ref(security): Stop accepting Expect-CT, HPKP, and Expect-Staple reports

CHANGELOG.md

@@ -54,6 +54,7 @@
 - Retry 500 responses from objectstore. ([#6162](https://github.com/getsentry/relay/pull/6162))
 - Remove the `metrics_extracted` and `spans_extracted` flags from the transactions processing pipeline. ([#6190](https://github.com/getsentry/relay/pull/6190), [#6200](https://github.com/getsentry/relay/pull/6200))
 - Convert TUS uploads to Objectstore multipart uploads. ([#6172](https://github.com/getsentry/relay/pull/6172))
+- Stop accepting the deprecated Expect-CT, HPKP, and Expect-Staple security reports. ([#6230](https://github.com/getsentry/relay/pull/6230))
 
 ## 26.6.0
 

relay-event-schema/src/protocol/security_report.rs

@@ -1155,9 +1155,6 @@ impl ExpectStaple {
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub enum SecurityReportType {
     Csp,
-    ExpectCt,
-    ExpectStaple,
-    Hpkp,
     Unsupported,
 }
 
@@ -1173,9 +1170,6 @@ impl SecurityReportType {
             #[serde(rename = "type")]
             ty: Option<CspViolationType>,
             csp_report: Option<IgnoredAny>,
-            known_pins: Option<IgnoredAny>,
-            expect_staple_report: Option<IgnoredAny>,
-            expect_ct_report: Option<IgnoredAny>,
         }
 
         let helper: SecurityReport = serde_json::from_slice(data)?;
@@ -1186,12 +1180,6 @@ impl SecurityReportType {
             Some(SecurityReportType::Csp)
         } else if let Some(CspViolationType::Other) = helper.ty {
             Some(SecurityReportType::Unsupported)
-        } else if helper.known_pins.is_some() {
-            Some(SecurityReportType::Hpkp)
-        } else if helper.expect_staple_report.is_some() {
-            Some(SecurityReportType::ExpectStaple)
-        } else if helper.expect_ct_report.is_some() {
-            Some(SecurityReportType::ExpectCt)
         } else {
             None
         })
@@ -2030,7 +2018,8 @@ mod tests {
     }
 
     #[test]
-    fn test_security_report_type_deserializer_recognizes_expect_ct_reports() {
+    fn test_security_report_type_deserializer_rejects_expect_ct_reports() {
+        // Expect-CT is no longer a supported report type: the classifier must not recognize it.
         let expect_ct_report_text = r#"{
             "expect-ct-report": {
                 "date-time": "2014-04-06T13:00:50Z",
@@ -2055,11 +2044,12 @@ mod tests {
         }"#;
 
         let report_type = SecurityReportType::from_json(expect_ct_report_text.as_bytes()).unwrap();
-        assert_eq!(report_type, Some(SecurityReportType::ExpectCt));
+        assert_eq!(report_type, None);
     }
 
     #[test]
-    fn test_security_report_type_deserializer_recognizes_expect_staple_reports() {
+    fn test_security_report_type_deserializer_rejects_expect_staple_reports() {
+        // Expect-Staple is no longer a supported report type: the classifier must not recognize it.
         let expect_staple_report_text = r#"{
              "expect-staple-report": {
                 "date-time": "2014-04-06T13:00:50Z",
@@ -2074,11 +2064,12 @@ mod tests {
         }"#;
         let report_type =
             SecurityReportType::from_json(expect_staple_report_text.as_bytes()).unwrap();
-        assert_eq!(report_type, Some(SecurityReportType::ExpectStaple));
+        assert_eq!(report_type, None);
     }
 
     #[test]
-    fn test_security_report_type_deserializer_recognizes_hpkp_reports() {
+    fn test_security_report_type_deserializer_rejects_hpkp_reports() {
+        // HPKP is no longer a supported report type: the classifier must not recognize it.
         let hpkp_report_text = r#"{
             "date-time": "2014-04-06T13:00:50Z",
             "hostname": "www.example.com",
@@ -2098,7 +2089,7 @@ mod tests {
           }"#;
 
         let report_type = SecurityReportType::from_json(hpkp_report_text.as_bytes()).unwrap();
-        assert_eq!(report_type, Some(SecurityReportType::Hpkp));
+        assert_eq!(report_type, None);
     }
 
     #[test]

relay-server/src/endpoints/security_report.rs

@@ -81,9 +81,6 @@ fn is_security_mime(mime: Mime) -> bool {
         (ty, subty, suffix),
         ("application", "json", None)
             | ("application", "csp-report", None)
-            | ("application", "expect-ct-report", None)
-            | ("application", "expect-ct-report", Some("json"))
-            | ("application", "expect-staple-report", None)
             | ("application", "reports", Some("json"))
     )
 }

relay-server/src/processing/errors/errors/raw_security.rs

@@ -1,7 +1,5 @@
 use relay_base_schema::events::EventType;
-use relay_event_schema::protocol::{
-    Csp, Event, ExpectCt, ExpectStaple, Hpkp, LenientString, Metrics, SecurityReportType,
-};
+use relay_event_schema::protocol::{Csp, Event, LenientString, Metrics, SecurityReportType};
 use relay_protocol::Annotated;
 use relay_quotas::DataCategory;
 
@@ -83,15 +81,6 @@ fn event_from_security_report(
 
     let (apply_result, event_type) = match report_type {
         SecurityReportType::Csp => (Csp::apply_to_event(data, &mut event), EventType::Csp),
-        SecurityReportType::ExpectCt => (
-            ExpectCt::apply_to_event(data, &mut event),
-            EventType::ExpectCt,
-        ),
-        SecurityReportType::ExpectStaple => (
-            ExpectStaple::apply_to_event(data, &mut event),
-            EventType::ExpectStaple,
-        ),
-        SecurityReportType::Hpkp => (Hpkp::apply_to_event(data, &mut event), EventType::Hpkp),
         SecurityReportType::Unsupported => return Err(ProcessingError::UnsupportedSecurityType),
     };