feat(py): Add validate_pii_selector_spec

CHANGELOG.md

@@ -11,6 +11,7 @@
 - Filter outliers (>180s) for mobile measurements. ([#2649](https://github.com/getsentry/relay/pull/2649))
 - Allow access to more context fields in dynamic sampling and metric extraction. ([#2607](https://github.com/getsentry/relay/pull/2607), [#2640](https://github.com/getsentry/relay/pull/2640), [#2675](https://github.com/getsentry/relay/pull/2675))
 - Allow advanced scrubbing expressions for datascrubbing safe fields. ([#2670](https://github.com/getsentry/relay/pull/2670))
+- Add `validate_pii_selector_spec` to CABI for safe fields validation. ([#2687](https://github.com/getsentry/relay/pull/2687))
 
 **Bug Fixes**:
 

py/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## Unreleased
+
+- Add `validate_pii_selector_spec` to validate safe fields. ([#2687](https://github.com/getsentry/relay/pull/2687))
+
 ## 0.8.33
 
 - Drop events starting or ending before January 1, 1970 UTC. ([#2613](https://github.com/getsentry/relay/pull/2613))

py/sentry_relay/processing.py

@@ -21,6 +21,7 @@
     "is_glob_match",
     "is_codeowners_path_match",
     "parse_release",
+    "validate_pii_selector_spec",
     "validate_pii_config",
     "convert_datascrubbing_config",
     "pii_strip_event",
@@ -166,6 +167,17 @@ def is_codeowners_path_match(value, pattern):
     )
 
 
+def validate_pii_selector_spec(selector):
+    """
+    Validate a PII selector spec. Used to validate datascrubbing safe fields.
+    """
+    assert isinstance(selector, str)
+    raw_error = rustcall(lib.relay_validate_pii_selector_spec, encode_str(selector))
+    error = decode_str(raw_error, free=True)
+    if error:
+        raise ValueError(error)
+
+
 def validate_pii_config(config):
     """
     Validate a PII config against the schema. Used in project options UI.

py/tests/test_processing.py

@@ -128,6 +128,24 @@ def test_normalize_user_agent(must_normalize):
         assert "contexts" not in event
 
 
+def test_validate_pii_selector_spec():
+    sentry_relay.validate_pii_selector_spec("test")
+    sentry_relay.validate_pii_selector_spec("$user.id")
+    sentry_relay.validate_pii_selector_spec("extra.'sys.argv'.**")
+
+    with pytest.raises(ValueError) as e:
+        sentry_relay.validate_pii_selector_spec("no_spaces allowed")
+    assert "1 | no_spaces allowed" in str(e.value)
+
+    with pytest.raises(ValueError) as e:
+        sentry_relay.validate_pii_selector_spec("unterminated.'string")
+    assert "expected QuotedCharacter" in str(e.value)
+
+    with pytest.raises(ValueError) as e:
+        sentry_relay.validate_pii_selector_spec("double.**.wildcard.**")
+    assert "deep wildcard used more than once" in str(e.value)
+
+
 def test_validate_pii_config():
     sentry_relay.validate_pii_config("{}")
     sentry_relay.validate_pii_config('{"applications": {}}')

relay-cabi/include/relay.h

@@ -552,6 +552,11 @@ struct RelayStr relay_store_normalizer_normalize_event(struct RelayStoreNormaliz
  */
 bool relay_translate_legacy_python_json(struct RelayStr *event);
 
+/**
+ * Validates a PII selector spec. Used to validate datascrubbing safe fields.
+ */
+struct RelayStr relay_validate_pii_selector_spec(const struct RelayStr *value);
+
 /**
  * Validate a PII config against the schema. Used in project options UI.
  */

relay-cabi/src/processing.rs

@@ -19,6 +19,7 @@ use relay_event_schema::processor::{process_value, split_chunks, ProcessingState
 use relay_event_schema::protocol::{Event, VALID_PLATFORMS};
 use relay_pii::{
     selector_suggestions_from_value, DataScrubbingConfig, PiiConfig, PiiConfigError, PiiProcessor,
+    SelectorSpec,
 };
 use relay_protocol::{Annotated, Remark, RuleCondition};
 use relay_sampling::SamplingConfig;
@@ -150,6 +151,16 @@ pub unsafe extern "C" fn relay_translate_legacy_python_json(event: *mut RelayStr
     true
 }
 
+/// Validates a PII selector spec. Used to validate datascrubbing safe fields.
+#[no_mangle]
+#[relay_ffi::catch_unwind]
+pub unsafe extern "C" fn relay_validate_pii_selector_spec(value: *const RelayStr) -> RelayStr {
+    match (*value).as_str().parse::<SelectorSpec>() {
+        Ok(_) => RelayStr::new(""),
+        Err(e) => RelayStr::from_string(e.to_string()),
+    }
+}
+
 /// Validate a PII config against the schema. Used in project options UI.
 #[no_mangle]
 #[relay_ffi::catch_unwind]
@@ -336,9 +347,13 @@ pub unsafe extern "C" fn normalize_global_config(value: *const RelayStr) -> Rela
     }
 }
 
-#[test]
-fn pii_config_validation_invalid_regex() {
-    let config = r#"
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn pii_config_validation_invalid_regex() {
+        let config = r#"
         {
           "rules": {
             "strip-fields": {
@@ -355,15 +370,15 @@ fn pii_config_validation_invalid_regex() {
           }
         }
     "#;
-    assert_eq!(
-        unsafe { relay_validate_pii_config(&RelayStr::from(config)).as_str() },
-        "regex parse error:\n    (not valid regex\n    ^\nerror: unclosed group"
-    );
-}
+        assert_eq!(
+            unsafe { relay_validate_pii_config(&RelayStr::from(config)).as_str() },
+            "regex parse error:\n    (not valid regex\n    ^\nerror: unclosed group"
+        );
+    }
 
-#[test]
-fn pii_config_validation_valid_regex() {
-    let config = r#"
+    #[test]
+    fn pii_config_validation_valid_regex() {
+        let config = r#"
         {
           "rules": {
             "strip-fields": {
@@ -380,8 +395,9 @@ fn pii_config_validation_valid_regex() {
           }
         }
     "#;
-    assert_eq!(
-        unsafe { relay_validate_pii_config(&RelayStr::from(config)).as_str() },
-        ""
-    );
+        assert_eq!(
+            unsafe { relay_validate_pii_config(&RelayStr::from(config)).as_str() },
+            ""
+        );
+    }
 }