fix(express) strip query and fragment from tracing URLs (#6586)

packages/tracing-internal/src/node/integrations/express.ts

@@ -1,6 +1,12 @@
 /* eslint-disable max-lines */
 import type { Hub, Integration, PolymorphicRequest, Transaction } from '@sentry/types';
-import { extractPathForTransaction, getNumberOfUrlSegments, isRegExp, logger } from '@sentry/utils';
+import {
+  extractPathForTransaction,
+  getNumberOfUrlSegments,
+  isRegExp,
+  logger,
+  stripUrlQueryAndFragment,
+} from '@sentry/utils';
 
 import { shouldDisableAutoInstrumentation } from './utils/node-utils';
 
@@ -343,7 +349,7 @@ function instrumentRouter(appOrRouter: ExpressRouter): void {
       if (transaction && transaction.metadata.source !== 'custom') {
         // If the request URL is '/' or empty, the reconstructed route will be empty.
         // Therefore, we fall back to setting the final route to '/' in this case.
-        const finalRoute = req._reconstructedRoute || '/';
+        const finalRoute = stripUrlQueryAndFragment(req._reconstructedRoute || '/');
 
         transaction.setName(...extractPathForTransaction(req, { path: true, method: true, customRoute: finalRoute }));
       }