Sanitize URLs in Span description and breadcrumbs

[antonpirker]

HTTP Client Integrations record the URLs of HTTP requests. URLs can contain sensitive information like credentials or PII. This data should be removed before sending the events to Sentry.

See this PR in develop docs:
getsentry/develop#773

• Go: not applicable, no instrumentation for http clients in Go
• Java: Sanitize sensitive data from URLs sent to Sentry sentry-java#2365
• PHP: GuzzleTracingMiddleware: Sanitise span description sentry-php#1429
• Python: Sanitize URLs in Span description and breadcrumbs sentry-python#1742
• Node: Sanitize sensitive data from URLs sent to Sentry sentry-javascript#6389
• Browser JS: fix(core): Ensure http.client span descriptions don't contain query params or fragments sentry-javascript#15404
• Ruby: Sanitize URLs in Span description and breadcrumbs sentry-ruby#1955
• .NET: Sanitize sensitive data from URLs sent to Sentry sentry-dotnet#2078

Other Platforms:

• Mobile meta issue: Sanitize sensitive data from URLs (span desc, span data, crumbs, client errors) team-mobile#70
• Rust: Prevent PII leak for http requests sentry-rust#516

[vladanpaunovic]

@antonpirker can you put here a list of all affected SDKs that are problematic today?

[marandaneto]

Mobile meta issue

[smeubank]

@jjbayer is ingest aware of this work? Are there changes planned for relay to consider this work and make it relevant?

[jjbayer]

@jjbayer is ingest aware of this work? Are there changes planned for relay to consider this work and make it relevant?

@smeubank there is no work planned. The linked Relay issue is not specifically about URLs. Are Relay changes even necessary, or is it considered more of an added bonus? Probably best to contact Jernej if there is a bigger Relay story we want to get into the upcoming quarter.