src/sentry/src/Tracing/Aspect/GuzzleHttpClientAspect.php (1)

71-189: 可能泄露敏感信息：完整请求/响应头部与正文片段上报

setData 中包含 http.request.headers、http.response.headers，且响应正文在某些情况下会上传。Headers 常包含 Authorization/Cookie/Set-Cookie/X-API-Key 等敏感信息；正文也可能含 PII。建议最少进行头部白/黑名单过滤，并用开关控制是否上报。

可以局部修正 on_stats 里的 setData 构造，示例（仅示意关键点）：

-                $span->setData([
+                // 构造脱敏后的请求头
+                $reqHeaders = $request->getHeaders();
+                $sanitizedReqHeaders = [];
+                foreach ($reqHeaders as $k => $v) {
+                    $lk = strtolower($k);
+                    if (in_array($lk, ['authorization','cookie','proxy-authorization','x-api-key'], true)) {
+                        continue;
+                    }
+                    $sanitizedReqHeaders[$k] = $v;
+                }
+
+                $data = [
                   // See: https://develop.sentry.dev/sdk/performance/span-data-conventions/#http
                   'http.query' => $uri->getQuery(),
                   'http.fragment' => $uri->getFragment(),
                   'http.request.method' => $request->getMethod(),
                   'http.request.body.size' => strlen($options['body'] ?? ''),
                   'http.request.full_url' => (string) $request->getUri(),
                   'http.request.path' => $request->getUri()->getPath(),
                   'http.request.scheme' => $request->getUri()->getScheme(),
                   'http.request.host' => $request->getUri()->getHost(),
                   'http.request.port' => $request->getUri()->getPort(),
                   'http.request.user_agent' => $request->getHeaderLine('User-Agent'),
-                  'http.request.headers' => $request->getHeaders(),
+                  // 仅在开关开启时上报请求头，且使用脱敏版本
+                  'http.request.headers' => $this->switcher->isTracingExtraTagEnabled('http.request.headers') ? $sanitizedReqHeaders : null,
                   // Other
                   'coroutine.id' => Coroutine::id(),
                   'http.system' => 'guzzle',
                   'http.guzzle.config' => $guzzleConfig,
                   'http.guzzle.options' => $options ?? [],
                   'duration' => $stats->getTransferTime() * 1000, // in milliseconds
-                ]);
+                ];
+                // 去除为 null 的键，避免污染数据
+                $span->setData(array_filter($data, static fn($v) => $v !== null));
@@
-                        $span->setData([
-                            'http.response.status_code' => $response->getStatusCode(),
-                            'http.response.reason' => $response->getReasonPhrase(),
-                            'http.response.headers' => $response->getHeaders(),
-                            'http.response.body.size' => $response->getBody()->getSize() ?? 0,
-                            'http.response_content_length' => $response->getHeaderLine('Content-Length'),
-                            'http.decoded_response_content_length' => $response->getHeaderLine('X-Decoded-Content-Length'),
-                            'http.response_transfer_size' => $response->getHeaderLine('Content-Length'),
-                        ]);
+                        // 脱敏响应头，仅在开关开启时上报
+                        $respHeaders = $response->getHeaders();
+                        $sanitizedRespHeaders = [];
+                        foreach ($respHeaders as $k => $v) {
+                            if (in_array(strtolower($k), ['set-cookie'], true)) {
+                                continue;
+                            }
+                            $sanitizedRespHeaders[$k] = $v;
+                        }
+                        $respData = [
+                            'http.response.status_code' => $response->getStatusCode(),
+                            'http.response.reason' => $response->getReasonPhrase(),
+                            'http.response.headers' => $this->switcher->isTracingExtraTagEnabled('http.response.headers') ? $sanitizedRespHeaders : null,
+                            'http.response.body.size' => $response->getBody()->getSize() ?? 0,
+                            'http.response_content_length' => $response->getHeaderLine('Content-Length'),
+                            'http.decoded_response_content_length' => $response->getHeaderLine('X-Decoded-Content-Length'),
+                            'http.response_transfer_size' => $response->getHeaderLine('Content-Length'),
+                        ];
+                        $span->setData(array_filter($respData, static fn($v) => $v !== null));

说明：

• 对敏感头部做黑名单过滤，并以开关控制是否上报 headers。
• 保持已有的 http.response.body.contents 行为受开关控制。

src/sentry/src/Tracing/Aspect/CacheAspect.php (1)

