Gracefully handle "sentry-trace" headers that don't match the regexp

Fixes the handling of invalid "sentry-trace" header values, such as "null".

Related error backtrace:

Rack app error handling request { POST /graphql }
.../sentry-ruby-core-4.1.6/lib/sentry/transaction.rb:32:in `from_sentry_trace'
.../sentry-ruby-core-4.1.6/lib/sentry/rack/capture_exceptions.rb:21:in `block in call'
.../sentry-ruby-core-4.1.6/lib/sentry/hub.rb:52:in `with_scope'
.../sentry-ruby-core-4.1.6/lib/sentry-ruby.rb:149:in `with_scope'
.../sentry-ruby-core-4.1.6/lib/sentry/rack/capture_exceptions.rb:14:in `call'

Author: lfittl

sentry-ruby/CHANGELOG.md

@@ -33,6 +33,10 @@ end
 
 - Inspect exception cause by default & don't exclude ActiveJob::DeserializationError [#1180](https://github.com/getsentry/sentry-ruby/pull/1180)
   - Fixes [#1071](https://github.com/getsentry/sentry-ruby/issues/1071)
+- Ignore invalid values for sentry-trace header that don't match the required format [#1265](https://github.com/getsentry/sentry-ruby/pull/1265)
+- Correctly call sampled state initialization logic when capturing sentry-trace [#1265](https://github.com/getsentry/sentry-ruby/pull/1265)
+  - Previously the span's sampled state was always set to nil when the sentry-trace header was set,
+    which caused child spans to not be reported
 
 ## 4.1.6
 

sentry-ruby/lib/sentry/rack/capture_exceptions.rb

@@ -16,12 +16,9 @@ def call(env)
           scope.set_transaction_name(env["PATH_INFO"]) if env["PATH_INFO"]
           scope.set_rack_env(env)
 
-          span =
-            if sentry_trace = env["HTTP_SENTRY_TRACE"]
-              Sentry::Transaction.from_sentry_trace(sentry_trace, name: scope.transaction_name, op: transaction_op)
-            else
-              Sentry.start_transaction(name: scope.transaction_name, op: transaction_op)
-            end
+          sentry_trace = env["HTTP_SENTRY_TRACE"]
+          span = Sentry::Transaction.from_sentry_trace(sentry_trace, name: scope.transaction_name, op: transaction_op) if sentry_trace
+          span ||= Sentry.start_transaction(name: scope.transaction_name, op: transaction_op)
 
           scope.set_span(span)
 

sentry-ruby/lib/sentry/transaction.rb

@@ -29,6 +29,7 @@ def self.from_sentry_trace(sentry_trace, **options)
       return unless sentry_trace
 
       match = SENTRY_TRACE_REGEXP.match(sentry_trace)
+      return if match.nil?
       trace_id, parent_span_id, sampled_flag = match[1..3]
 
       sampled = sampled_flag != "0"

sentry-ruby/spec/sentry/rack/capture_exceptions_spec.rb

@@ -194,6 +194,20 @@
         expect(transaction.contexts.dig(:trace, :parent_span_id)).to eq(external_transaction.span_id)
         expect(transaction.contexts.dig(:trace, :span_id)).not_to eq(external_transaction.span_id)
       end
+
+      it "safely handles bugus header values" do
+        env["HTTP_SENTRY_TRACE"] = 'null'
+
+        stack.call(env)
+
+        # creates a new transaction
+        transaction = transport.events.last
+        expect(transaction.type).to eq("transaction")
+        expect(transaction.timestamp).not_to be_nil
+        expect(transaction.contexts.dig(:trace, :status)).to eq("ok")
+        expect(transaction.contexts.dig(:trace, :op)).to eq("rack.request")
+        expect(transaction.spans.count).to eq(0)
+      end
     end
 
     context "when the transaction is sampled" do

sentry-ruby/spec/sentry/transaction_spec.rb

@@ -23,6 +23,12 @@
       expect(child_transaction.parent_sampled).to eq(true)
       expect(child_transaction.op).to eq("child")
     end
+
+    it "handles invalid values without crashing" do
+      child_transaction = described_class.from_sentry_trace("dummy", op: "child")
+
+      expect(child_transaction).to be_nil
+    end
   end
 
   describe "#deep_dup" do