feat(data-collection): Request data collection

[sl0thentr0py]

• Add PII_HEADER_SNIPPETS to backfill
• Use data_collection.http_headers.request for ip address collection (both env and request)
  • Sensitive headers like auth and cookies are now ALWAYS filtered unlike before
• Use data_collection.cookies for cookie collection (fix Hash signature since it always was one)
• Use data_collection.url_query_params for query string and parse query into Hash and filter
• Use data_collection.http_bodies for body
  • JSON is also parsed and filtered now, form data is also filtered for sensitive keys
• Deprecate rack_env_whitelist, will be removed in major

Issues

• Resolves: feat(pii): Wire core request interface to data_collection #3003
• Resolves: RUBY-191

[linear-code]

RUBY-191

[cursor]

Cursor Bugbot has reviewed your changes and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit dacba84. Configure here.}

[cursor]

Frozen default http_bodies array

Medium Severity

@http_bodies is assigned the frozen BODY_TYPES constant directly. In-place updates such as << or delete raise FrozenError. Elsewhere this codebase already uses .dup for frozen defaults like DEFAULT_PATCHES.

 

^{Reviewed by Cursor Bugbot for commit dacba84. Configure here.}

[cursor]

Truncated JSON becomes parse error

Medium Severity

JSON bodies are read only up to MAX_BODY_LIMIT and then parsed. Oversized bodies are truncated mid-document, parsing fails, and the captured data becomes the parser error message instead of any request content.

 

^{Reviewed by Cursor Bugbot for commit dacba84. Configure here.}

[cursor]

Spec checks wrong header terms

Low Severity

These examples assert http_headers.request.terms twice and never verify http_headers.response.terms, so a regression in the response-header backfill or defaults would not be caught.

Additional Locations (1)

• sentry-ruby/spec/sentry/data_collection_spec.rb#L70-L73

 

^{Reviewed by Cursor Bugbot for commit dacba84. Configure here.}