Skip to content

fix(sentry-apps): gate error webhook subscriptions correctly#120611

Open
cvxluo wants to merge 1 commit into
masterfrom
cvxluo/gate-granular-errorcreated-subscriptions-behind-th
Open

fix(sentry-apps): gate error webhook subscriptions correctly#120611
cvxluo wants to merge 1 commit into
masterfrom
cvxluo/gate-granular-errorcreated-subscriptions-behind-th

Conversation

@cvxluo

@cvxluo cvxluo commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

I slightly misconfigured the flag checks when GAing granular webhook subscriptions, so that in theory someone could pass error.created directly to the API and bypass the appropriate flag check for error events. Clean up that path.

…e event-hooks entitlement

Co-authored-by: Claude <noreply@anthropic.com>
@github-actions github-actions Bot added the Scope: Backend Automatically applied to PRs that change backend components label Jul 24, 2026
Comment on lines +139 to +146
def has_error_events(events: Collection[str] | None) -> bool:
"""Whether any entry subscribes to error webhooks, as the whole resource or a single event."""
return any(
event == SentryAppResourceType.ERROR or resource_of(event) is SentryAppResourceType.ERROR
for event in events or ()
)


Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

has_error_events iterates over raw request events without type guard

has_error_events is called on unvalidated request.data['events'] before the serializer runs. A non-iterable value such as an integer raises TypeError instead of a validation error.

Evidence
  • has_error_events is called from sentry_apps.py:post() and sentry_app_details.py:put() on request.data.get('events') before SentryAppParser serializes the payload.
  • The generator for event in events or () assumes events is iterable; a JSON body like {"events": 42} yields 42, which is not iterable and raises TypeError.
  • The parser's EventListField would also reject an int, but has_error_events runs first and turns a validation error into an unhandled 500.

Identified by Warden · sentry-backend-bugs · 4GZ-TU4

@cvxluo
cvxluo marked this pull request as ready for review July 25, 2026 00:10
@cvxluo
cvxluo requested a review from a team July 25, 2026 00:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Scope: Backend Automatically applied to PRs that change backend components

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants