search

getsentry / self-hosted

Sentry, feature-complete and packaged up for low-volume deployments and proofs-of-concept
https://develop.sentry.dev/self-hosted/
Other
7.94k stars 1.78k forks source link

Disabling source maps fetching instance-wide #1709

Open mikhno-s opened 2 years ago

mikhno-s commented 2 years ago

Problem Statement

We have multiple-organisation setup and we need to have a way to disable source map fetching sentry-wide.

Solution Brainstorm

Add a configuration parameter which disable source map fetching.

hubertdeng123 commented 2 years ago

Hey there, we should actually have this option as per our docs

By default, if Sentry can't find the uploaded files it needs, it will attempt to download them from the URLs in the stacktrace. To disable this, turn off "Enable JavaScript source fetching" in either your organization's "Security & Privacy" settings or your project's general settings.

mikhno-s commented 2 years ago

I ask about "hardcoded" functionality. Because fetching source code can be a cause of huge SSRF vulnerability and I want to remove the possibility to enable this function for managers and owners.

And a bit side question - what service in sentry-architecture performs those requests for source map fetching?

hubertdeng123 commented 2 years ago

Got it, so if I understand this correctly you'd want the sourcemaps completely disabled for everyone during the setup of your self-hosted instance? This request will have to go on our backlog then.

Our cron workers and web workers handle the source map calculation.

mikhno-s commented 2 years ago

So another way how to prevent such problems - I can put services, that are run via sentry run cron and sentry run worker to DMZ, right?

hubertdeng123 commented 2 years ago

By preventing such problems, are you referring to the security issues that might happen?

mikhno-s commented 2 years ago

Yes, potentially SSRF

hubertdeng123 commented 2 years ago

That sounds about right to me, although I'm not entirely certain