Skip to content

Sentry Integration Security Issues #317

@symbioquine

Description

@symbioquine

Describe the bug

The Sentry SDK python package is a very aggressive instrumentation implementation which appears to hook itself into things when simply initialized. (Maybe also just by being imported, I haven't ruled that out.)

In practice this means that even with QUARTZ_SOLAR_FORECAST_LOGGING=false a lot of information can be leaked about your environment/code.

I was originally going to leave the logging in place in my code, but I noticed that it caused my container to hang longer than expected upon exit. Only 2 seconds so maybe not an issue, however that got me looking into what the Sentry SDK actually does.

QUARTZ_SOLAR_FORECAST_LOGGING=false only disables the explicit logging that quartz_solar_forecast does. The Sentry SDK, just by being initialized, also hooks itself into arbitrary exceptions (even somewhat expected ones like KeyboardInterrupt) and sends an exception traceback that leaks a bunch of my code including - the full PVSite coordinates (untruncated), my application's arguments, my application's dependencies, etc.

I suspect it may also instrument arbitrary http(s) requests made by my application since it has integrations like aiohttp and httpx enabled out-of-the-box.

To Reproduce

I enabled DEBUG logging and added the following to this line: https://github.com/getsentry/sentry-python/blob/cd23041494a7cf98350c983d69e528a772e5cd6d/sentry_sdk/transport.py#L477 in my python venv:

logger.debug('body.getvalue()=' + repr(body.getvalue()))

There's probably lots of other ways to observe what the Sentry SDK is doing under the hood. (Wireshark, proxies, etc)

Expected behavior

quartz_solar_forecast should not leak potentially sensitive information from my environment/code without my consent.

Additional context

N/A

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions