feat(data-collection): Port Rails controller and ActiveStorage - #3033
Merged
sl0thentr0py merged 1 commit intoAug 13, 2026
Merged
@sentry/warden / warden: security-review
completed
Aug 13, 2026 in 0s
1 issue
security-review: Found 1 issue (1 medium)
Medium
Nested sensitive request parameters bypass filtering in Rails controller spans - `sentry-rails/lib/sentry/rails/controller_transaction.rb:29-38`
In the default deny-list mode, nested request parameters such as user[password] bypass url_query_params filtering because only the top-level user key is inspected, causing the secret to be included raw in controller span :params and the reconstructed :path sent to Sentry.
⏱ 6m 49s · 2.2M in / 99.7k out · $1.90
Annotations
Check warning on line 38 in sentry-rails/lib/sentry/rails/controller_transaction.rb
sentry-warden / warden: security-review
Nested sensitive request parameters bypass filtering in Rails controller spans
In the default deny-list mode, nested request parameters such as `user[password]` bypass `url_query_params` filtering because only the top-level `user` key is inspected, causing the secret to be included raw in controller span `:params` and the reconstructed `:path` sent to Sentry.
Loading