fix(wsgi): Gate url.full, url.path, and http.query behind send_default_pii - #6654
Merged
@sentry/warden / warden
completed
Jun 25, 2026 in 0s
1 issue
Low
`url.path` omits `SCRIPT_NAME`, diverging from the path in `url.full` - `sentry_sdk/integrations/wsgi.py:421-423`
url.path is set from PATH_INFO alone (line 421-423), but url.full is built from SCRIPT_NAME + "/" + PATH_INFO via get_request_url. When SCRIPT_NAME is non-empty (e.g. a mounted sub-application), url.path will be a suffix of the actual URL path shown in url.full, diverging from the OTel semantic convention that url.path represents the full URI path component. This is a telemetry-accuracy issue with no security or functional impact.
4 skills analyzed
| Skill | Findings | Duration | Cost |
|---|---|---|---|
| security-review | 0 | 1.6s | $0.04 |
| code-review | 0 | 1m 34s | $0.44 |
| find-bugs | 1 | 2m 3s | $0.53 |
| skill-scanner | 0 | 5.9s | $0.02 |
⏱ 3m 45s · 415.7k in / 27.8k out · $1.03
Loading