Contexts set via setContext are ignored when they contain the string "context"

[wouterdewinter]

Is there an existing issue for this?

• I have checked for existing issues https://github.com/getsentry/sentry-javascript/issues
• I have reviewed the documentation https://docs.sentry.io/
• I am using the latest SDK release https://github.com/getsentry/sentry-javascript/releases

How do you use Sentry?

Sentry Saas (sentry.io)

Which SDK are you using?

@sentry/browser

SDK Version

8.31.0

Framework Version

No response

Link to Sentry event

https://elanza-eu.sentry.io/issues/8109038/events/a822fb8979f84e61891652df46f5567c/?project=4507531780227152

Reproduction Example/SDK Setup

Sentry init code:

Sentry.init({
    dsn: ...,
    environment: ...,
  });

Steps to Reproduce

We're setting some custom context before capturing an exception:

    Sentry.withScope((scope: Sentry.Scope) => {
      scope.setContext("Error Context", { a: "123", b: 2 });
      scope.setContext("Error Contekt", { a: "123", b: 2 });
      Sentry.captureException(error);
    });

Expected Result

We expect both contexts to appear in the Sentry user interface.

Actual Result

The context containing the string "context" does not appear in the UI, the other one with an intentional typo does appear.

[rwachtler]

Hello! 👋

I tried to reproduce this with a fresh Sentry setup (8.31.0) and a plain HTML / JS playground, but I am not able to verify the statement "Contexts set via setContext are ignored when they contain the string "context"". This is also not mentioned in the docs 👇

There are no restrictions on context name. In the context object, all keys are allowed except for type, which is used internally.
(Source)

What is the error object you are referring to in your code? Is it defined when you are trying to capture the exception?

My local reproduction:

<!-- Sentry initialization before </body> -->
<script>
  Sentry.onLoad(function() {
    Sentry.init({
        // Tracing
        tracesSampleRate: 1.0, // Capture 100% of the transactions
        // Session Replay
        replaysSessionSampleRate: 0.1, // This sets the sample rate at 10%. You may want to change it to 100% while in development and then sample at a lower rate in production.
        replaysOnErrorSampleRate: 1.0, // If you're not already sampling the entire session, change the sample rate to 100% when sampling sessions where errors occur.
      });
  });
</script>
<script src="js/scripts.js"></script>

// Contents of js/scripts.js
Sentry.withScope((scope) => {
  scope.setContext("Error Context", { a: "123", b: 2 });
  scope.setContext("Error Contekt", { a: "123", b: 2 });

  const error = new Error("This is a test error");

  Sentry.captureException(error);
});

Error Context from my Sentry UI instance

[Lms24]

Hi @wouterdewinter thanks for writing in! And also hi @rwachtler thanks a lot for investigating and chiming in!

@wouterdewinter I checked your linked event and can see from the event JSON that the "Error Context" seems to have been stripped out by our PII scrubbing logic. Do you add any data that seems PII sensitive (something like tokens, credit card, social security numbers, etc)?
I asked our ingestion team (who handle PII scrubbing) if they can tell us more about what exactly caused the context to be removed.

[Lms24]

Hey @wouterdewinter I have some answers and I gotta say this is a fun one (wouldn't have caught this by myself tbh):

Your organization settings for data scrubbing contain keywords in the "Global Sensitive Fields" settings. These field names are matched against any keys in your event (including contexts) and if an key matches one of the field names (i.e. contains them), they get scrubbed. In case of "Event Con_text_", this is what happened.

I fully realize that this is unintuitive but we do this to be extra careful to scrub all potentially sensitive data.

From our docs:

an extreme example where this behavior can become surprising, the string "Unexpected error" will be removed from events if the entry exp is in "Additional Sensitive Fields

You can read more about this here: https://docs.sentry.io/security-legal-pii/scrubbing/server-side-scrubbing/

[wouterdewinter]

Yep, that's it! We added "text" as a Global Sensitive Field as it can contain user generated content in our application which can contain PII. I did not realise it would match fields too that just contain the string, such as "context".

I can confirm it now works as expected after removing the Global Sensitive Field.

Thanks a lot for investigating!