getsentry / getsentry/sentry

Symbol source URLs are not properly validated

Open
#85,937 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
44.8k
Forks
4.9k
Avg merge
22h 21m
Merged PRs (30d)
586

Description

Spun off from https://github.com/getsentry/sentry/issues/85052, of which this is the root cause.

For custom HTTP symbol sources, we accept values of the form `foo.bar.baz` (in fact, we accept any string). Then, we a symbolication request is made to Symbolicator, the URL string can't be parsed into a `Url` and Symbolicator returns 400 with a moderately useful error message, e.g.

>"invalid value: string \"symbols.mozilla.org/\", expected relative URL without a base at line 8 column 2"

This error message is swallowed on the Sentry side at https://github.com/getsentry/sentry/blob/ed6ca2038d8f3fe68c2debd6c318ddaada86acab/src/sentry/lang/native/symbolicator.py#L386-L391

and bubbled up to the user in the form of "internal server error". This is obviously very unhelpful and also tricky to debug.

Ideas for improvement:
* Improve symbol source URL validation.
* Instead of just returning "internal server error", attach an event ID so that we can quickly find and diagnose the error.

Contributor guide

Open the contributing guide

Research direction

Start with src/sentry/lang/native/symbolicator.py around lines 386-391, then trace where custom HTTP symbol source URLs are accepted and passed to Symbolicator. Compare the validation and error-handling paths to determine whether malformed URLs should be rejected earlier or receive a diagnostic event ID; the issue is done when the resulting user-facing failure is actionable rather than an internal server error.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.