Skip to content

fix(core): Catch beforeSendSpan callback throws - #22836

Merged
Lms24 merged 6 commits into
developfrom
fix/before-send-span-throw
Aug 7, 2026
Merged

fix(core): Catch beforeSendSpan callback throws #22836
Lms24 merged 6 commits into
developfrom
fix/before-send-span-throw

Conversation

@Lms24

@Lms24 Lms24 commented Jul 29, 2026

Copy link
Copy Markdown
Member

This PR wraps the beforeSendSpan callback application in captureSpan, captureStandaloneSpanWithStaticCallback and core client transaction beforeSendSpan invocations in a try/catch. The error is logged and the span is sent unmodified to Sentry.

Spans are captured synchronously from the afterSpanEnd hook, so a throwing callback propagates straight out of whatever user code called span.end(). Especially with the required beforeSendSpan migration from SpanJSON to StreamedSpanJSON, this is quite likely to happen.

We want to apply similar guards to more user-facing callbacks in the future, so we might be able to reuse/adjust the applyBeforeSendSpan helper to more functionality later on.

@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

size-limit report 📦

Path Size % Change Change
@sentry/browser 30.35 kB +0.08% +22 B 🔺
@sentry/browser - with treeshaking flags 28.52 kB -0.08% -22 B 🔽
@sentry/browser - with treeshaking flags tracing without tracing 26.85 kB -0.03% -6 B 🔽
@sentry/browser (incl. Tracing) 49.1 kB +0.04% +18 B 🔺
@sentry/browser (incl. Tracing + Span Streaming) 49.13 kB +0.05% +24 B 🔺
@sentry/browser (incl. Tracing, Profiling) 53.9 kB +0.05% +23 B 🔺
@sentry/browser (incl. Tracing, Replay) 88.45 kB +0.04% +27 B 🔺
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 77.82 kB -0.02% -13 B 🔽
@sentry/browser (incl. Tracing, Replay with Canvas) 93.15 kB +0.03% +25 B 🔺
@sentry/browser (incl. Tracing, Replay, Feedback) 105.84 kB +0.03% +31 B 🔺
@sentry/browser (incl. Feedback) 47.69 kB +0.04% +16 B 🔺
@sentry/browser (incl. sendFeedback) 35.18 kB +0.05% +17 B 🔺
@sentry/browser (incl. FeedbackAsync) 40.33 kB +0.02% +5 B 🔺
@sentry/browser (incl. Metrics) 31.43 kB +0.08% +23 B 🔺
@sentry/browser (incl. Logs) 31.66 kB +0.03% +9 B 🔺
@sentry/browser (incl. Metrics & Logs) 32.34 kB +0.09% +26 B 🔺
@sentry/react 32.14 kB +0.02% +4 B 🔺
@sentry/react (incl. Tracing) 51.29 kB +0.06% +26 B 🔺
@sentry/vue 35.45 kB +0.02% +4 B 🔺
@sentry/vue (incl. Tracing) 51.07 kB +0.05% +23 B 🔺
@sentry/svelte 30.38 kB +0.07% +21 B 🔺
CDN Bundle 32.32 kB -0.07% -21 B 🔽
CDN Bundle (incl. Tracing) 49.65 kB -0.02% -6 B 🔽
CDN Bundle (incl. Logs, Metrics) 33.84 kB -0.1% -32 B 🔽
CDN Bundle (incl. Tracing, Logs, Metrics) 50.94 kB -0.05% -24 B 🔽
CDN Bundle (incl. Replay, Logs, Metrics) 74.38 kB -0.03% -22 B 🔽
CDN Bundle (incl. Tracing, Replay) 87.17 kB -0.03% -18 B 🔽
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) 88.45 kB -0.03% -23 B 🔽
CDN Bundle (incl. Tracing, Replay, Feedback) 93.05 kB -0.03% -22 B 🔽
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) 94.3 kB -0.03% -25 B 🔽
CDN Bundle - uncompressed 95.83 kB -0.06% -49 B 🔽
CDN Bundle (incl. Tracing) - uncompressed 148.93 kB -0.04% -56 B 🔽
CDN Bundle (incl. Logs, Metrics) - uncompressed 100.42 kB -0.05% -49 B 🔽
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed 152.91 kB -0.04% -56 B 🔽
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed 229.34 kB -0.03% -49 B 🔽
CDN Bundle (incl. Tracing, Replay) - uncompressed 268.18 kB -0.03% -56 B 🔽
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed 272.15 kB -0.03% -56 B 🔽
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 281.88 kB -0.02% -56 B 🔽
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed 285.83 kB -0.02% -56 B 🔽
@sentry/nextjs (client) 53.84 kB +0.04% +17 B 🔺
@sentry/sveltekit (client) 49.48 kB +0.04% +16 B 🔺
@sentry/core/server 65.8 kB +0.05% +29 B 🔺
@sentry/core/browser 52.04 kB +0.07% +34 B 🔺
@sentry/node 119.48 kB +0.05% +50 B 🔺
@sentry/node/import (ESM hook with diagnostics-channel injection) 0 B added added
@sentry/node - without tracing 83.46 kB +0.06% +46 B 🔺
@sentry/aws-serverless 92.76 kB +0.03% +19 B 🔺
@sentry/cloudflare (withSentry) - minified 214.91 kB +0.02% +27 B 🔺
@sentry/cloudflare (withSentry) 530.62 kB -0.03% -152 B 🔽

