fix(plug): broader scrubbing (#1070)

* fix(plug): broaden default %Plug.Conn{} scrubbing

Expand the default @scrubbable_conn_fields so scrub/1 also clears req_cookies
and assigns, scrubs body_params and query_params with the default sensitive
keys, and reduces private to an allow-list of framework metadata — in addition
to today's cookies/req_headers/params.

assigns is cleared wholesale because auth libraries (Guardian, Pow, Coherence)
routinely store decoded tokens, full user structs, and password hashes there,
where no key-based heuristic redacts safely. private mixes sensitive data (the
decoded session under :plug_session, Guardian's raw JWT) with high-signal
framework routing metadata, so it uses the :private_allow_list strategy: Phoenix
routing/render keys are retained (configurable via :scrub_conn_private_allow_list)
and everything else is dropped. This keeps the most useful triage breadcrumb —
which controller/action failed — without leaking secrets.

Expressed entirely through the strategy-aware attribute and the allow-list
mechanism from earlier commits — no changes to scrub/1 dispatch or to the
consumers (Sentry.PlugContext and Sentry.PlugCapture both funnel through
Sentry.Scrubber.scrub/1). The PlugContext request-interface payload is unchanged
(it reads back only params/cookies/req_headers); the broadening manifests on the
PlugCapture ActionClauseError conn path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(plug): cover default params, private allow-list, assigns, and req_cookies scrubbing

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refa(scrubber): handle `body_params` the same as `params`

* test(plug): assert cookie value is scrubbed from stacktrace frame vars

Broadened conn scrubbing now clears req_cookies, so the session cookie value
no longer appears in the inspected conn captured into frame vars. Restore the
cookie-value assertion alongside the auth-header one.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: solnic

lib/sentry/config.ex

@@ -514,6 +514,37 @@ defmodule Sentry.Config do
       `{Sentry.Test.Config, :namespace}` as the resolver to enable per-test
       configuration isolation via `Sentry.Test.Config.put/1`.
       """
+    ],
+    scrubber: [
+      type: :keyword_list,
+      default: [],
+      type_doc: "`t:keyword/0`",
+      doc: """
+      Configuration for how the SDK scrubs sensitive data out of captured events.
+
+      *Available since v13.1.1*.
+      """,
+      keys: [
+        conn_private_allow_list: [
+          type: {:list, :atom},
+          default: Sentry.Scrubber.default_private_allow_list(),
+          type_doc: "list of `t:atom/0`",
+          doc: """
+          A list of keys that are retained in a `%Plug.Conn{}`'s `:private` map when
+          a captured error embeds a connection (for example a `Phoenix.ActionClauseError`
+          reported via `Sentry.PlugCapture`). All other `:private` keys are dropped.
+
+          The `:private` map can hold framework internals and sensitive data (such as
+          the decoded session under `:plug_session`), so it is not safe to report
+          wholesale. By default the SDK keeps only Phoenix's routing and render
+          metadata — see `Sentry.Scrubber.default_private_allow_list/0` — which is
+          high-signal for triaging which controller/action failed. Set this option to
+          extend or replace that list.
+
+          *Available since v13.1.1*.
+          """
+        ]
+      ]
     ]
   ]
 
@@ -914,6 +945,9 @@ defmodule Sentry.Config do
   @spec in_app_module_allow_list() :: [atom()]
   def in_app_module_allow_list, do: fetch!(:in_app_module_allow_list)
 
+  @spec scrubber() :: keyword()
+  def scrubber, do: fetch!(:scrubber)
+
   @spec send_result() :: :none | :sync
   def send_result, do: fetch!(:send_result)
 

lib/sentry/plug_capture.ex

@@ -80,9 +80,16 @@ defmodule Sentry.PlugCapture do
       request. When no `Sentry.PlugContext` has run, falls back to the
       defaults defined by `Sentry.Scrubber.scrub/2`:
 
-      * scrubs *all* cookies
+      * scrubs *all* cookies (`cookies` and `req_cookies`)
       * drops sensitive request headers (`authorization`, `authentication`, `cookie`)
-      * scrubs sensitive body params (`password`, `passwd`, `secret`)
+      * scrubs `params` and `body_params` through the configured `body_scrubber`
+        (defaulting to the sensitive params `password`, `passwd`, `secret`; a
+        `nil` `body_scrubber` empties both), and scrubs the same sensitive params
+        in `query_params`
+      * clears `assigns` (where auth libraries store user structs and tokens)
+      * reduces `private` to an allow-list of framework metadata, dropping
+        everything else (notably the decoded session under `:plug_session`);
+        configurable via the `scrubber: [conn_private_allow_list: ...]` option
 
