Don't send cookie and form scope data by default

Author: jcberquist

ModuleConfig.cfc

@@ -49,6 +49,9 @@ component {
 			"levelMax"               : "ERROR",
 			// Enable/disable error logging
 			"enableExceptionLogging" : true,
+			// Sentry recommends not sending cookie and form data by default
+			"sendCookies"            : false,
+			"sendPostData"           : false,
 			// Data sanitization, scrub fields and headers, replaced with "[Filtered]" at runtime
 			"scrubFields"            : [],
 			"scrubHeaders"           : [],

models/SentryService.cfc

@@ -85,6 +85,10 @@ component accessors=true singleton {
 			"levelMax"               : "ERROR",
 			// Enable/disable error logging
 			"enableExceptionLogging" : true,
+			// Whether to include client cookies when sending request information to Sentry
+			"sendCookies"            : false,
+			// Whether to include POST data (e.g. FORM) when sending request information to Sentry
+			"sendPostData"           : false,
 			// Data sanitization, scrub fields and headers, replaced with "[Filtered]" at runtime
 			"scrubFields"            : [
 				"passwd",
@@ -709,21 +713,31 @@ component accessors=true singleton {
 		// Request interface
 		// https://develop.sentry.dev/sdk/event-payloads/request/
 		arguments.captureStruct[ "request" ] = {
-			"url"    : arguments.path,
-			"method" : arguments.cgiVars.request_method ?: "GET",
-			"data"   : !structIsEmpty( form ) ? sanitizeFields( form ) : sanitizeFields(
-				isJSON( getHTTPRequestData().content ) ? deserializeJSON( getHTTPRequestData().content ) : {}
-			),
+			"url"          : arguments.path,
+			"method"       : arguments.cgiVars.request_method ?: "GET",
 			"query_string" : sanitizeQueryString( arguments.cgiVars.query_string ?: "" ),
-			// Sentry requires all cookies be strings
-			"cookies"      : sanitizeFields(
+			"env"          : sanitizeEnv( arguments.cgiVars ),
+			"headers"      : sanitizeHeaders( httpRequestData.headers )
+		};
+
+		if ( variables.settings.sendCookies ) {
+			arguments.captureStruct[ "request" ][ "cookies" ] = sanitizeFields(
 				cookie.map( function( k, v ){
-					return toString( v );
+					return toString( v ); // Sentry requires all cookies be strings
 				} )
-			),
-			"env"     : arguments.cgiVars,
-			"headers" : sanitizeHeaders( httpRequestData.headers )
-		};
+			)
+		}
+
+		if ( variables.settings.sendPostData ) {
+			if ( !structIsEmpty( form ) ) {
+				arguments.captureStruct[ "request" ][ "data" ] = sanitizeFields( form );
+			} else {
+				arguments.captureStruct[ "request" ][ "data" ] = sanitizeFields(
+					isJSON( httpRequestData.content ) ? deserializeJSON( httpRequestData.content ) : {}
+				)
+			}
+		}
+
 		// serialize data
 		jsonCapture = serializeJSON( arguments.captureStruct );
 
@@ -884,6 +898,11 @@ component accessors=true singleton {
 				}
 			}
 		}
+
+		if ( !variables.settings.sendCookies && structKeyExists( arguments.headers, "Cookie" ) ) {
+			arguments.headers.Cookie = "[Filtered]";
+		}
+
 		// Sentry requires all headers be strings
 		return arguments.headers.map( function( k, v ){
 			return toString( v );
@@ -910,6 +929,25 @@ component accessors=true singleton {
 		return arguments.data;
 	}
 
+	/**
+	 * Sanitize env/CGI vars
+	 *
+	 * @data The data fields
+	 */
+	private any function sanitizeEnv( required any data ){
+		if ( !isStruct( arguments.data ) ) {
+			return arguments.data;
+		}
+
+		// don't mutate CGI scope
+		return arguments.data.map( function( k, v ){
+			if ( !variables.settings.sendCookies && k == "http_cookie" ) {
+				return "[Filtered]";
+			}
+			return v;
+		} );
+	}
+
 	/**
 	 * Sanitize the incoming query string
 	 *

readme.md

@@ -34,6 +34,8 @@ Version 2 of this module includes some potentially breaking changes in how the e
 
 Additionally, Sentry has deprecated sending events to the `/api/{project_id}/store` endpoint in favor of a new `/api/{project_id}/envelope` endpoint (and a new structure for the body of the post requests). Again, if you self-host an older version of the Sentry service, sending events to the `store` endpoint might be your only option. There is a new module setting, `sentryEventEndpoint`, that defaults to `store`, but can be set to `envelope` to enable sending events to the modern endpoint.
 
+In version 2, `cookie` and `form` scope data will not be sent with events by default. To enable sending this data, use the new `sendCookies` and `sendPostData` settings.
+
 ## CFML App Installation
 
 If your app uses neither ColdBox nor LogBox, you can still instantiate the `SentryService` and use it directly so long as you prep it with the settings it needs.
@@ -142,6 +144,10 @@ settings = {
   enableExceptionLogging : true,
   // Send messages to Sentry in a thread
   async : true,
+  // Whether to include client cookies when sending request information to Sentry
+  sendCookies : false,
+  // Whether to include POST data (e.g. FORM) when sending request information to Sentry
+  sendPostData : false,
   // Don't sent URL or FORM field values of these names to Sentry
   scrubFields : [ 'passwd', 'password', 'password_confirmation', 'secret', 'confirm_password', 'secret_token', 'APIToken', 'x-api-token', 'fwreinit' ],
   // Don't sent HTTP header values of these names to Sentry