Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 4 additions & 12 deletions sentry-rails/lib/sentry/rails/capture_exceptions.rb
Original file line number Diff line number Diff line change
Expand Up @@ -36,19 +36,11 @@ def capture_exception(exception, env)
end

def start_transaction(env, scope)
options = {
name: scope.transaction_name,
source: scope.transaction_source,
op: transaction_op,
origin: SPAN_ORIGIN
}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SPAN_ORIGIN resolves to parent's constant via lexical scoping

Medium Severity

By delegating to super, the origin: SPAN_ORIGIN reference in the parent's start_transaction method resolves via lexical scoping to "auto.http.rack" (the parent's constant) instead of "auto.http.rails" (the Rails subclass's constant). Ruby constant lookup uses the lexical scope of where the code is written, not the runtime class of self. Previously, the Rails override built its own options hash referencing its own SPAN_ORIGIN. This is a silent data regression in transaction telemetry.

Fix in Cursor Fix in Web


if @assets_regexp && scope.transaction_name.match?(@assets_regexp)
options.merge!(sampled: false)
super do |options|
if @assets_regexp && scope.transaction_name.match?(@assets_regexp)
options.merge!(sampled: false)
end
Comment on lines +39 to +42
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Calling super causes the transaction's origin to be incorrectly set to the parent class's SPAN_ORIGIN ("auto.http.rack") instead of the correct Rails-specific one ("auto.http.rails").
Severity: MEDIUM

Suggested Fix

To ensure the correct origin is used, explicitly pass origin: SPAN_ORIGIN in the block provided to super. This will override the default value set by the parent method and use the constant defined in the current Rails class.

Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: sentry-rails/lib/sentry/rails/capture_exceptions.rb#L39-L42

Potential issue: The call to `super` within `Sentry::Rails::CaptureExceptions` invokes
the `start_transaction` method from the parent class, `Sentry::Rack::CaptureExceptions`.
This parent method references the constant `SPAN_ORIGIN`. Due to Ruby's lexical constant
scoping, the value resolved will be the one defined in the parent class
(`"auto.http.rack"`) rather than the one in the Rails-specific child class
(`"auto.http.rails"`). This will cause all Rails transactions to be mislabeled with the
generic Rack origin, which is a regression from the previous behavior. The change was
intended to add queue time tracking but inadvertently introduced this side effect.

end

transaction = Sentry.continue_trace(env, **options)
Sentry.start_transaction(transaction: transaction, custom_sampling_context: { env: env }, **options)
end

def show_exceptions?(exception, env)
Expand Down
2 changes: 2 additions & 0 deletions sentry-ruby/lib/sentry/rack/capture_exceptions.rb
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,8 @@ def start_transaction(env, scope)
origin: SPAN_ORIGIN
}

yield(options) if block_given?

transaction = Sentry.continue_trace(env, **options)
transaction = Sentry.start_transaction(transaction: transaction, custom_sampling_context: { env: env }, **options)

Expand Down
Loading