getsentry / getsentry/sentry-java
Session-end timer runs on java.util.Timer
未關閉
Platform: Java
- 主要語言
- Kotlin
- 星號
- 1.4k
- 分支
- 478
- 平均合併
- 3 天 4 小時
- 30 天內合併 PR
- 72
描述
Audit finding **B2 — actual bug, MEDIUM**.
`LifecycleWatcher` schedules session end with `java.util.Timer` (`new Timer(true)` / `scheduleEndSession`, `sentry-android-core/src/main/java/io/sentry/android/core/LifecycleWatcher.java:106-122`), sharing B1's mechanics:
* Device sleeps within the 30s background window → session ends only at wake; `Session.end()` stamps wake time → inflated session durations in release health. Replay `stop()` and `ContinuousProfiler.close(false)` also run hours late.
* The foreground check `lastUpdatedSession + sessionIntervalMillis <= now` is a wall-clock interval → a clock step causes spurious or missed session rotation.
Source: [JAVA-557]() §B2.
貢獻指南
評估
這個 Issue 還沒有評估資料。