fix(scripts): prevent command injection in expo-upload-sourcemaps by antonis · Pull Request #5636 · getsentry/sentry-react-native

antonis · 2026-02-09T12:39:48Z

📢 Type of change

Bugfix
New feature
Enhancement
Refactoring

📜 Description

Replaced execSync with spawnSync to eliminate shell command injection vulnerability. Arguments are now passed as an array directly to the binary, preventing any shell metacharacter interpretation.

Security improvements:

No shell invocation - uses spawnSync instead of execSync
Arguments passed as array, not string concatenation
Eliminates need for platform-specific escaping
Immune to command injection by design

Added comprehensive test suite with 12 tests covering:

Basic functionality (uploads, error handling)
Security (command injection prevention)
Hermes support (--debug-id-reference flag)
Environment variable validation
Sourcemap processing

💡 Motivation and Context

Fixes https://linear.app/getsentry/issue/RN-485/command-injection-vulnerabilities-in-getsentrysentry-react-native-in-7

💚 How did you test it?

Added unit tests

📝 Checklist

I added tests to verify changes
No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled
I updated the docs if needed.
I updated the wizard if needed.
All tests passing
No breaking changes

🔮 Next steps

#skip-changelog

Replaced execSync with spawnSync to eliminate shell command injection vulnerability. Arguments are now passed as an array directly to the binary, preventing any shell metacharacter interpretation. Security improvements: - No shell invocation - uses spawnSync instead of execSync - Arguments passed as array, not string concatenation - Eliminates need for platform-specific escaping - Immune to command injection by design Added comprehensive test suite with 12 tests covering: - Basic functionality (uploads, error handling) - Security (command injection prevention) - Hermes support (--debug-id-reference flag) - Environment variable validation - Sourcemap processing All tests pass. No behavior changes for legitimate use cases. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

linear · 2026-02-09T12:39:52Z

RN-485 Command Injection vulnerabilities in getsentry/sentry-react-native in 7 locations

github-actions · 2026-02-09T12:40:07Z

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

This PR will not appear in the changelog.

_{🤖 This preview updates automatically when you update the PR.}

github-actions · 2026-02-09T12:56:37Z

iOS (legacy) Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	1205.90 ms	1211.51 ms	5.62 ms
Size	3.38 MiB	4.60 MiB	1.22 MiB

Baseline results on branch: main

Startup times

Revision	Plain	With Sentry	Diff
`e07935d`+dirty	1217.37 ms	1211.44 ms	-5.93 ms
`46da307`+dirty	1217.08 ms	1224.16 ms	7.08 ms
`534ba8c`+dirty	1230.22 ms	1231.18 ms	0.96 ms
`c7f264b`+dirty	1211.82 ms	1218.04 ms	6.22 ms
`20d5eaa`+dirty	1231.12 ms	1226.00 ms	-5.12 ms
`276d348`+dirty	1224.22 ms	1227.38 ms	3.16 ms
`ebf60f9`+dirty	1217.66 ms	1214.82 ms	-2.84 ms
`98f632c`+dirty	1236.40 ms	1241.62 ms	5.22 ms
`1853710`+dirty	1224.35 ms	1230.18 ms	5.84 ms
`59d1977`+dirty	1225.28 ms	1227.83 ms	2.54 ms

App size

Revision	Plain	With Sentry	Diff
`e07935d`+dirty	3.41 MiB	4.58 MiB	1.17 MiB
`46da307`+dirty	2.63 MiB	3.87 MiB	1.24 MiB
`534ba8c`+dirty	2.63 MiB	3.81 MiB	1.18 MiB
`c7f264b`+dirty	2.63 MiB	3.91 MiB	1.28 MiB
`20d5eaa`+dirty	2.63 MiB	3.81 MiB	1.18 MiB
`276d348`+dirty	2.63 MiB	3.98 MiB	1.34 MiB
`ebf60f9`+dirty	3.41 MiB	4.67 MiB	1.25 MiB
`98f632c`+dirty	2.63 MiB	3.81 MiB	1.18 MiB
`1853710`+dirty	2.63 MiB	3.91 MiB	1.28 MiB
`59d1977`+dirty	3.38 MiB	4.60 MiB	1.22 MiB

github-actions · 2026-02-09T12:59:13Z

iOS (new) Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	1197.40 ms	1203.54 ms	6.14 ms
Size	3.38 MiB	4.60 MiB	1.22 MiB

Baseline results on branch: main

Startup times

Revision	Plain	With Sentry	Diff
`e07935d`+dirty	1225.85 ms	1227.72 ms	1.87 ms
`46da307`+dirty	1213.45 ms	1207.96 ms	-5.49 ms
`534ba8c`+dirty	1225.00 ms	1237.43 ms	12.43 ms
`c7f264b`+dirty	1229.78 ms	1225.84 ms	-3.94 ms
`20d5eaa`+dirty	1224.67 ms	1223.16 ms	-1.51 ms
`276d348`+dirty	1222.10 ms	1229.02 ms	6.92 ms
`ebf60f9`+dirty	1218.85 ms	1212.53 ms	-6.32 ms
`98f632c`+dirty	1221.38 ms	1229.26 ms	7.88 ms
`1853710`+dirty	1213.67 ms	1226.35 ms	12.67 ms
`59d1977`+dirty	1200.76 ms	1207.90 ms	7.14 ms

App size

Revision	Plain	With Sentry	Diff
`e07935d`+dirty	3.41 MiB	4.58 MiB	1.17 MiB
`46da307`+dirty	3.19 MiB	4.44 MiB	1.25 MiB
`534ba8c`+dirty	3.19 MiB	4.38 MiB	1.19 MiB
`c7f264b`+dirty	3.19 MiB	4.48 MiB	1.29 MiB
`20d5eaa`+dirty	3.19 MiB	4.38 MiB	1.19 MiB
`276d348`+dirty	3.19 MiB	4.54 MiB	1.36 MiB
`ebf60f9`+dirty	3.41 MiB	4.67 MiB	1.25 MiB
`98f632c`+dirty	3.19 MiB	4.38 MiB	1.19 MiB
`1853710`+dirty	3.19 MiB	4.48 MiB	1.29 MiB
`59d1977`+dirty	3.38 MiB	4.60 MiB	1.22 MiB

github-actions · 2026-02-09T13:15:26Z

Android (new) Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	368.16 ms	409.38 ms	41.22 ms
Size	43.94 MiB	49.27 MiB	5.33 MiB

Baseline results on branch: main

Startup times

Revision	Plain	With Sentry	Diff
`294387d`+dirty	359.44 ms	393.40 ms	33.97 ms
`083f560`+dirty	383.96 ms	417.76 ms	33.80 ms
`8db9631`+dirty	351.44 ms	396.28 ms	44.84 ms
`955f2eb`+dirty	388.13 ms	433.56 ms	45.44 ms
`a206511`+dirty	331.54 ms	356.98 ms	25.44 ms
`a0b15d6`+dirty	414.33 ms	448.85 ms	34.52 ms
`8ece263`+dirty	369.44 ms	414.65 ms	45.21 ms
`20d5eaa`+dirty	358.31 ms	442.37 ms	84.06 ms
`6c36ba5`+dirty	367.14 ms	426.80 ms	59.66 ms
`d9f44bb`+dirty	460.61 ms	496.62 ms	36.00 ms

App size

Revision	Plain	With Sentry	Diff
`294387d`+dirty	43.94 MiB	48.87 MiB	4.93 MiB
`083f560`+dirty	7.15 MiB	8.43 MiB	1.28 MiB
`8db9631`+dirty	7.15 MiB	8.43 MiB	1.28 MiB
`955f2eb`+dirty	7.15 MiB	8.42 MiB	1.27 MiB
`a206511`+dirty	43.94 MiB	48.90 MiB	4.96 MiB
`a0b15d6`+dirty	7.15 MiB	8.42 MiB	1.27 MiB
`8ece263`+dirty	7.15 MiB	8.41 MiB	1.26 MiB
`20d5eaa`+dirty	7.15 MiB	8.42 MiB	1.27 MiB
`6c36ba5`+dirty	43.94 MiB	49.27 MiB	5.33 MiB
`d9f44bb`+dirty	43.94 MiB	49.22 MiB	5.29 MiB

github-actions · 2026-02-09T13:44:25Z

Android (legacy) Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	414.26 ms	466.73 ms	52.48 ms
Size	43.75 MiB	48.41 MiB	4.66 MiB

