[Default scrubbers] Safe fields behaviour

[masinette]

Environment

SaaS (https://sentry.io/)

Version

No response

Link

No response

DSN

No response

Steps to Reproduce

Adding "user.id" to the project Safe Field, but it is still filtered.

I tested on my account an only got the wanted result when using "user.id" and "user" together.
I tried these values separately and in combination with one another in the Safe Field: user, id and user.id.

Steps to reproduce:

1. Create a test event by setting the user.id to sensitive string: Sentry.setUser({"id":"5355849125500546"})
2. Set safe field to id.
3. Sent test event
4. Check if [user.id] is filtered or not
5. Repeat for each entry in project Safe Fields

Expected Result

The user id being filtered with "user.id" in the Safe Field.

Actual Result

• Start with empty field: empty
• id - filtered
• user - filtered
• user.id - filtered
• user, id - filtered
• user, user.id - not filtered
• id, user.id - filtered
• user, id, user.id - filtered
• Start with empty field: empty
• id - filtered
• user - filtered
• user.id - filtered
• user, id - filtered
• user, user.id - not filtered
• id, user.id - filtered
• user, id, user.id - filtered

┆Issue is synchronized with this Jira Improvement by Unito

[getsantry]

Assigning to @getsentry/support for routing, due by Monday, March 13th at 16:49 (yyz). ⏲️

[getsantry]

Routing to @getsentry/workflow for triage, due by Tuesday, March 14th at 4:25 pm (sfo). ⏲️

[getsantry]

Routing to @getsentry/ingest for triage, due by Tuesday, March 14th at 17:00 (vie). ⏲️

[iker-barriocanal]

Same as ISSUE-1421.

[Dav1dde]

Only id should actually whitelist the user.id field, I tried reproducing this and for me only using id actually stops the filtering any other combination (without id) has no effect.

@masinette jfyi

[Dav1dde]

We additionally changed the safe fields syntax in getsentry/relay#2605 to support the advanced config's path expressions, this means user.id will work now as well as just id (this will match any field named id).

Please re-open or create a new issue if something else comes up or this is not actually solved.