98-102: 修复 strlen(json_encode(...)) 在失败时的类型错误风险
json_encode 失败会返回 false，传入 strlen 会触发 TypeError（PHP 8.1+）。为安全应转为字符串。

建议修改为：

-                    'item_size' => match (true) {
-                        isset($arguments['value']) => strlen(json_encode($arguments['value'])),
-                        isset($arguments['values']) && is_array($arguments['values']) => strlen(json_encode(array_values($arguments['values']))),
-                        default => 0,
-                    },
+                    'item_size' => match (true) {
+                        isset($arguments['value']) => strlen((string) json_encode($arguments['value'])),
+                        isset($arguments['values']) && is_array($arguments['values']) => strlen((string) json_encode(array_values($arguments['values']))),
+                        default => 0,
+                    },

src/sentry/src/Tracing/Aspect/AsyncQueueJobMessageAspect.php (1)

96-115: 可能的空 Span 导致 Carrier 构建报错
这里未判断 $scope->getSpan() 结果；若无当前 span，Carrier::fromSpan($span) 可能报错。建议与 AMQP 处一致增加空值保护。

建议修改为：

-            function (Scope $scope) use ($proceedingJoinPoint, $messageId, $destinationName, $bodySize) {
-                $span = $scope->getSpan();
-                $carrier = Carrier::fromSpan($span)->with([
-                    'publish_time' => microtime(true),
-                    'message_id' => $messageId,
-                    'destination_name' => $destinationName,
-                    'body_size' => $bodySize,
-                ]);
-
-                Context::set(Constants::TRACE_CARRIER, $carrier);
+            function (Scope $scope) use ($proceedingJoinPoint, $messageId, $destinationName, $bodySize) {
+                $span = $scope->getSpan();
+                if ($span) {
+                    $carrier = Carrier::fromSpan($span)->with([
+                        'publish_time' => microtime(true),
+                        'message_id' => $messageId,
+                        'destination_name' => $destinationName,
+                        'body_size' => $bodySize,
+                    ]);
+                    Context::set(Constants::TRACE_CARRIER, $carrier);
+                }
 
                 return $proceedingJoinPoint->process();
             },

src/sentry/src/Tracing/Aspect/DbAspect.php (1)

81-86: 安全遍历绑定参数，避免 foreach(null) 警告
当未提供 bindings 时，foreach 目标可能为 null，存在运行时警告风险。

建议改为：

-        if ($this->switcher->isTracingExtraTagEnabled('db.sql.bindings', true)) {
-            $data['db.sql.bindings'] = $arguments['arguments']['bindings'] ?? [];
-            foreach ($arguments['arguments']['bindings'] as $key => $value) {
-                $data['db.parameter.' . $key] = $value;
-            }
-        }
+        if ($this->switcher->isTracingExtraTagEnabled('db.sql.bindings', true)) {
+            $bindings = (array) ($arguments['arguments']['bindings'] ?? []);
+            $data['db.sql.bindings'] = $bindings;
+            foreach ($bindings as $key => $value) {
+                $data['db.parameter.' . $key] = $value;
+            }
+        }

src/sentry/src/Tracing/Listener/EventHandleListener.php (4)

223-236: 事务 BEGIN 跨度被立即结束，后续 COMMIT/ROLLBACK 结束了错误的 span（严重问题）。

这里使用 trace() 会在回调返回后立刻 finish 事务 span；随后的 COMMIT/ROLLBACK 调用 getCurrentHub()->getSpan() 取到的很可能是请求的活动 span（例如 request.received），导致错误的 span 被 finish。

建议显式创建 child span、设置为当前活动 span，并存入 Context 以便后续提交/回滚时准确结束：

-        trace(
-            fn () => null,
-            SpanContext::make()
-                ->setOp('db.transaction')
-                ->setDescription('BEGIN')
-                ->setOrigin('auto.db')
-                ->setStartTimestamp(microtime(true))
-                ->setData([
-                    'coroutine.id' => Coroutine::id(),
-                    'db.system' => $event->connection->getDriverName(),
-                    'db.name' => $event->connection->getDatabaseName(),
-                    'db.pool.name' => $event->connectionName,
-                ])
-        );
+        $transaction = SentrySdk::getCurrentHub()->getTransaction();
+        if ($transaction) {
+            $span = $transaction->startChild(
+                SpanContext::make()
+                    ->setOp('db.transaction')
+                    ->setDescription('BEGIN')
+                    ->setOrigin('auto.db')
+                    ->setStartTimestamp(microtime(true))
+                    ->setData([
+                        'coroutine.id' => Coroutine::id(),
+                        'db.system' => $event->connection->getDriverName(),
+                        'db.name' => $event->connection->getDatabaseName(),
+                        'db.pool.name' => $event->connectionName,
+                    ])
+            );
+            SentrySdk::getCurrentHub()->setSpan($span);
+            Context::set('sentry.db.transaction.span.' . $event->connectionName, $span);
+        }

