feat(pii): add data processors that are shared within framework SDKs

src/DataCollection/HttpBodyCollector.php

@@ -0,0 +1,127 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Sentry\DataCollection;
+
+use GuzzleHttp\Psr7\Query;
+use Sentry\Exception\JsonException;
+use Sentry\Options;
+use Sentry\Util\JSON;
+
+/**
+ * Collects bodies already obtained safely by an integration. Never consumes
+ * resources or streams, or invokes application serializers.
+ *
+ * @internal
+ */
+final class HttpBodyCollector
+{
+    public const MAX_BODY_LENGTH = 10 ** 5;
+
+    private const MAX_REQUEST_BODY_SIZE_TO_LENGTH = [
+        'none' => 0,
+        'never' => 0,
+        'small' => 10 ** 3,
+        'medium' => 10 ** 4,
+        'always' => self::MAX_BODY_LENGTH,
+    ];
+
+    private function __construct()
+    {
+    }
+
+    /**
+     * @param 'incomingRequest'|'outgoingRequest'|'incomingResponse'|'outgoingResponse' $bodyType
+     */
+    public static function getMaxBodyLength(Options $options, string $bodyType): int
+    {
+        $dataCollection = $options->getDataCollection();
+        if ($dataCollection === null || !\in_array($bodyType, $dataCollection->getHttpBodies(), true)) {
+            return 0;
+        }
+
+        return $bodyType === 'incomingRequest' || $bodyType === 'outgoingRequest'
+            ? self::MAX_REQUEST_BODY_SIZE_TO_LENGTH[$options->getMaxRequestBodySize()]
+            : self::MAX_BODY_LENGTH;
+    }
+
+    public static function isSupportedContentType(string $contentType): bool
+    {
+        return self::getBodyFormat($contentType) !== null;
+    }
+
+    /**
+     * @return array<array-key, mixed>|null Null means the body is not structured JSON/form data
+     */
+    public static function parse(string $body, string $contentType): ?array
+    {
+        $format = self::getBodyFormat($contentType);
+        if ($format === null) {
+            return null;
+        }
+
+        try {
+            /** @mago-ignore analysis:mixed-assignment */
+            $parsedBody = $format === 'form' ? Query::parse($body) : JSON::decode($body);
+        } catch (JsonException $exception) {
+            return null;
+        }
+
+        return \is_array($parsedBody) ? $parsedBody : null;
+    }
+
+    /**
+     * @param array<array-key, mixed> $body
+     *
+     * @return array<array-key, mixed>|null Null means omitted
+     */
+    public static function collect(array $body): ?array
+    {
+        $body = self::normalizeArray($body, 0);
+
+        return $body === null ? null : KeyValueDataFilter::filterHttpBodyData($body);
+    }
+
+    /**
+     * @return 'json'|'form'|null
+     */
+    private static function getBodyFormat(string $contentType): ?string
+    {
+        $mediaType = strtolower(trim(explode(';', $contentType, 2)[0]));
+        if ($mediaType === 'application/json' || substr($mediaType, -5) === '+json') {
+            return 'json';
+        }
+
+        return $mediaType === 'application/x-www-form-urlencoded' ? 'form' : null;
+    }
+
+    /**
+     * @param array<array-key, mixed> $body
+     *
+     * @return array<array-key, mixed>|null Null means normalization failed
+     */
+    private static function normalizeArray(array $body, int $depth): ?array
+    {
+        if ($depth >= 32) {
+            return null;
+        }
+
+        $normalized = [];
+        /** @mago-ignore analysis:mixed-assignment */
+        foreach ($body as $key => $value) {
+            if (\is_array($value)) {
+                $value = self::normalizeArray($value, $depth + 1);
+                if ($value === null) {
+                    return null;
+                }
+            } elseif ($value !== null && !\is_scalar($value)) {
+                $value = KeyValueDataFilter::FILTERED_VALUE;
+            }
+
+            $normalized[$key] = $value;
+        }
+
+        return $normalized;
+    }
+}

