fix(v10/core): Apply dataCollection.urlQueryParams to collected URLs and query strings (#24572)

Backport of: #23060, #23061, #23143, and the URL-query part of #22853

`dataCollection.urlQueryParams` shipped on v10, but it was never wired
to the URL fields, so `request.url`, `request.query_string`, `url.full`,
`url.query` and their legacy aliases were sent unfiltered. The wiring
only landed on `develop`, after the v10 branch was cut.

## Differences to the original PRs

- #22853: only the `requestdata.ts` query-string filtering and the
`filterQueryParams` rewrite it depends on are included. The v11 default
changes, the `include` resolution rewrite, event cookie/header
filtering, the browser `httpclient` changes and the MIGRATION notes are
left out, as they are breaking or out of scope.
- v10 attribute names are kept. Where develop writes `url.full` /
`url.query`, v10 still writes `http.url`, `http.query`, `http.target`
and `url`; these are now filtered instead of renamed. Tests assert on
the v10 names.
- `filterCollectedUrlQuery` preserves a leading `?`, because v10 records
`URL.search` verbatim in `http.query` / `url.query`.
- Legacy duplicates outside the original diff are filtered too
(`http.url` in the core and node-core http server spans, core fetch,
browser fetch/XHR).
- `google-cloud-http`: only the span-name query stripping is kept; v10
never set `url.full` there.
- `nitro`: unchanged, since `getHttpSpanDetailsFromUrlObject` already
falls back to `getClient()`.
- The undici breadcrumb test lives in `node-core`, where that code sits
on v10.
- Extra commit for sites that no longer exist on develop: Next.js
pages/edge `wrapApiHandlerWithSentry`, Remix `http.url` (tracing channel
and vendored instrumentation), and Ember `url.full`.

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

Author: chargome

.size-limit.js

@@ -480,7 +480,7 @@ module.exports = [
     ignore: [...builtinModules, ...nodePrefixedBuiltinModules],
     gzip: false,
     brotli: false,
-    limit: '490 KiB',
+    limit: '492 KiB',
     disablePlugins: ['@size-limit/webpack'],
     webpack: false,
     modifyEsbuildConfig: function (config) {

dev-packages/node-integration-tests/suites/express/tracing/withError/test.ts

@@ -26,5 +26,21 @@ describe('express tracing with error', () => {
       runner.makeRequest('get', '/test/123/abc?q=1');
       await runner.completed();
     });
+
+    test('preserves encoded query parameters while filtering sensitive values on events', async () => {
+      const runner = createRunner()
+        .ignore('transaction')
+        .expect({
+          event: {
+            request: {
+              query_string: 'q=hello%20world&token=[Filtered]',
+            },
+          },
+        })
+        .start();
+
+      await runner.makeRequest('get', '/test/123/abc?q=hello%20world&token=secret');
+      await runner.completed();
+    });
   });
 });

packages/angular/src/tracing.ts

@@ -22,7 +22,13 @@ import {
   getAbsoluteUrl,
 } from '@sentry/browser';
 import type { Integration, Span } from '@sentry/core';
-import { debug, parseStringToURLObject, stripUrlQueryAndFragment, timestampInSeconds } from '@sentry/core';
+import {
+  debug,
+  parseStringToURLObject,
+  stripUrlQueryAndFragment,
+  timestampInSeconds,
+  filterCollectedUrl,
+} from '@sentry/core';
 import type { Observable } from 'rxjs';
 import { Subscription } from 'rxjs';
 import { filter, tap } from 'rxjs/operators';
@@ -71,7 +77,7 @@ export function _updateSpanAttributesForParametrizedUrl(route: string, url: stri
     span.setAttributes({
       [SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN]: `auto.${op}.angular`,
       [SEMANTIC_ATTRIBUTE_SENTRY_SOURCE]: 'route',
-      [URL_FULL]: absoluteUrl,
+      [URL_FULL]: filterCollectedUrl(absoluteUrl),
       [URL_PATH]: parseStringToURLObject(absoluteUrl)?.pathname,
       [URL_TEMPLATE]: route,
     });

packages/astro/src/server/middleware.ts

@@ -11,6 +11,8 @@ import {
   spanToJSON,
   stripUrlQueryAndFragment,
   winterCGRequestToRequestData,
+  filterCollectedUrl,
+  filterCollectedUrlQuery,
 } from '@sentry/core';
 import {
   captureException,
@@ -219,7 +221,7 @@ async function instrumentRequestStartHttpServerSpan(
             [SEMANTIC_ATTRIBUTE_HTTP_REQUEST_METHOD]: method,
             // This is here for backwards compatibility, we used to set this here before
             method,
-            [URL_FULL]: ctx.url.href,
+            [URL_FULL]: filterCollectedUrl(ctx.url.href),
             [URL_PATH]: ctx.url.pathname,
             url: stripUrlQueryAndFragment(ctx.url.href),
             ...httpHeadersToSpanAttributes(
@@ -233,7 +235,7 @@ async function instrumentRequestStartHttpServerSpan(
           }
 
           if (ctx.url.search) {
-            attributes['http.query'] = ctx.url.search;
+            attributes['http.query'] = filterCollectedUrlQuery(ctx.url.search);
           }
 
           if (ctx.url.hash) {

packages/aws-serverless/src/requestSpanOptions.ts

@@ -18,7 +18,7 @@
  */
 import { CLOUD_ACCOUNT_ID, FAAS_COLDSTART, URL_FULL } from '@sentry/conventions/attributes';
 import type { SpanAttributes, StartSpanOptions } from '@sentry/core';
-import { SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN, SPAN_KIND } from '@sentry/core';
+import { SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN, SPAN_KIND, filterCollectedUrl } from '@sentry/core';
 import type { Context } from 'aws-lambda';
 import { ATTR_FAAS_EXECUTION, ATTR_FAAS_ID } from './semconv';
 
@@ -62,7 +62,7 @@ function extractOtherEventFields(event: unknown): SpanAttributes {
   const answer: SpanAttributes = {};
   const fullUrl = extractFullUrl(event as ApiGatewayLikeEvent);
   if (fullUrl) {
-    answer[URL_FULL] = fullUrl;
+    answer[URL_FULL] = filterCollectedUrl(fullUrl);
   }
   return answer;
 }

packages/browser-utils/src/metrics/browserMetrics.ts

@@ -11,6 +11,7 @@ import {
   setMeasurement,
   spanToJSON,
   stringMatchesSomePattern,
+  filterCollectedUrl,
 } from '@sentry/core';
 import { htmlTreeAsString } from '../htmlTreeAsString';
 import { WINDOW } from '../types';
@@ -775,7 +776,7 @@ export function _addResourceSpans(
 
   attributes['url.same_origin'] = resourceUrl.includes(WINDOW.location.origin);
 
-  attributes[URL_FULL] = resourceUrl;
+  attributes[URL_FULL] = filterCollectedUrl(resourceUrl);
 
   _setResourceRequestAttributes(entry, attributes, [
     // https://developer.mozilla.org/en-US/docs/Web/API/PerformanceResourceTiming/responseStatus

packages/browser/src/integrations/fetchStreamPerformance.ts

@@ -9,6 +9,7 @@ import {
   SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,
   startInactiveSpan,
   stripDataUrlContent,
+  filterCollectedUrl,
 } from '@sentry/core';
 
 const responseToStreamSpan = new WeakMap<object, Span>();
@@ -80,7 +81,7 @@ export const fetchStreamPerformanceIntegration = defineIntegration(() => {
             name: `${method} ${sanitizedUrl}`,
             startTime: handlerData.endTimestamp,
             attributes: {
-              url: stripDataUrlContent(url),
+              url: filterCollectedUrl(stripDataUrlContent(url)),
               'http.method': method,
               type: 'fetch',
               [SEMANTIC_ATTRIBUTE_SENTRY_OP]: 'http.client.stream',

packages/browser/src/integrations/httpcontext.ts

@@ -1,4 +1,4 @@
-import { defineIntegration, safeSetSpanJSONAttributes } from '@sentry/core/browser';
+import { defineIntegration, filterCollectedUrl, safeSetSpanJSONAttributes } from '@sentry/core/browser';
 import { getHttpRequestData, WINDOW } from '../helpers';
 import { HTTP_REQUEST_HEADER_KEY_BASE, SENTRY_OP, URL_FULL, USER_AGENT_ORIGINAL } from '@sentry/conventions/attributes';
 
