Issue originally reported against sentry-java at getsentry/sentry-java#6056 (tracked as JAVA-723), but the actual code path lives in this repo's Java event-processing pipeline, not the SDK. See the discussion there for more details.
What's happening?
deobfuscate_exception_value() in src/sentry/lang/java/processing.py builds raw_method_name from the last raw stacktrace frame's module.function and replaces it in the exception message via re.sub(re.escape(raw_method_name), deobfuscated_method_name, exception["value"]). This is a plain substring replace with no word-boundary or context check confirming the match is actually a reference to that frame.
When a ProGuard mapping obfuscates some unrelated class down to a short, ordinary-looking name (e.g. ...AccountsListFragmentKt$$ExternalSyntheticLambda19 -> en:), and the exception message happens to contain that same string for an unrelated reason (e.g. a locale code like 'en'), the substring gets swapped for the fully-qualified class name even though it has nothing to do with the frame.
How to reproduce
An exception with message string/pay_anyone_cancel_dialog_positive: requested 'en-IE', got 'en', combined with a ProGuard mapping containing com.monzo.standin.screens.accountslist.AccountsListFragmentKt$$ExternalSyntheticLambda19 -> en:.
Actual: en in the message is deobfuscated to com.monzo.standin.screens.accountslist.AccountsListFragmentKt$$ExternalSyntheticLambda19.
Confidence
Root cause confidence: high — traced directly to the literal substring re.sub in deobfuscate_exception_value (src/sentry/lang/java/processing.py, lines ~20-41).
Requested by adam.brown.
--
View Junior Session [Sentry]
Issue originally reported against
sentry-javaat getsentry/sentry-java#6056 (tracked as JAVA-723), but the actual code path lives in this repo's Java event-processing pipeline, not the SDK. See the discussion there for more details.What's happening?
deobfuscate_exception_value()insrc/sentry/lang/java/processing.pybuildsraw_method_namefrom the last raw stacktrace frame'smodule.functionand replaces it in the exception message viare.sub(re.escape(raw_method_name), deobfuscated_method_name, exception["value"]). This is a plain substring replace with no word-boundary or context check confirming the match is actually a reference to that frame.When a ProGuard mapping obfuscates some unrelated class down to a short, ordinary-looking name (e.g.
...AccountsListFragmentKt$$ExternalSyntheticLambda19 -> en:), and the exception message happens to contain that same string for an unrelated reason (e.g. a locale code like'en'), the substring gets swapped for the fully-qualified class name even though it has nothing to do with the frame.How to reproduce
An exception with message
string/pay_anyone_cancel_dialog_positive: requested 'en-IE', got 'en', combined with a ProGuard mapping containingcom.monzo.standin.screens.accountslist.AccountsListFragmentKt$$ExternalSyntheticLambda19 -> en:.Actual:
enin the message is deobfuscated tocom.monzo.standin.screens.accountslist.AccountsListFragmentKt$$ExternalSyntheticLambda19.Confidence
Root cause confidence: high — traced directly to the literal substring
re.subindeobfuscate_exception_value(src/sentry/lang/java/processing.py, lines ~20-41).Requested by adam.brown.
--
View Junior Session [Sentry]