[MAUI] Local scope tags leak into subsequent HttpClient auto captured events

[kerenkhatiwada]

Package

Sentry

.NET Flavor

.NET

.NET Version

8.0.16

OS

macOS

OS Version

No response

Development Environment

Visual Studio v17.x

SDK Version

5.16.0

Self-Hosted Sentry Version

No response

Workload Versions

n/a

UseSentry or SentrySdk.Init call

 .UseSentry(options =>
            {
                options.Dsn = "";
                options.TracesSampleRate = 1.0;
                options.CaptureFailedRequests = true;
                options.FailedRequestStatusCodes.Add((400, 499));
            })

Steps to Reproduce

Reported via Zendesk ticket: Tags set inside the local scope callback of SentrySdk.CaptureException(error, scope => { ... }) are appearing on automatically captured HttpClient events. The tag (lats.EventName) is only set within the local callback and not configured globally, and it bleeds into later auto captured events.

Make a failing HTTP request (404) inside a try/catch. In catch, call:
SentrySdk.CaptureException(ex, scope => { scope.SetTags(SetExtra(apiMethod, "http.error")); });
This correctly sends an event with tag lats.EventName=testtag.

Make another failing HTTP request (500). The HttpClient integration automatically captures an event.
That event still includes the tag lats.EventName=testtag even though it wasn’t set globally.

Expected Result

Tags set in a local scope callback should not bleed to other automatically captured events.

Actual Result

The automatically captured HttpClient event inherits tags from the local scope, even though that scope should have been isolated.

[linear]

NET-487

[jamescrosswell]

Looking at the code, I can't see how this would be possible:

sentry-dotnet/src/Sentry/Internal/Hub.cs

Lines 515 to 533 in 9e2f5f2

	public SentryId CaptureEvent(SentryEvent evt, SentryHint? hint, Action<Scope> configureScope)
	{
	if (!IsEnabled)
	{
	return SentryId.Empty;
	}
	try
	{
	var clonedScope = CurrentScope.Clone();
	configureScope(clonedScope);
	// Although we clone a temporary scope for the configureScope action, for the second scope
	// argument (the breadcrumbScope) we pass in the current scope... this is because we want
	// a breadcrumb to be left on the current scope for exception events
	var eventId = CaptureEvent(evt, hint, clonedScope);
	AddBreadcrumbForException(evt, CurrentScope);
	return eventId;
	}

Can we get a bit of sample code that reproduces the problem to investigate further?

[MichaelShapiro]

Hi @jamescrosswell. I'm the one who reported it. I'll just copy and paste my email with all the details I sent earleir to @kerenkhatiwada:

===========

Here is exact code how all http related error events are being communicated from my app to Sentry.

public override void LogApiError(Exception error, string apiMethod, string apiFullUrl,
    [Optional] string? payload,
    [CallerMemberName] string? callerFunction = null,
    [CallerFilePath] string? callerFile = null)
{
    base.LogApiError(error, apiMethod, apiFullUrl, payload, callerFunction, callerFile);

    if (settingsService.HandledErrorsTelemetry)
    {
        SentrySdk.CaptureException(error, scope =>
        {
            scope.Contexts.Add("Error Payload", BuildContext(null, apiFullUrl, callerFunction, callerFile, Sanitize(payload!, apiMethod), null));
           
           // Here I set tags, one of them is  lats.EventName that sparked this help request
           scope.SetTags(SetExtra(apiMethod, "http.error"));
        });

         // disregard this block - it's my attempt to mitigate the situation
        //SentrySdk.ConfigureScope(scope =>
        //{
        //    scope.SetTag("lats.EventName", "PreviousNameIsReset");
        //});
    }
}

The above function is called from the try/catch block when some exception arises, like this:

// function
Try
{
execute httpClient post or get something that will fail on the server
}
catch (HttpRequestException ex)
{
diagnostics.LogApiError(ex, request.MethodName, targetUrl, $"\nREQUEST {jsonRequest}\nRESPONSE {jsonResponse}", caller);
}

So, the above setup is pretty standard and boring. Now, to replicate, we need to execute two sequential calls that will all fail on the server:

Call #1: https://my server/NegotiateApiVersion will result in 404 because such a page doesn't exist.
The error is caught by the HttpRequestException catch block
LogApiError will be triggered and Sentry event will be sent with a tag "Lats.EventName" set to the value of "NegotiateApiVersion"
Here is the actual event: https://cma-inc.sentry.io/issues/6810027947/events/5f03878d536f4d58a826eba4acc0f0d1/?project=4507097791463424

Call #2: https://my server/sqlTest/api/V5/TDS/AddTDS will result in 500 because of, let's say, mismatch of the expected return type. The reason is truly irrelevant here.
BEFORE the error is eventually caught by HttpRequestException catch block (in step #3) the HTTPClientError is somehow being reported to Sentry
LogApiError is NOT triggered yet
Here is the actual event. Well, it's actually two events and they are very similar:
https://cma-inc.sentry.io/issues/5243722030/events/6486f3c48aa547b2931587d37b977913/?project=4507097791463424
https://cma-inc.sentry.io/issues/5243722030/events/d5a367b738554125bc01ec2af305edfe/?project=4507097791463424
HERE, in the above events that were NOT sent by me, by try/catch and my LogApiErrorfunction explicitly, you can clearly see that the tag "Lats.EventName" still set to the value of "NegotiateApiVersion" eventhough I played no role in setting nor keeping this tag.

Finally, the above error (the 500) is being caught by my HttpRequestException try/catch
LogApiError will be triggered and Sentry event will be sent with a tag "Lats.EventName" set to the value of "TDS/AddTDS"
Here is the actual event: https://cma-inc.sentry.io/issues/6916320887/events/4e94e91bdbb140b4baf9cf90c627454e/?project=4507097791463424

So, to reiterate, my question is about step #2 - why does the Sentry report retains the tag that was set on the previous call presumably on a local to the call scope?

===========

Something like that. I hope I am not misreading the documentation about hub and scope. The way I understand it, the line
SentrySdk.CaptureException(error, scope => ...
makes whatever tags are set to be local to this particular call.

Let me know if I can answer any more questions.

[jamescrosswell]

@Flash0ver I think you'll have to look into this. I don't have access to any of the events @MichaelShapiro is referencing.

As I say, I can't see logically how the result of the scope delegate could end up being applied to a different event (our code creates a clone of the underlying scope before invoking the delegate).