AssemblyMetadataAttribute with Sentry.ProjectDirectory and full project path is added to my executable

[conanthedev]

Package

Sentry

.NET Flavor

.NET Framework

.NET Version

4.8

OS

Windows

SDK Version

3.21.0

Self-Hosted Sentry Version

No response

Steps to Reproduce

• Start a new Console project
• Add Sentry nuget package
• Compile
• Check compiled assembly metadata

Expected Result

No Sentry AssemblyMetadataAttribute added. Or i'd like to understand why is that attribute added.

Actual Result

// C:\source\ConsoleApp1\ConsoleApp1\bin\Debug\ConsoleApp1.exe
// ConsoleApp1, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null

// Entry point: ConsoleApp1.Program.Main
// Timestamp: <Unknown> (DB45C17B)

using System;
using System.Diagnostics;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Runtime.Versioning;

[assembly: AssemblyVersion("1.0.0.0")]
[assembly: CompilationRelaxations(8)]
[assembly: RuntimeCompatibility(WrapNonExceptionThrows = true)]
[assembly: Debuggable(DebuggableAttribute.DebuggingModes.Default | DebuggableAttribute.DebuggingModes.DisableOptimizations | DebuggableAttribute.DebuggingModes.IgnoreSymbolStoreSequencePoints | DebuggableAttribute.DebuggingModes.EnableEditAndContinue)]
[assembly: AssemblyTitle("ConsoleApp1")]
[assembly: AssemblyDescription("")]
[assembly: AssemblyConfiguration("")]
[assembly: AssemblyCompany("")]
[assembly: AssemblyProduct("ConsoleApp1")]
[assembly: AssemblyCopyright("Copyright ©  2022")]
[assembly: AssemblyTrademark("")]
[assembly: ComVisible(false)]
[assembly: Guid("e6393966-4753-4c91-ac84-d4789705ed8f")]
[assembly: AssemblyFileVersion("1.0.0.0")]
[assembly: AssemblyMetadata("Sentry.ProjectDirectory", "C:\\source\\ConsoleApp1\\ConsoleApp1\\")]
[assembly: TargetFramework(".NETFramework,Version=v4.8", FrameworkDisplayName = ".NET Framework 4.8")]

[SimonCropp]

ProjectDirectory is used to to ensure that, when a stack trace frame is sent to the server, we can trim off the prefix (project) part that is the full path to the source file

[conanthedev]

Thanks for the information. So it is only pertinent if pdb are present. From what I can see in AttributeReader and SentryStackTraceFactory it seems safe if the attribute isn't present or if the Sentry.ProjectDirectory is empty. Do you foresee any issue if I override the target to avoid the attribute being added?

<Target Name="WriteSentryAttributes" />

[mattjohnsonpint]

This was a feature we added in 3.20.0 (Send project root path with events (#1739)), to address a longstanding issue (#327). You can see where the project path is applied to stack frames here:

sentry-dotnet/src/Sentry/Extensibility/SentryStackTraceFactory.cs

Lines 190 to 196 in 5693b9b

	if (projectPath != null && frameFileName != null)
	{
	if (frameFileName.StartsWith(projectPath, StringComparison.OrdinalIgnoreCase))
	{
	frameFileName = frameFileName.Substring(projectPath.Length);
	}
	}

The effect of disabling it would be to revert to the previous behavior, where the full absolute path is included in the stack trace.

Out of curiosity - why is this a concern? Does adding the custom attribute create some other issue? I'd like to understand that better. Thanks.

[conanthedev]

For my desktop app, I was using Sentry 3.13 and recently updated to 3.21. I noticed the added attribute when tweaking obfuscation parameters. It jumped at me, because since I was working locally it was showing the project folder with my username. In production, it would 'leak' the CI PC path, which would be harmless. But since I don't ship pdb, it serves no purpose so might as well remove it.

[mattjohnsonpint]

Do you currently get any file paths in your stack traces at all? Or just method names? (and obfuscated ones at that?)

[conanthedev]

No file paths and obfuscated method names. The perks of obfuscation.

[conanthedev]

Thanks for the info guys. I'm going to override the WriteSentryAttributes target for now.