fix(supabase): Consider sendDefaultPii for supabase integration#20490
fix(supabase): Consider sendDefaultPii for supabase integration#20490
sendDefaultPii for supabase integration#20490Conversation
size-limit report 📦
|
There was a problem hiding this comment.
I haven't worked with supabase yet, but it would be interesting to know if the query really contains sensitive data, usually it is stripped away.
Also FWIW the db.query and db.body are not in our convetions: https://getsentry.github.io/sentry-conventions/attributes/db/#db-query-text
as far as I can see (I also have no prior experience with the supabase integration) we monkey patch this ourselves and thus get all the content directly, so I assume there would be no sanitization from supabases side here?
good point, we should look at possibly adjusting this in a follow up! |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 32f9b58. Configure here.
| const description = `${operation === 'select' ? '' : `${operation}${body ? '(...) ' : ''}`}${queryItems.join( | ||
| ' ', | ||
| )} from(${table})`; | ||
| const mutationPart = operation === 'select' ? '' : `${operation}${Object.keys(body).length ? '(...) ' : ''}`; |
There was a problem hiding this comment.
Body check change breaks array insert descriptions
Medium Severity
The condition for showing (...) in the span description changed from body ? to Object.keys(body).length ?, but the local body variable (line 358) is always Object.create(null) — always truthy but potentially empty. For array body inserts (e.g., .insert([{title: 'Test'}])), isPlainObject returns false for arrays, so body stays empty and Object.keys(body).length is 0. This removes the (...) marker from the description, breaking the existing browser integration test that expects 'insert(...) filter(columns, ) from(todos)'.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 32f9b58. Configure here.
|
I just checked it and it is Pii: (no pii) await supabase.from('todos').insert({
task: 'PLAINTEXT-MARKER-abc123-secret',
email: 'alice.secret@example.com',
name: 'Alice Private',
})Picture
(pii) This one is quite interesting, as on the attributes it is "[Filtered]" but on the top it shows the query in plain text await supabase
.from('todos')
.select('*')
.eq('email', 'alice.secret@example.com')Picture
|
2 participants
We did not consider
sendDefaultPiifor the supabase integration. However:This PR fixes this.