Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix default host issue for the Sentry Tunnel middleware #2019

Merged
merged 4 commits into from
Oct 27, 2022
Merged

Fix default host issue for the Sentry Tunnel middleware #2019

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
92c9a64
Allow any host ending in sentry.io
mattjohnsonpint Oct 27, 2022
4f505f4
Update xmldocs
mattjohnsonpint Oct 27, 2022
dfcf218
Update tests
mattjohnsonpint Oct 27, 2022
7f527e1
Update CHANGELOG.md
mattjohnsonpint Oct 27, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@
- Fix DI issue by binding to MAUI using lifecycle events ([#2006](https://github.com/getsentry/sentry-dotnet/pull/2006))
- Unhide `SentryEvent.Exception` ([#2011](https://github.com/getsentry/sentry-dotnet/pull/2011))
- Bump `Google.Cloud.Functions.Hosting` to version 1.1.0 ([#2015](https://github.com/getsentry/sentry-dotnet/pull/2015))
- Fix default host issue for the Sentry Tunnel middleware ([#2019](https://github.com/getsentry/sentry-dotnet/pull/2019))

## 3.22.0

Expand Down
12 changes: 10 additions & 2 deletions src/Sentry.AspNetCore/SentryTunnelMiddleware.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ public class SentryTunnelMiddleware : IMiddleware
/// <seealso href="https://docs.sentry.io/platforms/javascript/troubleshooting/#dealing-with-ad-blockers"/>
public SentryTunnelMiddleware(string[] allowedHosts)
{
_allowedHosts = new[] { "sentry.io" }.Concat(allowedHosts).ToArray();
_allowedHosts = allowedHosts;
}

/// <inheritdoc />
Expand Down Expand Up @@ -77,7 +77,10 @@ public async Task InvokeAsync(HttpContext context, RequestDelegate next)
await response.WriteAsync("Invalid DSN JSON supplied").ConfigureAwait(false);
return;
}
if (headerJson.TryGetValue("dsn", out var dsnString) && Uri.TryCreate(dsnString.ToString(), UriKind.Absolute, out var dsn) && _allowedHosts.Contains(dsn.Host))

if (headerJson.TryGetValue("dsn", out var dsnString) &&
Uri.TryCreate(dsnString.ToString(), UriKind.Absolute, out var dsn) &&
IsHostAllowed(dsn.Host))
{
var projectId = dsn.AbsolutePath.Trim('/');
memoryStream.Position = 0;
Expand Down Expand Up @@ -110,4 +113,9 @@ public async Task InvokeAsync(HttpContext context, RequestDelegate next)
await response.WriteAsync("Received empty body").ConfigureAwait(false);
}
}

private bool IsHostAllowed(string host) =>
host.EndsWith(".sentry.io", StringComparison.OrdinalIgnoreCase) ||
host.Equals("sentry.io", StringComparison.OrdinalIgnoreCase) ||
_allowedHosts.Contains(host, StringComparer.OrdinalIgnoreCase);
}
8 changes: 6 additions & 2 deletions src/Sentry.AspNetCore/SentryWebHostBuilderExtensions.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,8 +110,12 @@ public static IWebHostBuilder UseSentry(
/// <summary>
/// Adds and configures the Sentry tunneling middleware.
/// </summary>
/// <param name="services"></param>
/// <param name="hostnames">The extra hostnames to be allowed for the tunneling. sentry.io is allowed by default; add your own Sentry domain if you use a self-hosted Sentry or Relay.</param>
/// <param name="services">The service collection</param>
/// <param name="hostnames">
/// The extra hostnames to be allowed for the tunneling.
/// Hosts ending in <c>.sentry.io</c> are always allowed, and do not need to be included in this list.
/// Add your own domain if you use a self-hosted Sentry or Relay.
/// </param>
public static void AddSentryTunneling(this IServiceCollection services, params string[] hostnames) =>
services.AddScoped(_ => new SentryTunnelMiddleware(hostnames));

Expand Down
9 changes: 6 additions & 3 deletions test/Sentry.AspNetCore.Tests/Tunnel/IntegrationsTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,13 +28,16 @@ public IntegrationsTests()
_server = new TestServer(builder);
}

[Fact]
public async Task TunnelMiddleware_CanForwardValidEnvelope()
[Theory]
[InlineData("sentry.io")]
[InlineData("ingest.sentry.io")]
[InlineData("o12345.ingest.sentry.io")]
public async Task TunnelMiddleware_CanForwardValidEnvelope(string host)
{
var requestMessage = new HttpRequestMessage(new HttpMethod("POST"), "/tunnel")
{
Content = new StringContent(
@"{""sent_at"":""2021-01-01T00:00:00.000Z"",""sdk"":{""name"":""sentry.javascript.browser"",""version"":""6.8.0""},""dsn"":""https://dns@sentry.io/1""}
@"{""sent_at"":""2021-01-01T00:00:00.000Z"",""sdk"":{""name"":""sentry.javascript.browser"",""version"":""6.8.0""},""dsn"":""https://dns@" + host + @"/1""}
{""type"":""session""}
{""sid"":""fda00e933162466c849962eaea0cfaff""}")
};
Expand Down