Add option to drop scrubbed user IP addresses (#6241)

Fixes #5701 by adding an EventScrubber option to remove
`user.ip_address` instead of replacing it with `[Filtered]`.

This avoids emitting `[Filtered]` in a field Relay expects to be a valid
IP address, while preserving the existing default behavior for backward
compatibility. By default, `user.ip_address` is still scrubbed through
the normal scrubber path and keeps the `_meta` annotation.

---------

Co-authored-by: Julio César Suástegui <juliosuas@users.noreply.github.com>

Author: juliosuas

sentry_sdk/scrubber.py

@@ -137,7 +137,10 @@ def scrub_extra(self, event: "Event") -> None:
     def scrub_user(self, event: "Event") -> None:
         with capture_internal_exceptions():
             if "user" in event:
-                self.scrub_dict(event["user"])
+                user = event["user"]
+                if "ip_address" in self.denylist and isinstance(user, dict):
+                    user.pop("ip_address", None)
+                self.scrub_dict(user)
 
     def scrub_breadcrumbs(self, event: "Event") -> None:
         with capture_internal_exceptions():

tests/new_scopes_compat/test_new_scopes_compat_event.py

@@ -102,7 +102,6 @@ def create_expected_error_event(trx, span):
             "user": {
                 "id": "123",
                 "email": "jane.doe@example.com",
-                "ip_address": "[Filtered]",
             },
             "transaction": "test_transaction",
             "transaction_info": {"source": "custom"},
@@ -137,7 +136,6 @@ def create_expected_error_event(trx, span):
             },
             "platform": "python",
             "_meta": {
-                "user": {"ip_address": {"": {"rem": [["!config", "s"]]}}},
                 "extra": {
                     "should_be_removed_by_event_scrubber": {
                         "": {"rem": [["!config", "s"]]}
@@ -207,7 +205,6 @@ def create_expected_transaction_event(trx, span):
             "user": {
                 "id": "123",
                 "email": "jane.doe@example.com",
-                "ip_address": "[Filtered]",
             },
             "extra": {
                 "extra1": "extra1_value",
@@ -226,7 +223,6 @@ def create_expected_transaction_event(trx, span):
             },
             "platform": "python",
             "_meta": {
-                "user": {"ip_address": {"": {"rem": [["!config", "s"]]}}},
                 "extra": {
                     "should_be_removed_by_event_scrubber": {
                         "": {"rem": [["!config", "s"]]}

tests/test_scrubber.py

@@ -89,6 +89,42 @@ def test_ip_address_not_scrubbed_when_pii_enabled(sentry_init, capture_events):
     }
 
 
+def test_user_ip_address_removed_when_pii_disabled(sentry_init, capture_events):
+    sentry_init()
+    events = capture_events()
+
+    try:
+        1 / 0
+    except ZeroDivisionError:
+        ev, _hint = event_from_exception(sys.exc_info())
+        ev["user"] = {"id": "42", "ip_address": "127.0.0.1"}
+
+        capture_event(ev)
+
+    (event,) = events
+
+    assert event["user"] == {"id": "42"}
+    assert "user" not in event.get("_meta", {})
+
+
+def test_user_ip_address_not_removed_when_pii_enabled(sentry_init, capture_events):
+    sentry_init(send_default_pii=True)
+    events = capture_events()
+
+    try:
+        1 / 0
+    except ZeroDivisionError:
+        ev, _hint = event_from_exception(sys.exc_info())
+        ev["user"] = {"id": "42", "ip_address": "127.0.0.1"}
+
+        capture_event(ev)
+
+    (event,) = events
+
+    assert event["user"] == {"id": "42", "ip_address": "127.0.0.1"}
+    assert "user" not in event.get("_meta", {})
+
+
 def test_stack_var_scrubbing(sentry_init, capture_events):
     sentry_init()
     events = capture_events()