This repository was archived by the owner on Oct 23, 2023. It is now read-only.
This repository was archived by the owner on Oct 23, 2023. It is now read-only.
Prevents access to request raw data in Flask #457
Open
Description
This all seems to be a bit of a mess, but if you want to access the raw request data in Flask regardless of the content type (I can't control the client), you need to call
request.get_data()
and you need to do this before accessing request.data or request.form, because both of these will call get_data() in such a way that the stream will be exhausted, parsed into the form dict, and the raw data is never cached.
This doesn't seem documented except in the comments: https://github.com/mitsuhiko/werkzeug/blob/master/werkzeug/wrappers.py#L440
Should the sentry extension call request.get_data() first to make sure the raw data is cached before using request.form?
Metadata
Metadata
Assignees
Type
Projects
Milestone
Relationships
Development
No branches or pull requests
Activity
groveriffic commentedon Mar 4, 2016
I've run into this issue also recently.
It makes sense that Flask doesn't want to cache the unparsed body. This could be really large in the case of file uploads. Triggering the caching is probably not best for all scenarios.
This is working for me right now
There might still be a better, more general solution. I'm not sure if the code that captures
request.form
could just be moved into anafter_request
and still have the same results?mitsuhiko commentedon Mar 9, 2016
I don't think the raven client should force buffering of the body. That seems like a terrible idea because this could be (as mentioned) huge.
davidhariri commentedon Aug 4, 2016
Just ran into this. It took me a long time to realize that this is what was happening. @mitsuhiko could we perhaps add this issue to the docs in Sentry?
jcerjak commentedon Feb 28, 2017
Please add a big fat warning in the Sentry docs, also got bitten by this :/
No longer provide form data for Flask. Fixes #457
No longer provide form data for Flask. Fixes getsentry#457
No longer provide form data for Flask. Fixes getsentry#457
No longer provide form data for Flask. Fixes getsentry#457
No longer provide form data for Flask. Fixes getsentry#457
jeteon commentedon Sep 25, 2018
Also just ran into this. Why does the Sentry SDK need to access
request.data
orrequest.form
? If the SDK is already accessing the data (and triggering it being parsed into a data structure that is attached the request) then I don't understand how it would be doing much for memory/performance concerns by not cacheing it.mitsuhiko commentedon Sep 25, 2018
For what it's worth the new sentry-python SDK makes this configurable and generally is less invasive for accessing this information.
fix signature check on push
2 remaining items