ProGuard deobfuscation can replace unrelated substrings in exception messages

Issue originally reported against sentry-java at https://github.com/getsentry/sentry-java/issues/6056 (tracked as JAVA-723), but the actual code path lives in this repo's Java event-processing pipeline, not the SDK. See the discussion there for more details.

What's happening?

deobfuscate_exception_value() in src/sentry/lang/java/processing.py builds raw_method_name from the last raw stacktrace frame's module.function and replaces it in the exception message via re.sub(re.escape(raw_method_name), deobfuscated_method_name, exception["value"]). This is a plain substring replace with no word-boundary or context check confirming the match is actually a reference to that frame.

When a ProGuard mapping obfuscates some unrelated class down to a short, ordinary-looking name (e.g. ...AccountsListFragmentKt$$ExternalSyntheticLambda19 -> en:), and the exception message happens to contain that same string for an unrelated reason (e.g. a locale code like 'en'), the substring gets swapped for the fully-qualified class name even though it has nothing to do with the frame.

How to reproduce

An exception with message string/pay_anyone_cancel_dialog_positive: requested 'en-IE', got 'en', combined with a ProGuard mapping containing com.monzo.standin.screens.accountslist.AccountsListFragmentKt$$ExternalSyntheticLambda19 -> en:.

Actual: en in the message is deobfuscated to com.monzo.standin.screens.accountslist.AccountsListFragmentKt$$ExternalSyntheticLambda19.

Confidence

Root cause confidence: high — traced directly to the literal substring re.sub in deobfuscate_exception_value (src/sentry/lang/java/processing.py, lines ~20-41).

Requested by adam.brown.

--

View Junior Session [Sentry]

Start in src/sentry/lang/java/processing.py at deobfuscate_exception_value(), especially the re.sub call that replaces raw_method_name in exception["value"]. Reproduce the locale-code example from the issue and verify that unrelated substrings remain unchanged while references to the deobfuscated frame still are replaced.