x-www-form-urlencoded mistaken for JSON

[dmalan]

We deployed Sentry on one of our Flask apps today (via pip3 install raven[flask]), which revealed a bug we'd overlooked. But in trying to replicate the bug via Sentry's suggested curl command, we noticed that the suggested curl command seems to be mistaking POST data submitted as x-www-form-urlencoded for JSON.

Specifically, the suggested curl command in Sentry's web UI (at a URL of the form https://sentry.io/ORG/PROJECT/issues/#/) suggests using

-H "Content-Type: application/x-www-form-urlencoded"
--data "{\"username\":\"\",\"script\":\"foo\",\"cmd\":\"\",\"format\":\"html\"}"

among other command-line args. But the suggested curl command should actually be

-H "Content-Type: application/x-www-form-urlencoded"
--data "cmd=&format=html&username=&script=foo"

(among other command-line args)?

Perhaps related to #5599, but this is perhaps just an issue in the web UI?

[benvinegar]

This seems like a relative easy change we can make. Could probably be entirely client-side. I'll take a look at an implementation soon.

[evanpurkhiser]

In this specific case, the Flask request recording takes the url encoded form data directly from Flasks request.form attribute, which is an object, not a string.

https://github.com/getsentry/raven-python/blob/7a9455a7baaf0447a934c8dea5ac44a098f2d8d9/raven/contrib/flask.py#L190-L191

Then when rendering in the request as a curl command, because the data is an object we just assume it should be JSON encoded:

sentry/src/sentry/interfaces/http.py

Lines 170 to 175 in 18395ed

	body = data.get('data')
	if isinstance(body, dict):
	body = json.dumps(body)
	if body:
	body = trim(body, settings.SENTRY_MAX_HTTP_BODY_SIZE)

Finally, when rendering it, because it's already a string it doesn't transform it to parameters:

sentry/src/sentry/static/sentry/app/components/events/interfaces/utils.jsx

Lines 33 to 37 in 18395ed

	if (_.isString(data.data)) {
	result += ' \\\n --data "' + escapeQuotes(data.data) + '"';
	} else if (defined(data.data)) {
	result += ' \\\n --data "' + escapeQuotes(jQuery.param(data.data)) + '"';
	}