1973017 - Glean lint should automatically flag event dictionary keys labeled "url" or other potentially-indicative-of-PII key names

Status: RESOLVED FIXED

(Data Platform and Tools :: Glean: SDK, enhancement, P1)

Description

[:Gijs (he/him)]

We already have some checks that enforce that certain types of metrics have a particular declared data sensitivity (though I looked and couldn't easily find the code that does that?), but we should expand this to event keys to avoid mis-collecting data at the patch creation stage, instead of later in the process during human review.

Comment 1

[Chris H-C :chutten|PTO (back Oct 23)]

(In reply to :Gijs (he/him) from comment #0)

We already have some checks that enforce that certain types of metrics have a particular declared data sensitivity (though I looked and couldn't easily find the code that does that?),

It's enforced by the schema, and apparently it's only for text, not for url like I expected. Huh.

Comment 2

[BMO Github Automation]

Attachment: [mozilla/glean_parser] Bug 1973017 - New lint: HIGHER_DATA_SENSITIVITY_REQUIRED for when an event extra key could potentially contain sensitive data (#799)

Comment 3

[Jan-Erik Rediger [:janerik]]

badboy merged PR [mozilla/glean_parser]: Bug 1973017 - New lint: HIGHER_DATA_SENSITIVITY_REQUIRED for when an event extra key could potentially contain sensitive data (#799) in fa3cfc5.