-
-
Notifications
You must be signed in to change notification settings - Fork 95
Description
Describe the bug
The Sentry SDK python package is a very aggressive instrumentation implementation which appears to hook itself into things when simply initialized. (Maybe also just by being imported, I haven't ruled that out.)
In practice this means that even with QUARTZ_SOLAR_FORECAST_LOGGING=false a lot of information can be leaked about your environment/code.
I was originally going to leave the logging in place in my code, but I noticed that it caused my container to hang longer than expected upon exit. Only 2 seconds so maybe not an issue, however that got me looking into what the Sentry SDK actually does.
QUARTZ_SOLAR_FORECAST_LOGGING=false only disables the explicit logging that quartz_solar_forecast does. The Sentry SDK, just by being initialized, also hooks itself into arbitrary exceptions (even somewhat expected ones like KeyboardInterrupt) and sends an exception traceback that leaks a bunch of my code including - the full PVSite coordinates (untruncated), my application's arguments, my application's dependencies, etc.
I suspect it may also instrument arbitrary http(s) requests made by my application since it has integrations like aiohttp and httpx enabled out-of-the-box.
To Reproduce
I enabled DEBUG logging and added the following to this line: https://github.com/getsentry/sentry-python/blob/cd23041494a7cf98350c983d69e528a772e5cd6d/sentry_sdk/transport.py#L477 in my python venv:
logger.debug('body.getvalue()=' + repr(body.getvalue()))There's probably lots of other ways to observe what the Sentry SDK is doing under the hood. (Wireshark, proxies, etc)
Expected behavior
quartz_solar_forecast should not leak potentially sensitive information from my environment/code without my consent.
Additional context
N/A