From 416e79300dda3a6286aba952caeae10efc274c1e Mon Sep 17 00:00:00 2001
From: Martin Linzmayer <martin.linzmayer@sentry.io>
Date: Tue, 28 Apr 2026 14:35:42 +0200
Subject: [PATCH] fix(logs): guard pii in logs

---
 src/Logs/LogsAggregator.php       | 28 ++++++++++++++-------------
 tests/Logs/LogsAggregatorTest.php | 32 +++++++++++++++++++++++++++++++
 2 files changed, 47 insertions(+), 13 deletions(-)

diff --git a/src/Logs/LogsAggregator.php b/src/Logs/LogsAggregator.php
index bc0b5f302..29571175f 100644
--- a/src/Logs/LogsAggregator.php
+++ b/src/Logs/LogsAggregator.php
@@ -90,20 +90,22 @@ public function add(
             $log->setAttribute('sentry.sdk.version', $client->getSdkVersion());
         }
 
-        $hub->configureScope(static function (Scope $scope) use ($log) {
-            $user = $scope->getUser();
-            if ($user !== null) {
-                if ($user->getId() !== null) {
-                    $log->setAttribute('user.id', $user->getId());
+        if ($options->shouldSendDefaultPii()) {
+            $hub->configureScope(static function (Scope $scope) use ($log) {
+                $user = $scope->getUser();
+                if ($user !== null) {
+                    if ($user->getId() !== null) {
+                        $log->setAttribute('user.id', $user->getId());
+                    }
+                    if ($user->getEmail() !== null) {
+                        $log->setAttribute('user.email', $user->getEmail());
+                    }
+                    if ($user->getUsername() !== null) {
+                        $log->setAttribute('user.name', $user->getUsername());
+                    }
                 }
-                if ($user->getEmail() !== null) {
-                    $log->setAttribute('user.email', $user->getEmail());
-                }
-                if ($user->getUsername() !== null) {
-                    $log->setAttribute('user.name', $user->getUsername());
-                }
-            }
-        });
+            });
+        }
 
         if (\count($values)) {
             $log->setAttribute('sentry.message.template', $message);
diff --git a/tests/Logs/LogsAggregatorTest.php b/tests/Logs/LogsAggregatorTest.php
index 208203432..eb701f5be 100644
--- a/tests/Logs/LogsAggregatorTest.php
+++ b/tests/Logs/LogsAggregatorTest.php
@@ -164,6 +164,7 @@ public function testAttributesAreAddedToLogMessage(): void
     {
         $client = ClientBuilder::create([
             'enable_logs' => true,
+            'send_default_pii' => true,
             'release' => '1.0.0',
             'environment' => 'production',
             'server_name' => 'web-server-01',
@@ -210,6 +211,37 @@ public function testAttributesAreAddedToLogMessage(): void
         $this->assertSame('my_user', $attributes->get('user.name')->getValue());
     }
 
+    public function testUserAttributesAreNotAddedToLogMessageWhenSendDefaultPiiIsDisabled(): void
+    {
+        $client = ClientBuilder::create([
+            'enable_logs' => true,
+            'send_default_pii' => false,
+        ])->getClient();
+
+        $hub = new Hub($client);
+        SentrySdk::setCurrentHub($hub);
+
+        $hub->configureScope(static function (Scope $scope) {
+            $userDataBag = new UserDataBag();
+            $userDataBag->setId('unique_id');
+            $userDataBag->setEmail('foo@example.com');
+            $userDataBag->setUsername('my_user');
+            $scope->setUser($userDataBag);
+        });
+
+        $aggregator = new LogsAggregator();
+        $aggregator->add(LogLevel::info(), 'User performed action');
+
+        $logs = $aggregator->all();
+        $this->assertCount(1, $logs);
+
+        $attributes = $logs[0]->attributes();
+
+        $this->assertNull($attributes->get('user.id'));
+        $this->assertNull($attributes->get('user.email'));
+        $this->assertNull($attributes->get('user.name'));
+    }
+
     public function testFlushesImmediatelyWhenThresholdIsReached(): void
     {
         StubTransport::$events = [];