detect dangerous/invalid chars in profiling directory name

getsentry · adinauer · Oct 1, 2025 · Apr 25, 2025 · May 19, 2025 · May 19, 2025
commit 91e244d62d6c89951481a30f4f6c2b9c71a8f9e7
@@ -122,7 +122,7 @@ private boolean isInvalidDirectory() {
         logger.log(
             SentryLevel.WARNING,
             "Disabling profiling because traces directory path contains invalid character: %s",
-            filename);
+            invalidChar);
         return true;
       }
     }

@@ -81,7 +81,7 @@ class JavaContinuousProfilerTest {
     // Profiler doesn't start if the folder doesn't exists.
     // Usually it's generated when calling Sentry.init, but for tests we can create it manually.
 
-    fixture.options.cacheDirPath = "."
+    fixture.options.cacheDirPath = "tmp"
     File(fixture.options.profilingTracesDirPath!!).mkdirs()
 
     Sentry.setCurrentScopes(fixture.scopes)
@@ -406,6 +406,21 @@ class JavaContinuousProfilerTest {
       .log(eq(SentryLevel.WARNING), eq("SDK is rate limited. Stopping profiler."))
   }
 
+  @Test
+  fun `profiler does not start when filename contains invalid characters`() {
+    val profiler = fixture.getSut { it.profilingTracesDirPath = "," }
+
+    profiler.startProfiler(ProfileLifecycle.MANUAL, fixture.mockTracesSampler)
+    assertFalse(profiler.isRunning)
+    assertEquals(SentryId.EMPTY_ID, profiler.profilerId)
+    verify(fixture.mockLogger)
+      .log(
+        eq(SentryLevel.WARNING),
+        eq("Disabling profiling because traces directory path contains invalid character: %s"),
+        eq(","),
+      )
+  }
+
   fun withMockScopes(closure: () -> Unit) =
     Mockito.mockStatic(Sentry::class.java).use {
       it.`when`<Any> { Sentry.getCurrentScopes() }.thenReturn(fixture.scopes)

@@ -74,4 +74,8 @@ class ContinuousProfilerStub() : IContinuousProfiler {
   override fun getProfilerId(): SentryId {
     TODO("Not yet implemented")
   }
+
+  override fun getChunkId(): SentryId {
+    TODO("Not yet implemented")
+  }
 }