Sentry-php: Option to disable variables in stack traces

[anka-213]

We don't want to log sensitive user data, but we do want to have stack traces. Is there an option to do this?

[ste93cry]

There isn't any option tailored specifically at disabling the capturing of the arguments of the functions, however you can use the before_send option to attach a callback that will run right before the event is sent and that allows you to edit any of its data. Take a look at #959, it's pretty similar to what you are asking and I've posted an example to show how you can access the stacktraces

[anka-213]

I looked at that code, but I don't know what the // ... is supposed to be filled with. How do you do the actual scrubbing?

[ste93cry]

Well, it depends on what you want to do of course. Since you asked for an option to disable vars capturing, I assume that you don't want to log any of the arguments of a frame, so something like this should work:

foreach ($stacktrace->getFrames() as $frame) {
    $frame->setVars([]);
}

[anka-213]

@ste93cry Thanks! So the complete code would look something like this?

\Sentry\init([
    ...,
    'before_send' => static function (Event $event): Event {
        $stacktrace = $event->getStacktrace();

        if (null !== $stacktrace) {
            foreach ($stacktrace->getFrames() as $frame) {
               $frame->setVars([]);
            }
        }

        $exceptions = $event->getExceptions();

        foreach ($exceptions as $exception) {
            if (!isset($exception['stacktrace'])) {
                continue;
            }
            $stacktrace = $exception['stacktrace'];

            foreach ($stacktrace->getFrames() as $frame) {
               $frame->setVars([]);
            }
        }

        return $event;
    }
]);

[ste93cry]

Exactly. That code will strip from the frame all arguments of each function, thus not sending any sensitive data. You can then adjust the code to do other things according to your needs, mine is just an example

[cweiske]

We had do prune stack trace variables to comply with GDPR, since the variable values may contain personal information. Sending them ouside the EU to Google servers (sentry.io) is not allowed.