refactor: Add recursive scrubbing to EventScrubber with tests

sentry_sdk/scrubber.py

@@ -59,19 +59,36 @@
 
 
 class EventScrubber(object):
-    def __init__(self, denylist=None):
-        # type: (Optional[List[str]]) -> None
+    def __init__(self, denylist=None, recursive=False):
+        # type: (Optional[List[str]], bool) -> None
         self.denylist = DEFAULT_DENYLIST if denylist is None else denylist
         self.denylist = [x.lower() for x in self.denylist]
+        self.recursive = recursive
+
+    def scrub_list(self, lst):
+        # type: (List[Any]) -> None
+        if not isinstance(lst, list):
+            return
+
+        for v in lst:
+            if isinstance(v, dict):
+                self.scrub_dict(v)
+            elif isinstance(v, list):
+                self.scrub_list(v)
 
     def scrub_dict(self, d):
         # type: (Dict[str, Any]) -> None
         if not isinstance(d, dict):
             return
 
-        for k in d.keys():
+        for k, v in d.items():
             if isinstance(k, string_types) and k.lower() in self.denylist:
                 d[k] = AnnotatedValue.substituted_because_contains_sensitive_data()
+            elif self.recursive:
+                if isinstance(v, dict):
+                    self.scrub_dict(v)
+                elif isinstance(v, list):
+                    self.scrub_list(v)
 
     def scrub_request(self, event):
         # type: (Event) -> None

tests/test_scrubber.py

@@ -169,3 +169,18 @@ def test_scrubbing_doesnt_affect_local_vars(sentry_init, capture_events):
     (frame,) = frames
     assert frame["vars"]["password"] == "[Filtered]"
     assert password == "cat123"
+
+
+def test_recursive_event_scrubber(sentry_init, capture_events):
+    sentry_init(event_scrubber=EventScrubber(recursive=True))
+    events = capture_events()
+    complex_structure = {
+        "deep": {
+            "deeper": [{"deepest": {"password": "my_darkest_secret"}}],
+        },
+    }
+
+    capture_event({"extra": complex_structure})
+
+    (event,) = events
+    assert event["extra"]["deep"]["deeper"][0]["deepest"]["password"] == "'[Filtered]'"