src/DataCollection/HttpDataCollector.php

@@ -0,0 +1,98 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Sentry\DataCollection;
+
+use GuzzleHttp\Psr7\Uri;
+use Sentry\Tracing\Span;
+
+/**
+ * Collects transport-independent HTTP data. Integrations provide normalized
+ * inputs without consuming streams or invoking application callbacks.
+ *
+ * @internal
+ */
+final class HttpDataCollector
+{
+    private function __construct()
+    {
+    }
+
+    public static function collectQueryString(?DataCollectionOptions $dataCollection, string $queryString): ?string
+    {
+        if ($queryString === '') {
+            return null;
+        }
+
+        return $dataCollection === null
+            ? $queryString
+            : KeyValueDataFilter::filterQueryString($queryString, $dataCollection->getUrlQueryParams());
+    }
+
+    public static function collectUrl(?DataCollectionOptions $dataCollection, string $url): string
+    {
+        if ($dataCollection === null) {
+            return $url;
+        }
+
+        $uri = new Uri($url);
+        $query = self::collectQueryString($dataCollection, (string) parse_url($url, \PHP_URL_QUERY));
+        $result = (string) $uri->withUserInfo('')->withQuery('')->withFragment('');
+
+        if ($query !== null && $query !== '') {
+            $result .= '?' . $query;
+        }
+
+        if ($uri->getFragment() !== '') {
+            $result .= '#' . $uri->getFragment();
+        }
+
+        return $result;
+    }
+
+    /**
+     * @param array<array-key, string[]> $headers
+     * @param 'request'|'response'       $direction
+     *
+     * @return array<string, string[]>
+     */
+    public static function collectHeaders(DataCollectionOptions $dataCollection, array $headers, string $direction): array
+    {
+        $headerBehavior = $dataCollection->getHttpHeaders()[$direction];
+        $cookieBehavior = $dataCollection->getCookies();
+        $prefix = 'http.' . $direction . '.header.';
+        $regularHeaders = [];
+        $attributes = [];
+
+        foreach ($headers as $name => $values) {
+            $name = strtolower((string) $name);
+
+            if ($name === 'cookie' || $name === 'set-cookie') {
+                if ($cookieBehavior['mode'] !== 'off' && $values !== []) {
+                    // Raw cookie headers cannot be filtered by individual cookie name.
+                    $attributes[$prefix . $name] = array_fill(0, \count($values), KeyValueDataFilter::FILTERED_VALUE);
+                }
+
+                continue;
+            }
+
+            $regularHeaders[$name] = $values;
+        }
+
+        $filteredHeaders = KeyValueDataFilter::filterHeaders($regularHeaders, $headerBehavior);
+        foreach ($filteredHeaders ?? [] as $name => $values) {
+            $attributes[$prefix . $name] = $values;
+        }
+
+        return $attributes;
+    }
+
+    /**
+     * @param array<string, mixed> $data
+     */
+    public static function setMissingSpanData(Span $span, array $data): void
+    {
+        $span->setData(array_diff_key($data, $span->getData()));
+    }
+}

src/DataCollection/HttpHeaderNormalizer.php

@@ -0,0 +1,73 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Sentry\DataCollection;
+
+use Sentry\Util\Http;
+
+/**
+ * Prepares header lines and maps for collection without invoking application
+ * callbacks. Already normalized PSR-7 headers do not require this step.
+ *
+ * @internal
+ */
+final class HttpHeaderNormalizer
+{
+    private function __construct()
+    {
+    }
+
+    /**
+     * Integer-keyed strings are raw header lines. Numeric header names in maps
+     * must use array values to distinguish them from raw lines.
+     *
+     * @param array<array-key, mixed> $headers
+     *
+     * @return array<array-key, string[]>
+     */
+    public static function normalize(array $headers): array
+    {
+        $normalized = [];
+
+        foreach ($headers as $name => $values) {
+            // Numeric keys with array values can be valid header names in a
+            // header map; only scalar entries are interpreted as raw lines.
+            if (\is_int($name) && !\is_array($values)) {
+                if (!\is_string($values)) {
+                    continue;
+                }
+
+                $parsedHeaders = [];
+                Http::parseResponseHeaders($values, $parsedHeaders);
+                foreach ($parsedHeaders as $parsedName => $parsedValues) {
+                    self::appendHeader($normalized, (string) $parsedName, $parsedValues);
+                }
+
+                continue;
+            }
+
+            self::appendHeader($normalized, (string) $name, \is_array($values) ? $values : [$values]);
+        }
+
+        return $normalized;
+    }
+
+    /**
+     * @param array<array-key, string[]> $normalized
+     * @param array<array-key, mixed>    $values
+     */
+    private static function appendHeader(array &$normalized, string $name, array $values): void
+    {
+        $name = strtolower(trim($name));
+        if ($name === '') {
+            return;
+        }
+
+        foreach ($values as $value) {
+            // Header bags may contain nulls or objects. Do not call
+            // __toString or retain objects for later serialization.
+            $normalized[$name][] = \is_scalar($value) ? (string) $value : KeyValueDataFilter::FILTERED_VALUE;
+        }
+    }
+}

src/DataCollection/KeyValueDataFilter.php

@@ -119,7 +119,7 @@ public static function filterKeyValueData(array $data, array $behavior): ?array
     }
 
     /**
-     * Filters structured HTTP body data while replacing unkeyed top-level values.
+     * Filters HTTP body fields by key name while retaining scalar list values.
      *
      * @param array<array-key, mixed> $data
      *
@@ -135,9 +135,13 @@ public static function filterHttpBodyData(array $data): array
 
         /** @mago-ignore analysis:mixed-assignment */
         foreach ($data as $value) {
-            $filtered[] = \is_array($value)
-                ? self::filterHttpBodyData($value)
-                : self::FILTERED_VALUE;
+            if (\is_array($value)) {
+                $value = self::filterHttpBodyData($value);
+            } elseif ($value !== null && !\is_scalar($value)) {
+                $value = self::FILTERED_VALUE;
+            }
+
+            $filtered[] = $value;
         }
 
         return $filtered;

src/DataCollection/RequestDataCollector.php

@@ -68,18 +68,7 @@ public function shouldCollectUserInfo(): bool
 
     public function collectQueryString(string $queryString): ?string
     {
-        if ($this->dataCollection === null) {
-            return $queryString !== '' ? $queryString : null;
-        }
-
-        if ($queryString === '') {
-            return null;
-        }
-
-        return KeyValueDataFilter::filterQueryString(
-            $queryString,
-            $this->dataCollection->getUrlQueryParams()
-        );
+        return HttpDataCollector::collectQueryString($this->dataCollection, $queryString);
     }
 
     /**

src/Integration/RequestIntegration.php

@@ -6,6 +6,7 @@
 
 use Psr\Http\Message\ServerRequestInterface;
 use Psr\Http\Message\UploadedFileInterface;
+use Sentry\DataCollection\HttpDataCollector;
 use Sentry\DataCollection\RequestDataCollector;
 use Sentry\Event;
 use Sentry\Exception\JsonException;
@@ -124,9 +125,7 @@ private function processEvent(Event $event, Options $options): void
         $queryString = $collector->collectQueryString($request->getUri()->getQuery());
 
         $requestData = [
-            'url' => $collector->usesDataCollection()
-                ? (string) $request->getUri()->withQuery($queryString ?? '')
-                : (string) $request->getUri(),
+            'url' => HttpDataCollector::collectUrl($options->getDataCollection(), (string) $request->getUri()),
             'method' => $request->getMethod(),
         ];