Symbol source URLs are not properly validated
- Dominant language
- Python
- Stars
- 44.8k
- Forks
- 4.9k
- Avg merge
- 22h 21m
- Merged PRs (30d)
- 586
Description
Spun off from https://github.com/getsentry/sentry/issues/85052, of which this is the root cause.
For custom HTTP symbol sources, we accept values of the form `foo.bar.baz` (in fact, we accept any string). Then, we a symbolication request is made to Symbolicator, the URL string can't be parsed into a `Url` and Symbolicator returns 400 with a moderately useful error message, e.g.
>"invalid value: string \"symbols.mozilla.org/\", expected relative URL without a base at line 8 column 2"
This error message is swallowed on the Sentry side at https://github.com/getsentry/sentry/blob/ed6ca2038d8f3fe68c2debd6c318ddaada86acab/src/sentry/lang/native/symbolicator.py#L386-L391
and bubbled up to the user in the form of "internal server error". This is obviously very unhelpful and also tricky to debug.
Ideas for improvement:
* Improve symbol source URL validation.
* Instead of just returning "internal server error", attach an event ID so that we can quickly find and diagnose the error.
Contributor guide
Research direction
Start with src/sentry/lang/native/symbolicator.py around lines 386-391, then trace where custom HTTP symbol source URLs are accepted and passed to Symbolicator. Compare the validation and error-handling paths to determine whether malformed URLs should be rejected earlier or receive a diagnostic event ID; the issue is done when the resulting user-facing failure is actionable rather than an internal server error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100