feat(investigations): Add response serializers - #121576
Merged
Merged
Conversation
github-actions
Bot
added
the
Scope: Backend
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 22b59ea. Configure here.
![sentry-warden[bot]](https://avatars.githubusercontent.com/in/2755838?s=60&v=4){kind=small}
Comment on lines
+157
to
+173
| "position": obj.position, | ||
| "kind": obj.kind, | ||
| "title": obj.title, | ||
| "content": content, | ||
| "generationPrompt": obj.prompt, | ||
| "generatedContent": generated_content, | ||
| "output": output, | ||
| "outputStatus": output_status, | ||
| "currentExecution": ( | ||
| { | ||
| "id": str(execution.id), | ||
| "status": execution.status, | ||
| "executor": execution.executor, | ||
| "schemaVersion": execution.result_schema_version, | ||
| "startedAt": execution.started_at, | ||
| "completedAt": execution.completed_at, | ||
| "error": execution.error, |
Contributor
There was a problem hiding this comment.
Execution error field bypasses project access control in block serializer
currentExecution.error is serialized even when is_accessible returns False, potentially exposing stack traces or SQL fragments from restricted project executions.
Evidence
InvestigationBlockExecution.erroris aJSONField(null=True)onblock_execution.py:68with no schema constraint, so it may hold stack traces, SQL fragments, or internal paths from Seer runs.is_accessible(execution)(block.py:114-118) gates theoutputandcontentfields based onaccessible_project_ids, butcurrentExecutionis built unconditionally whenexecution is not None.- The
errorkey insidecurrentExecutionis included on line 173 without any accessibility check, so a viewer blocked from seeing a block's result can still receive the execution's error payload.
Also found at 1 additional location
src/sentry/investigations/endpoints/serializers/investigation.py:148
Identified by Warden · wrdn-data-exfil, security-review · H6E-FH6
This splits out the response serializers from #121403 to keep the total pr size down, and restructures them into separate folders.
wedamija
force-pushed
the
danf/investigations-serializers
branch
from
August 10, 2026 18:54
0757dc0 to
1f11584
Compare
arslnb
approved these changes
Aug 10, 2026
arslnb
left a comment
arslnb
left a comment
Contributor
There was a problem hiding this comment.
Looks good, the warden comment shouldn't matter since this response (or error) is already visible to the user via the explorer flow
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This splits out the response serializers from #121403 to keep the total pr size down, and restructures them into separate folders.