getsentry / getsentry/sentry

API Delete Debug File endpoint requires different scope and cannot find existing files

Open
#89,107 7 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
44.8k
Forks
4.9k
Avg merge
22h 21m
Merged PRs (30d)
586

Description

### Environment

SaaS (https://sentry.io/)

### Steps to Reproduce

1. Generate an API token with Project Read + Write access
2. Use this generated token (header of Authorization: Bearer ) to get debug files for a project in the org. `GET https://sentry.io/api/0/projects///files/dsyms/?&cursor=20:0:0`
3. See valid debug files that have been uploaded in the recent past. Choose one and record the `id` property. Call it 000000000.
4. Send this delete request with the same auth header used in the GET. `DELETE https://sentry.io/api/0/projects///files/dsyms/?id=000000000`
5. Instead of a valid 200 response, you get a 403 Forbidden.
6. Try elevating privileges. Create a new API Token with the highest access to all scopes. Retry the DELETE call for the same id, but replace the limited access token with this new elevated one.
7. Instead of a valid 200 response, observe a 404 Not Found response.

This was consulted for reference: https://docs.sentry.io/api/projects/delete-a-specific-projects-debug-information-file/

I realize this is potentially two-in-one, but both seem pertinent to the use case of trying to delete a file that hasn't lapsed on the lifetime timer but needs to be removed to save space.

Other things I tried:
I noticed that the returned information for a debug file included an `id`, a `uuid`, and a `debugId`. I tried using each of these as the `?id=` query parameter, but saw no change in behaviour. The API returned 404 every time.

### Expected Result

I expected to be able to use the `project:write` scope in a token to make use of the delete endpoint for the debug files.
I also expected to be able to delete the file that I was able to observe with the GET request immediately prior.

### Actual Result

With the documented scope, I received a 403 Unauthorized for the DELETE request, but a successful 200 response for the GET request.
With the elevated scoped token, I received a 404 Not Found for the DELETE request, but a successful 200 response for the GET request.

### Product Area

APIs

### Link

_No response_

### DSN

https://82d686712b2311765cdd86f35e588331@o1018989.ingest.us.sentry.io/4506867340607488

### Version

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the documented delete endpoint for project debug information files and trace the GET and DELETE handlers for `/api/0/projects///files/dsyms/`. Compare their authorization scope and handling of the returned `id`, `uuid`, and `debugId`; done means the documented scope can delete a file returned by GET and regression coverage verifies both responses.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.