How to disable Sentry from using clipboard data in Android

[ubaidvalere]

Description

My react native app was rejected by Google because sentry send clipboard data to some endpoint. How can I disable this functionality to be able to release my app without rejection.

[markushi]

@ubaidvalere Both our sentry react-native, as well as our sentry-java SDK should never access any clipboard data.

Is it possible you have some code which captures clipboard data and passes it to the Sentry SDK? E.g. by creating a breadcrumb with the clipboard content:

const text = await Clipboard.getString();

Sentry.addBreadcrumb({
  message: text
});

[ubaidvalere]

I am not passing any clipboard text to Sentry, in fact I am not using any function of Sentry instead of init function.
However I am using clipboard to get the referral code when user first install the app, but that does not involve Sentry.

[markushi]

@ubaidvalere alright, thanks for letting us know! Does your app perform any web requests? I suspect that referral code (and thus the clipboard data) is being sent there, and one of our automatic integrations picks that up.

Debug mode could probably help you to find the root cause. After enabling it, you should see some detailed logs.

Sentry.init({
  // ...
  debug: true,
});

[ubaidvalere]

I can't find anything helpful in the Sentry log.

Sentry Logger [log]: Integration installed: ModulesLoader
LOG Sentry Logger [log]: Unhandled promise rejections will be caught by Sentry.
LOG Sentry Logger [log]: Integration installed: ReactNativeErrorHandlers
LOG Sentry Logger [log]: Integration installed: Release
LOG Sentry Logger [log]: Integration installed: InboundFilters
LOG Sentry Logger [log]: Integration installed: FunctionToString
LOG Sentry Logger [log]: Integration installed: Breadcrumbs
LOG Sentry Logger [log]: Integration installed: Dedupe
LOG Sentry Logger [log]: Integration installed: HttpContext
LOG Sentry Logger [log]: Integration installed: NativeLinkedErrors
LOG Sentry Logger [log]: Integration installed: EventOrigin
LOG Sentry Logger [log]: Integration installed: SdkInfo
LOG Sentry Logger [log]: Integration installed: ReactNativeInfo
LOG Sentry Logger [log]: Integration installed: DebugSymbolicator
LOG Sentry Logger [log]: Integration installed: RewriteFrames
LOG Sentry Logger [log]: Integration installed: DeviceContext
LOG Sentry Logger [log]: [ReactNativeTracing] Native frames instrumentation initialized.
LOG Sentry Logger [log]: [ReactNativeTracing] Not instrumenting route changes as routingInstrumentation has not been set.
LOG Sentry Logger [log]: Integration installed: ReactNativeTracing
LOG Reactotron Configured
LOG Running "AthesApp" with {"rootTag":1,"initialProps":{}}
LOG Sentry Logger [log]: Setting idle transaction on scope. Span ID: aba264e15a247177
LOG Sentry Logger [log]: [Tracing] starting ui.load transaction - App Start
LOG Sentry Logger [log]: Starting heartbeat
LOG Sentry Logger [log]: pinging Heartbeat -> current counter: 0
LOG Sentry Logger [log]: [ReactNativeTracing] Starting ui.load transaction "App Start" on scope
LOG Sentry Logger [log]: [Tracing] Starting 'app.start.cold' span on transaction 'App Start' (aba264e15a247177).
LOG Linking.getInitialURL null
LOG Sentry Logger [log]: [Tracing] pushActivity: bea34d10b8f969f2
LOG Sentry Logger [log]: [Tracing] new activities count 1
LOG Sentry Logger [log]: [Tracing] Starting 'http.client' span on transaction 'App Start' (aba264e15a247177).
LOG Sentry Logger [log]: [Tracing] pushActivity: 87ed84488936a41c
LOG Sentry Logger [log]: [Tracing] new activities count 2
LOG Sentry Logger [log]: [Tracing] Starting 'http.client' span on transaction 'App Start' (aba264e15a247177).
LOG Sentry Logger [log]: [Tracing] popActivity 87ed84488936a41c
LOG Sentry Logger [log]: [Tracing] new activities count 1
LOG Sentry Logger [log]: [Tracing] popActivity bea34d10b8f969f2
LOG Sentry Logger [log]: [Tracing] new activities count 0
LOG Sentry Logger [log]: [Tracing] pushActivity: 91e528500a893db1
LOG Sentry Logger [log]: [Tracing] new activities count 1
LOG Sentry Logger [log]: [Tracing] Starting 'http.client' span on transaction 'App Start' (aba264e15a247177).
LOG Sentry Logger [log]: [Tracing] popActivity 91e528500a893db1
LOG Sentry Logger [log]: [Tracing] new activities count 0
LOG Sentry Logger [log]: [Tracing] finishing IdleTransaction 2024-09-26T14:38:18.606Z ui.load
DEBUG Sentry Logger [debug]: Removing AppState listener for ui.load transaction.
LOG Sentry Logger [log]: [Tracing] flushing IdleTransaction
LOG Sentry Logger [log]: [Measurements] Adding measurements to transaction {
"app_start_cold": {
"value": 27711.194091796875,
"unit": "millisecond"
},
"stall_count": {
"value": 2,
"unit": "none"
},
"stall_total_time": {
"value": 380.93701171875,
"unit": "millisecond"
},
"stall_longest_time": {
"value": 221.136962890625,
"unit": "millisecond"
}
}
LOG Sentry Logger [log]: [Tracing] Finishing ui.load transaction: App Start.
LOG Sentry Logger [log]: [Measurements] Adding measurements to ui.load transaction App Start: {
"frames_total": {
"value": 131,
"unit": "none"
},
"frames_frozen": {
"value": 0,
"unit": "none"
},
"frames_slow": {
"value": 2,
"unit": "none"
}
}

[markushi]

@ubaidvalere did you trigger the code which accesses the clipboard too?

The issue should be highly connected with your app code. Maybe a http request url containing the clipboard data?
In any case you can scrub that data by utilizing beforeSend() and beforeSendTransaction(). E.g. you could set a breakpoint within those hooks, and check the event payload to identify the corresponding attributes.

Our docs around data scrubbing show some example code as well.

[romtsn]

@ubaidvalere have you had a chance to debug the events payload?

[ubaidvalere]

Actually I tried resubmitting the build and it was approved. Also I was not able to find anything in the event payload. Closing this ticket now.