fix(core): gate dynamic route params behind sendDefaultPii

Author: cursoragent

packages/core/src/js/tracing/reactnavigation.ts

@@ -197,6 +197,7 @@ export const reactNavigationIntegration = ({
   let initialStateHandled: boolean = false;
   let stateChangeTimeout: ReturnType<typeof setTimeout> | undefined;
   let recentRouteKeys: string[] = [];
+  let sendDefaultPii: boolean = false;
 
   if (enableTimeToInitialDisplay) {
     NATIVE.initNativeReactNavigationNewFrameTracking().catch((reason: unknown) => {
@@ -208,6 +209,7 @@ export const reactNavigationIntegration = ({
    * Set the initial state and start initial navigation span for the current screen.
    */
   const afterAllSetup = (client: Client): void => {
+    sendDefaultPii = client.getOptions().sendDefaultPii === true;
     tracing = getReactNativeTracingIntegration(client);
     if (tracing) {
       idleSpanOptions = {
@@ -461,7 +463,7 @@ export const reactNavigationIntegration = ({
     latestNavigationSpan.setAttributes({
       'route.name': routeName,
       'route.key': route.key,
-      ...extractDynamicRouteParams(routeName, route.params),
+      ...(sendDefaultPii ? extractDynamicRouteParams(routeName, route.params) : {}),
       'route.has_been_seen': routeHasBeenSeen,
       'previous_route.name': previousRoute?.name,
       'previous_route.key': previousRoute?.key,

packages/core/test/tracing/reactnavigation.test.ts

@@ -1054,7 +1054,7 @@ describe('ReactNavigationInstrumentation', () => {
 
   describe('dynamic route params', () => {
     it('includes dynamic route params from [id] route', async () => {
-      setupTestClient();
+      setupTestClient({ sendDefaultPii: true });
       jest.runOnlyPendingTimers(); // Flush the init transaction
 
       // Navigate to a static screen first so previous_route.name is set to a known value
@@ -1085,7 +1085,7 @@ describe('ReactNavigationInstrumentation', () => {
     });
 
     it('includes dynamic route params from [...slug] catch-all route joined with /', async () => {
-      setupTestClient();
+      setupTestClient({ sendDefaultPii: true });
       jest.runOnlyPendingTimers(); // Flush the init transaction
 
       mockNavigation.navigateToCatchAllRoute();
@@ -1110,6 +1110,22 @@ describe('ReactNavigationInstrumentation', () => {
       );
     });
 
+    it('does not include dynamic route params when sendDefaultPii is disabled', async () => {
+      setupTestClient();
+      jest.runOnlyPendingTimers(); // Flush the init transaction
+
+      mockNavigation.navigateToDynamicRoute();
+      jest.runOnlyPendingTimers();
+
+      await client.flush();
+
+      const actualEvent = client.event;
+      const traceData = actualEvent?.contexts?.trace?.data as Record<string, unknown>;
+
+      expect(traceData[SEMANTIC_ATTRIBUTE_ROUTE_NAME]).toBe('profile/[id]');
+      expect(traceData['route.params.id']).toBeUndefined();
+    });
+
     it('does not include non-dynamic params from static routes', async () => {
       setupTestClient();
       jest.runOnlyPendingTimers(); // Flush the init transaction
@@ -1131,6 +1147,7 @@ describe('ReactNavigationInstrumentation', () => {
     setupOptions: {
       beforeSpanStart?: (options: StartSpanOptions) => StartSpanOptions;
       useDispatchedActionData?: boolean;
+      sendDefaultPii?: boolean;
     } = {},
   ) {
     const rNavigation = reactNavigationIntegration({
@@ -1146,6 +1163,7 @@ describe('ReactNavigationInstrumentation', () => {
     const options = getDefaultTestClientOptions({
       enableNativeFramesTracking: false,
       enableStallTracking: false,
+      sendDefaultPii: setupOptions.sendDefaultPii,
       tracesSampleRate: 1.0,
       integrations: [rNavigation, rnTracing],
       enableAppStartTracking: false,