fix: three defensive bug fixes (DSN cache poisoning, region silent catches, projects silent catches) - #1433
Draft
cursor[bot] wants to merge 3 commits into
Draft
fix: three defensive bug fixes (DSN cache poisoning, region silent catches, projects silent catches)#1433cursor[bot] wants to merge 3 commits into
cursor[bot] wants to merge 3 commits into
Conversation
When setCachedDetection() is called with an empty allDsns array (no DSNs found during detection), it writes dsn="" and project_id="" into the dsn_cache table. getCachedDsn() previously returned these entries as valid cache hits, causing downstream code to receive a CachedDsnEntry with an empty DSN string. This wastes time on verification attempts and inflates cache hit telemetry with bogus entries. Guard getCachedDsn() to return undefined (cache miss) when the stored DSN is empty, so the caller falls through to a fresh detection scan. Co-authored-by: Miguel Betegón <miguelbetegongarcia@gmail.com>
The two catch blocks in resolveEffectiveOrg() silently swallowed errors from resolveOrgRegion() and listOrganizationsUncached(), making it impossible to diagnose why org resolution fell back to the raw slug. Network errors, auth issues, and API failures were completely invisible in debug output. Add log.debug() calls so errors are visible with --verbose, following the project's catch-block logging standard. Co-authored-by: Miguel Betegón <miguelbetegongarcia@gmail.com>
…rations Multiple catch blocks in api/projects.ts silently swallowed errors: - listProjects: cache population failures invisible - seedProjectCaches: project/DSN cache seeding failures invisible - findProjectByDsnKey: per-region lookup failures invisible - tryGetPrimaryDsn: DSN key fetch failures invisible All of these are best-effort operations that correctly fall back on error, but the silent catches made it impossible to diagnose why DSN detection, project resolution, or shell completions were not working. Add log.debug() calls so errors are visible with --verbose. Co-authored-by: Miguel Betegón <miguelbetegongarcia@gmail.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three independent bug fixes found via codebase analysis. Each addresses a different class of silent failure that made debugging CLI issues difficult.
Fix 1:
dsn-cache.ts— Empty DSN cache poisoningRoot cause: When
setCachedDetection()is called with an emptyallDsnsarray (no DSNs found), it storesdsn=""andproject_id=""in thedsn_cachetable.getCachedDsn()then returned these entries as valid cache hits.Reproduction: Run any CLI command in a project with no Sentry DSN configured. The empty row gets stored, then subsequent
detectDsn()calls waste time verifying a bogus cache entry before falling through to full scan.Fix: Guard
getCachedDsn()to returnundefinedwhendsnis empty.Fix 2:
region.ts— Silent catches inresolveEffectiveOrgRoot cause: Two catch blocks silently swallowed errors from
resolveOrgRegion()andlistOrganizationsUncached(), making org resolution failures invisible in debug output.Reproduction: Org resolution fails due to network error or auth issue — user sees the raw slug used as fallback with no explanation of why resolution failed.
Fix: Add
log.debug()calls so errors are visible with--verbose.Fix 3:
api/projects.ts— Silent catches in project operationsRoot cause: Multiple catch blocks in
listProjects,seedProjectCaches,findProjectByDsnKey, andtryGetPrimaryDsnsilently swallowed errors, making it impossible to diagnose why DSN detection, project resolution, or shell completions were not working.Reproduction: Any of these best-effort operations fail (e.g., cache write error, network timeout in region fan-out) — user gets no diagnostic output.
Fix: Add
log.debug()calls to all silent catch blocks.