ref(security): Stop accepting Expect-CT, HPKP, and Expect-Staple reports

CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## Unreleased
 
+**Breaking Changes**:
+
+- Stop accepting the deprecated Expect-CT, HPKP, and Expect-Staple security reports and remove their
+  event types and event schema fields. Such reports are now rejected at ingest with an `invalid`
+  outcome (`security_report_type`), including events which an older upstream Relay already classified
+  as `hpkp`, `expectct`, or `expectstaple`. ([#6230](https://github.com/getsentry/relay/pull/6230))
+
 **Features**:
 
 - Raise the size limit for the flags context to 128 KiB. ([#6310](https://github.com/getsentry/relay/pull/6310))

relay-base-schema/src/data_category.rs

@@ -28,7 +28,7 @@ pub enum DataCategory {
     ///
     /// SDK rate limiting behavior: apply to the entire envelope if it contains an item `transaction`.
     Transaction = 2,
-    /// Events with an event type of `csp`, `hpkp`, `expectct` and `expectstaple`.
+    /// Events with an event type of `csp`.
     ///
     /// SDK rate limiting behavior: ignore.
     Security = 3,
@@ -400,9 +400,7 @@ impl From<EventType> for DataCategory {
         match ty {
             EventType::Default | EventType::Error => Self::Error,
             EventType::Transaction => Self::Transaction,
-            EventType::Csp | EventType::Hpkp | EventType::ExpectCt | EventType::ExpectStaple => {
-                Self::Security
-            }
+            EventType::Csp => Self::Security,
             EventType::UserReportV2 => Self::UserReportV2,
         }
     }

relay-base-schema/src/events.rs

@@ -16,9 +16,8 @@ use serde::{Deserialize, Serialize};
 ///
 ///  - **Error monitoring events** (`default`, `error`): Processed and grouped into unique issues
 ///    based on their exception stack traces and error messages.
-///  - **Security events** (`csp`, `hpkp`, `expectct`, `expectstaple`): Derived from Browser
-///    security violation reports and grouped into unique issues based on the endpoint and
-///    violation. SDKs do not send such events.
+///  - **Security events** (`csp`): Derived from Browser security violation reports and grouped into
+///    unique issues based on the endpoint and violation. SDKs do not send such events.
 ///  - **Transaction events** (`transaction`): Contain operation spans and collected into traces for
 ///    performance monitoring.
 #[derive(
@@ -30,12 +29,6 @@ pub enum EventType {
     Error,
     /// A CSP violation payload.
     Csp,
-    /// An HPKP violation payload.
-    Hpkp,
-    /// An ExpectCT violation payload.
-    ExpectCt,
-    /// An ExpectStaple violation payload.
-    ExpectStaple,
     /// Performance monitoring transactions carrying spans.
     Transaction,
     /// User feedback payload.
@@ -55,9 +48,6 @@ impl EventType {
             EventType::Default => "default",
             EventType::Error => "error",
             EventType::Csp => "csp",
-            EventType::Hpkp => "hpkp",
-            EventType::ExpectCt => "expectct",
-            EventType::ExpectStaple => "expectstaple",
             EventType::Transaction => "transaction",
             EventType::UserReportV2 => "feedback",
         }
@@ -84,9 +74,6 @@ impl FromStr for EventType {
             "default" => EventType::Default,
             "error" => EventType::Error,
             "csp" => EventType::Csp,
-            "hpkp" => EventType::Hpkp,
-            "expectct" => EventType::ExpectCt,
-            "expectstaple" => EventType::ExpectStaple,
             "transaction" => EventType::Transaction,
             "feedback" => EventType::UserReportV2,
             _ => return Err(ParseEventTypeError),

relay-cabi/include/relay.h

@@ -35,7 +35,7 @@ enum RelayDataCategory {
    */
   RELAY_DATA_CATEGORY_TRANSACTION = 2,
   /**
-   * Events with an event type of `csp`, `hpkp`, `expectct` and `expectstaple`.
+   * Events with an event type of `csp`.
    *
    * SDK rate limiting behavior: ignore.
    */

relay-event-normalization/src/event.rs

@@ -418,9 +418,6 @@ fn normalize_security_report(
 
 fn is_security_report(event: &Event) -> bool {
     event.csp.value().is_some()
-        || event.expectct.value().is_some()
-        || event.expectstaple.value().is_some()
-        || event.hpkp.value().is_some()
 }
 
 /// Backfills IP addresses in various places.
@@ -1222,8 +1219,11 @@ pub fn is_valid_platform(platform: &str) -> bool {
     VALID_PLATFORMS.contains(&platform)
 }
 
-/// Infers the `EventType` from the event's interfaces.
-fn infer_event_type(event: &Event) -> EventType {
+/// Infers the [`EventType`] from the event's interfaces.
+///
+/// This is the type normalization assigns. A declared type is only honoured for transactions and
+/// user feedback.
+pub fn infer_event_type(event: &Event) -> EventType {
     // The event type may be set explicitly when constructing the event items from specific
     // items. This is DEPRECATED, and each distinct event type may get its own base class. For
     // the time being, this is only implemented for transactions, so be specific:
@@ -1246,12 +1246,6 @@ fn infer_event_type(event: &Event) -> EventType {
         EventType::Error
     } else if event.csp.value().is_some() {
         EventType::Csp
-    } else if event.hpkp.value().is_some() {
-        EventType::Hpkp
-    } else if event.expectct.value().is_some() {
-        EventType::ExpectCt
-    } else if event.expectstaple.value().is_some() {
-        EventType::ExpectStaple
     } else {
         EventType::Default
     }

relay-event-normalization/src/lib.rs

@@ -28,7 +28,8 @@ mod validation;
 pub use validation::{EventValidationConfig, validate_event, validate_standalone_span};
 pub mod replay;
 pub use event::{
-    NormalizationConfig, normalize_event, normalize_measurements, normalize_performance_score,
+    NormalizationConfig, infer_event_type, normalize_event, normalize_measurements,
+    normalize_performance_score,
 };
 pub use normalize::breakdowns::*;
 pub use normalize::*;

relay-event-schema/src/protocol/event.rs

@@ -12,10 +12,10 @@ use uuid::Uuid;
 use crate::processor::ProcessValue;
 use crate::protocol::{
     AppContext, Breadcrumb, Breakdowns, BrowserContext, ClientSdkInfo, Contexts, Csp, DebugMeta,
-    DefaultContext, DeviceContext, EventType, Exception, ExpectCt, ExpectStaple, Fingerprint,
-    GpuContext, Hpkp, LenientString, Level, LogEntry, Measurements, Metrics, MonitorContext,
-    OsContext, ProfileContext, RelayInfo, Request, ResponseContext, RuntimeContext, Span, SpanId,
-    Stacktrace, Tags, TemplateInfo, Thread, Timestamp, TraceContext, TransactionInfo, User, Values,
+    DefaultContext, DeviceContext, EventType, Exception, Fingerprint, GpuContext, LenientString,
+    Level, LogEntry, Measurements, Metrics, MonitorContext, OsContext, ProfileContext, RelayInfo,
+    Request, ResponseContext, RuntimeContext, Span, SpanId, Stacktrace, Tags, TemplateInfo, Thread,
+    Timestamp, TraceContext, TransactionInfo, User, Values,
 };
 
 /// Wrapper around a UUID with slightly different formatting.
@@ -444,21 +444,6 @@ pub struct Event {
     #[metastructure(omit_from_schema)] // we only document error events for now
     pub csp: Annotated<Csp>,
 
-    /// HPKP (security) reports.
-    #[metastructure(pii = "true", legacy_alias = "sentry.interfaces.Hpkp")]
-    #[metastructure(omit_from_schema)] // we only document error events for now
-    pub hpkp: Annotated<Hpkp>,
-
-    /// ExpectCT (security) reports.
-    #[metastructure(pii = "true", legacy_alias = "sentry.interfaces.ExpectCT")]
-    #[metastructure(omit_from_schema)] // we only document error events for now
-    pub expectct: Annotated<ExpectCt>,
-
-    /// ExpectStaple (security) reports.
-    #[metastructure(pii = "true", legacy_alias = "sentry.interfaces.ExpectStaple")]
-    #[metastructure(omit_from_schema)] // we only document error events for now
-    pub expectstaple: Annotated<ExpectStaple>,
-
     /// Spans for tracing.
     #[metastructure(max_bytes = 819200)]
     #[metastructure(omit_from_schema)] // we only document error events for now