   """
   defmacro __using__(opts) do

lib/sentry/plug_context.ex

@@ -155,6 +155,7 @@ defmodule Sentry.PlugContext do
         # when no :url_scrubber is configured, fall back to the no-op
         # default_url_scrubber/1 rather than Sentry.Scrubber's scrubbing default.
         |> Keyword.put_new(:url_scrubber, {__MODULE__, :default_url_scrubber, []})
+        |> Keyword.put(:private_allow_list, Sentry.Config.scrubber()[:conn_private_allow_list])
 
       Sentry.Scrubber.put_conn_scrubber(conn_scrubber_opts)
 

lib/sentry/scrubber.ex

@@ -49,8 +49,22 @@ defmodule Sentry.Scrubber do
       (typically from `Sentry.PlugContext.call/2`), falling back to the SDK
       default `scrub(conn, field)` clause when none is registered, or
     * a fixed tag — `:clear` replaces the field with `%{}`, `:params` scrubs the
-      field as a params-shaped map, and `:query_string` redacts sensitive params
-      from a raw query string.
+      field as a params-shaped map, `:query_string` redacts sensitive params from
+      a raw query string, and `:private_allow_list` keeps only the registered
+      allow-listed keys of the field (see `default_private_allow_list/0` and the
+      `:private_allow_list` option of `put_conn_scrubber/1`), dropping everything
+      else.
+
+  By default `scrub/1` redacts `cookies`, `req_headers`, `params`, and
+  `body_params` (the configurable fields — `body_params` shares the
+  `:body_scrubber` with `params`, so it honors the same registered scrubber and
+  is emptied when `body_scrubber` is `nil`), clears `req_cookies` and `assigns`
+  to `%{}`, scrubs `query_params` as a params-shaped map, and reduces `private`
+  to its allow-listed keys (`default_private_allow_list/0`). `assigns` is cleared
+  wholesale because auth libraries (Guardian, Pow, Coherence) routinely store
+  decoded tokens, full user structs, and session data there, where no key-based
+  heuristic redacts safely. `private` keeps only the allow-listed framework
+  metadata and drops everything else (notably `:plug_session`).
 
   The defaults can be overridden per call with `scrub(conn, overrides)`, where
   `overrides` is a `field: strategy` keyword list merged over the attribute —
@@ -67,35 +81,70 @@ defmodule Sentry.Scrubber do
   @scrubber_pdict_key {__MODULE__, :scrubber}
   @scrubber_names [:body_scrubber, :header_scrubber, :cookie_scrubber, :url_scrubber]
 
+  # Keys retained when a `%Plug.Conn{}`'s `:private` map is scrubbed with the
+  # `:private_allow_list` strategy. These are Phoenix's routing/render metadata
+  # — safe, high-signal breadcrumbs for triaging which controller/action failed.
+  # Anything not listed (e.g. `:plug_session`, which holds decoded session data)
+  # is dropped. This is the SDK default; the `scrubber: [conn_private_allow_list: ...]`
+  # config option exposes it as a user-configurable option.
+  @default_private_allow_list [
+    :phoenix_controller,
+    :phoenix_action,
+    :phoenix_endpoint,
+    :phoenix_router,
+    :phoenix_view,
+    :phoenix_layout,
+    :phoenix_format,
+    :phoenix_template,
+    :phoenix_router_url,
+    :phoenix_static_url
+  ]
+
   # Default `field -> strategy` mapping applied by `scrub/1` (overridable per
   # call via `scrub(conn, overrides)`). A strategy is either a configurable
   # scrubber struct-key (resolved per process via `get/1`) or a fixed tag:
   # `:clear` -> `%{}`, `:params` -> params-shaped scrub (Unfetched-safe),
-  # `:query_string` -> redact sensitive params from the raw query string.
+  # `:query_string` -> redact sensitive params from the raw query string,
+  # `:private_allow_list` -> keep only the registered allow-listed keys.
   # Add an entry to make a new conn field scrubbed by default.
+  #
+  # `assigns` is cleared wholesale because auth libraries (Guardian, Pow,
+  # Coherence) routinely store decoded tokens, full user structs, and session
+  # data there — there is no reliable key-based heuristic to redact it safely.
+  # `private` mixes sensitive data (e.g. `:plug_session`) with high-signal
+  # framework metadata (Phoenix routing), so it uses an allow-list instead of
+  # clearing wholesale — see `@default_private_allow_list`.
   @scrubbable_conn_fields [
     cookies: :cookie_scrubber,
+    req_cookies: :clear,
     req_headers: :header_scrubber,
     params: :body_scrubber,
-    query_string: :query_string
+    body_params: :body_scrubber,
+    query_params: :params,
+    query_string: :query_string,
+    assigns: :clear,
+    private: :private_allow_list
   ]
 
   @typedoc """
   A resolved set of per-field scrubbers for a `%Plug.Conn{}`.
 
   Each scrubber field holds a 1-arity function that takes the conn and returns
-  the scrubbed value for the corresponding field. Built by `put_conn_scrubber/1`
-  from `t:conn_scrubber_opts/0` and stored in the process dictionary.
+  the scrubbed value for the corresponding field. `private_allow_list` holds the
+  keys retained by the `:private_allow_list` strategy. Built by
+  `put_conn_scrubber/1` from `t:conn_scrubber_opts/0` and stored in the process
+  dictionary.
   """
   @type t :: %__MODULE__{
           body_scrubber: (Plug.Conn.t() -> term()),
           header_scrubber: (Plug.Conn.t() -> term()),
           cookie_scrubber: (Plug.Conn.t() -> term()),
-          url_scrubber: (Plug.Conn.t() -> String.t())
+          url_scrubber: (Plug.Conn.t() -> String.t()),
+          private_allow_list: [atom()]
         }
 
   @enforce_keys @scrubber_names
-  defstruct @scrubber_names
+  defstruct @scrubber_names ++ [private_allow_list: @default_private_allow_list]
 
   @doc false
   @spec scrubber_names() :: [atom()]
@@ -123,12 +172,14 @@ defmodule Sentry.Scrubber do
 
   Each `*_scrubber` key, when omitted, falls back to the field's default
   scrubber — the matching `scrub(conn, field)` clause of `scrub/2`.
+  `:private_allow_list` defaults to `default_private_allow_list/0`.
   """
   @type conn_scrubber_opts :: [
           body_scrubber: field_scrubber(),
           header_scrubber: field_scrubber(),
           cookie_scrubber: field_scrubber(),
-          url_scrubber: field_scrubber()
+          url_scrubber: field_scrubber(),
+          private_allow_list: [atom()]
         ]
 
   @doc """
@@ -152,6 +203,18 @@ defmodule Sentry.Scrubber do
   @spec default_header_keys() :: [String.t()]
   def default_header_keys, do: @default_scrubbed_header_keys
 
+  @doc """
+  Returns the default list of `%Plug.Conn{}` `:private` keys retained by the
+  `:private_allow_list` scrubbing strategy.
+
+  These are Phoenix's routing/render metadata keys, kept because they are
+  high-signal, non-sensitive breadcrumbs for triaging errors. This is the
+  default for the `scrubber: [conn_private_allow_list: ...]` configuration option.
+  """
+  @doc since: "13.1.1"
+  @spec default_private_allow_list() :: [atom()]
+  def default_private_allow_list, do: @default_private_allow_list
+
   @doc """
   Drops sensitive keys from a flat map.
 
@@ -261,7 +324,8 @@ defmodule Sentry.Scrubber do
       body_scrubber: resolve_scrubber(opts, :body_scrubber, :body),
       header_scrubber: resolve_scrubber(opts, :header_scrubber, :headers),
       cookie_scrubber: resolve_scrubber(opts, :cookie_scrubber, :cookies),
-      url_scrubber: resolve_scrubber(opts, :url_scrubber, :url)
+      url_scrubber: resolve_scrubber(opts, :url_scrubber, :url),
+      private_allow_list: Keyword.get(opts, :private_allow_list, @default_private_allow_list)
     }
   end
 
@@ -468,6 +532,8 @@ defmodule Sentry.Scrubber do
   #     params-shaped map, leaving `%Plug.Conn.Unfetched{}` untouched
   #   * `:query_string` — redacts sensitive params from THIS field (a raw query
   #     string) via `scrub_query_string/1`
+  #   * `:private_allow_list` — keeps only the registered allow-listed keys of
+  #     THIS field (a map), dropping everything else
   defp scrub_conn_field(conn, _field, scrubber_key) when scrubber_key in @scrubber_names,
     do: get(scrubber_key).(conn)
 
@@ -479,6 +545,9 @@ defmodule Sentry.Scrubber do
   defp scrub_conn_field(conn, field, :query_string),
     do: scrub_query_string(Map.fetch!(conn, field))
 
+  defp scrub_conn_field(conn, field, :private_allow_list),
+    do: Map.take(Map.fetch!(conn, field), scrubber().private_allow_list)
+
   # Scrubs a params-shaped value with the default sensitive keys, leaving
   # `%Plug.Conn.Unfetched{}` (and any non-plain-map) untouched. Shared by the
   # `:body` default clause and the `:params` strategy.

test/plug_capture_test.exs

@@ -213,6 +213,37 @@ defmodule Sentry.PlugCaptureTest do
       refute arg2 =~ "secret", "non-conn params arg leaked into exception value: #{arg2}"
     end
 
+    test "retains allow-listed conn.private metadata when scrubbing ActionClauseError" do
+      # The embedded conn's :private map is reduced to the allow-list: Phoenix
+      # routing metadata is high-signal for triage and must survive, while
+      # non-allow-listed entries (e.g. the per-router pipeline key) are dropped.
+      assert_raise Phoenix.ActionClauseError, fn ->
+        conn(:get, "/action_clause_error?password=secret")
+        |> call_phoenix_endpoint()
+      end
+
+      event =
+        assert_sentry_report(:event,
+          culprit: "Sentry.PlugCaptureTest.PhoenixController.action_clause_error/2"
+        )
+
+      assert [exception] = event.exception
+
+      # Sensitive data is still scrubbed (proves the scrubber ran)...
+      assert exception.value =~ ~s(params: %{"password" => "*********"})
+
+      # ...routing metadata in the allow-list survives...
+      assert exception.value =~ "phoenix_controller"
+      assert exception.value =~ "Sentry.PlugCaptureTest.PhoenixController"
+      assert exception.value =~ "phoenix_action"
+      assert exception.value =~ ":action_clause_error"
+
+      # ...but non-allow-listed private entries are dropped. Phoenix stores a
+      # per-router pipeline list under the router module key; it is not in the
+      # allow-list, so it must not appear in the reported conn.
+      refute exception.value =~ "Sentry.PlugCaptureTest.PhoenixRouter => []"
+    end
+
     test "scrubs Phoenix.ActionClauseError using PlugContext-configured body_scrubber" do
       Application.put_env(:sentry, PhoenixEndpointWithCustomPlugContext,
         render_errors: [view: Sentry.ErrorView, accepts: ~w(html)]

test/sentry/config_test.exs

@@ -122,6 +122,20 @@ defmodule Sentry.ConfigTest do
       end
     end
 
+    test ":scrubber :conn_private_allow_list" do
+      assert Config.validate!([])[:scrubber][:conn_private_allow_list] ==
+               Sentry.Scrubber.default_private_allow_list()
+
+      config = [scrubber: [conn_private_allow_list: [:phoenix_action, :my_custom_key]]]
+
+      assert Config.validate!(config)[:scrubber][:conn_private_allow_list] ==
+               [:phoenix_action, :my_custom_key]
+
+      assert_raise ArgumentError, ~r/invalid list in :conn_private_allow_list/, fn ->
+        Config.validate!(scrubber: [conn_private_allow_list: ["not_an_atom"]])
+      end
+    end
+
     # TODO: remove me on v11.0.0. :included_environments has been deprecated in v10.0.0.
     test ":included_environments" do
       output =

test/sentry/plug_context_test.exs

@@ -225,6 +225,24 @@ defmodule Sentry.PlugContextTest do
 
       assert scrubbed.params == %{"foo" => "kept"}
     end
+
+    test "registers the configured scrubber :conn_private_allow_list", %{conn: conn} do
+      Sentry.Test.Config.put(scrubber: [conn_private_allow_list: [:phoenix_action]])
+
+      call(conn, [])
+
+      # call/2 read the config value and registered it, so the :private_allow_list
+      # strategy now retains only the configured key.
+      scrubbed =
+        Sentry.Scrubber.scrub(
+          %Plug.Conn{
+            private: %{phoenix_action: :show, phoenix_controller: SomeApp.PageController}
+          },
+          private: :private_allow_list
+        )
+
+      assert scrubbed.private == %{phoenix_action: :show}
+    end
   end
 
   defp call(conn, opts) do