Skip to content

fix(search): Reject unsupported project inbox sorts - #122414

Open
cvxluo wants to merge 1 commit into
masterfrom
cvxluo/reject-unsupported-project-inbox-sorts
Open

fix(search): Reject unsupported project inbox sorts#122414
cvxluo wants to merge 1 commit into
masterfrom
cvxluo/reject-unsupported-project-inbox-sorts

Conversation

@cvxluo

@cvxluo cvxluo commented Aug 21, 2026

Copy link
Copy Markdown
Contributor

Inbox sorting is implemented only by organization issue search, so remove its project API documentation and generic executor registration.

Project requests now return 400 instead of sending an empty aggregation name to Snuba.

Fixes SENTRY-5N94

Inbox sorting is implemented only by organization issue search.

Remove its project API documentation and generic executor registration.

Project requests now return 400 instead of sending an empty aggregation name to Snuba.

Fixes SENTRY-5N94

Co-authored-by: Claude <noreply@anthropic.com>
@github-actions github-actions Bot added the Scope: Backend Automatically applied to PRs that change backend components label Aug 21, 2026
@cvxluo
cvxluo marked this pull request as ready for review August 21, 2026 20:11
@cvxluo
cvxluo requested review from a team as code owners August 21, 2026 20:11
Comment on lines 1248 to 1250
}

aggregation_defs = {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Removing inbox from sort_strategies without adding API-level validation can cause a KeyError when sort_by='inbox' is passed, as the code directly accesses self.sort_strategies[sort_by].
Severity: HIGH

Suggested Fix

Add validation at the API layer, likely in build_query_params_from_request(), to ensure the sort parameter is one of the allowed values defined in the OpenAPI specification. This will reject invalid sort options like inbox before they reach the query executor, preventing the KeyError.

Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: src/sentry/search/snuba/executors.py#L1248-L1250

Potential issue: The pull request removes the `"inbox"` key from the
`PostgresSnubaQueryExecutor.sort_strategies` dictionary. However, there is no
corresponding input validation at the API layer to prevent clients from sending
`sort=inbox`. When an API request like `GET
/api/projects/{org}/{project}/issues/?sort=inbox` is made, the `sort_by` parameter
reaches the executor. The code then attempts to access `self.sort_strategies["inbox"]`,
which results in an unhandled `KeyError` because the key no longer exists. The existing
fallback logic does not handle this case, leading to a server error.

Also affects:

  • src/sentry/apidocs/parameters.py:408~414

Did we get this right? 👍 / 👎 to inform future reviews.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Scope: Backend Automatically applied to PRs that change backend components

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant