Skip to content

ProGuard deobfuscation can replace unrelated substrings in exception messages #123739

Description

@sentry-junior

Issue originally reported against sentry-java at getsentry/sentry-java#6056 (tracked as JAVA-723), but the actual code path lives in this repo's Java event-processing pipeline, not the SDK. See the discussion there for more details.

What's happening?

deobfuscate_exception_value() in src/sentry/lang/java/processing.py builds raw_method_name from the last raw stacktrace frame's module.function and replaces it in the exception message via re.sub(re.escape(raw_method_name), deobfuscated_method_name, exception["value"]). This is a plain substring replace with no word-boundary or context check confirming the match is actually a reference to that frame.

When a ProGuard mapping obfuscates some unrelated class down to a short, ordinary-looking name (e.g. ...AccountsListFragmentKt$$ExternalSyntheticLambda19 -> en:), and the exception message happens to contain that same string for an unrelated reason (e.g. a locale code like 'en'), the substring gets swapped for the fully-qualified class name even though it has nothing to do with the frame.

How to reproduce

An exception with message string/pay_anyone_cancel_dialog_positive: requested 'en-IE', got 'en', combined with a ProGuard mapping containing com.monzo.standin.screens.accountslist.AccountsListFragmentKt$$ExternalSyntheticLambda19 -> en:.

Actual: en in the message is deobfuscated to com.monzo.standin.screens.accountslist.AccountsListFragmentKt$$ExternalSyntheticLambda19.

Confidence

Root cause confidence: high — traced directly to the literal substring re.sub in deobfuscate_exception_value (src/sentry/lang/java/processing.py, lines ~20-41).

Requested by adam.brown.

--

View Junior Session [Sentry]

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions