feat(processor): Add Span Attachment scrubbing logic

relay-server/src/processing/spans/process.rs

@@ -7,14 +7,15 @@ use relay_event_normalization::{
 };
 use relay_event_schema::processor::{ProcessingState, ValueType, process_value};
 use relay_event_schema::protocol::{AttachmentV2Meta, Span, SpanId, SpanV2};
+use relay_pii::PiiAttachmentsProcessor;
 use relay_protocol::Annotated;
 
 use crate::envelope::{ContainerItems, EnvelopeHeaders, Item, ItemContainer, ParentId, WithHeader};
 use crate::managed::Managed;
-use crate::processing::Context;
 use crate::processing::spans::{
     self, Error, ExpandedAttachment, ExpandedSpan, ExpandedSpans, Result, SampledSpans,
 };
+use crate::processing::{Context, utils};
 use crate::services::outcome::DiscardReason;
 
 /// Parses all serialized spans.
@@ -224,16 +225,32 @@ fn validate_timestamps(span: &SpanV2) -> Result<()> {
 pub fn scrub(spans: &mut Managed<ExpandedSpans>, ctx: Context<'_>) {
     spans.retain(
         |spans| &mut spans.spans,
-        |span, _| {
+        |span, r| {
             scrub_span(&mut span.span, ctx)
                 .inspect_err(|err| relay_log::debug!("failed to scrub pii from span: {err}"))?;
 
-            // TODO: Also scrub the attachment
+            span.attachments
+                .retain_mut(|attachment| match scrub_attachment(attachment, ctx) {
+                    Ok(()) => true,
+                    Err(err) => {
+                        relay_log::debug!("failed to scrub pii from span attachment: {err}");
+                        r.reject_err(err, &*attachment);
+                        false
+                    }
+                });
+
             Ok::<(), Error>(())
         },
     );
 
-    // TODO: Also scrub the standalone attachments
+    spans.retain(
+        |spans| &mut spans.stand_alone_attachments,
+        |attachment, _| {
+            scrub_attachment(attachment, ctx).inspect_err(|err| {
+                relay_log::debug!("failed to scrub pii from span attachment: {err}")
+            })
+        },
+    );
 }
 
 fn scrub_span(span: &mut Annotated<SpanV2>, ctx: Context<'_>) -> Result<()> {
@@ -254,6 +271,47 @@ fn scrub_span(span: &mut Annotated<SpanV2>, ctx: Context<'_>) -> Result<()> {
     Ok(())
 }
 
+fn scrub_attachment(attachment: &mut ExpandedAttachment, ctx: Context<'_>) -> Result<()> {
+    let pii_config_from_scrubbing = ctx
+        .project_info
+        .config
+        .datascrubbing_settings
+        .pii_config()
+        .map_err(|e| Error::PiiConfig(e.clone()))?;
+
+    let ExpandedAttachment { meta, body } = attachment;
+
+    relay_pii::eap::scrub(
+        ValueType::Attachments, // TODO: How do we event want to allow people to filter here?
+        meta,
+        ctx.project_info.config.pii_config.as_ref(),
+        pii_config_from_scrubbing.as_ref(),
+    )?;
+
+    if let Some(config) = ctx.project_info.config.pii_config.as_ref()
+        // FIXME: Not a fan of this at all, the fact that the UI is misleading around this does not help IMO.
+        //  Also also kind of weird since you can add a bogus rule to get around this (or even add a rule by accident to get around this).
+        // From attachments.rs:
+        // We temporarily only scrub attachments to projects that have at least one simple attachment rule,
+        // such as `$attachments.'foo.txt'`.
+        // After we have assessed the impact on performance we can relax this condition.
+        && utils::attachments::has_simple_attachment_selector(config)
+    {
+        let filename = meta
+            .value()
+            .and_then(|m| m.filename.as_str())
+            .unwrap_or_default();
+
+        let processor = PiiAttachmentsProcessor::new(config.compiled());
+        let mut payload = body.to_vec();
+        if processor.scrub_attachment(filename, &mut payload) {
+            *body = Bytes::from(payload);
+        };
+    }
+
+    Ok(())
+}
+
 fn span_duration(span: &SpanV2) -> Option<Duration> {
     let start_timestamp = *span.start_timestamp.value()?;
     let end_timestamp = *span.end_timestamp.value()?;
@@ -266,6 +324,7 @@ mod tests {
     use relay_pii::{DataScrubbingConfig, PiiConfig};
     use relay_protocol::SerializableAnnotated;
     use relay_sampling::evaluation::ReservoirCounters;
+    use uuid::Uuid;
 
     use crate::services::projects::project::ProjectInfo;
 
@@ -701,6 +760,91 @@ mod tests {
         "###);
     }
 
+    #[test]
+    fn test_scrub_attachment_body() {
+        let pii_config = serde_json::from_value::<PiiConfig>(serde_json::json!({
+            "rules": {"0": {"type": "ip", "redaction": {"method": "remove"}}},
+            "applications": {"$attachments.'data.txt'": ["0"]}
+        }))
+        .unwrap();
+
+        let mut attachment = ExpandedAttachment {
+            meta: Annotated::new(AttachmentV2Meta {
+                attachment_id: Annotated::new(Uuid::new_v4()),
+                filename: Annotated::new("data.txt".to_owned()),
+                content_type: Annotated::new("text/plain".to_owned()),
+                ..Default::default()
+            }),
+            body: Bytes::from("Some IP: 127.0.0.1"),
+        };
+
+        let ctx = make_context(DataScrubbingConfig::default(), Some(pii_config));
+        scrub_attachment(&mut attachment, ctx).unwrap();
+
+        assert_eq!(attachment.body, "Some IP: *********");
+    }
+
+    #[test]
+    fn test_scrub_attachment_meta() {
+        use relay_event_schema::protocol::{Attribute, AttributeType, Attributes};
+        use relay_protocol::Value;
+
+        let pii_config = serde_json::from_value::<PiiConfig>(serde_json::json!({
+            "applications": {"$string": ["@email:replace"]}
+        }))
+        .unwrap();
+
+        let mut attributes = Attributes::new();
+        attributes.0.insert(
+            "email_attr".to_owned(),
+            Annotated::new(Attribute::new(
+                AttributeType::String,
+                Value::String("[email protected]".to_owned()),
+            )),
+        );
+
+        let mut attachment = ExpandedAttachment {
+            meta: Annotated::new(AttachmentV2Meta {
+                attachment_id: Annotated::new(Uuid::new_v4()),
+                filename: Annotated::new("data.txt".to_owned()),
+                content_type: Annotated::new("text/plain".to_owned()),
+                attributes: Annotated::new(attributes),
+                ..Default::default()
+            }),
+            body: Bytes::from("Some attachment body"),
+        };
+
+        let ctx = make_context(DataScrubbingConfig::default(), Some(pii_config));
+        scrub_attachment(&mut attachment, ctx).unwrap();
+
+        let attrs = &attachment.meta.value().unwrap().attributes;
+        insta::assert_json_snapshot!(SerializableAnnotated(attrs), @r#"
+        {
+          "email_attr": {
+            "type": "string",
+            "value": "[email]"
+          },
+          "_meta": {
+            "email_attr": {
+              "value": {
+                "": {
+                  "rem": [
+                    [
+                      "@email:replace",
+                      "s",
+                      0,
+                      7
+                    ]
+                  ],
+                  "len": 20
+                }
+              }
+            }
+          }
+        }
+        "#);
+    }
+
     #[test]
     fn test_validate_timestamp_start_before_end() {
         validate_timestamps(&SpanV2 {

relay-server/src/processing/utils/attachments.rs

@@ -108,7 +108,7 @@ fn scrub_view_hierarchy(item: &mut crate::envelope::Item, config: &relay_pii::Pi
     }
 }
 
-fn has_simple_attachment_selector(config: &relay_pii::PiiConfig) -> bool {
+pub fn has_simple_attachment_selector(config: &relay_pii::PiiConfig) -> bool {
     for application in &config.applications {
         if let SelectorSpec::Path(vec) = &application.0 {
             let Some([a, b]) = vec.get(0..2) else {