Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,10 @@
- Fix user `geo` being dropped from the native scope by forwarding it as a structured object instead of a JSON string ([#6309](https://github.com/getsentry/sentry-react-native/pull/6309))
- Remove unused `React/RCTTextView.h` import that broke iOS builds on React Native 0.87, where the header was removed as part of the legacy architecture cleanup ([#6322](https://github.com/getsentry/sentry-react-native/pull/6322))

### Internal

- Hide the `dataCollection` option until it is fully supported in React Native. It is exposed by `@sentry/core` but is not yet honored by the native SDKs (iOS/Android) nor by the RN-specific `sendDefaultPii` gates, so setting it would silently have no effect. Use `sendDefaultPii` instead. ([#6345](https://github.com/getsentry/sentry-react-native/pull/6345))

### Dependencies

- Bump JavaScript SDK from v10.58.0 to v10.60.0 ([#6321](https://github.com/getsentry/sentry-react-native/pull/6321), [#6332](https://github.com/getsentry/sentry-react-native/pull/6332))
Expand Down
2 changes: 1 addition & 1 deletion packages/core/etc/sentry-react-native.api.md
Original file line number Diff line number Diff line change
Expand Up @@ -591,7 +591,7 @@ export const reactNativeNavigationIntegration: (input: ReactNativeNavigationOpti
// Warning: (ae-forgotten-export) The symbol "BaseReactNativeOptions" needs to be exported by the entry point index.d.ts
//
// @public
export interface ReactNativeOptions extends Omit<Options<ReactNativeTransportOptions>, '_experiments'>, BaseReactNativeOptions {
export interface ReactNativeOptions extends Omit<Options<ReactNativeTransportOptions>, '_experiments' | 'dataCollection'>, BaseReactNativeOptions {
}

// Warning: (ae-forgotten-export) The symbol "ReactNativeTracingOptions" needs to be exported by the entry point index.d.ts
Expand Down
10 changes: 8 additions & 2 deletions packages/core/src/js/options.ts
Original file line number Diff line number Diff line change
Expand Up @@ -512,11 +512,17 @@ export interface ReactNativeTransportOptions extends BrowserTransportOptions {
* @see ReactNativeFrontend for more information.
*/

// `dataCollection` is omitted until the option is fully supported in React Native. It is exposed by

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The dataCollection option is hidden from TypeScript but can still be passed at runtime. It is ignored by React Native specific logic, which still uses sendDefaultPii, leading to silent misconfiguration.
Severity: MEDIUM

Suggested Fix

To fully prevent usage, the dataCollection property should be explicitly destructured and removed from the options object at runtime in wrapper.ts before the remaining options are passed to initNativeSdk. This ensures it is not passed to the core SDK or native layers, preventing the partial, confusing behavior.

Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: packages/core/src/js/options.ts#L515

Potential issue: Hiding the `dataCollection` option from TypeScript types using `Omit`
is a compile-time-only change. At runtime, users can still provide this option. The
option is passed to the core SDK but is ignored by React Native-specific data-gating
logic (e.g., for IP addresses, deep links), which continues to read the `sendDefaultPii`
option. This discrepancy can lead to silent failures where a user's data privacy
settings in `dataCollection` are not respected by the React Native layer, causing
unintended data to be sent if `sendDefaultPii` is also configured.

Did we get this right? ๐Ÿ‘ / ๐Ÿ‘Ž to inform future reviews.

// `@sentry/core` but is not yet honored by the native SDKs (iOS/Android) nor by the RN-specific
// `sendDefaultPii` gates (e.g. IP inference, deep links, navigation params). Use `sendDefaultPii`
// instead.
export interface ReactNativeOptions
extends Omit<Options<ReactNativeTransportOptions>, '_experiments'>, BaseReactNativeOptions {}
extends Omit<Options<ReactNativeTransportOptions>, '_experiments' | 'dataCollection'>, BaseReactNativeOptions {}

export interface ReactNativeClientOptions
extends Omit<ClientOptions<ReactNativeTransportOptions>, 'tunnel' | '_experiments'>, BaseReactNativeOptions {}
extends
Omit<ClientOptions<ReactNativeTransportOptions>, 'tunnel' | '_experiments' | 'dataCollection'>,
BaseReactNativeOptions {}

export interface ReactNativeWrapperOptions {
/** Props for the root React profiler */
Expand Down
Loading