feat(graphql): [Data Collection 4] Apply GraphQL policies - #5800
Draft
adinauer wants to merge 8 commits into
Draft
feat(graphql): [Data Collection 4] Apply GraphQL policies#5800adinauer wants to merge 8 commits into
adinauer wants to merge 8 commits into
Conversation
Control GraphQL documents and variables through the new Data Collection policies across GraphQL and Apollo integrations. Preserve sendDefaultPii and maxRequestBodySize behavior when Data Collection is absent. Co-Authored-By: Claude <noreply@anthropic.com>
Contributor
|
📲 Install BuildsAndroid
|
This was referenced Jul 21, 2026
Bring the queue option removal and preceding stack updates into this layer.
This was referenced Jul 22, 2026
lbloder
reviewed
Aug 10, 2026
| try { | ||
| it.writeTo(buffer) | ||
| data = buffer.readUtf8() | ||
| data = GraphqlUtils.filterRequestBody(buffer.readUtf8(), scopes.options) |
Collaborator
There was a problem hiding this comment.
GraphQL/Apollo also allow Http.Get for queries (https://graphql.org/learn/serving-over-http/#get-request-and-parameters) so we might need to filter that too, not just the request body.
Member
Author
There was a problem hiding this comment.
In theory customers can just use:
dataCollection.setUrlQueryParams(
KeyValueCollectionBehavior.denyList("query", "variables"));
It looks like other SDKs also aren't using the graphql options on GET params.
We can just mention this in docs.
lbloder
reviewed
Aug 10, 2026
Contributor
Semver Impact of This PR🟡 Minor (new features) 📋 Changelog PreviewThis is how your changes will appear in the changelog. This PR will not appear in the changelog. 🤖 This preview updates automatically when you update the PR. |
9 tasks
This was referenced Aug 24, 2026
Add focused coverage for parsing a single GraphQL request object and independently removing document and variable content while preserving operation metadata and allowed fields. Refs #5666 Co-Authored-By: Claude <noreply@anthropic.com>
Apply document and variable collection policies to every operation in a batched GraphQL request. Fail closed when a batch contains non-object entries instead of attaching partially filtered content. Refs #5666 Co-Authored-By: Claude <noreply@anthropic.com>
Verify GraphQL request filtering fails closed when a batch contains a non-object entry. Refs #5666 Co-Authored-By: Claude <noreply@anthropic.com>
Contributor
Performance metrics 🚀
|
…n-graphql # Conflicts: # sentry/src/test/java/io/sentry/DataCollectionResolverTest.kt
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Stack (Data Collection)
📜 Description
Apply Data Collection policies to GraphQL document and variable capture across GraphQL Java and Apollo 2, 3, and 4 integrations.
The integrations independently filter GraphQL documents and variables while retaining operation metadata. Legacy
sendDefaultPii, request-size, and integration-specific always-collect behavior remain unchanged when Data Collection is absent.💡 Motivation and Context
GraphQL documents and variables can contain customer data. The new namespace provides granular control without forcing integrations to interpret legacy options themselves.
Refs #5666
💚 How did you test it?
./gradlew spotlessApply apiDump./gradlew apiCheck📝 Checklist
sendDefaultPIIis enabled.🔮 Next steps
Apply the remaining Data Collection categories to database and HTTP integration paths.
#skip-changelog