Skip to content

fix(security): Replace destructive rm -rf with safer file removal in btrace skill #5385

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
fix-it-felix-sentry wants to merge 1 commit into from
+2 −2
Closed

fix(security): Replace destructive rm -rf with safer file removal in btrace skill #5385

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .claude/skills/btrace-perfetto/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,7 @@ For each branch to trace:
Clear any stale port files, set properties, and launch:

```bash
adb shell "rm -rf /storage/emulated/0/Android/data/io.sentry.samples.android/files/rhea-port"
adb shell "test -e /storage/emulated/0/Android/data/io.sentry.samples.android/files/rhea-port && rm /storage/emulated/0/Android/data/io.sentry.samples.android/files/rhea-port || true"
Copy link
Copy Markdown

@cursor cursor Bot May 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Plain rm silently fails on rhea-port directory

High Severity

The rhea-port path is a directory created by the RheaTrace SDK during initialization, not a plain file. Replacing rm -rf with plain rm (no -r flag) means the command can no longer remove a directory. Because || true swallows the error, the stale port directory silently persists, and subsequent btrace operations will fail with confusing errors about port conflicts or timeouts. The fix needs to retain the ability to remove a directory while still being safer than the original rm -rf.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 9603df4. Configure here.

adb shell setprop debug.rhea3.startWhenAppLaunch 1
adb shell setprop debug.rhea3.waitTraceTimeout 60
adb shell am force-stop io.sentry.samples.android
Expand Down Expand Up @@ -299,5 +299,5 @@ After tracing is complete, remind the user that the btrace integration changes t
| Empty jar file (0 bytes) | Download from Maven Central (`repo1.maven.org`), not `oss.sonatype.org` |
| `FileNotFoundException` on sampling download | App was already running when properties were set; force-stop and relaunch |
| `SocketException: Unexpected end of file` in release builds | R8 stripped btrace classes; add `-keep class com.bytedance.rheatrace.** { *; }` to proguard-rules.pro |
| Stale port from previous session | Run `adb shell "rm -rf /storage/emulated/0/Android/data/io.sentry.samples.android/files/rhea-port"` before launching |
| Stale port from previous session | Run `adb shell "test -e /storage/emulated/0/Android/data/io.sentry.samples.android/files/rhea-port && rm /storage/emulated/0/Android/data/io.sentry.samples.android/files/rhea-port || true"` before launching |
| Most `onTouchEvent` durations are 0ms | Increase sampling rate with `-sampleInterval 333000` (3kHz) |
Loading