fix(scrubber): Scrub request bodies that are JSON arrays (#7561)

### Description

`scrub_request` only calls `scrub_dict` on `event["request"]["data"]`,
and `scrub_dict` returns immediately for anything that isn't a dict. So
a body that parses to a top level JSON array is skipped entirely and
every secret in it ships in the clear. It happens under the default
scrubber, no config needed.

`scrub_list` already handles this shape. Its docstring says it walks a
list and any nested lists and calls `scrub_dict` on every dictionary it
finds, and `scrub_dict` already hands nested lists to it when
`recursive` is on. It just was never called on the request body.

What changed:

* `scrub_request` now calls `scrub_dict` and then `scrub_list` on
`event["request"]["data"]`. Each one ignores the type it doesn't handle,
so dict bodies behave exactly as before.
* Two tests in `tests/test_scrubber.py`, one for a list body under the
default scrubber and one for a dict nested inside a list body with
`recursive=True`.

One thing worth your call: `scrub_list` recurses into nested lists no
matter what `recursive` is set to, so `[[{"password": "x"}]]` now gets
filtered where today it isn't. That only ever filters more, never less.
If you'd rather keep the shallow path exact I can gate the call on
`self.recursive` instead.


Fixes #7543

Author: Om-singhaI

sentry_sdk/scrubber.py

@@ -128,7 +128,9 @@ def scrub_request(self, event: "Event") -> None:
                 if "cookies" in event["request"]:
                     self.scrub_dict(event["request"]["cookies"])
                 if "data" in event["request"]:
-                    self.scrub_dict(event["request"]["data"])
+                    data = event["request"]["data"]
+                    self.scrub_dict(data)  # no-op unless data is a dict
+                    self.scrub_list(data)  # no-op unless data is a list
 
     def scrub_extra(self, event: "Event") -> None:
         with capture_internal_exceptions():

tests/test_scrubber.py

@@ -62,6 +62,59 @@ def test_request_scrubbing(sentry_init, capture_events):
     }
 
 
+def test_request_scrubbing_list_body(sentry_init, capture_events):
+    sentry_init()
+    events = capture_events()
+
+    try:
+        1 / 0
+    except ZeroDivisionError:
+        ev, _hint = event_from_exception(sys.exc_info())
+
+        ev["request"] = {
+            "data": [
+                {"token": "secret", "foo": "bar"},
+                {"password": "secret", "baz": "qux"},
+            ],
+        }
+
+        capture_event(ev)
+
+    (event,) = events
+
+    assert event["request"] == {
+        "data": [
+            {"token": "[Filtered]", "foo": "bar"},
+            {"password": "[Filtered]", "baz": "qux"},
+        ],
+    }
+
+    assert event["_meta"]["request"] == {
+        "data": {
+            "0": {"token": {"": {"rem": [["!config", "s"]]}}},
+            "1": {"password": {"": {"rem": [["!config", "s"]]}}},
+        }
+    }
+
+
+def test_recursive_request_scrubbing_list_body(sentry_init, capture_events):
+    sentry_init(event_scrubber=EventScrubber(recursive=True))
+    events = capture_events()
+
+    try:
+        1 / 0
+    except ZeroDivisionError:
+        ev, _hint = event_from_exception(sys.exc_info())
+
+        ev["request"] = {"data": [{"deep": {"password": "secret"}}]}
+
+        capture_event(ev)
+
+    (event,) = events
+
+    assert event["request"] == {"data": [{"deep": {"password": "[Filtered]"}}]}
+
+
 def test_ip_address_not_scrubbed_when_pii_enabled(sentry_init, capture_events):
     sentry_init(send_default_pii=True)
     events = capture_events()