View base workflow run

@Lms24
Lms24 force-pushed the feat/span-streaming-tree-shaking branch from 962dbc1 to 7de446c Compare July 29, 2026 15:37
@Lms24
Lms24 force-pushed the fix/before-send-span-throw branch from 2b3d3e2 to 192e001 Compare July 29, 2026 15:37
@Lms24
Lms24 force-pushed the feat/span-streaming-tree-shaking branch from 7de446c to 74a1167 Compare August 3, 2026 12:58
@Lms24
Lms24 force-pushed the fix/before-send-span-throw branch from 192e001 to f1557e3 Compare August 3, 2026 12:58
@Lms24
Lms24 force-pushed the feat/span-streaming-tree-shaking branch from 74a1167 to ee4761d Compare August 3, 2026 14:31
@Lms24
Lms24 force-pushed the fix/before-send-span-throw branch 2 times, most recently from cd95b76 to b5688d4 Compare August 4, 2026 09:23
@Lms24
Lms24 force-pushed the feat/span-streaming-tree-shaking branch 2 times, most recently from b568562 to a43fe54 Compare August 4, 2026 13:33
@Lms24
Lms24 force-pushed the fix/before-send-span-throw branch from b5688d4 to 214a5f3 Compare August 4, 2026 13:33
@Lms24
Lms24 force-pushed the feat/span-streaming-tree-shaking branch from a43fe54 to a3e7446 Compare August 4, 2026 13:47
@Lms24
Lms24 force-pushed the fix/before-send-span-throw branch from 214a5f3 to 8eda355 Compare August 4, 2026 13:47
@Lms24
Lms24 changed the base branch from feat/span-streaming-tree-shaking to develop August 4, 2026 16:18
@Lms24
Lms24 force-pushed the fix/before-send-span-throw branch from 8eda355 to 91dd535 Compare August 4, 2026 16:18
@Lms24 Lms24 changed the title fix(core): Don't let a throwing beforeSendSpan callback escape into user code fix(core): Catch beforeSendSpan callback throws Aug 4, 2026
@Lms24 Lms24 self-assigned this Aug 4, 2026
@Lms24
Lms24 force-pushed the fix/before-send-span-throw branch from 61f06d4 to 8745c98 Compare August 6, 2026 16:29

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 8745c98. Configure here.

}
const processedRootSpanJson = applyBeforeSendSpanCallback(rootSpanJson, beforeSendSpan);
// update event with processed root span values
processedEvent = merge(event, convertSpanJsonToTransactionEvent(processedRootSpanJson));

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unmodified root span still merged

Low Severity

When beforeSendSpan throws or returns null for the root span, applyBeforeSendSpanCallback correctly hands back the original span JSON, but the caller always merges the convert round-trip into the transaction. Previously a null return left the event untouched. Because merge replaces contexts.trace wholesale and the converters apply defaults, the “unmodified” fallback can still alter the event.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 8745c98. Configure here.

@Lms24 Lms24 Aug 7, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah I'm willing to take this risk. mutating the originally passed in json is not something we directly recommend but we should still expected. It might even be advantageous here: If users scrub first, and then decide to return null, the scrubbing still gets applied if they mutate in-place. This should be fine to change, especially in v11. I'm not planning on backporting this PR anyway.

@Lms24
Lms24 force-pushed the fix/before-send-span-throw branch from 8745c98 to 282d43b Compare August 7, 2026 09:54
@Lms24
Lms24 marked this pull request as ready for review August 7, 2026 10:47
@Lms24
Lms24 requested review from JPeer264 and nicohrubec August 7, 2026 10:48
Comment thread packages/core/src/tracing/spans/beforeSendSpan.ts Outdated
@Lms24
Lms24 enabled auto-merge (squash) August 7, 2026 16:19
@Lms24
Lms24 merged commit 4e89bba into develop Aug 7, 2026
528 of 531 checks passed
@Lms24
Lms24 deleted the fix/before-send-span-throw branch August 7, 2026 17:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants