getsentry / sentry-native

Sentry SDK for C, C++ and native applications.
MIT License
404 stars 170 forks source link

feat: check validity of trace- and span-id in context update from header #1046

Closed JoshuaMoelans closed 1 month ago

JoshuaMoelans commented 1 month ago

Analysis of https://github.com/getsentry/sentry-native/issues/1012 showed a potential way for users to send invalid trace and span id values. This can happen when a customer uses sentry_transaction_context_update_from_header(...) which reads a string that looks like traceid-spanid(-sampled)?. The only formatting that currently gets checked is whether there is a first -.

Although these are never used in an unsafe context within our code, it still makes sense to reject the invalid formats on our end rather than relying on Relay to reject them.

The formats we expect are the following (from our docs):

ToDo

github-actions[bot] commented 1 month ago
Messages
:book: Do not forget to update Sentry-docs with your feature once the pull request gets approved.

Generated by :no_entry_sign: dangerJS against 271b06f0a37ccf2f8c69b68f1d8b9d2b00de8ad5

codecov[bot] commented 1 month ago

Codecov Report

Attention: Patch coverage is 96.00000% with 1 line in your changes missing coverage. Please review.

Project coverage is 81.78%. Comparing base (dbb9580) to head (271b06f). Report is 1 commits behind head on master.

Additional details and impacted files ```diff @@ Coverage Diff @@ ## master #1046 +/- ## ========================================== - Coverage 83.33% 81.78% -1.56% ========================================== Files 53 53 Lines 6338 6363 +25 Branches 1198 1207 +9 ========================================== - Hits 5282 5204 -78 - Misses 1042 1046 +4 - Partials 14 113 +99 ```
JoshuaMoelans commented 1 month ago

ToDo: update the docs (think it is this page) with a valid header.

supervacuus commented 1 month ago

I went ahead with the merge and created a docs issue as a follow-up to your todo item: https://github.com/getsentry/sentry-docs/issues/11504