How to disable Sentry from using clipboard data in Android

[ubaidvalere]

Description

My react native app was rejected by Google because sentry send clipboard data to some endpoint. How can I disable this functionality to be able to release my app without rejection.

[markushi]

@ubaidvalere Both our sentry react-native, as well as our sentry-java SDK should never access any clipboard data.

Is it possible you have some code which captures clipboard data and passes it to the Sentry SDK? E.g. by creating a breadcrumb with the clipboard content:

const text = await Clipboard.getString();

Sentry.addBreadcrumb({
  message: text
});

[ubaidvalere]

I am not passing any clipboard text to Sentry, in fact I am not using any function of Sentry instead of init function. However I am using clipboard to get the referral code when user first install the app, but that does not involve Sentry.

[markushi]

@ubaidvalere alright, thanks for letting us know! Does your app perform any web requests? I suspect that referral code (and thus the clipboard data) is being sent there, and one of our automatic integrations picks that up.

Debug mode could probably help you to find the root cause. After enabling it, you should see some detailed logs.

Sentry.init({
  // ...
  debug: true,
});

[ubaidvalere]

I can't find anything helpful in the Sentry log.

Sentry Logger [log]: Integration installed: ModulesLoader LOG Sentry Logger [log]: Unhandled promise rejections will be caught by Sentry. LOG Sentry Logger [log]: Integration installed: ReactNativeErrorHandlers LOG Sentry Logger [log]: Integration installed: Release LOG Sentry Logger [log]: Integration installed: InboundFilters LOG Sentry Logger [log]: Integration installed: FunctionToString LOG Sentry Logger [log]: Integration installed: Breadcrumbs LOG Sentry Logger [log]: Integration installed: Dedupe LOG Sentry Logger [log]: Integration installed: HttpContext LOG Sentry Logger [log]: Integration installed: NativeLinkedErrors LOG Sentry Logger [log]: Integration installed: EventOrigin LOG Sentry Logger [log]: Integration installed: SdkInfo LOG Sentry Logger [log]: Integration installed: ReactNativeInfo LOG Sentry Logger [log]: Integration installed: DebugSymbolicator LOG Sentry Logger [log]: Integration installed: RewriteFrames LOG Sentry Logger [log]: Integration installed: DeviceContext LOG Sentry Logger [log]: [ReactNativeTracing] Native frames instrumentation initialized. LOG Sentry Logger [log]: [ReactNativeTracing] Not instrumenting route changes as routingInstrumentation has not been set. LOG Sentry Logger [log]: Integration installed: ReactNativeTracing LOG Reactotron Configured LOG Running "AthesApp" with {"rootTag":1,"initialProps":{}} LOG Sentry Logger [log]: Setting idle transaction on scope. Span ID: aba264e15a247177 LOG Sentry Logger [log]: [Tracing] starting ui.load transaction - App Start LOG Sentry Logger [log]: Starting heartbeat LOG Sentry Logger [log]: pinging Heartbeat -> current counter: 0 LOG Sentry Logger [log]: [ReactNativeTracing] Starting ui.load transaction "App Start" on scope LOG Sentry Logger [log]: [Tracing] Starting 'app.start.cold' span on transaction 'App Start' (aba264e15a247177). LOG Linking.getInitialURL null LOG Sentry Logger [log]: [Tracing] pushActivity: bea34d10b8f969f2 LOG Sentry Logger [log]: [Tracing] new activities count 1 LOG Sentry Logger [log]: [Tracing] Starting 'http.client' span on transaction 'App Start' (aba264e15a247177). LOG Sentry Logger [log]: [Tracing] pushActivity: 87ed84488936a41c LOG Sentry Logger [log]: [Tracing] new activities count 2 LOG Sentry Logger [log]: [Tracing] Starting 'http.client' span on transaction 'App Start' (aba264e15a247177). LOG Sentry Logger [log]: [Tracing] popActivity 87ed84488936a41c LOG Sentry Logger [log]: [Tracing] new activities count 1 LOG Sentry Logger [log]: [Tracing] popActivity bea34d10b8f969f2 LOG Sentry Logger [log]: [Tracing] new activities count 0 LOG Sentry Logger [log]: [Tracing] pushActivity: 91e528500a893db1 LOG Sentry Logger [log]: [Tracing] new activities count 1 LOG Sentry Logger [log]: [Tracing] Starting 'http.client' span on transaction 'App Start' (aba264e15a247177). LOG Sentry Logger [log]: [Tracing] popActivity 91e528500a893db1 LOG Sentry Logger [log]: [Tracing] new activities count 0 LOG Sentry Logger [log]: [Tracing] finishing IdleTransaction 2024-09-26T14:38:18.606Z ui.load DEBUG Sentry Logger [debug]: Removing AppState listener for ui.load transaction. LOG Sentry Logger [log]: [Tracing] flushing IdleTransaction LOG Sentry Logger [log]: [Measurements] Adding measurements to transaction { "app_start_cold": { "value": 27711.194091796875, "unit": "millisecond" }, "stall_count": { "value": 2, "unit": "none" }, "stall_total_time": { "value": 380.93701171875, "unit": "millisecond" }, "stall_longest_time": { "value": 221.136962890625, "unit": "millisecond" } } LOG Sentry Logger [log]: [Tracing] Finishing ui.load transaction: App Start. LOG Sentry Logger [log]: [Measurements] Adding measurements to ui.load transaction App Start: { "frames_total": { "value": 131, "unit": "none" }, "frames_frozen": { "value": 0, "unit": "none" }, "frames_slow": { "value": 2, "unit": "none" } }

[markushi]

@ubaidvalere did you trigger the code which accesses the clipboard too?

The issue should be highly connected with your app code. Maybe a http request url containing the clipboard data? In any case you can scrub that data by utilizing beforeSend() and beforeSendTransaction(). E.g. you could set a breakpoint within those hooks, and check the event payload to identify the corresponding attributes.

Our docs around data scrubbing show some example code as well.

[romtsn]

@ubaidvalere have you had a chance to debug the events payload?

[ubaidvalere]

Actually I tried resubmitting the build and it was approved. Also I was not able to find anything in the event payload. Closing this ticket now.