fix(rails): filter the context emitted by ErrorSubscriber

Author: solnic

sentry-rails/lib/sentry/rails/error_reporter_context.rb

@@ -8,15 +8,26 @@ module Rails
     module ErrorReporterContext
       SUPPORTS_EXECUTION_CONTEXT = Gem::Version.new(::Rails.version) >= Gem::Version.new("7.0.0")
 
+      # Prepare a context hash for the "rails.error" context entry, so that user data attached
+      # via `Rails.error.set_context` gets the same treatment regardless of whether the
+      # exception was handled.
+      #
+      # Serialization runs first: the serializer expands Enumerables and Ranges into arrays the
+      # filter can descend into, and it preserves hash keys, so filtering its output is strictly
+      # more thorough than filtering the raw context.
+      #
+      # @param context [Hash] the raw context
+      # @return [Hash] the serialized context with sensitive values redacted
+      def error_context(context)
+        Sentry::Rails::ParameterFilter.filter_sensitive_params(Sentry::Rails::Serializer.serialize(context))
+      end
+
       if SUPPORTS_EXECUTION_CONTEXT
         def execution_context
           context = ::ActiveSupport::ExecutionContext.to_h
           return {} if context.empty?
 
-          # Serialize first: the serializer expands Enumerables and Ranges into arrays the
-          # filter can descend into, and it preserves hash keys, so filtering its output is
-          # strictly more thorough than filtering the raw context.
-          { "rails.error" => Sentry::Rails::ParameterFilter.filter_sensitive_params(Sentry::Rails::Serializer.serialize(context)) }
+          { "rails.error" => error_context(context) }
         end
       else
         def execution_context

sentry-rails/lib/sentry/rails/error_subscriber.rb

@@ -1,11 +1,15 @@
 # frozen_string_literal: true
 
+require "sentry/rails/error_reporter_context"
+
 module Sentry
   module Rails
     # This is not a user-facing class. You should use it with Rails 7.0's error reporter feature and its interfaces.
     # See https://github.com/rails/rails/blob/main/activesupport/lib/active_support/error_reporter.rb to learn more about reporting APIs.
     # If you want Sentry to subscribe to the error reporter, please set `config.rails.register_error_subscriber` to `true`.
     class ErrorSubscriber
+      include ErrorReporterContext
+
       SKIP_SOURCES = Regexp.union([/.*_cache_store.active_support/])
 
       def report(error, handled:, severity:, context:, source: nil)
@@ -29,7 +33,7 @@ def report(error, handled:, severity:, context:, source: nil)
 
         hint[:mechanism] ||= Sentry::Mechanism.new(type: Sentry::Rails.integration_name, handled: handled)
 
-        Sentry::Rails.capture_exception(error, level: severity, contexts: { "rails.error" => context }, tags: tags, hint: hint)
+        Sentry::Rails.capture_exception(error, level: severity, contexts: { "rails.error" => error_context(context) }, tags: tags, hint: hint)
       end
     end
   end

sentry-rails/spec/sentry/rails_spec.rb

@@ -366,6 +366,27 @@ def capture_in_separate_process(exit_code:)
         expect(event.contexts).to include({ "rails.error" => { foo: "bar" } })
       end
 
+      it "filters Rails.error.set_context data attached before a handled exception" do
+        Rails.error.set_context(
+          debug_key: "important_value",
+          api_key: "secret-api-key",
+          nested: { password: "hunter2" }
+        )
+
+        Rails.error.handle(severity: :info) { 1/0 }
+
+        expect(transport.events.count).to eq(1)
+
+        event = transport.events.first
+        expect(event.contexts).to include(
+          "rails.error" => hash_including(
+            debug_key: "important_value",
+            api_key: "[FILTERED]",
+            nested: { password: "[FILTERED]" }
+          )
+        )
+      end
+
       it "skips cache storage sources", skip: Rails.version.to_f < 7.1 do
         Rails.error.handle(severity: :info, source: "mem_cache_store.active_support") do
           1/0