search

getsentry / sentry

Developer-first error tracking and performance monitoring
https://sentry.io
Other
39.11k stars 4.2k forks source link

Filter sensitive data in exception message #9309

Closed tarzan closed 4 years ago

tarzan commented 6 years ago

I got sensitive data as part of the stacktrace in my app that is not being redacted.

This is a duplicate of #4666 which got closed without any further info of how to manage/fix this. Are you fixing this or have a better solution?

We're running sentry-elixir 6.4.1 on our elixir 1.6.3 app.

benvinegar commented 6 years ago

More detail would be helpful. Where is the PII appearing? Are you sure you have server-side scrubbing enabled?

tarzan commented 6 years ago

I just opened this issue because I wanted to know why the previous issue got closed.

Yes we have server-side scrubbing enabled and got the exception while trying to replay an authentication request on a phoenix app that implements https://github.com/ueberauth/guardian .

The particular exception looked something like:

Elixir.Phoenix.ActionClauseError
could not find a matching DetroitWeb.SessionController.callback clause
to process request. This typically happens when there is a
parameter mismatch but may also happen when any of the other
action arguments do not match. The request parameters are:

  %{"_csrf_token" => "LXZ6JkQAflpaNEUECiE2XD0lSnxcNgAAaFNU4KFmjNrhphE7ra91ow==", "_utf8" => "✓", "provider" => "identity", "session" => %{"email" => "email@example.com", "password" => "password", "rememberme" => "false"}}

Maybe this is now fixed due to https://github.com/getsentry/sentry-elixir/pull/192

BYK commented 4 years ago

I think this might be useful: https://docs.sentry.io/platforms/elixir/data-management/sensitive-data/

Closing this issue due to staleness. Feel free to comment here if you think we should still work on this.