Redact URLs in automatic Rails breadcrumbs

CHANGELOG.md

@@ -1,6 +1,13 @@
 Changelog
 =========
 
+## TBD
+
+### Fixes
+
+* Redact URLs in automatic Rails breadcrumbs
+  | [#805](https://github.com/bugsnag/bugsnag-ruby/pull/805)
+
 ## v6.26.0 (19 July 2023)
 
 ### Enhancements

features/fixtures/expected_breadcrumbs/request.json

@@ -6,8 +6,8 @@
         "controller": "BreadcrumbsController",
         "action": "handled",
         "method": "GET",
-        "path": "/breadcrumbs/handled",
+        "path": "/breadcrumbs/handled?password=[FILTERED]&abc=xyz",
         "event_name": "start_processing.action_controller",
         "event_id": ".*"
     }
-}
+}

features/rails_features/breadcrumbs.feature

@@ -3,7 +3,7 @@ Feature: Rails automatic breadcrumbs
 @rails3 @rails4 @rails5 @rails6 @rails7
 Scenario: Request breadcrumb
   Given I start the rails service
-  When I navigate to the route "/breadcrumbs/handled" on the rails app
+  When I navigate to the route "/breadcrumbs/handled?password=secret&abc=xyz" on the rails app
   And I wait to receive an error
   Then the error is valid for the error reporting API version "4.0" for the "Ruby Bugsnag Notifier" notifier
   And the event contains a breadcrumb matching the JSON fixture in "features/fixtures/expected_breadcrumbs/request.json"

lib/bugsnag/integrations/railtie.rb

@@ -24,7 +24,8 @@ def event_subscription(event)
         filtered_data[:event_name] = event[:id]
         filtered_data[:event_id] = event_id
 
-        if event[:id] == "sql.active_record"
+        case event[:id]
+        when "sql.active_record"
           if data.key?(:binds)
             binds = data[:binds].each_with_object({}) { |bind, output| output[bind.name] = '?' if defined?(bind.name) }
             filtered_data[:binds] = JSON.dump(binds) unless binds.empty?
@@ -36,6 +37,12 @@ def event_subscription(event)
             # the connection ID is the object_id of the connection object
             filtered_data[:connection_id] = data[:connection].object_id
           end
+
+        when "start_processing.action_controller"
+          filtered_data[:path] = Bugsnag.cleaner.clean_url(data[:path]) if data.key?(:path)
+
+        when "redirect_to.action_controller"
+          filtered_data[:location] = Bugsnag.cleaner.clean_url(data[:location]) if data.key?(:location)
         end
 
         Bugsnag.leave_breadcrumb(