---

239-251: COMMIT 结束了当前活动 span 而非事务 span（严重问题）。

应取回 BEGIN 时存入 Context 的事务 span 并结束，避免误伤 request.received 等其他 span。

-        if (! $span = SentrySdk::getCurrentHub()->getSpan()) {
-            return;
-        }
-
-        $span->setStatus(SpanStatus::ok())
-            ->setDescription('COMMIT')
-            ->finish();
+        $span = Context::get('sentry.db.transaction.span.' . $event->connectionName);
+        if (! $span) {
+            return;
+        }
+        $span->setStatus(SpanStatus::ok())
+            ->setDescription('COMMIT')
+            ->finish();
+        Context::set('sentry.db.transaction.span.' . $event->connectionName, null);
+        SentrySdk::getCurrentHub()->setSpan(SentrySdk::getCurrentHub()->getTransaction());

---

253-265: ROLLBACK 同样结束了错误的 span（严重问题）。

与 COMMIT 相同，需用 Context 中保存的事务 span。

-        if (! $span = SentrySdk::getCurrentHub()->getSpan()) {
-            return;
-        }
-
-        $span->setStatus(SpanStatus::internalError())
-            ->setDescription('ROLLBACK')
-            ->finish();
+        $span = Context::get('sentry.db.transaction.span.' . $event->connectionName);
+        if (! $span) {
+            return;
+        }
+        $span->setStatus(SpanStatus::internalError())
+            ->setDescription('ROLLBACK')
+            ->finish();
+        Context::set('sentry.db.transaction.span.' . $event->connectionName, null);
+        SentrySdk::getCurrentHub()->setSpan(SentrySdk::getCurrentHub()->getTransaction());

---

458-501: 避免默认记录 Redis 参数，建议受开关控制；同时保持现有结果记录开关。

Redis 参数可能包含敏感信息（安全与合规风险）。建议仅在明确开启时记录。

应用以下修改：将参数写入从 setData 初始数组移除，改为在回调中按开关写入。

-        trace(
-            function (Scope $scope) use ($event) {
+        trace(
+            function (Scope $scope) use ($event) {
                 if (! $span = $scope->getSpan()) {
                     return;
                 }
 
                 if ($this->switcher->isTracingExtraTagEnabled('redis.result')) {
                     $span->setData(['db.redis.result' => $event->result]);
                 }
 
+                if ($this->switcher->isTracingExtraTagEnabled('redis.parameters')) {
+                    $span->setData(['db.redis.parameters' => $event->parameters]);
+                }
+
                 if ($exception = $event->throwable) {
                     $span->setStatus(SpanStatus::internalError())
                         ->setTags([
                             'error' => 'true',
                             'exception.class' => $exception::class,
                             'exception.code' => (string) $exception->getCode(),
                         ])
                         ->setData([
                             'exception.message' => $exception->getMessage(),
                         ]);
                     if ($this->switcher->isTracingExtraTagEnabled('exception.stack_trace')) {
                         $span->setData(['exception.stack_trace' => (string) $exception]);
                     }
                 }
             },
             SpanContext::make()
 
                 ->setOp('db.redis')
                 ->setDescription($redisStatement)
                 ->setData([
                     'coroutine.id' => Coroutine::id(),
                     'db.system' => 'redis',
                     'db.statement' => $redisStatement,
                     'db.redis.connection' => $event->connectionName,
                     'db.redis.database_index' => $config['db'] ?? 0,
-                    'db.redis.parameters' => $event->parameters,
                     'db.redis.pool.name' => $event->connectionName,
                     'db.redis.pool.max' => $pool->getOption()->getMaxConnections(),
                     'db.redis.pool.max_idle_time' => $pool->getOption()->getMaxIdleTime(),
                     'db.redis.pool.idle' => $pool->getConnectionsInChannel(),
                     'db.redis.pool.using' => $pool->getCurrentConnections(),
                     'duration' => $event->time * 1000,
                 ])
                 ->setStartTimestamp(microtime(true) - $event->time / 1000)
         );