fix(scrubbing): apply the url scrubber to conn path and query fields … - #1196
Merged
Conversation
solnic
force-pushed
the
fix/scrub-url-derived-conn-fields
branch
4 times, most recently
from
September 8, 2026 12:04
13d1bf5 to
1810f90
Compare
solnic
marked this pull request as ready for review
September 9, 2026 12:13
whatyouhide
approved these changes
Sep 10, 2026
| defp scrubbed_uri(conn) do | ||
| case get(:url_scrubber).(conn) do | ||
| url when is_binary(url) -> URI.parse(url) | ||
| _other -> nil |
Collaborator
There was a problem hiding this comment.
Is this the same behavior we had before? It's a pretty dangerous silent failure mechanism so I’m wondering if we'd at least need a warning log.
Collaborator
Author
There was a problem hiding this comment.
@whatyouhide ah great catch - this is now fixed via a658d85 - I also added rescuing from potential failures which follows Sentry spec about user-provided callbacks.
Collaborator
Author
There was a problem hiding this comment.
edit: I rebased the stack so the fixup commit is 665d723 now, sorry for the noise
solnic
force-pushed
the
fix/scrub-url-derived-conn-fields
branch
from
September 10, 2026 13:29
a658d85 to
665d723
Compare
sl0thentr0py
approved these changes
Sep 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Now
:url_scrubberalso handles the conn's ownrequest_path,path_infoandquery_string, wherever the connection itself is reported.path_infois rebuilt againstscript_name, so forwarded routers stay correct.Before
The app's scrubber redacts the token segment of the URL, but the conn embedded in the exception still carries the raw path:
request_path—/scrubbing-demo/forwarded/reset-password/pathsecret-...path_info— the secret as its own segmentquery_string— every parameter in the clearAfter
The same three fields now come from the scrubbed URL:
request_pathandpath_info— the token segment replaced with the placeholderscript_name— still["scrubbing-demo", "forwarded"], showingpath_infowas rebuilt against the mount point rather than the whole pathquery_string— redacted alongside themCloses #1195