fix(wsgi): Gate url.full, url.path, and http.query behind send_default_pii#6654
Merged
@sentry/warden / warden: find-bugs
completed
Jun 25, 2026 in 0s
1 issue
find-bugs: Found 1 issue (1 low)
Low
`url.path` omits `SCRIPT_NAME`, diverging from the path in `url.full` - `sentry_sdk/integrations/wsgi.py:421-423`
url.path is set from PATH_INFO alone (line 421-423), but url.full is built from SCRIPT_NAME + "/" + PATH_INFO via get_request_url. When SCRIPT_NAME is non-empty (e.g. a mounted sub-application), url.path will be a suffix of the actual URL path shown in url.full, diverging from the OTel semantic convention that url.path represents the full URI path component. This is a telemetry-accuracy issue with no security or functional impact.
⏱ 2m 3s · 267.6k in / 15.6k out · $0.53
Loading