.

Author: sentrivana

tests/integrations/aiohttp/test_aiohttp.py

@@ -123,6 +123,36 @@ async def hello(request):
     assert request["data"] == json.dumps(body)
 
 
+@pytest.mark.asyncio
+async def test_request_body_not_included_when_disabled(
+    sentry_init, aiohttp_client, capture_events
+):
+    """Test that request body is not captured when include_request_bodies=False"""
+    sentry_init(
+        integrations=[AioHttpIntegration()],
+        include_request_bodies=False,
+        send_default_pii=True,
+    )
+
+    async def hello(request):
+        await request.read()  # this populates request._read_bytes so that we can actually test include_request_bodies
+        1 / 0
+
+    app = web.Application()
+    app.router.add_post("/", hello)
+
+    events = capture_events()
+
+    client = await aiohttp_client(app)
+    resp = await client.post("/", data={"key": "value"})
+    assert resp.status == 500
+
+    assert len(events) == 1
+    event = events[0]
+
+    assert not event["request"]["data"]
+
+
 @pytest.mark.asyncio
 async def test_403_not_captured(sentry_init, aiohttp_client, capture_events):
     sentry_init(integrations=[AioHttpIntegration()])

tests/integrations/bottle/test_bottle.py

@@ -255,7 +255,7 @@ def index():
 def test_json_not_truncated(sentry_init, capture_events, app, get_client):
     sentry_init(integrations=[BottleIntegration()])
 
-    data = {"key{}".format(i): "value{}".format(i) for i in range(10**4)}
+    data = {"key{}".format(i): "value{}".format(i) for i in range(1000)}
 
     @app.route("/", method="POST")
     def index():
@@ -277,6 +277,32 @@ def index():
     assert event["request"]["data"] == data
 
 
+def test_request_body_not_included_when_disabled(
+    sentry_init, capture_events, app, get_client
+):
+    """Test that request body is not captured when include_request_bodies=False"""
+    sentry_init(
+        integrations=[BottleIntegration()],
+        include_request_bodies=False,
+        send_default_pii=True,
+    )
+
+    @app.route("/", method="POST")
+    def index():
+        1 / 0
+
+    events = capture_events()
+
+    client = get_client()
+    with pytest.raises(ZeroDivisionError):
+        client.post("/", json={"key": "value"})
+
+    assert len(events) == 1
+    event = events[0]
+
+    assert not event["request"]["data"]
+
+
 @pytest.mark.parametrize(
     "integrations",
     [

tests/integrations/django/test_basic.py

@@ -809,6 +809,30 @@ def raw_data(self):
         assert "data" not in event["request"]
 
 
+def test_request_body_not_included_when_disabled(sentry_init, client, capture_events):
+    """Test that request body is not captured when include_request_bodies=False"""
+    sentry_init(
+        integrations=[DjangoIntegration()],
+        include_request_bodies=False,
+        send_default_pii=True,
+    )
+    events = capture_events()
+
+    content, status, headers = unpack_werkzeug_response(
+        client.post(
+            reverse("post_echo"),
+            data=b'{"key": "value"}',
+            content_type="application/json",
+        )
+    )
+    assert status.lower() == "200 ok"
+
+    (event,) = events
+
+    assert event["message"] == "hi"
+    assert not event["request"]["data"]
+
+
 def test_template_tracing_meta(sentry_init, client, capture_events):
     sentry_init(integrations=[DjangoIntegration()])
     events = capture_events()

tests/integrations/fastapi/test_fastapi.py

@@ -248,6 +248,33 @@ async def _error(request: Request):
     assert event["request"]["headers"]["authorization"] == "[Filtered]"
 
 
+@pytest.mark.asyncio
+async def test_request_body_not_included_when_disabled(sentry_init, capture_events):
+    """Test that request body is not captured when include_request_bodies=False"""
+    sentry_init(
+        integrations=[StarletteIntegration(), FastApiIntegration()],
+        include_request_bodies=False,
+        send_default_pii=True,
+    )
+
+    app = FastAPI()
+
+    @app.post("/test")
+    async def _test():
+        capture_message("Oh no!")
+        return "ok"
+
+    events = capture_events()
+
+    client = TestClient(app)
+    client.post("/test", json={"key": "value"})
+
+    assert len(events) == 1
+    (event,) = events
+
+    assert not event["request"]["data"]
+
+
 def test_response_status_code_ok_in_transaction_context(sentry_init, capture_envelopes):
     """
     Tests that the response status code is added to the transaction "response" context.

tests/integrations/flask/test_flask.py

@@ -477,6 +477,32 @@ def index():
     assert event["request"]["data"] == data
 
 
+def test_flask_request_body_not_included_when_disabled(
+    sentry_init, capture_events, app
+):
+    """Test that request body is not captured when include_request_bodies=False"""
+    sentry_init(
+        integrations=[flask_sentry.FlaskIntegration()],
+        include_request_bodies=False,
+        send_default_pii=True,
+    )
+
+    @app.route("/", methods=["POST"])
+    def index():
+        capture_message("test message")
+        return "ok"
+
+    events = capture_events()
+
+    client = app.test_client()
+    response = client.post("/", content_type="application/json", data={"key": "value"})
+    assert response.status_code == 200
+
+    (event,) = events
+
+    assert not event["request"]["data"]
+
+
 @pytest.mark.parametrize(
     "integrations",
     [

tests/integrations/tornado/test_tornado.py

@@ -297,6 +297,36 @@ def post(self):
     assert event["request"]["data"] == {"foo": {"bar": 42}}
 
 
+def test_request_body_not_included_when_disabled(
+    tornado_testcase, sentry_init, capture_events
+):
+    """Test that request body is not captured when include_request_bodies=False"""
+    sentry_init(
+        integrations=[TornadoIntegration()],
+        include_request_bodies=False,
+        send_default_pii=True,
+    )
+    events = capture_events()
+
+    class TestHandler(RequestHandler):
+        def post(self):
+            raise ValueError("test error")
+
+    client = tornado_testcase(Application([(r"/test", TestHandler)]))
+
+    response = client.fetch(
+        "/test",
+        method="POST",
+        headers={"Content-Type": "application/json"},
+        body=b'{"key": "value"}',
+    )
+
+    assert response.code == 500
+    (event,) = events
+
+    assert not event["request"]["data"]
+
+
 def test_error_has_new_trace_context_performance_enabled(
     tornado_testcase, sentry_init, capture_events
 ):