getsentry / getsentry/sentry-javascript
Sensitive values bypass the denylist in header and cookie collection
Abierto
javascript
- Lenguaje dominante
- TypeScript
- Estrellas
- 8.7k
- Forks
- 1.8k
- Merge medio
- 1 d 17 h
- PR fusionados (30 d)
- 523
Descripción
A cookie header that cannot be split into `name=value` pairs ends up verbatim in an attribute key, and headers listed in `headersToSpanAttributes` skip the denylist, so an `authorization` header is sent in the clear.
Guía de contribución
Evaluación
Este issue todavía no se ha evaluado.