fix(stdlib): Move get_aws_sigv4_signed_headers to sentry_sdk.utils + support for SigV4 query/presigned authentication

Refs: #7031 & PY-2667

Author: pabloDeputter

sentry_sdk/integrations/stdlib.py

@@ -21,6 +21,7 @@
     SENSITIVE_DATA_SUBSTITUTE,
     capture_internal_exceptions,
     ensure_integration_enabled,
+    get_aws_sigv4_signed_headers,
     is_sentry_url,
     logger,
     parse_url,
@@ -61,30 +62,6 @@ def add_python_runtime_context(
             return event
 
 
-def _aws_sigv4_signed_headers(buffer: "Optional[List[bytes]]") -> "Set[str]":
-    if buffer is None:
-        return set()
-    for line in buffer:
-        name, separator, value = line.partition(b":")
-        if not separator or name.lower() != b"authorization":
-            continue
-
-        value = value.lstrip()
-        if not value.startswith((b"AWS4-HMAC-SHA256", b"AWS4-ECDSA-P256-SHA256")):
-            continue
-
-        for part in value.split(b","):
-            part = part.strip()
-            if part.startswith(b"SignedHeaders="):
-                _, _, header_names = part.partition(b"=")
-                return {
-                    header.decode("ascii", "ignore").lower()
-                    for header in header_names.split(b";")
-                    if header
-                }
-    return set()
-
-
 def _request_header_names(buffer: "Optional[List[bytes]]") -> "Set[str]":
     if buffer is None:
         return set()
@@ -216,7 +193,7 @@ def endheaders(self: "HTTPConnection", *args: "Any", **kwargs: "Any") -> "Any":
             if real_url is not None:
                 request_buffer = getattr(self, "_buffer", None)
                 existing_headers = _request_header_names(request_buffer)
-                signed_headers = _aws_sigv4_signed_headers(request_buffer)
+                signed_headers = get_aws_sigv4_signed_headers(request_buffer, real_url)
 
                 for (
                     header_name,

sentry_sdk/utils.py

@@ -1697,6 +1697,60 @@ def parse_url(url: str, sanitize: bool = True) -> "ParsedUrl":
     )
 
 
+def get_aws_sigv4_signed_headers(
+    headers: "Any", url: "Optional[str]" = None
+) -> "Set[str]":
+    # httpConnection exposes buffer, aiohttp uses header mapping.
+    if isinstance(headers, (str, bytes)):
+        authorization = headers
+    elif headers is None:
+        authorization = ""
+    elif hasattr(headers, "get"):
+        authorization = headers.get("Authorization", "")
+    else:
+        authorization = ""
+        for line in headers:
+            name, separator, value = line.partition(b":")
+            if separator and name.lower() == b"authorization":
+                authorization = value
+                break
+
+    if isinstance(authorization, bytes):
+        authorization = authorization.decode("ascii", "ignore")
+
+    signed_headers = set()
+    if isinstance(authorization, str):
+        # only AWS SigV4 authorization has the SignedHeaders parameter.
+        value = authorization.lstrip()
+        if value.startswith(("AWS4-HMAC-SHA256", "AWS4-ECDSA-P256-SHA256")):
+            for part in value.split(","):
+                part = part.strip()
+                if part.startswith("SignedHeaders="):
+                    _, _, header_names = part.partition("=")
+                    signed_headers.update(
+                        header.lower() for header in header_names.split(";") if header
+                    )
+                    break
+
+    if url is None:
+        return signed_headers
+
+    query = {
+        key.lower(): values for key, values in parse_qs(urlsplit(url).query).items()
+    }
+    algorithm = query.get("x-amz-algorithm", [""])[0]
+    if algorithm not in ("AWS4-HMAC-SHA256", "AWS4-ECDSA-P256-SHA256"):
+        return signed_headers
+
+    # presigned requests have SignedHeaders in the URL query.
+    signed_headers.update(
+        header.lower()
+        for header in query.get("x-amz-signedheaders", [""])[0].split(";")
+        if header
+    )
+    return signed_headers
+
+
 def is_valid_sample_rate(rate: "Any", source: str) -> bool:
     """
     Checks the given sample rate to make sure it is valid type and value (a