@@ -45,7 +45,7 @@ export const httpContextIntegration = defineIntegration(() => {
         ...(span.is_segment && {
           // Coerce empty string to undefined so the helper's nullish check drops it,
           // rather than writing an empty `url.full` attribute onto the span.
-          [URL_FULL]: span.attributes?.[SENTRY_OP] !== 'http.client' ? reqData.url : undefined,
+          [URL_FULL]: span.attributes?.[SENTRY_OP] !== 'http.client' ? filterCollectedUrl(reqData.url) : undefined,
           [`${HTTP_REQUEST_HEADER_KEY_BASE}.referer`]: reqData.headers['Referer'],
         }),
       });

packages/browser/src/tracing/browserTracingIntegration.ts

@@ -45,6 +45,7 @@ import {
   startTrackingLongTasks,
 } from '@sentry/browser-utils';
 import { DEBUG_BUILD } from '../debug-build';
+import { filterCollectedUrl } from '@sentry/core';
 import { getHttpRequestData, WINDOW } from '../helpers';
 import { fetchStreamPerformanceIntegration } from '../integrations/fetchStreamPerformance';
 import { WEB_VITALS_INTEGRATION_NAME, webVitalsIntegration } from '../integrations/webVitals';
@@ -431,7 +432,7 @@ export const browserTracingIntegration = ((options: Partial<BrowserTracingOption
 
     const attributes = {
       ...(urlObject?.pathname && { [URL_PATH]: urlObject.pathname }),
-      ...(urlObject && !isURLObjectRelative(urlObject) && { [URL_FULL]: urlObject.href }),
+      ...(urlObject && !isURLObjectRelative(urlObject) && { [URL_FULL]: filterCollectedUrl(urlObject.href) }),
       ...finalStartSpanOptions.attributes,
     };
 

packages/browser/src/tracing/request.ts

@@ -10,6 +10,8 @@ import type {
 } from '@sentry/core/browser';
 import {
   addFetchInstrumentationHandler,
+  filterCollectedUrl,
+  filterCollectedUrlQuery,
   getActiveSpan,
   getClient,
   getLocationHref,
@@ -174,10 +176,10 @@ export function instrumentOutgoingRequests(client: Client, _options?: Partial<Re
         const sanitizedFullUrl = fullUrl ? stripDataUrlContent(fullUrl) : undefined;
         createdSpan.setAttributes({
           // oxlint-disable-next-line typescript/no-deprecated
-          [HTTP_URL]: sanitizedFullUrl,
+          [HTTP_URL]: filterCollectedUrl(sanitizedFullUrl),
           // `url.full` must match `http.url`. Setting it here ensures parentless `http.client`
           // segment spans don't get `url.full` backfilled with the host page URL (see httpContextIntegration).
-          [URL_FULL]: sanitizedFullUrl,
+          [URL_FULL]: filterCollectedUrl(sanitizedFullUrl),
           'server.address': host,
         });
 
@@ -389,17 +391,17 @@ function xhrCallback(
       ? startInactiveSpan({
           name: `${method} ${urlForSpanName}`,
           attributes: {
-            url: stripDataUrlContent(url),
+            url: filterCollectedUrl(stripDataUrlContent(url)),
             type: 'xhr',
             'http.method': method,
-            'http.url': sanitizedFullUrl,
+            'http.url': filterCollectedUrl(sanitizedFullUrl),
             // `url.full` must match `http.url`. Setting it here ensures parentless `http.client`
             // segment spans don't get `url.full` backfilled with the host page URL (see httpContextIntegration).
-            [URL_FULL]: sanitizedFullUrl,
+            [URL_FULL]: filterCollectedUrl(sanitizedFullUrl),
             'server.address': parsedUrl?.host,
             [SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN]: 'auto.http.browser',
             [SEMANTIC_ATTRIBUTE_SENTRY_OP]: 'http.client',
-            ...(parsedUrl?.search && { 'http.query': parsedUrl?.search }),
+            ...(parsedUrl?.search && { 'http.query': filterCollectedUrlQuery(parsedUrl?.search) }),
             ...(parsedUrl?.hash && { 'http.fragment': parsedUrl?.hash }),
           },
         })