preserve encoded values

Author: s1gr1d

dev-packages/node-integration-tests/suites/express/tracing/withError/test.ts

@@ -26,5 +26,21 @@ describe('express tracing with error', () => {
       runner.makeRequest('get', '/test/123/abc?q=1');
       await runner.completed();
     });
+
+    test('preserves encoded query parameters while filtering sensitive values on events', async () => {
+      const runner = createRunner()
+        .ignore('transaction')
+        .expect({
+          event: {
+            request: {
+              query_string: 'q=hello%20world&token=[Filtered]',
+            },
+          },
+        })
+        .start();
+
+      await runner.makeRequest('get', '/test/123/abc?q=hello%20world&token=secret');
+      await runner.completed();
+    });
   });
 });

packages/core/src/integrations/requestdata.ts

@@ -8,7 +8,7 @@ import type { IntegrationFn } from '../types/integration';
 import type { QueryParams, RequestEventData } from '../types/request';
 import type { StreamedSpanJSON } from '../types/span';
 import { parseCookie } from '../utils/cookie';
-import { SENSITIVE_COOKIE_NAME_SNIPPETS } from '../utils/data-collection/filtering-snippets';
+import { FILTERED_VALUE, SENSITIVE_COOKIE_NAME_SNIPPETS } from '../utils/data-collection/filtering-snippets';
 import { filterKeyValueData } from '../utils/data-collection/filterKeyValueData';
 import { filterQueryParams } from '../utils/data-collection/filterQueryParams';
 import { httpHeadersToSpanAttributes } from '../utils/request';
@@ -263,8 +263,14 @@ function filterQueryString(queryString: QueryParams, behavior: CollectBehavior):
     return filtered;
   }
 
-  const result = Object.entries(filtered)
-    .map(([key, value]) => `${key}=${value}`)
+  const result = normalized
+    .split('&')
+    .map(pair => {
+      const [key] = pair.split('=', 1);
+      const normalizedKey = new URLSearchParams(pair).keys().next().value;
+
+      return normalizedKey && filtered[normalizedKey] === FILTERED_VALUE ? `${key}=${FILTERED_VALUE}` : pair;
+    })
     .join('&');
   return result || undefined;
 }

packages/core/test/lib/integrations/requestdata.test.ts

@@ -600,6 +600,19 @@ describe('requestDataIntegration', () => {
       expect(event.request?.query_string).toBe('page=1&token=[Filtered]');
     });
 
+    it('preserves encoded query parameter values while filtering sensitive parameters', () => {
+      const integration = requestDataIntegration();
+      const event: Event = {
+        sdkProcessingMetadata: {
+          normalizedRequest: { query_string: 'q=hello%20world&token=secret' },
+        },
+      };
+
+      integration.processEvent?.(event, {}, mockClient(false));
+
+      expect(event.request?.query_string).toBe('q=hello%20world&token=[Filtered]');
+    });
+
     it('preserves the configured query allowlist when include.query_string is true', () => {
       const integration = requestDataIntegration({ include: { query_string: true } });
       const event: Event = {