crashtracker: JSON-encode panic message transport to prevent protocol injection by paullegranddc · Pull Request #1966 · DataDog/libdatadog

paullegranddc · 2026-05-11T12:13:49Z

Motivation

Panic payloads were written verbatim between DD_CRASHTRACK_BEGIN_MESSAGE / DD_CRASHTRACK_END_MESSAGE markers, allowing an attacker-controlled multiline panic to inject protocol markers and tamper with downstream parsing and configuration.
The intent of this change is to close the marker-injection channel while preserving the ability for the receiver to reconstruct the original panic text.

Description

Encode panic message text with serde_json::to_string before emitting it in the collector, preventing embedded newlines or marker text from becoming raw protocol lines (libdd-crashtracker/src/collector/emitters.rs).
Decode/normalize the received message line on the receiver by unescaping escaped newline and carriage-return sequences so JSON-encoded messages are reconstructed as original multiline text (libdd-crashtracker/src/receiver/receive_report.rs).
The change is minimal and backwards-compatible because the receiver falls back to treating non-JSON/raw lines as before via simple unescape handling.

Testing

Ran cargo test -p libdd-crashtracker emit_message -- --nocapture, which executed the emit_message unit tests and reported 8 passed; 0 failed.
The collector and receiver unit-test suites were built during testing; the targeted emit_message tests passed successfully.

Codex Task

github-actions · 2026-05-11T12:15:56Z

📚 Documentation Check Results

⚠️ 1073 documentation warning(s) found

📦 `libdd-crashtracker` - 1073 warning(s)

Updated: 2026-05-11 12:16:05 UTC | Commit: 34b91d5 | missing-docs job results

github-actions · 2026-05-11T12:16:55Z

Clippy Allow Annotation Report

Comparing clippy allow annotations between branches:

Base Branch: origin/main
PR Branch: origin/codex/propose-fix-for-crashtracker-vulnerability

Summary by Rule

Rule	Base Branch	PR Branch	Change

Annotation Counts by File

File	Base Branch	PR Branch	Change

Annotation Stats by Crate

Crate	Base Branch	PR Branch	Change
`clippy-annotation-reporter`	5	5	No change (0%)
`datadog-ffe-ffi`	1	1	No change (0%)
`datadog-ipc`	21	21	No change (0%)
`datadog-live-debugger`	6	6	No change (0%)
`datadog-live-debugger-ffi`	10	10	No change (0%)
`datadog-profiling-replayer`	4	4	No change (0%)
`datadog-remote-config`	3	3	No change (0%)
`datadog-sidecar`	57	57	No change (0%)
`libdd-common`	13	13	No change (0%)
`libdd-common-ffi`	12	12	No change (0%)
`libdd-data-pipeline`	5	5	No change (0%)
`libdd-ddsketch`	2	2	No change (0%)
`libdd-dogstatsd-client`	1	1	No change (0%)
`libdd-profiling`	13	13	No change (0%)
`libdd-telemetry`	20	20	No change (0%)
`libdd-tinybytes`	4	4	No change (0%)
`libdd-trace-normalization`	2	2	No change (0%)
`libdd-trace-obfuscation`	8	8	No change (0%)
`libdd-trace-stats`	1	1	No change (0%)
`libdd-trace-utils`	15	15	No change (0%)
Total	203	203	No change (0%)

About This Report

This report tracks Clippy allow annotations for specific rules, showing how they've changed in this PR. Decreasing the number of these annotations generally improves code quality.

github-actions · 2026-05-11T12:17:26Z

🔒 Cargo Deny Results

⚠️ 4 issue(s) found, showing only errors (advisories, bans, sources)

📦 `libdd-crashtracker` - 4 error(s)

Show output

error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:144:1
    │
144 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── libdd-common v4.0.0
      │   ├── (build) libdd-crashtracker v1.0.0
      │   ├── libdd-shared-runtime v0.1.0
      │   │   └── libdd-telemetry v5.0.0
      │   │       └── libdd-crashtracker v1.0.0 (*)
      │   └── libdd-telemetry v5.0.0 (*)
      └── libdd-crashtracker v1.0.0 (*)

error[vulnerability]: Name constraints for URI names were incorrectly accepted
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:158:1
    │
158 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0098
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0098
    ├ Name constraints for URI names were ignored and therefore accepted.
      
      Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.  URI name constraints are now rejected unconditionally.
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-965h-392x-2mh5](https://github.com/rustls/webpki/security/advisories/GHSA-965h-392x-2mh5). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      └── rustls v0.23.37
          ├── hyper-rustls v0.27.7
          │   └── libdd-common v4.0.0
          │       ├── (build) libdd-crashtracker v1.0.0
          │       ├── libdd-shared-runtime v0.1.0
          │       │   └── libdd-telemetry v5.0.0
          │       │       └── libdd-crashtracker v1.0.0 (*)
          │       └── libdd-telemetry v5.0.0 (*)
          ├── libdd-common v4.0.0 (*)
          └── tokio-rustls v0.26.0
              ├── hyper-rustls v0.27.7 (*)
              └── libdd-common v4.0.0 (*)

error[vulnerability]: Name constraints were accepted for certificates asserting a wildcard name
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:158:1
    │
158 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0099
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0099
    ├ Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.
      
      This was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly allow a name of `reject.example.com` which is outside the constraint.
      This is very similar to [CVE-2025-61727](https://go.dev/issue/76442).
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-xgp8-3hg3-c2mh](https://github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      └── rustls v0.23.37
          ├── hyper-rustls v0.27.7
          │   └── libdd-common v4.0.0
          │       ├── (build) libdd-crashtracker v1.0.0
          │       ├── libdd-shared-runtime v0.1.0
          │       │   └── libdd-telemetry v5.0.0
          │       │       └── libdd-crashtracker v1.0.0 (*)
          │       └── libdd-telemetry v5.0.0 (*)
          ├── libdd-common v4.0.0 (*)
          └── tokio-rustls v0.26.0
              ├── hyper-rustls v0.27.7 (*)
              └── libdd-common v4.0.0 (*)

error[vulnerability]: Reachable panic in certificate revocation list parsing
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:158:1
    │
158 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0104
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0104
    ├ A panic was reachable when parsing certificate revocation lists via [`BorrowedCertRevocationList::from_der`]
      or [`OwnedCertRevocationList::from_der`].  This was the result of mishandling a syntactically valid empty
      `BIT STRING` appearing in the `onlySomeReasons` element of a `IssuingDistributionPoint` CRL extension.
      
      This panic is reachable prior to a CRL's signature being verified.
      
      Applications that do not use CRLs are not affected.
      
      Thank you to @tynus3 for the report.
    ├ Solution: Upgrade to >=0.103.13, <0.104.0-alpha.1 OR >=0.104.0-alpha.7 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      └── rustls v0.23.37
          ├── hyper-rustls v0.27.7
          │   └── libdd-common v4.0.0
          │       ├── (build) libdd-crashtracker v1.0.0
          │       ├── libdd-shared-runtime v0.1.0
          │       │   └── libdd-telemetry v5.0.0
          │       │       └── libdd-crashtracker v1.0.0 (*)
          │       └── libdd-telemetry v5.0.0 (*)
          ├── libdd-common v4.0.0 (*)
          └── tokio-rustls v0.26.0
              ├── hyper-rustls v0.27.7 (*)
              └── libdd-common v4.0.0 (*)

advisories FAILED, bans ok, sources ok

Updated: 2026-05-11 12:17:32 UTC | Commit: 34b91d5 | dependency-check job results

github-actions · 2026-05-11T12:17:26Z

🔒 Cargo Deny Results

⚠️ 4 issue(s) found, showing only errors (advisories, bans, sources)

📦 `libdd-crashtracker` - 4 error(s)

Show output

error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:144:1
    │
144 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── libdd-common v4.0.0
      │   ├── (build) libdd-crashtracker v1.0.0
      │   ├── libdd-shared-runtime v0.1.0
      │   │   └── libdd-telemetry v5.0.0
      │   │       └── libdd-crashtracker v1.0.0 (*)
      │   └── libdd-telemetry v5.0.0 (*)
      └── libdd-crashtracker v1.0.0 (*)

error[vulnerability]: Name constraints for URI names were incorrectly accepted
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:158:1
    │
158 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0098
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0098
    ├ Name constraints for URI names were ignored and therefore accepted.
      
      Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.  URI name constraints are now rejected unconditionally.
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-965h-392x-2mh5](https://github.com/rustls/webpki/security/advisories/GHSA-965h-392x-2mh5). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      └── rustls v0.23.37
          ├── hyper-rustls v0.27.7
          │   └── libdd-common v4.0.0
          │       ├── (build) libdd-crashtracker v1.0.0
          │       ├── libdd-shared-runtime v0.1.0
          │       │   └── libdd-telemetry v5.0.0
          │       │       └── libdd-crashtracker v1.0.0 (*)
          │       └── libdd-telemetry v5.0.0 (*)
          ├── libdd-common v4.0.0 (*)
          └── tokio-rustls v0.26.0
              ├── hyper-rustls v0.27.7 (*)
              └── libdd-common v4.0.0 (*)

error[vulnerability]: Name constraints were accepted for certificates asserting a wildcard name
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:158:1
    │
158 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0099
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0099
    ├ Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.
      
      This was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly allow a name of `reject.example.com` which is outside the constraint.
      This is very similar to [CVE-2025-61727](https://go.dev/issue/76442).
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-xgp8-3hg3-c2mh](https://github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      └── rustls v0.23.37
          ├── hyper-rustls v0.27.7
          │   └── libdd-common v4.0.0
          │       ├── (build) libdd-crashtracker v1.0.0
          │       ├── libdd-shared-runtime v0.1.0
          │       │   └── libdd-telemetry v5.0.0
          │       │       └── libdd-crashtracker v1.0.0 (*)
          │       └── libdd-telemetry v5.0.0 (*)
          ├── libdd-common v4.0.0 (*)
          └── tokio-rustls v0.26.0
              ├── hyper-rustls v0.27.7 (*)
              └── libdd-common v4.0.0 (*)

error[vulnerability]: Reachable panic in certificate revocation list parsing
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:158:1
    │
158 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0104
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0104
    ├ A panic was reachable when parsing certificate revocation lists via [`BorrowedCertRevocationList::from_der`]
      or [`OwnedCertRevocationList::from_der`].  This was the result of mishandling a syntactically valid empty
      `BIT STRING` appearing in the `onlySomeReasons` element of a `IssuingDistributionPoint` CRL extension.
      
      This panic is reachable prior to a CRL's signature being verified.
      
      Applications that do not use CRLs are not affected.
      
      Thank you to @tynus3 for the report.
    ├ Solution: Upgrade to >=0.103.13, <0.104.0-alpha.1 OR >=0.104.0-alpha.7 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      └── rustls v0.23.37
          ├── hyper-rustls v0.27.7
          │   └── libdd-common v4.0.0
          │       ├── (build) libdd-crashtracker v1.0.0
          │       ├── libdd-shared-runtime v0.1.0
          │       │   └── libdd-telemetry v5.0.0
          │       │       └── libdd-crashtracker v1.0.0 (*)
          │       └── libdd-telemetry v5.0.0 (*)
          ├── libdd-common v4.0.0 (*)
          └── tokio-rustls v0.26.0
              ├── hyper-rustls v0.27.7 (*)
              └── libdd-common v4.0.0 (*)

advisories FAILED, bans ok, sources ok

Updated: 2026-05-11 12:17:25 UTC | Commit: 34b91d5 | dependency-check job results

datadog-official · 2026-05-11T12:28:10Z

✨ Fix all issues with BitsAI or with Cursor

⚠️ Warnings

🧪 4 Tests failed

test_crash_tracking_bin_panic_hook_after_fork from bin_tests::crashtracker_bin_test

(Fix with Cursor)

thread 'test_crash_tracking_bin_panic_hook_after_fork' panicked at bin_tests/tests/crashtracker_bin_test.rs:895:9

thread 'test_crash_tracking_bin_panic_hook_after_fork' panicked at bin_tests/tests/crashtracker_bin_test.rs:895:9:
Expected panic message to start with 'Process panicked with message', got: "Process panicked with message \"child panicked after fork - hook should fire\" (bin_tests/src/modes/unix/test_013_panic_hook_after_fork.rs:69:13)"
stack backtrace:
   0:     0x55865841c00a - std::backtrace_rs::backtrace::libunwind::trace::h886f3b0575353f6e
                               at /rustc/e71f9a9a98b0faf423844bf0ba7438f29dc27d58/library/std/src/../../backtrace/src/backtrace/libunwind.rs:116:5
   1:     0x55865841c00a - std::backtrace_rs::backtrace::trace_unsynchronized::h652d1041ec67eb09
                               at /rustc/e71f9a9a98b0faf423844bf0ba7438f29dc27d58/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   2:     0x55865841c00a - std::sys::backtrace::_print_fmt::hd0317245a04c3039
...

