fix(nextjs): Filter the query of the document URL on the pageload request data

The pageload wrote the raw document URL into `normalizedRequest`, so the
`dataCollection.urlQueryParams` denylist no longer applied to `request.url` of
any App Router pageload. The URL is now filtered once, when it is captured.

Author: s1gr1d

packages/nextjs/src/client/routing/appRouterRoutingInstrumentation.ts

@@ -136,7 +136,7 @@ function startPageloadSpan(
 
 /** Instruments the Next.js app router for pageloads. */
 export function appRouterInstrumentPageLoad(client: Client): void {
-  const documentUrl = WINDOW.location.href;
+  const documentUrl = filterCollectedUrl(WINDOW.location.href, client);
   const pathname = stripTrailingSlash(WINDOW.location.pathname);
   const parameterizedPathname = resolveCurrentRoute(client);
   const spanOptions: StartSpanOptions = {
@@ -148,7 +148,7 @@ export function appRouterInstrumentPageLoad(client: Client): void {
       [SENTRY_ORIGIN]: 'auto.pageload.nextjs.app_router_instrumentation',
       [SENTRY_SEGMENT_NAME_SOURCE]: parameterizedPathname ? 'route' : 'url',
       [URL_PATH]: WINDOW.location.pathname,
-      [URL_FULL]: filterCollectedUrl(documentUrl, client),
+      [URL_FULL]: documentUrl,
       ...(parameterizedPathname && { [URL_TEMPLATE]: parameterizedPathname }),
     },
   };

packages/nextjs/test/client/appRouterRoutingInstrumentation.test.ts

@@ -315,4 +315,24 @@ describe('appRouterInstrumentPageLoad', () => {
       'http://localhost:3000/navigation?from=document',
     );
   });
+
+  // `settlePendingPageloadWait` is a no-op when the pageload did not wait, so both cases run the same steps.
+  it.each([
+    { start: 'at once', cacheComponents: 'false' },
+    { start: 'after the wait', cacheComponents: 'true' },
+  ])(
+    'filters sensitive query parameters from the document URL of a pageload that starts $start',
+    async ({ cacheComponents }) => {
+      vi.stubEnv('_sentryCacheComponents', cacheComponents);
+      window.history.replaceState({}, '', '/navigation?token=2c4f9e1b&from=document');
+      const { core, instrumentation } = await setup('static');
+
+      instrumentation.appRouterInstrumentPageLoad(core.getClient()!);
+      instrumentation.settlePendingPageloadWait();
+
+      const filteredUrl = 'http://localhost:3000/navigation?token=[Filtered]&from=document';
+      expect(core.spanToJSON(core.getActiveSpan()!).attributes?.[URL_FULL]).toBe(filteredUrl);
+      expect(core.getCurrentScope().getScopeData().sdkProcessingMetadata.normalizedRequest?.url).toBe(filteredUrl);
+    },
+  );
 });