Description
https://docs.sentry.io/platforms/javascript/session-replay/configuration/#network-details
The SDK currently lets clients specify EITHER a regexp OR a regular url as a String - and the SDK doesn't know whether the client meant to provide a regexp or an absolute url - it just does String#matches
So for example
networkDetailAllowUrls = ["http://www.google.com/"]
Can match unintended URLs like
"wwwXgoogleXcom".
This behaviour differs from
JS SDK - in JS RegExp is a first-class type and the SDK can do 'typeof' or similar
iOS SDK - has a swift protocol to enforce specifying whether the input is String or NSUrlExpression
Impact
For sentry-java It does not seem a huge deal, b/c most developers will test the urls they provide.
TODO: are there severe edge-cases that result in details being captured for unexpected urls?
For sentry-react-native, the SDK will passthrough SentryReplayOptions to the underlying native impls on sentry-java|cocoa - it may introduce more of an issue as the behaviour will fork.
Proposed Changes
Not 100% sure tbh. The concrete soln seems to follow the JS/iOS path of having a way to differentiate whether the String provided is a regexp or an actual url. But that seems like a big lift (API changes)
Description
https://docs.sentry.io/platforms/javascript/session-replay/configuration/#network-details
The SDK currently lets clients specify EITHER a regexp OR a regular url as a
String- and the SDK doesn't know whether the client meant to provide a regexp or an absolute url - it just does String#matchesSo for example
Can match unintended URLs like
"wwwXgoogleXcom".
This behaviour differs from
JS SDK - in JS
RegExpis a first-class type and the SDK can do 'typeof' or similariOS SDK - has a swift protocol to enforce specifying whether the input is String or NSUrlExpression
Impact
For sentry-java It does not seem a huge deal, b/c most developers will test the urls they provide.
TODO: are there severe edge-cases that result in details being captured for unexpected urls?
For sentry-react-native, the SDK will passthrough SentryReplayOptions to the underlying native impls on sentry-java|cocoa - it may introduce more of an issue as the behaviour will fork.
Proposed Changes
Not 100% sure tbh. The concrete soln seems to follow the JS/iOS path of having a way to differentiate whether the String provided is a regexp or an actual url. But that seems like a big lift (API changes)