Skip to content

chore(ci): Validate alert id#19499

Merged
chargome merged 1 commit intodevelopfrom
cg/sec-input-validation
Feb 25, 2026
Merged

chore(ci): Validate alert id#19499
chargome merged 1 commit intodevelopfrom
cg/sec-input-validation

Conversation

@chargome
Copy link
Member

@chargome chargome commented Feb 24, 2026

This came up in a clanker review, feel free to close @nicohrubec

Closes #19503 (added automatically)

@chargome chargome requested a review from nicohrubec February 24, 2026 14:36
@chargome chargome self-assigned this Feb 24, 2026
@github-actions
Copy link
Contributor

size-limit report 📦

Path Size % Change Change
@sentry/browser 25.62 kB - -
@sentry/browser - with treeshaking flags 24.12 kB - -
@sentry/browser (incl. Tracing) 42.42 kB - -
@sentry/browser (incl. Tracing, Profiling) 47.09 kB - -
@sentry/browser (incl. Tracing, Replay) 81.24 kB - -
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 70.86 kB - -
@sentry/browser (incl. Tracing, Replay with Canvas) 85.94 kB - -
@sentry/browser (incl. Tracing, Replay, Feedback) 98.2 kB - -
@sentry/browser (incl. Feedback) 42.43 kB - -
@sentry/browser (incl. sendFeedback) 30.29 kB - -
@sentry/browser (incl. FeedbackAsync) 35.34 kB - -
@sentry/browser (incl. Metrics) 26.79 kB - -
@sentry/browser (incl. Logs) 26.93 kB - -
@sentry/browser (incl. Metrics & Logs) 27.61 kB - -
@sentry/react 27.37 kB - -
@sentry/react (incl. Tracing) 44.76 kB - -
@sentry/vue 30.07 kB - -
@sentry/vue (incl. Tracing) 44.27 kB - -
@sentry/svelte 25.64 kB - -
CDN Bundle 28.16 kB - -
CDN Bundle (incl. Tracing) 43.25 kB - -
CDN Bundle (incl. Logs, Metrics) 29 kB - -
CDN Bundle (incl. Tracing, Logs, Metrics) 44.09 kB - -
CDN Bundle (incl. Replay, Logs, Metrics) 68.08 kB - -
CDN Bundle (incl. Tracing, Replay) 80.13 kB - -
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) 81 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback) 85.65 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) 86.53 kB - -
CDN Bundle - uncompressed 82.34 kB - -
CDN Bundle (incl. Tracing) - uncompressed 128.06 kB - -
CDN Bundle (incl. Logs, Metrics) - uncompressed 85.18 kB - -
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed 130.89 kB - -
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed 208.84 kB - -
CDN Bundle (incl. Tracing, Replay) - uncompressed 244.94 kB - -
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed 247.76 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 257.85 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed 260.66 kB - -
@sentry/nextjs (client) 47.17 kB - -
@sentry/sveltekit (client) 42.89 kB - -
@sentry/node-core 52.18 kB +0.02% +9 B 🔺
@sentry/node 173.45 kB +0.01% +8 B 🔺
@sentry/node - without tracing 97.33 kB +0.01% +9 B 🔺
@sentry/aws-serverless 113.13 kB +0.01% +7 B 🔺

View base workflow run

@github-actions
Copy link
Contributor

node-overhead report 🧳

Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.

Scenario Requests/s % of Baseline Prev. Requests/s Change %
GET Baseline 9,092 - 8,672 +5%
GET With Sentry 1,725 19% 1,656 +4%
GET With Sentry (error only) 6,113 67% 5,970 +2%
POST Baseline 1,211 - 1,188 +2%
POST With Sentry 595 49% 551 +8%
POST With Sentry (error only) 1,069 88% 1,052 +2%
MYSQL Baseline 3,338 - 3,240 +3%
MYSQL With Sentry 463 14% 400 +16%
MYSQL With Sentry (error only) 2,726 82% 2,650 +3%

View base workflow run

@chargome chargome marked this pull request as ready for review February 24, 2026 15:23
Copy link

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.

if ! [[ "$NUMBER" =~ ^[0-9]+$ ]]; then
echo "Error: Could not extract a valid numeric alert ID from input: $INPUT"
exit 1
fi
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bash-specific regex may break on sh

Medium Severity

The alert validation uses Bash-only syntax ([[ ... =~ ... ]] and ${var%%pattern}), so this step can fail if the workflow/job ever runs with shell: sh (or on non-Bash runners), even when the alert input is valid.

Fix in Cursor Fix in Web

@chargome chargome merged commit 218ad4f into develop Feb 25, 2026
73 checks passed
@chargome chargome deleted the cg/sec-input-validation branch February 25, 2026 09:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

chore(ci): Validate alert id

2 participants