chore: Add no-unfiltered-url-attributes rule - #23144
Open
chargome wants to merge 2 commits into
Open
Conversation
chargome
commented
Aug 7, 2026
Member
Author
There was a problem hiding this comment.
This rule here is pure claude but it actually found two occurrences in our code so that checks out.
chargome
changed the title
no-unfiltered-url-attributes ruleno-unfiltered-url-attributes rule
Contributor
size-limit report 📦
|
Lms24
approved these changes
Aug 7, 2026
chargome
marked this pull request as ready for review
August 7, 2026 10:30
chargome
requested review from
logaretm and
stephanie-anderson
and removed request for
a team
August 7, 2026 10:30
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
nicohrubec
approved these changes
Aug 7, 2026
chargome
force-pushed
the
feat/lint-rule-unfiltered-url-attributes
branch
2 times, most recently
from
August 7, 2026 12:45
f83d4be to
e7330aa
Compare
| }, | ||
| "overrides": [ | ||
| { | ||
| "files": ["**/src/**/*.ts", "**/src/**/*.tsx"], |
Contributor
There was a problem hiding this comment.
Bug: The new lint rule's configuration in .oxlintrc.base.json excludes the packages/ember/addon/ directory, which contains unfiltered URL collection sites.
Severity: HIGH
Suggested Fix
Update the glob pattern in .oxlintrc.base.json to include the packages/ember/addon/ directory. For example, change **/src/**/*.ts to something broader like packages/**/*.ts or add **/addon/**/*.ts to the list of included paths.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: .oxlintrc.base.json#L66
Potential issue: The new `no-unfiltered-url-attributes` lint rule is configured to run
only on files within `src` directories. However, the `packages/ember/addon/` directory
contains code that writes unfiltered URLs to Sentry spans, specifically at
`instrumentEmberAppInstanceForPerformance.ts:113`. Because the lint rule's glob pattern
in `.oxlintrc.base.json` excludes this path, it will not flag this existing issue or any
future unfiltered URL additions in that directory, allowing full URLs with query
parameters to be collected from Ember applications regardless of user settings.
Also affects:
packages/ember/addon/utils/instrumentEmberAppInstanceForPerformance.ts:113
Base automatically changed from
fix/filter-url-full-in-requestdata-and-navigate
to
develop
August 7, 2026 13:01
URL attributes are filtered at each write site rather than centrally, so that a URL a user attaches themselves is left alone. The tradeoff is that a site which forgets to filter leaks silently, which has already happened twice. The rule requires `url.full`, `url.query` and `http.target` to be wrapped in `filterCollectedUrl`, and recognises values that cannot carry a query: the query-stripping helpers, locals holding an already-filtered value, literals and regex matchers. Two non-HTTP resource identifiers opt out explicitly. Also adds a Bugbot rule for the shapes a lint rule cannot see, such as a URL passed through a helper first or attached to a breadcrumb instead of a span. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…lly read it Each package has its own `.oxlintrc.json` that extends `.oxlintrc.base.json` rather than the root config, so a rule enabled only at the root never runs for anything under `packages/`. Declare the plugin and the rule in the base config instead, scoped to `src` so tests asserting on URL attributes are not flagged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
chargome
force-pushed
the
feat/lint-rule-unfiltered-url-attributes
branch
from
August 7, 2026 13:01
e7330aa to
122d09b
Compare
| }, | ||
| "overrides": [ | ||
| { | ||
| "files": ["**/src/**/*.ts", "**/src/**/*.tsx"], |
Contributor
There was a problem hiding this comment.
Bug: The lint rule sdk/no-unfiltered-url-attributes has a file path configuration that excludes the Ember package, failing to catch an unfiltered URL attribute write.
Severity: HIGH
Suggested Fix
Update the files glob pattern for the sdk/no-unfiltered-url-attributes rule in .oxlintrc.base.json to include the Ember package's file paths, such as by adding **/addon/**/*.ts to the array.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: .oxlintrc.base.json#L66
Potential issue: The lint rule `sdk/no-unfiltered-url-attributes` is configured with a
file glob `**/src/**/*.ts` that does not include files in the Ember package's `addon/`
directory. Consequently, the rule fails to detect an unfiltered URL attribute write in
`packages/ember/addon/utils/instrumentEmberAppInstanceForPerformance.ts`. This file sets
the `url.full` attribute directly with the output of `getAbsoluteUrl()`, which does not
filter query parameters. This can lead to the collection and transmission of sensitive
data within URL query parameters from Ember applications to Sentry.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#23061 moved URL filtering to each write site, so a URL the user attaches themselves is left alone. The tradeoff is that new write sites need to filter urls.
The rule requires
url.full,url.queryandhttp.targetto be wrapped infilterCollectedUrl, and recognises values that can't carry a query.Also adds a Bugbot rule for the shapes a lint rule can't see, like a URL passed through a helper first or attached to a breadcrumb instead of a span.