Merge branch 'main' into 9.x.x

Author: markushi

CHANGELOG.md

@@ -2,9 +2,128 @@
 
 ## Unreleased
 
+### Features
+
+- Add `LocalSentrySpan` to `sentry-compose` so apps can provide a parent `ISpan` to a composable subtree and have nested `SentryTraced` spans attach to it ([#6112]https://github.com/getsentry/sentry-java/pull/6112)
+- Add `dataCollection`, a fine-grained replacement for `sendDefaultPii`, for controlling data collected automatically by SDK integrations ([#5759](https://github.com/getsentry/sentry-java/pull/5759))
+  - `sendDefaultPii` remains supported for backwards compatibility. When `dataCollection` is not configured, the SDK preserves the existing `sendDefaultPii` behavior.
+  - Configuring any `dataCollection` option makes it the source of truth. `sendDefaultPii` is then ignored, and omitted `dataCollection` options use the defaults below.
+  - The Logback appender is a compatibility exception. When an encoder is configured, `sendDefaultPii=true` continues to include the original message template and parameters. To opt in independently of `sendDefaultPii`, set `<includeUnencodedMessage>true</includeUnencodedMessage>` on the Sentry appender in `logback.xml` or `logback-spring.xml`.
+  - Data explicitly supplied through APIs such as `Sentry.setUser`, scopes, event processors, or `beforeSend` is not affected.
+
+  To opt in to the documented `dataCollection` defaults without configuring an individual option:
+
+  ```java
+  Sentry.init(options -> options.getDataCollection().forceDataCollection());
+  ```
+
+  | Option | Default | Behavior |
+  | --- | --- | --- |
+  | `userInfo` | `true` | Allows integrations to populate user identity and IP address information automatically. |
+  | `cookies` | `{ mode: DENY_LIST, terms: [] }` | Collects cookies while filtering sensitive values. |
+  | `httpHeaders.request` | `{ mode: DENY_LIST, terms: [] }` | Collects request headers while filtering sensitive values. |
+  | `httpHeaders.response` | `{ mode: DENY_LIST, terms: [] }` | Collects response headers while filtering sensitive values. |
+  | `httpBodies` | All supported body types | Collects supported incoming and outgoing request and response bodies. An empty set disables body collection. |
+  | `urlQueryParams` | `{ mode: DENY_LIST, terms: [] }` | Collects URL query parameters while filtering sensitive values. |
+  | `graphql.document` | `true` | Collects GraphQL documents. |
+  | `graphql.variables` | `true` | Collects GraphQL variables. |
+  | `databaseQueryData` | `true` | Allows collection of associated query data, such as bound parameters, write payloads, and results, where supported. Sanitized query statements and structural database metadata remain available. |
+  | `filePaths` | `true` | Allows file-system instrumentation to collect file and directory paths. File extensions and byte counts remain available when disabled. |
+
+  Cookies, HTTP headers, and URL query parameters support three modes:
+
+  - `OFF`: Do not collect the category.
+  - `DENY_LIST`: Collect values except those matching the built-in sensitive deny-list or additional configured terms.
+  - `ALLOW_LIST`: Only send plaintext values for matching terms. The built-in sensitive deny-list still applies.
+
+  Matching is case-insensitive and partial. The built-in sensitive deny-list contains `auth`, `token`, `secret`, `password`, `passwd`, `pwd`, `key`, `jwt`, `bearer`, `sso`, `saml`, `csrf`, `xsrf`, `credentials`, `session`, `sid`, and `identity`. Filtered values are replaced with `"[Filtered]"`. Custom deny-list terms extend rather than replace this list.
