|
16 | 16 | ### Features |
17 | 17 |
|
18 | 18 | - Add `LocalSentrySpan` to `sentry-compose` so apps can provide a parent `ISpan` to a composable subtree and have nested `SentryTraced` spans attach to it ([#6112]https://github.com/getsentry/sentry-java/pull/6112) |
19 | | -- Add `dataCollection`, a fine-grained replacement for `sendDefaultPii`, for controlling data collected automatically by SDK integrations ([#5759](https://github.com/getsentry/sentry-java/pull/5759)) |
| 19 | +- Add `dataCollection`, a fine-grained replacement for `sendDefaultPii`, for controlling data collected automatically by SDK integrations. See the Data Collection documentation for [Android](https://docs.sentry.io/platforms/android/configuration/options/#dataCollection), [Java](https://docs.sentry.io/platforms/java/configuration/options/#dataCollection), and [Spring Boot](https://docs.sentry.io/platforms/java/guides/spring-boot/configuration/options/#dataCollection) ([#5759](https://github.com/getsentry/sentry-java/pull/5759)) |
20 | 20 |
|
21 | 21 | > [!WARNING] |
22 | 22 | > `sendDefaultPii` will be removed in the next major SDK version. Migrate to `dataCollection` before upgrading. |
23 | 23 |
|
24 | | - - Until then, when `dataCollection` is not configured, the SDK preserves the existing `sendDefaultPii` behavior. |
25 | | - - Configuring any `dataCollection` option makes it the source of truth. `sendDefaultPii` is then ignored, and omitted `dataCollection` options use the defaults below. |
26 | | - - The Logback appender is a compatibility exception. When an encoder is configured, `sendDefaultPii=true` continues to include the original message template and parameters. To opt in independently of `sendDefaultPii`, set `<includeUnencodedMessage>true</includeUnencodedMessage>` on the Sentry appender in `logback.xml` or `logback-spring.xml`. |
27 | | - - Data explicitly supplied through APIs such as `Sentry.setUser`, scopes, event processors, or `beforeSend` is not affected. |
28 | | - |
29 | | - To opt in to the documented `dataCollection` defaults without configuring an individual option: |
30 | | - |
31 | | - ```java |
32 | | - Sentry.init(options -> options.getDataCollection().forceDataCollection()); |
33 | | - ``` |
34 | | - |
35 | | - | Option | Default | Behavior | |
36 | | - | --- | --- | --- | |
37 | | - | `userInfo` | `true` | Allows integrations to populate user identity and IP address information automatically. | |
38 | | - | `cookies` | `{ mode: DENY_LIST, terms: [] }` | Collects cookies while filtering sensitive values. | |
39 | | - | `httpHeaders.request` | `{ mode: DENY_LIST, terms: [] }` | Collects request headers while filtering sensitive values. | |
40 | | - | `httpHeaders.response` | `{ mode: DENY_LIST, terms: [] }` | Collects response headers while filtering sensitive values. | |
41 | | - | `httpBodies` | All supported body types | Collects supported incoming and outgoing request and response bodies. An empty set disables body collection. | |
42 | | - | `urlQueryParams` | `{ mode: DENY_LIST, terms: [] }` | Collects URL query parameters while filtering sensitive values. | |
43 | | - | `graphql.document` | `true` | Collects GraphQL documents. | |
44 | | - | `graphql.variables` | `true` | Collects GraphQL variables. | |
45 | | - | `databaseQueryData` | `true` | Allows collection of associated query data, such as bound parameters, write payloads, and results, where supported. Sanitized query statements and structural database metadata remain available. | |
46 | | - | `filePaths` | `true` | Allows file-system instrumentation to collect file and directory paths. File extensions and byte counts remain available when disabled. | |
47 | | - |
48 | | - Cookies, HTTP headers, and URL query parameters support three modes: |
49 | | - |
50 | | - - `OFF`: Do not collect the category. |
51 | | - - `DENY_LIST`: Collect values except those matching the built-in sensitive deny-list or additional configured terms. |
52 | | - - `ALLOW_LIST`: Only send plaintext values for matching terms. The built-in sensitive deny-list still applies. |
53 | | - |
