feat(replays): Add PII scrubbing to performance spans (#1730)

closes: getsentry/replay-backend#243

Co-authored-by: Joris Bayer <joris.bayer@sentry.io>

CHANGELOG.md

@@ -12,6 +12,7 @@
 - Remove concurrent profiling. ([#1697](https://github.com/getsentry/relay/pull/1697))
 - Use the main Sentry SDK to submit crash reports instead of a custom curl-based backend. This removes a dependency on `libcurl` and ensures compliance with latest TLS standards for crash uploads. Note that this only affects Relay if the hidden `_crash_db` option is used. ([#1707](https://github.com/getsentry/relay/pull/1707))
 - Support transaction naming rules. ([#1695](https://github.com/getsentry/relay/pull/1695))
+- Add PII scrubbing to URLs captured by replay recordings ([#1730](https://github.com/getsentry/relay/pull/1730))
 
 ## 22.12.0
 

relay-replays/src/recording.rs

@@ -174,7 +174,9 @@ impl RecordingProcessor<'_> {
                 Some(message) => self.strip_pii(message)?,
                 None => {}
             },
-            CustomEventDataVariant::PerformanceSpan(_) => {}
+            CustomEventDataVariant::PerformanceSpan(span) => {
+                self.strip_pii(&mut span.payload.description)?;
+            }
         }
 
         Ok(())
@@ -677,6 +679,48 @@ mod tests {
         unreachable!();
     }
 
+    #[test]
+    fn test_scrub_pii_navigation() {
+        let payload = include_bytes!("../tests/fixtures/rrweb-performance-navigation.json");
+        let mut events: Vec<Event> = serde_json::from_slice(payload).unwrap();
+
+        recording::strip_pii(&mut events).unwrap();
+
+        let event = events.pop().unwrap();
+        if let recording::Event::T5(custom) = &event {
+            if let recording::CustomEventDataVariant::PerformanceSpan(span) = &custom.data {
+                assert_eq!(
+                    &span.payload.description,
+                    "https://sentry.io?credit-card=[creditcard]"
+                );
+                return;
+            }
+        }
+
+        unreachable!();
+    }
+
+    #[test]
+    fn test_scrub_pii_resource() {
+        let payload = include_bytes!("../tests/fixtures/rrweb-performance-resource.json");
+        let mut events: Vec<Event> = serde_json::from_slice(payload).unwrap();
+
+        recording::strip_pii(&mut events).unwrap();
+
+        let event = events.pop().unwrap();
+        if let recording::Event::T5(custom) = &event {
+            if let recording::CustomEventDataVariant::PerformanceSpan(span) = &custom.data {
+                assert_eq!(
+                    &span.payload.description,
+                    "https://sentry.io?credit-card=[creditcard]"
+                );
+                return;
+            }
+        }
+
+        unreachable!();
+    }
+
     #[test]
     fn test_pii_ip_address_removal() {
         let payload = include_bytes!("../tests/fixtures/rrweb-pii-ip-address.json");

relay-replays/tests/fixtures/rrweb-performance-navigation.json

@@ -0,0 +1,19 @@
+[
+    {
+        "type": 5,
+        "timestamp": 1665063926.125,
+        "data": {
+            "tag": "performanceSpan",
+            "payload": {
+                "op": "navigation.navigate",
+                "description": "https://sentry.io?credit-card=4111-1111-1111-1111",
+                "startTimestamp": 1665063926.125,
+                "endTimestamp": 1665063926.833,
+                "data": {
+                    "size": 9538,
+                    "duration": 710
+                }
+            }
+        }
+    }
+]

relay-replays/tests/fixtures/rrweb-performance-resource.json

@@ -0,0 +1,19 @@
+[
+    {
+        "type": 5,
+        "timestamp": 1665063926.263,
+        "data": {
+            "tag": "performanceSpan",
+            "payload": {
+                "op": "resource.link",
+                "description": "https://sentry.io?credit-card=4111-1111-1111-1111",
+                "startTimestamp": 1665063926.263,
+                "endTimestamp": 1665063926.386,
+                "data": {
+                    "size": 31872,
+                    "encodedBodySize": 31356
+                }
+            }
+        }
+    }
+]