fix(pyreqwest): prevent middleware stacking and dedupe middleware span logic

Co-Authored-By: gpt-5.3-codex-high <noreply@anthropic.com>

Author: cursoragent

sentry_sdk/integrations/pyreqwest.py

@@ -1,4 +1,6 @@
 import sentry_sdk
+from collections import deque
+from contextlib import contextmanager
 from sentry_sdk import start_span
 from sentry_sdk.consts import OP, SPANDATA
 from sentry_sdk.integrations import Integration, DidNotEnable
@@ -16,16 +18,23 @@
 )
 
 from typing import TYPE_CHECKING
+from weakref import WeakSet
 
 if TYPE_CHECKING:
     from typing import Any
+    from typing import Iterator
 
 
 import importlib.util
 
 if importlib.util.find_spec("pyreqwest") is None:
     raise DidNotEnable("pyreqwest is not installed")
 
+_MAX_TRACKED_NON_WEAKREF_BUILDERS = 2048
+_instrumented_builders = WeakSet()  # type: "WeakSet[Any]"
+_instrumented_non_weakref_builder_ids = set()  # type: "set[int]"
+_instrumented_non_weakref_builder_ids_order = deque()  # type: "deque[int]"
+
 
 class PyreqwestIntegration(Integration):
     identifier = "pyreqwest"
@@ -74,24 +83,52 @@ def _patch_builder_method(cls: type, method_name: str, middleware: "Any") -> Non
     original_method = getattr(cls, method_name)
 
     def sentry_patched_method(self: "Any", *args: "Any", **kwargs: "Any") -> "Any":
-        if not getattr(self, "_sentry_instrumented", False):
+        if not _builder_is_instrumented(self):
             integration = sentry_sdk.get_client().get_integration(PyreqwestIntegration)
             if integration is not None:
                 self.with_middleware(middleware)
-                try:
-                    self._sentry_instrumented = True
-                except (TypeError, AttributeError):
-                    # In case the instance itself is immutable or doesn't allow extra attributes
-                    pass
+                _mark_builder_instrumented(self)
         return original_method(self, *args, **kwargs)
 
     setattr(cls, method_name, sentry_patched_method)
 
 
-async def sentry_async_middleware(request: "Any", next_handler: "Any") -> "Any":
-    if sentry_sdk.get_client().get_integration(PyreqwestIntegration) is None:
-        return await next_handler.run(request)
+def _builder_is_instrumented(builder: "Any") -> bool:
+    if getattr(builder, "_sentry_instrumented", False):
+        return True
+
+    if id(builder) in _instrumented_non_weakref_builder_ids:
+        return True
+
+    try:
+        return builder in _instrumented_builders
+    except TypeError:
+        return False
+
 
+def _mark_builder_instrumented(builder: "Any") -> None:
+    try:
+        _instrumented_builders.add(builder)
+    except TypeError:
+        builder_id = id(builder)
+        if builder_id not in _instrumented_non_weakref_builder_ids:
+            _instrumented_non_weakref_builder_ids.add(builder_id)
+            _instrumented_non_weakref_builder_ids_order.append(builder_id)
+            if (
+                len(_instrumented_non_weakref_builder_ids_order)
+                > _MAX_TRACKED_NON_WEAKREF_BUILDERS
+            ):
+                old_builder_id = _instrumented_non_weakref_builder_ids_order.popleft()
+                _instrumented_non_weakref_builder_ids.discard(old_builder_id)
+
+    try:
+        builder._sentry_instrumented = True
+    except (TypeError, AttributeError):
+        pass
+
+
+@contextmanager
+def _sentry_middleware_span(request: "Any") -> "Iterator[Any]":
     parsed_url = None
     with capture_internal_exceptions():
         parsed_url = parse_url(str(request.url), sanitize=False)
@@ -127,60 +164,29 @@ async def sentry_async_middleware(request: "Any", next_handler: "Any") -> "Any":
                 else:
                     request.headers[key] = value
 
-        response = await next_handler.run(request)
-
-        span.set_http_status(response.status)
+        yield span
 
     with capture_internal_exceptions():
         add_http_request_source(span)
 
-    return response
-
 
-def sentry_sync_middleware(request: "Any", next_handler: "Any") -> "Any":
+async def sentry_async_middleware(request: "Any", next_handler: "Any") -> "Any":
     if sentry_sdk.get_client().get_integration(PyreqwestIntegration) is None:
-        return next_handler.run(request)
+        return await next_handler.run(request)
 