test_crash_tracking_bin_panic_hook_string from bin_tests::crashtracker_bin_test

(Fix with Cursor)

thread 'test_crash_tracking_bin_panic_hook_string' panicked at bin_tests/tests/crashtracker_bin_test.rs:895:9

thread 'test_crash_tracking_bin_panic_hook_string' panicked at bin_tests/tests/crashtracker_bin_test.rs:895:9:
Expected panic message to start with 'Process panicked with message', got: "Process panicked with message \"Panic with value: 42\" (bin_tests/src/modes/unix/test_014_panic_hook_string.rs:29:9)"
stack backtrace:
   0:     0x55e0801c800a - std::backtrace_rs::backtrace::libunwind::trace::h886f3b0575353f6e
                               at /rustc/e71f9a9a98b0faf423844bf0ba7438f29dc27d58/library/std/src/../../backtrace/src/backtrace/libunwind.rs:116:5
   1:     0x55e0801c800a - std::backtrace_rs::backtrace::trace_unsynchronized::h652d1041ec67eb09
                               at /rustc/e71f9a9a98b0faf423844bf0ba7438f29dc27d58/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   2:     0x55e0801c800a - std::sys::backtrace::_print_fmt::hd0317245a04c3039
...

test_crash_tracking_bin_panic_hook_unknown_type from bin_tests::crashtracker_bin_test

(Fix with Cursor)

thread 'test_crash_tracking_bin_panic_hook_unknown_type' panicked at bin_tests/tests/crashtracker_bin_test.rs:895:9

thread 'test_crash_tracking_bin_panic_hook_unknown_type' panicked at bin_tests/tests/crashtracker_bin_test.rs:895:9:
Expected panic message to start with 'Process panicked with unknown type', got: "Process panicked with unknown type (bin_tests/src/modes/unix/test_015_panic_hook_unknown_type.rs:28:9)"
stack backtrace:
   0:     0x561376d6c00a - std::backtrace_rs::backtrace::libunwind::trace::h886f3b0575353f6e
                               at /rustc/e71f9a9a98b0faf423844bf0ba7438f29dc27d58/library/std/src/../../backtrace/src/backtrace/libunwind.rs:116:5
   1:     0x561376d6c00a - std::backtrace_rs::backtrace::trace_unsynchronized::h652d1041ec67eb09
                               at /rustc/e71f9a9a98b0faf423844bf0ba7438f29dc27d58/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   2:     0x561376d6c00a - std::sys::backtrace::_print_fmt::hd0317245a04c3039
...

test_crash_tracking_bin_unhandled_exception from bin_tests::crashtracker_bin_test

(Fix with Cursor)

thread 'test_crash_tracking_bin_unhandled_exception' panicked at bin_tests/tests/crashtracker_bin_test.rs:160:83

thread 'test_crash_tracking_bin_unhandled_exception' panicked at bin_tests/tests/crashtracker_bin_test.rs:160:83:
called \`Result::unwrap()\` on an \`Err\` value: Expected error message to contain 'Process was terminated due to an unhandled exception of type 'RuntimeException'. Message: 
 an exception 
 occured 
', got: '"Process was terminated due to an unhandled exception of type 'RuntimeException'. Message: \
 an exception \
 occured \
"'
...

View all

ℹ️ Info

No other issues found (see more)

❄️ No new flaky tests detected

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: dbd25b4 | Docs | Datadog PR Page | Give us feedback!}

dd-octo-sts · 2026-05-11T12:51:35Z

Artifact Size Benchmark Report

aarch64-alpine-linux-musl

Artifact	Baseline	Commit	Change
/aarch64-alpine-linux-musl/lib/libdatadog_profiling.a	81.66 MB	81.66 MB	0% (0 B) 👌
/aarch64-alpine-linux-musl/lib/libdatadog_profiling.so	7.57 MB	7.57 MB	0% (0 B) 👌

aarch64-apple-darwin

Artifact	Baseline	Commit	Change
/aarch64-apple-darwin/lib/libdatadog_profiling.a	59.16 MB	59.16 MB	0% (0 B) 👌
/aarch64-apple-darwin/lib/libdatadog_profiling.dylib	8.77 MB	8.77 MB	0% (0 B) 👌

aarch64-unknown-linux-gnu

Artifact	Baseline	Commit	Change
/aarch64-unknown-linux-gnu/lib/libdatadog_profiling.a	97.84 MB	97.84 MB	0% (0 B) 👌
/aarch64-unknown-linux-gnu/lib/libdatadog_profiling.so	10.01 MB	10.01 MB	0% (0 B) 👌

