Skip to content

feat(pii): add data collection for HTTP requests#2167

Closed
Litarnus wants to merge 3 commits into
data-collection-configfrom
legacy-value-compatibility
Closed

feat(pii): add data collection for HTTP requests#2167
Litarnus wants to merge 3 commits into
data-collection-configfrom
legacy-value-compatibility

Conversation

@Litarnus

Copy link
Copy Markdown
Contributor

Introduces new classes to support data collection and separate logic of what is collected with how its collected.

Pii/scrubbing logic was deliberately moved into own classes so that framework SDKs can use them and rely on a strong testing harness instead of having to reimplement similar behaviour and tests

RequestDataCollector

This acts as an abstraction layer with the configuration to produce the desired result based on the provided config. It will always use sendDefaultPii unless data collection was explicitly set (opt-in).
Having this class makes testing easier as well as the code in the RequestIntegration more readable, since it can just focus on what to collect instead of dealing with two distinct types of settings.
Also makes removal of the legacy value more easier.

SensitiveDataScrubber

Generic class to perform recursive scrubbing based on the provided behaviour config.

Comment thread src/DataCollection/SensitiveDataScrubber.php
Comment thread src/DataCollection/RequestDataCollector.php
Comment thread src/DataCollection/RequestDataCollector.php

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 65482dd. Configure here.

}

return $scrubbed;
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Scrubber skips nested sensitive keys

Medium Severity

scrubKeyValueData only inspects top-level keys and copies nested array values unchanged. Sensitive nested keys (for example PHP array cookies like user[password]) are therefore left intact, despite this class being introduced for recursive scrubbing that framework SDKs are expected to reuse.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 65482dd. Configure here.

@Litarnus Litarnus closed this Jul 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant