Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion samples/Sentry.Samples.Log4Net/Program.cs
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,11 @@

private static void Main()
{
#if NETFRAMEWORK
// Set the user running the process the current principal

Check warning on line 14 in samples/Sentry.Samples.Log4Net/Program.cs

View check run for this annotation

@sentry/warden / warden: find-bugs

[MS7-GQ5] Null `RenderedMessage` bypasses non-null `message` contract in `SentryLog.Create` (additional location)

The call in `SentryAppender.Structured.cs:14` passes `loggingEvent.RenderedMessage` to `SentryLog.Create` without a null/empty guard, unlike every other use of `RenderedMessage` in the appender (lines 103, 131). A null value propagates into `SentryLog.Message` and serializes as `"body": null`, violating the Sentry log protocol.
// Appender was configure to send the user with the event
// Appender was configured to send the user with the event
AppDomain.CurrentDomain.SetPrincipalPolicy(PrincipalPolicy.WindowsPrincipal);
#endif

// The following anonymous object gets serialized and sent with log messages
ThreadContext.Properties["inventory"] = new
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

<PropertyGroup>
<OutputType>Exe</OutputType>
<TargetFramework>net10.0</TargetFramework>
<TargetFramework>net481</TargetFramework>
<Version>3.5.234</Version>
</PropertyGroup>

Expand Down
16 changes: 16 additions & 0 deletions src/Sentry.Log4Net/LevelMapping.cs
Original file line number Diff line number Diff line change
Expand Up @@ -29,4 +29,20 @@ internal static class LevelMapping
_ => null
};
}

public static SentryLogLevel? ToSentryLogLevel(this LoggingEvent loggingEvent)
{
return loggingEvent.Level switch
{
var level when level == Level.Off => null,
var level when level >= Level.Fatal => SentryLogLevel.Fatal,
var level when level >= Level.Error => SentryLogLevel.Error,
var level when level >= Level.Warn => SentryLogLevel.Warning,
var level when level >= Level.Info => SentryLogLevel.Info,
var level when level >= Level.Debug => SentryLogLevel.Debug,
var level when level >= Level.Trace => SentryLogLevel.Trace,
var level when level >= Level.All => SentryLogLevel.Trace,
_ => null,
};
}
}
6 changes: 6 additions & 0 deletions src/Sentry.Log4Net/Sentry.Log4Net.csproj
Original file line number Diff line number Diff line change
Expand Up @@ -26,4 +26,10 @@
<InternalsVisibleTo Include="Sentry.Log4Net.Tests" PublicKey="$(SentryPublicKey)" />
</ItemGroup>

<ItemGroup>
<Compile Update="SentryAppender.Structured.cs">
<DependentUpon>SentryAppender.cs</DependentUpon>
</Compile>
</ItemGroup>

</Project>
33 changes: 33 additions & 0 deletions src/Sentry.Log4Net/SentryAppender.Structured.cs
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
namespace Sentry.Log4Net;

public partial class SentryAppender
{
private static void CaptureStructuredLog(IHub hub, SentryOptions options, LoggingEvent loggingEvent)
{
var level = loggingEvent.ToSentryLogLevel();
if (level.HasValue)
{
DateTimeOffset timestamp = new(loggingEvent.TimeStampUtc);
const string? template = null; // cannot get format-string from `log4net.Util.SystemStringFormat` via `LoggingEvent.MessageObject`
var parameters = ImmutableArray<KeyValuePair<string, object>>.Empty; // cannot get arguments from `log4net.Util.SystemStringFormat` via `LoggingEvent.MessageObject`

var log = SentryLog.Create(hub, timestamp, level.Value, loggingEvent.RenderedMessage, template, parameters);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing null check for RenderedMessage in structured logging

Medium Severity

loggingEvent.RenderedMessage is passed directly to SentryLog.Create as a non-nullable string message parameter, but it can return null in log4net (e.g., when no message object is set). The existing code in the same class defensively handles this — line 103 uses !string.IsNullOrWhiteSpace(loggingEvent.RenderedMessage) and falls back to string.Empty. The new structured logging path lacks this guard, which could result in a null value flowing into SentryLog.Message and causing issues during serialization.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit ca31e0b. Configure here.


log.SetDefaultAttributes(options, Sdk);
log.SetOrigin("auto.log.log4net");

foreach (var property in loggingEvent.GetProperties())
{
if (property is DictionaryEntry { Key: string key, Value: { } value })
{
if (key.Length != 0 && !key.StartsWith("log4net:", StringComparison.OrdinalIgnoreCase) && !Guid.TryParse(key, out _))
{
log.SetAttribute($"property.{key}", value);
}
}
}

hub.Logger.CaptureLog(log);
}
}
}
14 changes: 13 additions & 1 deletion src/Sentry.Log4Net/SentryAppender.cs
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ namespace Sentry.Log4Net;
/// <summary>
/// Sentry appender for log4net.
/// </summary>
public class SentryAppender : AppenderSkeleton
public partial class SentryAppender : AppenderSkeleton
{
private readonly Func<string, IDisposable> _initAction;
private volatile IDisposable? _sdkHandle;
Expand All @@ -15,6 +15,12 @@ public class SentryAppender : AppenderSkeleton
internal static readonly SdkVersion NameAndVersion
= typeof(SentryAppender).Assembly.GetNameAndVersion();

private static readonly SdkVersion Sdk = new()
{
Name = SdkName,
Version = NameAndVersion.Version,
};

private static readonly string ProtocolPackageName = "nuget:" + NameAndVersion.Name;

private readonly IHub _hub;
Expand Down Expand Up @@ -84,6 +90,12 @@ protected override void Append(LoggingEvent loggingEvent)
}
}

var options = _hub.GetSentryOptions();
if (options is { EnableLogs: true })
{
CaptureStructuredLog(_hub, options, loggingEvent);
}

var exception = loggingEvent.ExceptionObject ?? loggingEvent.MessageObject as Exception;

if (MinimumEventLevel is not null && loggingEvent.Level < MinimumEventLevel)
Expand Down
3 changes: 3 additions & 0 deletions src/Sentry/Sentry.csproj
Original file line number Diff line number Diff line change
Expand Up @@ -195,6 +195,9 @@
<Compile Update="MeasurementUnit.Duration.cs;MeasurementUnit.Fraction.cs;MeasurementUnit.Information.cs">
<DependentUpon>MeasurementUnit.cs</DependentUpon>
</Compile>
<Compile Update="SentryLog.Factory.cs">
<DependentUpon>SentryLog.cs</DependentUpon>
</Compile>
<Compile Update="SentryMetric.Factory.cs;SentryMetric.Generic.cs">
<DependentUpon>SentryMetric.cs</DependentUpon>
</Compile>
Expand Down
18 changes: 18 additions & 0 deletions src/Sentry/SentryLog.Factory.cs
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
namespace Sentry;

public sealed partial class SentryLog
{
internal static SentryLog Create(IHub hub, DateTimeOffset timestamp, SentryLogLevel level, string message, string? template, ImmutableArray<KeyValuePair<string, object>> parameters)

Check warning on line 5 in src/Sentry/SentryLog.Factory.cs

View check run for this annotation

@sentry/warden / warden: find-bugs

Null `RenderedMessage` bypasses non-null `message` contract in `SentryLog.Create`

The call in `SentryAppender.Structured.cs:14` passes `loggingEvent.RenderedMessage` to `SentryLog.Create` without a null/empty guard, unlike every other use of `RenderedMessage` in the appender (lines 103, 131). A null value propagates into `SentryLog.Message` and serializes as `"body": null`, violating the Sentry log protocol.
{
hub.GetTraceIdAndSpanId(out var traceId, out var spanId);

SentryLog log = new(timestamp, traceId, level, message)
{
Template = template,
Parameters = parameters,
SpanId = spanId,
};

return log;
}
}
2 changes: 1 addition & 1 deletion src/Sentry/SentryLog.cs
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ namespace Sentry;
/// Sentry .NET SDK Docs: <see href="https://docs.sentry.io/platforms/dotnet/logs/"/>.
/// </remarks>
[DebuggerDisplay(@"SentryLog \{ Level = {Level}, Message = '{Message}' \}")]
public sealed class SentryLog
public sealed partial class SentryLog
{
[SetsRequiredMembers]
internal SentryLog(DateTimeOffset timestamp, SentryId traceId, SentryLogLevel level, string message)
Expand Down
6 changes: 6 additions & 0 deletions test/Sentry.Log4Net.Tests/Sentry.Log4Net.Tests.csproj
Original file line number Diff line number Diff line change
Expand Up @@ -19,4 +19,10 @@
<Using Include="Sentry.Log4Net" />
</ItemGroup>

<ItemGroup>
<Compile Update="SentryAppenderTests.Structured.cs">
<DependentUpon>SentryAppenderTests.cs</DependentUpon>
</Compile>
</ItemGroup>

</Project>
Loading
Loading