v2_cookie.snap index 1c884925732..de897aa5408 100644 --- a/relay-pii/src/snapshots/relay_pii__convert__tests__span_v2_cookie.snap +++ b/relay-pii/src/snapshots/relay_pii__convert__tests__span_v2_cookie.snap @@ -7,7 +7,7 @@ expression: data "http.request.header.cookie": { "value": [ "baz=quux", - "session=[Filtered]", + "session__0=[Filtered]", "language=en", "csrf=[Filtered]", "foo=bar" @@ -171,11 +171,11 @@ expression: data [ "@cookies:filter", "s", - 8, - 18 + 11, + 21 ] ], - "len": 14 + "len": 17 } }, "3": {