feat(ktor): Add URL data to client spans

CHANGELOG.md

@@ -49,6 +49,10 @@
 - Remove deprecated OpenTelemetry integration classes and the legacy `SentrySpanStorage` ([#6243](https://github.com/getsentry/sentry-java/pull/6243))
 - Decide whether foregrounding the app starts a new session on a monotonic clock instead of the wall clock, so that a device time change no longer starts a session that should have been resumed, or resumes one that should have ended. This affects session counts ([#6096](https://github.com/getsentry/sentry-java/pull/6096))
 
+### Features
+
+- Add policy-controlled URL query parameters and fragments to Ktor HTTP client spans ([#6433](https://github.com/getsentry/sentry-java/pull/6433))
+
 ## 8.62.0
 
 ### Improvements

sentry-ktor-client/src/main/java/io/sentry/ktorClient/SentryKtorClientPlugin.kt

@@ -118,6 +118,7 @@ public val SentryKtorClientPlugin: ClientPlugin<SentryKtorClientPluginConfig> =
       val urlDetails = UrlUtils.parse(rawUrl, effectiveScopes.options.dataCollectionResolver)
       val spanDescription = "${request.method.value.toString()} ${urlDetails.urlOrFallback}"
       val span: ISpan? = parentSpan?.startChild(spanOp, spanDescription)
+      urlDetails.applyToSpan(span)
       if (span != null) {
         span.spanContext.origin = TRACE_ORIGIN
         request.attributes.put(requestSpanKey, span)

sentry-ktor-client/src/test/java/io/sentry/ktorClient/SentryKtorClientPluginTest.kt

@@ -556,13 +556,47 @@ class SentryKtorClientPluginTest {
   }
 
   @Test
-  fun `span description excludes query parameters and fragment`(): Unit = runBlocking {
+  fun `span description excludes query parameters and fragment while span data includes them`():
+    Unit = runBlocking {
     val sut = fixture.getSut()
     sut.get(fixture.server.url("/hello?token=secret&page=1#results").toString())
 
     val httpClientSpan = fixture.sentryTracer.children.first()
-    assertEquals("GET ${fixture.server.url("/hello")}", httpClientSpan.description)
-    assertNull(httpClientSpan.data[SpanDataConvention.HTTP_QUERY_KEY])
+    assertThat(httpClientSpan.description).isEqualTo("GET ${fixture.server.url("/hello")}")
+    assertThat(httpClientSpan.data[SpanDataConvention.HTTP_QUERY_KEY])
+      .isEqualTo("token=secret&page=1")
+    assertThat(httpClientSpan.data[SpanDataConvention.HTTP_FRAGMENT_KEY]).isEqualTo("results")
+  }
+
+  @Test
+  fun `data collection filters span query parameters`(): Unit = runBlocking {
+    val sut =
+      fixture.getSut(
+        optionsConfiguration =
+          Sentry.OptionsConfiguration {
+            it.dataCollection.urlQueryParams = KeyValueCollectionBehavior.denyList("token")
+          }
+      )
+    sut.get(fixture.server.url("/hello?name=value&token=secret").toString())
+
+    val httpClientSpan = fixture.sentryTracer.children.first()
+    assertThat(httpClientSpan.data[SpanDataConvention.HTTP_QUERY_KEY])
+      .isEqualTo("name=value&token=[Filtered]")
+  }
+
+  @Test
+  fun `data collection can disable span query parameters`(): Unit = runBlocking {
+    val sut =
+      fixture.getSut(
+        optionsConfiguration =
+          Sentry.OptionsConfiguration {
+            it.dataCollection.urlQueryParams = KeyValueCollectionBehavior.off()
+          }
+      )
+    sut.get(fixture.server.url("/hello?name=value").toString())
+
+    val httpClientSpan = fixture.sentryTracer.children.first()
+    assertThat(httpClientSpan.data).doesNotContainKey(SpanDataConvention.HTTP_QUERY_KEY)
   }
 
   @Test