getsentry / getsentry/sentry-java

Session-end timer runs on java.util.Timer

未关闭
#5,576 1 条评论 0 个 reaction 已指派 1 人 已被 @runningcode 认领 在 GitHub 查看
Platform: Java
主要语言
Kotlin
星标
1.4k
派生
478
平均合并
2 天 23 小时
30 天内合并 PR
67

描述

Audit finding **B2 — actual bug, MEDIUM**.

`LifecycleWatcher` schedules session end with `java.util.Timer` (`new Timer(true)` / `scheduleEndSession`, `sentry-android-core/src/main/java/io/sentry/android/core/LifecycleWatcher.java:106-122`), sharing B1's mechanics:

* Device sleeps within the 30s background window → session ends only at wake; `Session.end()` stamps wake time → inflated session durations in release health. Replay `stop()` and `ContinuousProfiler.close(false)` also run hours late.
* The foreground check `lastUpdatedSession + sessionIntervalMillis <= now` is a wall-clock interval → a clock step causes spurious or missed session rotation.

Source: [JAVA-557]() §B2.

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。