+
+  Configure all HTTP body types, a custom cookie deny-list, a request-header allow-list, and disable URL query parameter and file path collection in an options callback:
+
+  ```java
+  Sentry.init(
+      options -> {
+        options
+            .getDataCollection()
+            .setHttpBodies(
+                EnumSet.of(
+                    HttpBodyType.INCOMING_REQUEST,
+                    HttpBodyType.OUTGOING_REQUEST,
+                    HttpBodyType.INCOMING_RESPONSE,
+                    HttpBodyType.OUTGOING_RESPONSE));
+        options
+            .getDataCollection()
+            .setCookies(
+                KeyValueCollectionBehavior.denyList(
+                    "forwarded", "-ip", "remote-", "via", "-user"));
+        options
+            .getDataCollection()
+            .getHttpHeaders()
+            .setRequest(
+                KeyValueCollectionBehavior.allowList("content-type", "x-request-id"));
+        options
+            .getDataCollection()
+            .setUrlQueryParams(KeyValueCollectionBehavior.off());
+        options.getDataCollection().setFilePaths(false);
+      });
+  ```
+
+  Configure the same options in `sentry.properties`:
+
+  ```properties
+  data-collection.http-bodies=incoming_request,outgoing_request,incoming_response,outgoing_response
+  data-collection.cookies.mode=deny_list
+  data-collection.cookies.terms=forwarded,-ip,remote-,via,-user
+  data-collection.http-headers.request.mode=allow_list
+  data-collection.http-headers.request.terms=content-type,x-request-id
+  data-collection.url-query-params.mode=off
+  data-collection.file-paths=false
+  ```
+
+  Configure them with Spring Boot properties:
+
+  ```properties
+  sentry.data-collection.http-bodies=incoming-request,outgoing-request,incoming-response,outgoing-response
+  sentry.data-collection.cookies.mode=deny-list
+  sentry.data-collection.cookies.terms=forwarded,-ip,remote-,via,-user
+  sentry.data-collection.http-headers.request.mode=allow-list
+  sentry.data-collection.http-headers.request.terms=content-type,x-request-id
+  sentry.data-collection.url-query-params.mode=off
+  sentry.data-collection.file-paths=false
+  ```
+
+  Configure them in `AndroidManifest.xml`:
+
+  ```xml
+  <meta-data
+      android:name="io.sentry.data-collection.http-bodies"
+      android:value="incoming_request,outgoing_request,incoming_response,outgoing_response" />
+  <meta-data
+      android:name="io.sentry.data-collection.cookies.mode"
+      android:value="deny_list" />
+  <meta-data
+      android:name="io.sentry.data-collection.cookies.terms"
+      android:value="forwarded,-ip,remote-,via,-user" />
+  <meta-data
+      android:name="io.sentry.data-collection.http-headers.request.mode"
+      android:value="allow_list" />
+  <meta-data
+      android:name="io.sentry.data-collection.http-headers.request.terms"
+      android:value="content-type,x-request-id" />
+  <meta-data
+      android:name="io.sentry.data-collection.url-query-params.mode"
+      android:value="off" />
+  <meta-data
+      android:name="io.sentry.data-collection.file-paths"
+      android:value="false" />
+  ```
+
+  See the [Data Collection documentation](https://docs.sentry.io/platforms/java/configuration/options/#dataCollection) for all configuration keys, supported integrations, and migration guidance.
+
 ### Fixes
 
