Guard Next route data behind default pii flag

Author: lforst

packages/nextjs/src/performance/client.ts

@@ -1,5 +1,6 @@
 /* eslint-disable @typescript-eslint/no-explicit-any */
 
+import { getCurrentHub } from '@sentry/hub';
 import { Primitive, TraceparentData, Transaction, TransactionContext } from '@sentry/types';
 import {
   extractTraceparentData,
@@ -93,6 +94,8 @@ let activeTransaction: Transaction | undefined = undefined;
 let prevTransactionName: string | undefined = undefined;
 let startTransaction: StartTransactionCb | undefined = undefined;
 
+const client = getCurrentHub().getClient();
+
 /**
  * Creates routing instrumention for Next Router. Only supported for
  * client side routing. Works for Next >= 10.
@@ -118,7 +121,7 @@ export function nextRouterInstrumentation(
       name: prevTransactionName,
       op: 'pageload',
       tags: DEFAULT_TAGS,
-      ...(params && { data: params }),
+      ...(params && client && client.getOptions().sendDefaultPii && { data: params }),
       ...traceParentData,
       metadata: {
         source,

packages/nextjs/test/performance/client.test.ts

@@ -97,11 +97,6 @@ describe('client', () => {
           tags: {
             'routing.instrumentation': 'next-router',
           },
-          data: {
-            user: 'lforst',
-            id: '1337',
-            q: '42',
-          },
           metadata: {
             source: 'route',
             baggage: [{ environment: 'myEnv', release: '2.1.0' }, '', true],
@@ -129,7 +124,6 @@ describe('client', () => {
           tags: {
             'routing.instrumentation': 'next-router',
           },
-          data: {},
           metadata: {
             source: 'route',
             baggage: [{ environment: 'myEnv', release: '2.1.0' }, '', true],
@@ -151,7 +145,6 @@ describe('client', () => {
           tags: {
             'routing.instrumentation': 'next-router',
           },
-          data: {},
           metadata: {
             source: 'route',
           },

packages/types/src/options.ts

@@ -153,16 +153,11 @@ export interface ClientOptions<TO extends BaseTransportOptions = BaseTransportOp
   tunnel?: string;
 
   /**
-   * Important: This option is currently unused and will only work in the next major version of the SDK
-   *
    * Controls if potentially sensitive data should be sent to Sentry by default.
    * Note that this only applies to data that the SDK is sending by default
    * but not data that was explicitly set (e.g. by calling `Sentry.setUser()`).
-   * Details about the implementation are TBD.
    *
    * Defaults to `false`.
-   *
-   * @ignore
    */
   sendDefaultPii?: boolean;