54 | | - Matching is case-insensitive and partial. The built-in sensitive deny-list contains `auth`, `token`, `secret`, `password`, `passwd`, `pwd`, `key`, `jwt`, `bearer`, `sso`, `saml`, `csrf`, `xsrf`, `credentials`, `session`, `sid`, and `identity`. Filtered values are replaced with `"[Filtered]"`. Custom deny-list terms extend rather than replace this list. |
55 | | - |
56 | | - Configure all HTTP body types, a custom cookie deny-list, a request-header allow-list, and disable URL query parameter and file path collection in an options callback: |
57 | | - |
58 | | - ```java |
59 | | - Sentry.init( |
60 | | - options -> { |
61 | | - options |
62 | | - .getDataCollection() |
63 | | - .setHttpBodies( |
64 | | - EnumSet.of( |
65 | | - HttpBodyType.INCOMING_REQUEST, |
66 | | - HttpBodyType.OUTGOING_REQUEST, |
67 | | - HttpBodyType.INCOMING_RESPONSE, |
68 | | - HttpBodyType.OUTGOING_RESPONSE)); |
69 | | - options |
70 | | - .getDataCollection() |
71 | | - .setCookies( |
72 | | - KeyValueCollectionBehavior.denyList( |
73 | | - "forwarded", "-ip", "remote-", "via", "-user")); |
74 | | - options |
75 | | - .getDataCollection() |
76 | | - .getHttpHeaders() |
77 | | - .setRequest( |
78 | | - KeyValueCollectionBehavior.allowList("content-type", "x-request-id")); |
79 | | - options |
80 | | - .getDataCollection() |
81 | | - .setUrlQueryParams(KeyValueCollectionBehavior.off()); |
82 | | - options.getDataCollection().setFilePaths(false); |
83 | | - }); |
84 | | - ``` |
85 | | - |
86 | | - Configure the same options in `sentry.properties`: |
87 | | - |
88 | | - ```properties |
89 | | - data-collection.http-bodies=incoming_request,outgoing_request,incoming_response,outgoing_response |
90 | | - data-collection.cookies.mode=deny_list |
91 | | - data-collection.cookies.terms=forwarded,-ip,remote-,via,-user |
92 | | - data-collection.http-headers.request.mode=allow_list |
93 | | - data-collection.http-headers.request.terms=content-type,x-request-id |
94 | | - data-collection.url-query-params.mode=off |
95 | | - data-collection.file-paths=false |
96 | | - ``` |
97 | | - |
98 | | - Configure them with Spring Boot properties: |
99 | | - |
100 | | - ```properties |
101 | | - sentry.data-collection.http-bodies=incoming-request,outgoing-request,incoming-response,outgoing-response |
102 | | - sentry.data-collection.cookies.mode=deny-list |
103 | | - sentry.data-collection.cookies.terms=forwarded,-ip,remote-,via,-user |
104 | | - sentry.data-collection.http-headers.request.mode=allow-list |
105 | | - sentry.data-collection.http-headers.request.terms=content-type,x-request-id |
106 | | - sentry.data-collection.url-query-params.mode=off |
107 | | - sentry.data-collection.file-paths=false |
108 | | - ``` |
109 | | - |
110 | | - Configure them in `AndroidManifest.xml`: |
111 | | - |
112 | | - ```xml |
113 | | - <meta-data |
114 | | - android:name="io.sentry.data-collection.http-bodies" |
115 | | - android:value="incoming_request,outgoing_request,incoming_response,outgoing_response" /> |
116 | | - <meta-data |
117 | | - android:name="io.sentry.data-collection.cookies.mode" |
118 | | - android:value="deny_list" /> |
119 | | - <meta-data |
120 | | - android:name="io.sentry.data-collection.cookies.terms" |
121 | | - android:value="forwarded,-ip,remote-,via,-user" /> |
122 | | - <meta-data |
123 | | - android:name="io.sentry.data-collection.http-headers.request.mode" |
124 | | - android:value="allow_list" /> |
125 | | - <meta-data |
126 | | - android:name="io.sentry.data-collection.http-headers.request.terms" |
127 | | - android:value="content-type,x-request-id" /> |
128 | | - <meta-data |
129 | | - android:name="io.sentry.data-collection.url-query-params.mode" |
130 | | - android:value="off" /> |
131 | | - <meta-data |
132 | | - android:name="io.sentry.data-collection.file-paths" |
133 | | - android:value="false" /> |
134 | | - ``` |
135 | | - |
136 | | - See the [Data Collection documentation](https://docs.sentry.io/platforms/java/configuration/options/#dataCollection) for all configuration keys, supported integrations, and migration guidance. |
137 | | - |
138 | 24 | ### Fixes |
139 | 25 |
|
140 | 26 | - Disable URL caching when reading `META-INF/MANIFEST.MF` files during version detection so that the SDK no longer keeps jar file handles open for the life of the process ([#6124](https://github.com/getsentry/sentry-java/pull/6124) |
|
0 commit comments