fix(core): Apply dataCollection.urlQueryParams to url.full and url.query (#23061)

`urlQueryParams` only applied to `request.query_string` and
`requestDataIntegration`. Everywhere else, query strings went to Sentry
unfiltered — a `?token=…` was sent as-is.

We filter spans in one central place (`captureSpan`) instead of at the
\~57 write sites, which span \~18 packages and mostly have no access to
the client. One place also means a new integration cannot leak by
forgetting to filter.

Breadcrumbs do not go through the span pipeline, so those are filtered
separately.

closes #23049

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: chargome

packages/angular/src/tracing.ts

@@ -24,7 +24,13 @@ import {
 import { CODE_FUNCTION_NAME, SENTRY_OP, URL_FULL, URL_PATH, URL_TEMPLATE } from '@sentry/conventions/attributes';
 import { GENERAL_FUNCTION_SPAN_OP } from '@sentry/conventions/op';
 import type { Integration, Span } from '@sentry/core';
-import { debug, parseStringToURLObject, stripUrlQueryAndFragment, timestampInSeconds } from '@sentry/core';
+import {
+  debug,
+  parseStringToURLObject,
+  stripUrlQueryAndFragment,
+  timestampInSeconds,
+  filterCollectedUrl,
+} from '@sentry/core';
 import type { Observable } from 'rxjs';
 import { Subscription } from 'rxjs';
 import { filter, tap } from 'rxjs/operators';
@@ -72,7 +78,7 @@ export function _updateSpanAttributesForParametrizedUrl(route: string, url: stri
     span.setAttributes({
       [SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN]: `auto.${op}.angular`,
       [SEMANTIC_ATTRIBUTE_SENTRY_SOURCE]: 'route',
-      [URL_FULL]: absoluteUrl,
+      [URL_FULL]: filterCollectedUrl(absoluteUrl),
       [URL_PATH]: parseStringToURLObject(absoluteUrl)?.pathname,
       [URL_TEMPLATE]: route,
     });

packages/astro/src/server/middleware.ts

@@ -12,6 +12,8 @@ import {
   SEMANTIC_ATTRIBUTE_HTTP_REQUEST_METHOD,
   spanToJSON,
   winterCGRequestToRequestData,
+  filterCollectedUrl,
+  filterCollectedUrlQuery,
 } from '@sentry/core';
 import {
   captureException,
@@ -214,7 +216,7 @@ async function instrumentRequestStartHttpServerSpan(
             [SEMANTIC_ATTRIBUTE_HTTP_REQUEST_METHOD]: method,
             // This is here for backwards compatibility, we used to set this here before
             method,
-            [URL_FULL]: ctx.url.href,
+            [URL_FULL]: filterCollectedUrl(ctx.url.href),
             [URL_PATH]: ctx.url.pathname,
             ...httpHeadersToSpanAttributes(winterCGHeadersToDict(request.headers), client.getDataCollectionOptions()),
           };
@@ -223,7 +225,7 @@ async function instrumentRequestStartHttpServerSpan(
             attributes[HTTP_ROUTE] = parametrizedRoute;
           }
 
-          attributes[URL_QUERY] = getUrlQuery(ctx.url.search);
+          attributes[URL_QUERY] = filterCollectedUrlQuery(getUrlQuery(ctx.url.search));
           attributes[URL_FRAGMENT] = getUrlFragment(ctx.url.hash);
 
           const name = `${method} ${parametrizedRoute || ctx.url.pathname}`;

packages/aws-serverless/src/requestSpanOptions.ts

@@ -28,7 +28,7 @@ import {
 } from '@sentry/conventions/attributes';
 import { FAAS_FUNCTION_AWS_SPAN_OP } from '@sentry/conventions/op';
 import type { SpanAttributes, StartSpanOptions } from '@sentry/core';
-import { SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN } from '@sentry/core';
+import { SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN, filterCollectedUrl } from '@sentry/core';
 import type { Context } from 'aws-lambda';
 import { ATTR_FAAS_EXECUTION, ATTR_FAAS_ID } from './semconv';
 
@@ -75,7 +75,7 @@ function extractOtherEventFields(event: unknown): SpanAttributes {
   const answer: SpanAttributes = {};
   const fullUrl = extractFullUrl(event as ApiGatewayLikeEvent);
   if (fullUrl) {
-    answer[URL_FULL] = fullUrl;
+    answer[URL_FULL] = filterCollectedUrl(fullUrl);
   }
   return answer;
 }

packages/browser-utils/src/metrics/browserMetrics.ts

@@ -9,6 +9,7 @@ import {
   SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,
   setMeasurement,
   spanToJSON,
+  filterCollectedUrl,
 } from '@sentry/core';
 import { htmlTreeAsString } from '../htmlTreeAsString';
 import { WINDOW } from '../types';
@@ -629,7 +630,7 @@ export function _addResourceSpans(
 
   attributes['url.same_origin'] = resourceUrl.includes(WINDOW.location.origin);
 
-  attributes[URL_FULL] = resourceUrl;
+  attributes[URL_FULL] = filterCollectedUrl(resourceUrl);
 
   _setResourceRequestAttributes(entry, attributes, [
     // https://developer.mozilla.org/en-US/docs/Web/API/PerformanceResourceTiming/responseStatus

packages/browser/src/integrations/fetchStreamPerformance.ts

@@ -10,6 +10,7 @@ import {
   SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,
   startInactiveSpan,
   stripDataUrlContent,
+  filterCollectedUrl,
 } from '@sentry/core';
 
 const responseToStreamSpan = new WeakMap<object, Span>();
@@ -81,7 +82,7 @@ export const fetchStreamPerformanceIntegration = defineIntegration(() => {
             name: `${method} ${sanitizedUrl}`,
             startTime: handlerData.endTimestamp,
             attributes: {
-              [URL_FULL]: stripDataUrlContent(url),
+              [URL_FULL]: filterCollectedUrl(stripDataUrlContent(url)),
               'http.method': method,
               type: 'fetch',
               [SEMANTIC_ATTRIBUTE_SENTRY_OP]: 'http.client.stream',

packages/browser/src/integrations/httpcontext.ts

@@ -5,6 +5,7 @@ import {
   SEMANTIC_ATTRIBUTE_SENTRY_OP,
 } from '@sentry/core/browser';
 import { getHttpRequestData, WINDOW } from '../helpers';
+import { filterCollectedUrl } from '@sentry/core';
 import { URL_FULL } from '@sentry/conventions/attributes';
 
 /**
@@ -59,7 +60,7 @@ export const httpContextIntegration = defineIntegration(() => {
       safeSetSpanJSONAttributes(span, {
         // Coerce empty string to undefined so the helper's nullish check drops it,
         // rather than writing an empty `url.full` attribute onto the span.
-        [URL_FULL]: spanOp !== 'http.client' ? reqData.url : undefined,
+        [URL_FULL]: spanOp !== 'http.client' ? filterCollectedUrl(reqData.url) : undefined,
         'http.request.header.user_agent': headers['User-Agent'],
         'http.request.header.referer': headers['Referer'],
       });

packages/browser/src/tracing/browserTracingIntegration.ts

@@ -45,6 +45,7 @@ import {
   startTrackingLongTasks,
 } from '@sentry/browser-utils';
 import { DEBUG_BUILD } from '../debug-build';
+import { filterCollectedUrl } from '@sentry/core';
 import { getHttpRequestData, WINDOW } from '../helpers';
 import { fetchStreamPerformanceIntegration } from '../integrations/fetchStreamPerformance';
 import { WEB_VITALS_INTEGRATION_NAME, webVitalsIntegration } from '../integrations/webVitals';
@@ -392,7 +393,7 @@ export const browserTracingIntegration = ((options: Partial<BrowserTracingOption
 
     const attributes = {
       ...(urlObject?.pathname && { [URL_PATH]: urlObject.pathname }),
-      ...(urlObject && !isURLObjectRelative(urlObject) && { [URL_FULL]: urlObject.href }),
+      ...(urlObject && !isURLObjectRelative(urlObject) && { [URL_FULL]: filterCollectedUrl(urlObject.href) }),
       ...finalStartSpanOptions.attributes,
     };
 

packages/browser/src/tracing/request.ts

@@ -33,6 +33,7 @@ import {
   timestampInSeconds,
 } from '@sentry/core/browser';
 import type { XhrHint } from '@sentry/browser-utils';
+import { filterCollectedUrl, filterCollectedUrlQuery } from '@sentry/core';
 import {
   addPerformanceInstrumentationHandler,
   addXhrInstrumentationHandler,
@@ -176,7 +177,7 @@ export function instrumentOutgoingRequests(client: Client, _options?: Partial<Re
         const host = fullUrl ? parseUrl(fullUrl).host : undefined;
         const sanitizedFullUrl = fullUrl ? stripDataUrlContent(fullUrl) : undefined;
         createdSpan.setAttributes({
-          [URL_FULL]: sanitizedFullUrl,
+          [URL_FULL]: filterCollectedUrl(sanitizedFullUrl),
           'server.address': host,
         });
 
@@ -391,11 +392,11 @@ function xhrCallback(
             type: 'xhr',
             // eslint-disable-next-line typescript/no-deprecated
             [HTTP_METHOD]: method,
-            [URL_FULL]: sanitizedFullUrl,
+            [URL_FULL]: filterCollectedUrl(sanitizedFullUrl),
             [SERVER_ADDRESS]: parsedUrl?.host,
             [SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN]: 'auto.http.browser',
             [SEMANTIC_ATTRIBUTE_SENTRY_OP]: 'http.client',
-            [URL_QUERY]: getUrlQuery(parsedUrl?.search),
+            [URL_QUERY]: filterCollectedUrlQuery(getUrlQuery(parsedUrl?.search)),
             [URL_FRAGMENT]: getUrlFragment(parsedUrl?.hash),
           },
         })

packages/bun/src/integrations/bunserver.ts

@@ -15,6 +15,8 @@ import {
   setHttpStatus,
   startSpan,
   withIsolationScope,
+  filterCollectedUrl,
+  filterCollectedUrlQuery,
 } from '@sentry/core';
 import type { ServeOptions } from 'bun';
 import {
@@ -289,13 +291,13 @@ function getSpanAttributesFromParsedUrl(
   };
 
   if (parsedUrl) {
-    attributes[URL_QUERY] = getUrlQuery(parsedUrl.search);
+    attributes[URL_QUERY] = filterCollectedUrlQuery(getUrlQuery(parsedUrl.search));
     attributes[URL_FRAGMENT] = getUrlFragment(parsedUrl.hash);
     if (parsedUrl.pathname) {
       attributes[URL_PATH] = parsedUrl.pathname;
     }
     if (!isURLObjectRelative(parsedUrl)) {
-      attributes[URL_FULL] = parsedUrl.href;
+      attributes[URL_FULL] = filterCollectedUrl(parsedUrl.href);
       if (parsedUrl.port) {
         attributes[URL_PORT] = parsedUrl.port;
       }

packages/cloudflare/src/request.ts

@@ -87,7 +87,14 @@ export function wrapRequestHandlerWithInit(
     isolationScope.setClient(client);
 
     const urlObject = parseStringToURLObject(request.url);
-    const [name, attributes] = getHttpSpanDetailsFromUrlObject(urlObject, 'server', 'auto.http.cloudflare', request);
+    const [name, attributes] = getHttpSpanDetailsFromUrlObject(
+      urlObject,
+      'server',
+      'auto.http.cloudflare',
+      request,
+      undefined,
+      client,
+    );
 
     const contentLength = request.headers.get('content-length');
     if (contentLength) {