WIP #101561
WIP #101561
Conversation
github-actions
bot
added
Scope: Frontend
|
🚨 Warning: This pull request contains Frontend and Backend changes! It's discouraged to make changes to Sentry's Frontend and Backend in a single pull request. The Frontend and Backend are not atomically deployed. If the changes are interdependent of each other, they must be separated into two pull requests and be made forward or backwards compatible, such that the Backend or Frontend can be safely deployed independently. Have questions? Please ask in the |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
|
|
||
| deletes = models_which_use_deletions_code_path() | ||
|
|
||
| if options.get("cleanup.delete-old-groups.enabled") and model == ("sentry.Group",): |
There was a problem hiding this comment.
Bug: Group Cleanup Blocked by Incorrect Model Handling
The condition model == ("sentry.Group",) prevents the new group cleanup from running. The model parameter from CLI arguments typically contains simple names like "Group" or full paths, not ("sentry.Group",). This is inconsistent with how models are usually handled (e.g., lowercase names in a list, or all models if none specified), making the new cleanup unreachable.
![semgrep-code-getsentry[bot]](https://avatars.githubusercontent.com/u/1396951?s=60&v=4){kind=small}
| Group.objects.filter(project_id=project_id, last_seen__lt=cutoff_date) | ||
| .order_by("-last_seen", "-id") | ||
| .values_list("id", flat=True)[:batch_size] |
There was a problem hiding this comment.
High severity vulnerability may affect your project—review required:
Line 358 lists a dependency (django) with a known High severity vulnerability.
ℹ️ Why this matters
Affected versions of Django are vulnerable to Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). SQL injection in Django's ORM column aliases: when using QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), or QuerySet.extra() with dictionary expansion (**kwargs), the dictionary keys are used unescaped as SQL column aliases. On MySQL and MariaDB backends, an attacker who can influence those keys (for example, by passing a crafted dict of annotations) can inject arbitrary SQL into the generated query.
To resolve this comment:
Check if you are using Django with MySQL or MariaDB.
- If you're affected, upgrade this dependency to at least version 5.2.7 at uv.lock.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| cutoff_date = timezone.now() - timedelta(days=days) | ||
|
|
||
| # Get all project_ids (uses Project primary key index, very fast) | ||
| project_ids = list(Project.objects.values_list("id", flat=True)) |
There was a problem hiding this comment.
High severity vulnerability may affect your project—review required:
Line 331 lists a dependency (django) with a known High severity vulnerability.
ℹ️ Why this matters
Affected versions of Django are vulnerable to Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). SQL injection in Django's ORM column aliases: when using QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), or QuerySet.extra() with dictionary expansion (**kwargs), the dictionary keys are used unescaped as SQL column aliases. On MySQL and MariaDB backends, an attacker who can influence those keys (for example, by passing a crafted dict of annotations) can inject arbitrary SQL into the generated query.
To resolve this comment:
Check if you are using Django with MySQL or MariaDB.
- If you're affected, upgrade this dependency to at least version 5.2.7 at uv.lock.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
ryan953
removed
the
Scope: Frontend
2 participants
No description provided.