TF-4136 security(sentry): scrub sensitive headers without mutating HTTP payloads

core/lib/utils/config/env_loader.dart

@@ -1,5 +1,4 @@
 import 'package:core/utils/app_logger.dart';
-import 'package:flutter/material.dart';
 import 'package:flutter_dotenv/flutter_dotenv.dart';
 
 class EnvLoader {
@@ -21,7 +20,7 @@ class EnvLoader {
 
   static Future<void> loadFcmConfigFileToEnv({
     Map<String, String>? currentMapEnvData,
-    VoidCallback? onCallBack,
+    Future<void> Function()? onCallBack,
   }) async {
     try {
       await dotenv.load(
@@ -30,7 +29,7 @@ class EnvLoader {
       );
     } catch (e) {
       logWarning('EnvLoader::loadFcmConfigFileToEnv: Exception = $e');
-      onCallBack?.call();
+      await onCallBack?.call();
     }
   }
 

core/lib/utils/sentry/sentry_initializer.dart

@@ -4,6 +4,14 @@ import 'package:core/utils/sentry/sentry_config.dart';
 import 'package:sentry_flutter/sentry_flutter.dart';
 
 class SentryInitializer {
+  static const _blockedHeaderPatterns = [
+    'authorization',
+    'cookie',
+    'set-cookie',
+    'x-auth',
+    'x-token',
+  ];
+
   static Future<bool> init(FutureOr<void> Function() appRunner) async {
     final config = await SentryConfig.load();
 
@@ -36,10 +44,37 @@ class SentryInitializer {
     SentryEvent event,
     Hint? hint,
   ) async {
-    // Ignore AssertionError events
-    if (event.throwable is AssertionError) {
-      return null;
-    }
-    return event;
+    final req = event.request;
+    if (req == null) return event;
+
+    final sanitizedHeaders = Map<String, String>.from(req.headers)
+      ..removeWhere(
+        (k, _) => _blockedHeaderPatterns.any(
+          (p) => k.toLowerCase().contains(p),
+        ),
+      );
+
+    final sanitizedRequest = SentryRequest(
+      url: req.url,
+      method: req.method,
+      headers: sanitizedHeaders,
+      queryString: req.queryString,
+      cookies: null,
+      data: null,
+    );
+
+    return SentryEvent(
+      eventId: event.eventId,
+      contexts: event.contexts,
+      throwable: event.throwable,
+      timestamp: event.timestamp,
+      level: event.level,
+      logger: event.logger,
+      request: sanitizedRequest,
+      tags: event.tags,
+      breadcrumbs: event.breadcrumbs,
+      user: event.user,
+      fingerprint: event.fingerprint,
+    );
   }
 }

core/lib/utils/sentry/sentry_manager.dart

@@ -68,7 +68,7 @@ class SentryManager {
           Breadcrumb(
             message: message,
             data: extras,
-            level: SentryLevel.info,
+            level: level,
           ),
         );
       },

docs/configuration/sentry_configuration.md

@@ -21,8 +21,18 @@ SENTRY_ENVIRONMENT=<environment_name>
 ### 2. Activate Sentry in environment file
 In [`env.file`](https://github.com/linagora/tmail-flutter/blob/master/env.file), ensure the following line is present:
 
+- If you want to use Sentry:
 ```bash
-SENTRY_ENABLED=true | false
+SENTRY_ENABLED=true
+```
+
+- If you don't want to use Sentry:
+```bash
+SENTRY_ENABLED=false
+```
+  or
+```bash
+SENTRY_ENABLED=
 ```
 
 ### 3. Verification

lib/main/main_entry.dart

@@ -30,5 +30,7 @@ Future<void> runTmailPreload() async {
   await CozyIntegration.integrateCozy();
   await HiveCacheConfig.instance.initializeEncryptionKey();
 
-  setPathUrlStrategy();
+  if (PlatformInfo.isWeb) {
+    setPathUrlStrategy();
+  }
 }