libdatadog-x64-windows

Artifact	Baseline	Commit	Change
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.dll	24.40 MB	24.40 MB	0% (0 B) 👌
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.lib	79.87 KB	79.87 KB	0% (0 B) 👌
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.pdb	179.62 MB	179.62 MB	0% (0 B) 👌
/libdatadog-x64-windows/debug/static/datadog_profiling_ffi.lib	910.67 MB	910.67 MB	0% (0 B) 👌
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.dll	7.71 MB	7.71 MB	0% (0 B) 👌
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.lib	79.87 KB	79.87 KB	0% (0 B) 👌
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.pdb	23.11 MB	23.11 MB	0% (0 B) 👌
/libdatadog-x64-windows/release/static/datadog_profiling_ffi.lib	45.25 MB	45.25 MB	0% (0 B) 👌

libdatadog-x86-windows

Artifact	Baseline	Commit	Change
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.dll	21.02 MB	21.02 MB	0% (0 B) 👌
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.lib	81.11 KB	81.11 KB	0% (0 B) 👌
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.pdb	183.76 MB	183.76 MB	0% (0 B) 👌
/libdatadog-x86-windows/debug/static/datadog_profiling_ffi.lib	896.93 MB	896.93 MB	0% (0 B) 👌
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.dll	5.98 MB	5.98 MB	0% (0 B) 👌
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.lib	81.11 KB	81.11 KB	0% (0 B) 👌
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.pdb	24.74 MB	24.74 MB	0% (0 B) 👌
/libdatadog-x86-windows/release/static/datadog_profiling_ffi.lib	42.75 MB	42.75 MB	0% (0 B) 👌

x86_64-alpine-linux-musl

Artifact	Baseline	Commit	Change
/x86_64-alpine-linux-musl/lib/libdatadog_profiling.a	72.78 MB	72.78 MB	0% (0 B) 👌
/x86_64-alpine-linux-musl/lib/libdatadog_profiling.so	8.41 MB	8.41 MB	0% (0 B) 👌

x86_64-apple-darwin

Artifact	Baseline	Commit	Change
/x86_64-apple-darwin/lib/libdatadog_profiling.a	59.68 MB	59.68 MB	0% (0 B) 👌
/x86_64-apple-darwin/lib/libdatadog_profiling.dylib	9.08 MB	9.08 MB	0% (0 B) 👌

x86_64-unknown-linux-gnu

Artifact	Baseline	Commit	Change
/x86_64-unknown-linux-gnu/lib/libdatadog_profiling.a	90.53 MB	90.53 MB	0% (0 B) 👌
/x86_64-unknown-linux-gnu/lib/libdatadog_profiling.so	10.03 MB	10.03 MB	0% (0 B) 👌

crashtracker: JSON-encode panic message transport

dbd25b4

paullegranddc added codex aardvark labels May 11, 2026 — with ChatGPT Codex Connector

github-actions Bot added the crashtracker label May 11, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

crashtracker: JSON-encode panic message transport to prevent protocol injection#1966

crashtracker: JSON-encode panic message transport to prevent protocol injection#1966
paullegranddc wants to merge 1 commit into
mainfrom
codex/propose-fix-for-crashtracker-vulnerability

paullegranddc commented May 11, 2026

Uh oh!

github-actions Bot commented May 11, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 11, 2026

Uh oh!

github-actions Bot commented May 11, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 11, 2026

Uh oh!

datadog-official Bot commented May 11, 2026 •

edited

Loading

Uh oh!

dd-octo-sts Bot commented May 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

paullegranddc commented May 11, 2026

Motivation

Description

Testing

Uh oh!

github-actions Bot commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📚 Documentation Check Results

📦 libdd-crashtracker - 1073 warning(s)

Uh oh!

github-actions Bot commented May 11, 2026

Clippy Allow Annotation Report

Summary by Rule

Annotation Counts by File

Annotation Stats by Crate

About This Report

Uh oh!

github-actions Bot commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔒 Cargo Deny Results

📦 libdd-crashtracker - 4 error(s)

Uh oh!

github-actions Bot commented May 11, 2026

🔒 Cargo Deny Results

📦 libdd-crashtracker - 4 error(s)

Uh oh!

datadog-official Bot commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Warnings

ℹ️ Info

Uh oh!

dd-octo-sts Bot commented May 11, 2026

Artifact Size Benchmark Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions Bot commented May 11, 2026 •

edited

Loading

📦 `libdd-crashtracker` - 1073 warning(s)

github-actions Bot commented May 11, 2026 •

edited

Loading

📦 `libdd-crashtracker` - 4 error(s)

📦 `libdd-crashtracker` - 4 error(s)

datadog-official Bot commented May 11, 2026 •

edited

Loading