Merge ca6d2fd into 740ed8c

st0012 · web-flow · commit 16a0713cfc4a · 2021-08-27T08:31:15.000Z
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -16,6 +16,8 @@
 - Don't start `Sentry::SendEventJob`'s transaction [#1547](https://github.com/getsentry/sentry-ruby/pull/1547)
   - Fixes [#1539](https://github.com/getsentry/sentry-ruby/issues/1539)
 - Don't record breadcrumbs in disabled environments [#1549](https://github.com/getsentry/sentry-ruby/pull/1549)
+- Scrub header values with invalid encoding [#1552](https://github.com/getsentry/sentry-ruby/pull/1552)
+  - Fixes [#1551](https://github.com/getsentry/sentry-ruby/issues/1551)
 
 ## 4.6.5
 
diff --git a/sentry-ruby/lib/sentry/interfaces/request.rb b/sentry-ruby/lib/sentry/interfaces/request.rb
@@ -57,7 +57,7 @@ def read_data_from(request)
         request.POST
       elsif request.body # JSON requests, etc
         data = request.body.read(MAX_BODY_LIMIT)
-        data = data.force_encoding(Encoding::UTF_8) if data.respond_to?(:force_encoding)
+        data = encode_to_utf_8(data.to_s)
         request.body.rewind
         data
       end
@@ -76,7 +76,8 @@ def filter_and_format_headers(env)
           # Rack stores headers as HTTP_WHAT_EVER, we need What-Ever
           key = key.sub(/^HTTP_/, "")
           key = key.split('_').map(&:capitalize).join('-')
-          memo[key] = value.to_s
+
+          memo[key] = encode_to_utf_8(value.to_s)
         rescue StandardError => e
           # Rails adds objects to the Rack env that can sometimes raise exceptions
           # when `to_s` is called.
@@ -87,6 +88,18 @@ def filter_and_format_headers(env)
       end
     end
 
+    def encode_to_utf_8(value)
+      if value.encoding != Encoding::UTF_8 && value.respond_to?(:force_encoding)
+        value = value.dup.force_encoding(Encoding::UTF_8)
+      end
+
+      if !value.valid_encoding?
+        value = value.scrub
+      end
+
+      value
+    end
+
     def is_skippable_header?(key)
       key.upcase != key || # lower-case envs aren't real http headers
         key == "HTTP_COOKIE" || # Cookies don't go here, they go somewhere else
diff --git a/sentry-ruby/spec/sentry/interfaces/request_interface_spec.rb b/sentry-ruby/spec/sentry/interfaces/request_interface_spec.rb
@@ -59,6 +59,17 @@
       end
     end
 
+    context 'with special characters' do
+      let(:additional_headers) { { "HTTP_FOO" => "Tekirda\xC4" } }
+
+      it "doesn't cause any issue" do
+        interface = described_class.build(env: env)
+        json = JSON.generate(interface.to_hash)
+
+        expect(JSON.parse(json)["headers"]).to eq({"Content-Length"=>"0", "Foo"=>"Tekirda�"})
+      end
+    end
+
     context 'with additional env variables' do
       let(:mock) { double }
       let(:env) { { "some.variable" => mock } }
