fix(sentry): scrub percent-encoded Matrix IDs and opaque base64url tokens from URLs

[Just-Insane]

Description

Extends scrubMatrixUrl with two additional patterns that were leaking through the existing scrubber.

1. Opaque Matrix IDs with percent-encoded colon (%3A)

Device IDs, filter tokens, and other Matrix IDs that lack a sigil prefix but follow the localpart%3Aserver pattern were not matched by the existing sigil-based patterns. For example:

/Gj3Wy2D8gAi8jTIyR%3Asable.moe  →  /[MATRIX_ID]

2. Long opaque base64url path segments

Access tokens, Curve25519 keys, MSC3575 session tokens, and push endpoints appear as 30+ character base64url strings in URL path segments. These were passing through unscrubbed. For example:

/vI02CuiDNpaYEhUIVLbqE8vdKqm2ZwqIR5Y6NwNY_Rg/  →  /[REDACTED]/

The new pattern runs last so the earlier sigil-based patterns already handle known Matrix IDs first.

Fixes #

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• My changes generate no new warnings

AI disclosure:

• Partially AI assisted
• Fully AI generated

Two regex patterns added to scrubMatrixUrl in sentryScrubbers.ts. The first matches path segments containing a bare localpart%3Aserver form (no sigil) and replaces with [MATRIX_ID]. The second matches any path segment of 30 or more base64url characters and replaces with [REDACTED], covering access tokens, crypto keys, and opaque session identifiers. Both are appended after the existing patterns so known sigil-prefixed IDs are handled first.

[dozro]

hey it seems like you're missing a changeset. Can you please add a changeset, as described here https://github.com/SableClient/Sable/blob/dev/CONTRIBUTING.md#documenting-a-change

Thank you :3

[Just-Insane]

hey it seems like you're missing a changeset. Can you please add a changeset, as described here dev/CONTRIBUTING.md#documenting-a-change

Thank you :3

Yup, working on it.

[dozro]

changes in the code lgtm