 - Disable URL caching when reading `META-INF/MANIFEST.MF` files during version detection so that the SDK no longer keeps jar file handles open for the life of the process ([#6124](https://github.com/getsentry/sentry-java/pull/6124)
+- Keep the `EventListener` wrapped by `SentryOkHttpEventListener` per `Call` ([#6003](https://github.com/getsentry/sentry-java/pull/6003))
 
 ## 8.57.0
 
@@ -47,6 +166,7 @@
 
 ### Fixes
 
+- Support `ws` and `wss` URL parsing for WebSocket instrumentation ([#6064](https://github.com/getsentry/sentry-java/pull/6064))
 - Keep resolving the server name after `Sentry.close()` or a re-init. Closing the SDK shut down the shared hostname cache for the life of the process, so `server_name` silently froze at the value it had last resolved ([#6119](https://github.com/getsentry/sentry-java/pull/6119))
 - Order breadcrumbs by the timestamp they carry rather than by when they were created in the current process, so breadcrumbs restored from disk or handed over by a hybrid SDK no longer sort as if they had just happened ([#6097](https://github.com/getsentry/sentry-java/pull/6097))
 

sentry-android-core/api/sentry-android-core.api

@@ -283,7 +283,6 @@ public final class io/sentry/android/core/DeviceInfoUtil {
 	public fun getSplitApksInfo ()Lio/sentry/android/core/ContextUtils$SplitApksInfo;
 	public fun getTotalMemory ()Ljava/lang/Long;
 	public static fun isCharging (Landroid/content/Intent;Lio/sentry/SentryOptions;)Ljava/lang/Boolean;
-	public static fun resetInstance ()V
 }
 
 public abstract class io/sentry/android/core/EnvelopeFileObserverIntegration : io/sentry/Integration, java/io/Closeable {

sentry-android-core/src/main/java/io/sentry/android/core/ApplicationExitInfoEventProcessor.java

@@ -681,7 +681,7 @@ private void mergeUser(final @NotNull SentryBaseEvent event) {
     if (user.getId() == null) {
       user.setId(getDeviceId());
     }
-    if (user.getIpAddress() == null && options.isSendDefaultPii()) {
+    if (user.getIpAddress() == null && options.getDataCollectionResolver().isUserInfo()) {
       user.setIpAddress(IpAddressUtils.DEFAULT_IP_ADDRESS);
     }
   }

sentry-android-core/src/main/java/io/sentry/android/core/DefaultAndroidEventProcessor.java

@@ -178,7 +178,7 @@ private void mergeUser(final @NotNull SentryBaseEvent event) {
     if (user.getId() == null) {
       user.setId(Installation.id(context));
     }
-    if (user.getIpAddress() == null && options.isSendDefaultPii()) {
+    if (user.getIpAddress() == null && options.getDataCollectionResolver().isUserInfo()) {
       user.setIpAddress(IpAddressUtils.DEFAULT_IP_ADDRESS);
     }
   }

sentry-android-core/src/main/java/io/sentry/android/core/DeviceInfoUtil.java

@@ -15,15 +15,13 @@
 import android.os.SystemClock;
 import android.util.DisplayMetrics;
 import io.sentry.DateUtils;
-import io.sentry.ISentryLifecycleToken;
 import io.sentry.SentryLevel;
 import io.sentry.SentryOptions;
 import io.sentry.android.core.internal.util.CpuInfoUtils;
 import io.sentry.android.core.internal.util.DeviceOrientations;
 import io.sentry.android.core.internal.util.RootChecker;
 import io.sentry.protocol.Device;
 import io.sentry.protocol.OperatingSystem;
-import io.sentry.util.AutoClosableReentrantLock;
 import java.io.File;
 import java.util.Calendar;
 import java.util.Collections;
@@ -34,17 +32,10 @@
 import org.jetbrains.annotations.ApiStatus;
 import org.jetbrains.annotations.NotNull;
 import org.jetbrains.annotations.Nullable;
-import org.jetbrains.annotations.TestOnly;
 
 @ApiStatus.Internal
 public final class DeviceInfoUtil {
 
-  @SuppressLint("StaticFieldLeak")
-  private static volatile DeviceInfoUtil instance;
-
-  private static final @NotNull AutoClosableReentrantLock staticLock =
-      new AutoClosableReentrantLock();
-
   private final @NotNull Context context;
   private final @NotNull SentryAndroidOptions options;
   private final @NotNull BuildInfoProvider buildInfoProvider;
@@ -80,19 +71,7 @@ public DeviceInfoUtil(
   @NotNull
   public static DeviceInfoUtil getInstance(
       final @NotNull Context context, final @NotNull SentryAndroidOptions options) {
-    if (instance == null) {
-      try (final @NotNull ISentryLifecycleToken ignored = staticLock.acquire()) {
-        if (instance == null) {
-          instance = new DeviceInfoUtil(ContextUtils.getApplicationContext(context), options);
-        }
-      }
-    }
-    return instance;
-  }
-
-  @TestOnly
-  public static void resetInstance() {
-    instance = null;
+    return options.getOrCreateDeviceInfoUtil(context);
   }
 
   // we can get some inspiration here