-    parsed_url = None
-    with capture_internal_exceptions():
-        parsed_url = parse_url(str(request.url), sanitize=False)
+    with _sentry_middleware_span(request) as span:
+        response = await next_handler.run(request)
+        span.set_http_status(response.status)
 
-    with start_span(
-        op=OP.HTTP_CLIENT,
-        name="%s %s"
-        % (
-            request.method,
-            parsed_url.url if parsed_url else SENSITIVE_DATA_SUBSTITUTE,
-        ),
-        origin=PyreqwestIntegration.origin,
-    ) as span:
-        span.set_data(SPANDATA.HTTP_METHOD, request.method)
-        if parsed_url is not None:
-            span.set_data("url", parsed_url.url)
-            span.set_data(SPANDATA.HTTP_QUERY, parsed_url.query)
-            span.set_data(SPANDATA.HTTP_FRAGMENT, parsed_url.fragment)
+    return response
 
-        if should_propagate_trace(sentry_sdk.get_client(), str(request.url)):
-            for (
-                key,
-                value,
-            ) in sentry_sdk.get_current_scope().iter_trace_propagation_headers():
-                logger.debug(
-                    "[Tracing] Adding `{key}` header {value} to outgoing request to {url}.".format(
-                        key=key, value=value, url=request.url
-                    )
-                )
 
-                if key == BAGGAGE_HEADER_NAME:
-                    add_sentry_baggage_to_headers(request.headers, value)
-                else:
-                    request.headers[key] = value
+def sentry_sync_middleware(request: "Any", next_handler: "Any") -> "Any":
+    if sentry_sdk.get_client().get_integration(PyreqwestIntegration) is None:
+        return next_handler.run(request)
 
+    with _sentry_middleware_span(request) as span:
         response = next_handler.run(request)
-
         span.set_http_status(response.status)
 
-    with capture_internal_exceptions():
-        add_http_request_source(span)
-
     return response

tests/integrations/pyreqwest/test_pyreqwest.py

@@ -9,7 +9,11 @@
 
 from sentry_sdk import start_transaction
 from sentry_sdk.consts import SPANDATA
-from sentry_sdk.integrations.pyreqwest import PyreqwestIntegration
+from sentry_sdk.integrations.pyreqwest import (
+    PyreqwestIntegration,
+    _patch_builder_method,
+    sentry_sync_middleware,
+)
 from tests.conftest import get_free_port
 
 
@@ -55,6 +59,64 @@ def clear_captured_requests():
     PyreqwestMockHandler.captured_requests.clear()
 
 
+def test_patch_builder_method_only_adds_middleware_once(monkeypatch):
+    class DummyClient:
+        @staticmethod
+        def get_integration(_integration):
+            return object()
+
+    monkeypatch.setattr(
+        "sentry_sdk.integrations.pyreqwest.sentry_sdk.get_client", lambda: DummyClient()
+    )
+
+    class Builder:
+        def __init__(self):
+            self.middleware_count = 0
+
+        def with_middleware(self, _middleware):
+            self.middleware_count += 1
+            return self
+
+        def send(self):
+            return self.middleware_count
+
+    _patch_builder_method(Builder, "send", sentry_sync_middleware)
+
+    builder = Builder()
+    assert builder.send() == 1
+    assert builder.send() == 1
+
+
+def test_patch_builder_method_instruments_immutable_builder_once(monkeypatch):
+    class DummyClient:
+        @staticmethod
+        def get_integration(_integration):
+            return object()
+
+    monkeypatch.setattr(
+        "sentry_sdk.integrations.pyreqwest.sentry_sdk.get_client", lambda: DummyClient()
+    )
+
+    class ImmutableBuilder:
+        __slots__ = ("middleware_count",)
+
+        def __init__(self):
+            self.middleware_count = 0
+
+        def with_middleware(self, _middleware):
+            self.middleware_count += 1
+            return self
+
+        def send(self):
+            return self.middleware_count
+
+    _patch_builder_method(ImmutableBuilder, "send", sentry_sync_middleware)
+
+    builder = ImmutableBuilder()
+    assert builder.send() == 1
+    assert builder.send() == 1
+
+
 @pytest.mark.skipif(pyreqwest is None, reason="pyreqwest not installed")
 def test_sync_client_spans(sentry_init, capture_events, server_port):
     sentry_init(integrations=[PyreqwestIntegration()], traces_sample_rate=1.0)