getsentry/sentry-java 8.58.0

on GitHub

Features

• Add LocalSentrySpan to sentry-compose so apps can provide a parent ISpan to a composable subtree and have nested SentryTraced spans attach to it ([#6112]#6112)
• Add dataCollection, a fine-grained replacement for sendDefaultPii, for controlling data collected automatically by SDK integrations (#5759)

• Until then, when dataCollection is not configured, the SDK preserves the existing sendDefaultPii behavior.
• Configuring any dataCollection option makes it the source of truth. sendDefaultPii is then ignored, and omitted dataCollection options use the defaults below.
• The Logback appender is a compatibility exception. When an encoder is configured, sendDefaultPii=true continues to include the original message template and parameters. To opt in independently of sendDefaultPii, set <includeUnencodedMessage>true</includeUnencodedMessage> on the Sentry appender in logback.xml or logback-spring.xml.
• Data explicitly supplied through APIs such as Sentry.setUser, scopes, event processors, or beforeSend is not affected.

To opt in to the documented dataCollection defaults without configuring an individual option:

Sentry.init(options -> options.getDataCollection().forceDataCollection());

Cookies, HTTP headers, and URL query parameters support three modes:

• OFF: Do not collect the category.
• DENY_LIST: Collect values except those matching the built-in sensitive deny-list or additional configured terms.
• ALLOW_LIST: Only send plaintext values for matching terms. The built-in sensitive deny-list still applies.

Matching is case-insensitive and partial. The built-in sensitive deny-list contains auth, token, secret, password, passwd, pwd, key, jwt, bearer, sso, saml, csrf, xsrf, credentials, session, sid, and identity. Filtered values are replaced with "[Filtered]". Custom deny-list terms extend rather than replace this list.

Configure all HTTP body types, a custom cookie deny-list, a request-header allow-list, and disable URL query parameter and file path collection in an options callback:

Sentry.init(
    options -> {
      options
          .getDataCollection()
          .setHttpBodies(
              EnumSet.of(
                  HttpBodyType.INCOMING_REQUEST,
                  HttpBodyType.OUTGOING_REQUEST,
                  HttpBodyType.INCOMING_RESPONSE,
                  HttpBodyType.OUTGOING_RESPONSE));
      options
          .getDataCollection()
          .setCookies(
              KeyValueCollectionBehavior.denyList(
                  "forwarded", "-ip", "remote-", "via", "-user"));
      options
          .getDataCollection()
          .getHttpHeaders()
          .setRequest(
              KeyValueCollectionBehavior.allowList("content-type", "x-request-id"));
      options
          .getDataCollection()
          .setUrlQueryParams(KeyValueCollectionBehavior.off());
      options.getDataCollection().setFilePaths(false);
    });

Configure the same options in sentry.properties:

data-collection.http-bodies=incoming_request,outgoing_request,incoming_response,outgoing_response
data-collection.cookies.mode=deny_list
data-collection.cookies.terms=forwarded,-ip,remote-,via,-user
data-collection.http-headers.request.mode=allow_list
data-collection.http-headers.request.terms=content-type,x-request-id
data-collection.url-query-params.mode=off
data-collection.file-paths=false

Configure them with Spring Boot properties:

sentry.data-collection.http-bodies=incoming-request,outgoing-request,incoming-response,outgoing-response
sentry.data-collection.cookies.mode=deny-list
sentry.data-collection.cookies.terms=forwarded,-ip,remote-,via,-user
sentry.data-collection.http-headers.request.mode=allow-list
sentry.data-collection.http-headers.request.terms=content-type,x-request-id
sentry.data-collection.url-query-params.mode=off
sentry.data-collection.file-paths=false

Configure them in AndroidManifest.xml:

<meta-data
    android:name="io.sentry.data-collection.http-bodies"
    android:value="incoming_request,outgoing_request,incoming_response,outgoing_response" />
<meta-data
    android:name="io.sentry.data-collection.cookies.mode"
    android:value="deny_list" />
<meta-data
    android:name="io.sentry.data-collection.cookies.terms"
    android:value="forwarded,-ip,remote-,via,-user" />
<meta-data
    android:name="io.sentry.data-collection.http-headers.request.mode"
    android:value="allow_list" />
<meta-data
    android:name="io.sentry.data-collection.http-headers.request.terms"
    android:value="content-type,x-request-id" />
<meta-data
    android:name="io.sentry.data-collection.url-query-params.mode"
    android:value="off" />
<meta-data
    android:name="io.sentry.data-collection.file-paths"
    android:value="false" />

See the Data Collection documentation for all configuration keys, supported integrations, and migration guidance.

Fixes

• Disable URL caching when reading META-INF/MANIFEST.MF files during version detection so that the SDK no longer keeps jar file handles open for the life of the process (#6124
• Keep the EventListener wrapped by SentryOkHttpEventListener per Call (#6003)