Skip to content

ref(argv): Update integration #6155

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
sentrivana wants to merge 3 commits into from
Closed

ref(argv): Update integration #6155

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d20cdc0
ref(argv): Update integration
sentrivana Apr 28, 2026
1228fde
.
sentrivana Apr 28, 2026
8b427d5
update compat tests
sentrivana Apr 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions sentry_sdk/integrations/argv.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

import sentry_sdk
from sentry_sdk.integrations import Integration
from sentry_sdk.scope import add_global_event_processor
from sentry_sdk.scope import add_global_event_processor, should_send_default_pii

from typing import TYPE_CHECKING

Expand All @@ -23,7 +23,7 @@
extra = event.setdefault("extra", {})
# If some event processor decided to set extra to e.g. an
# `int`, don't crash. Not here.
if isinstance(extra, dict):
if isinstance(extra, dict) and should_send_default_pii:

Check failure on line 26 in sentry_sdk/integrations/argv.py

View check run for this annotation

@sentry/warden / warden: security-review

PII gate is a no-op: should_send_default_pii is referenced, not called 

`should_send_default_pii` is a function (defined in `sentry_sdk/scope.py:2136`), but the new condition `isinstance(extra, dict) and should_send_default_pii` checks the function object's truthiness rather than calling it. Function objects are always truthy, so the guard always passes and `sys.argv` is attached to every event regardless of the client's `send_default_pii` setting. Since `sys.argv` frequently contains secrets (API tokens, DB URLs, passwords passed via CLI flags), this leaks PII/credentials to Sentry for users who explicitly opted out.

Check failure on line 26 in sentry_sdk/integrations/argv.py

View check run for this annotation

@sentry/warden / warden: find-bugs

should_send_default_pii used as truthy reference instead of being called, PII gate is always true 

should_send_default_pii is a function (defined in sentry_sdk/scope.py at line 2136 as `def should_send_default_pii() -> bool`), but at line 26 it is referenced without parentheses. A function object is always truthy in Python, so the condition is effectively a no-op and sys.argv is attached to every event regardless of the user's send_default_pii setting. This leaks potentially sensitive command-line arguments (tokens, secrets, file paths, usernames) to Sentry for users who explicitly opted out of PII transmission.

Check failure on line 26 in sentry_sdk/integrations/argv.py

View check run for this annotation

@sentry/warden / warden: code-review

should_send_default_pii used as bare reference, never invoked 

`should_send_default_pii` is imported from `sentry_sdk.scope` where it is defined as a function (returns `Scope.get_client().should_send_default_pii()`). On line 26 it is used as a bare name in a boolean expression rather than being called as `should_send_default_pii()`. A function reference is always truthy in Python, so the PII guard is a no-op and `sys.argv` will be attached to every event regardless of the client's `send_default_pii` setting, leaking potentially sensitive command-line arguments (tokens, paths, credentials).
Comment thread
sentrivana marked this conversation as resolved.
Outdated
extra["sys.argv"] = sys.argv

return event
Loading