getsentry / getsentry/sentry-java
[SR] Network Details - Rationalize regexp matching
- Linguagem predominante
- Kotlin
- Estrelas
- 1.4k
- Forks
- 478
- Merge médio
- 3d 4h
- PRs com merge (30d)
- 72
Descrição
### Description
https://docs.sentry.io/platforms/javascript/session-replay/configuration/#network-details
_UI screenshot (session replay -> "Network" -> select http request from list)_
The SDK [currently lets](https://github.com/getsentry/sentry-java/blob/main/sentry/src/main/java/io/sentry/SentryReplayOptions.java#L434) clients specify EITHER a regexp OR a regular url as a `String` - and the SDK doesn't know whether the client meant to provide a regexp or an absolute url - it just does [String#matches](https://github.com/getsentry/sentry-java/blob/main/sentry/src/main/java/io/sentry/util/network/NetworkDetailCaptureUtils.java#L102)
So for example // _See [docs.sentry.io](https://docs.sentry.io/platforms/android/session-replay/configuration/#requirements)_
```kotlin
SentryAndroid.init(this) { options ->
options.sessionReplay.networkDetailAllowUrls = listOf("www.google.com")
}
```
Can match unintended URLs like
"wwwXgoogleXcom".
This behaviour differs from
JS SDK - in JS `RegExp` is a first-class type and the SDK can do 'typeof' or similar
iOS SDK - has a [swift protocol](https://github.com/getsentry/sentry-cocoa/blob/main/Sources/Swift/Protocol/SentryUrlMatchable.swift#L20) to enforce specifying whether the input is String or NSUrlExpression
### Impact
For sentry-java It does not seem a huge deal, b/c most developers will test the urls they provide.
**TODO**: are there severe edge-cases that result in details being captured for unexpected urls?
For sentry-react-native, the SDK will passthrough SentryReplayOptions to the underlying native impls on sentry-java|cocoa - it may introduce more of an issue as the behaviour will fork.
### Proposed Changes
Not 100% sure tbh. The concrete soln seems to follow the JS/iOS path of having a way to differentiate whether the String provided is a regexp or an actual url. But that seems like a big lift (API changes)
Guia de contribuição
Direção de pesquisa
Revise primeiro a documentação de configuração vinculada e SentryReplayOptions.java. Rastreie como networkDetailAllowUrls chega à correspondência em NetworkDetailCaptureUtils.java e, em seguida, compare os exemplos de URL documentados com o comportamento atual de String#matches. O trabalho estará concluído quando houver uma abordagem acordada para distinguir entradas regexp de entradas de URL, incluindo as implicações para sentry-react-native e os SDKs nativos.
Escrita pelo modelo de indexação a partir do texto da issue.
Avaliação
- Stack de tecnologia
- java, kotlin
- Domínio
- mobile-dev, networking
- Tipo de issue
- Bug
- Dificuldade
- 5/5
- Tempo estimado
- Mais de uma semana
- Status de atividade
- Pouca atividade
- Clareza
- Precisa de esclarecimento
- Facilidade para iniciantes
- 35/100