Baseline results on branch: main

Startup times

Revision	Plain	With Sentry	Diff
`294387d`+dirty	424.30 ms	465.40 ms	41.10 ms
`c7f264b`	434.98 ms	452.96 ms	17.98 ms
`ec14be7`+dirty	403.50 ms	411.46 ms	7.96 ms
`a206511`+dirty	424.28 ms	474.82 ms	50.54 ms
`11ded16`+dirty	317.29 ms	329.15 ms	11.86 ms
`1bea095`+dirty	401.42 ms	426.93 ms	25.52 ms
`77061ed`+dirty	369.55 ms	408.35 ms	38.80 ms
`d861c16`+dirty	336.96 ms	349.14 ms	12.18 ms
`6c36ba5`+dirty	385.48 ms	442.36 ms	56.88 ms
`d9f44bb`+dirty	400.64 ms	431.65 ms	31.01 ms

App size

Revision	Plain	With Sentry	Diff
`294387d`+dirty	43.75 MiB	48.04 MiB	4.29 MiB
`c7f264b`	17.75 MiB	19.68 MiB	1.94 MiB
`ec14be7`+dirty	17.75 MiB	19.69 MiB	1.94 MiB
`a206511`+dirty	43.75 MiB	48.07 MiB	4.32 MiB
`11ded16`+dirty	17.75 MiB	19.75 MiB	2.00 MiB
`1bea095`+dirty	17.75 MiB	19.70 MiB	1.95 MiB
`77061ed`+dirty	17.75 MiB	19.68 MiB	1.94 MiB
`d861c16`+dirty	17.75 MiB	19.70 MiB	1.96 MiB
`6c36ba5`+dirty	43.75 MiB	48.41 MiB	4.66 MiB
`d9f44bb`+dirty	43.75 MiB	48.40 MiB	4.64 MiB

antonis added the ready-to-merge Triggers the full CI test suite label Feb 9, 2026

antonis marked this pull request as ready for review February 9, 2026 14:44

antonis requested review from alwx and lucas-zimerman as code owners February 9, 2026 14:44

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(scripts): prevent command injection in expo-upload-sourcemaps#5636

fix(scripts): prevent command injection in expo-upload-sourcemaps#5636
antonis wants to merge 1 commit intomainfrom
antonis/RN-485

antonis commented Feb 9, 2026

Uh oh!

linear bot commented Feb 9, 2026

Uh oh!

github-actions bot commented Feb 9, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 9, 2026

Baseline results on branch: main

Startup times

App size

Uh oh!

github-actions bot commented Feb 9, 2026

Baseline results on branch: main

Startup times

App size

Uh oh!

github-actions bot commented Feb 9, 2026

Baseline results on branch: main

Startup times

App size

Uh oh!

github-actions bot commented Feb 9, 2026

Baseline results on branch: main

Startup times

App size

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

antonis commented Feb 9, 2026

📢 Type of change

📜 Description

💡 Motivation and Context

💚 How did you test it?

📝 Checklist

🔮 Next steps

Uh oh!

linear bot commented Feb 9, 2026

Uh oh!

github-actions bot commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Semver Impact of This PR

Uh oh!

github-actions bot commented Feb 9, 2026

iOS (legacy) Performance metrics 🚀

Baseline results on branch: main

Startup times

App size

Uh oh!

github-actions bot commented Feb 9, 2026

iOS (new) Performance metrics 🚀

Baseline results on branch: main

Startup times

App size

Uh oh!

github-actions bot commented Feb 9, 2026

Android (new) Performance metrics 🚀

Baseline results on branch: main

Startup times

App size

Uh oh!

github-actions bot commented Feb 9, 2026

Android (legacy) Performance metrics 🚀

Baseline results on branch: main

Startup times

App size

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions bot commented Feb 9, 2026 •

edited

Loading