docs(okhttp): update sanitizer docs to list all stripped URL components

Author: buongarzoni

rollbar-okhttp/README.md

@@ -37,7 +37,8 @@ dependencies {
 NetworkTelemetryRecorder recorder = new NetworkTelemetryRecorder() {
     @Override
     public void recordNetworkEvent(Level level, String method, String url, String statusCode) {
-        // url has query parameters stripped by default (see Security section below)
+        // url has userinfo, query parameters, and fragment stripped by default
+        // (see Security section below)
         rollbar.recordNetworkEventFor(level, method, url, statusCode);
     }
 
@@ -79,9 +80,9 @@ The interceptor will automatically record telemetry events to Rollbar without in
 
 ## Security
 
-URL query parameters often carry sensitive data such as API keys (`?api_key=...`), OAuth tokens (`?access_token=...`), or PII. To prevent accidental leakage to Rollbar, the interceptor **strips query parameters by default** before passing the URL to `NetworkTelemetryRecorder`.
+URLs can carry sensitive data in several components. To prevent accidental leakage to Rollbar, the interceptor **strips userinfo (basic-auth credentials), query parameters, and the fragment by default** before passing the URL to `NetworkTelemetryRecorder`.
 
-For example, a request to `https://api.example.com/charge?token=sk_live_secret` will be recorded as `https://api.example.com/charge`.
+For example, a request to `https://user:secret@api.example.com/charge?token=sk_live_secret#section` will be recorded as `https://api.example.com/charge`.
 
 If your URLs do not contain sensitive query parameters and you need them for debugging, you can opt in to the full URL by supplying a custom sanitizer:
 

rollbar-okhttp/src/main/java/com/rollbar/okhttp/NetworkTelemetryRecorder.java

@@ -11,8 +11,9 @@ public interface NetworkTelemetryRecorder {
    *
    * @param level      the severity level to attach to the telemetry event
    * @param method     the HTTP method (e.g. GET, POST)
-   * @param url        the request URL with query parameters stripped by default; supply a custom
-   *                   sanitizer to {@link RollbarOkHttpInterceptor} to change this behavior
+   * @param url        the request URL with userinfo (basic-auth credentials), query parameters,
+   *                   and fragment stripped by default; supply a custom sanitizer to
+   *                   {@link RollbarOkHttpInterceptor} to change this behavior
    * @param statusCode the HTTP response status code as a string (e.g. "200", "404")
    */
   void recordNetworkEvent(Level level, String method, String url, String statusCode);