Problem
With require_user_consent and consent revoked, Crashpad still launches the external crash reporter on crash. That reporter can upload via HTTP, bypassing consent.
Other backends (inproc, breakpad, native) block this in sentry__launch_external_crash_reporter() (solved in #1906). Crashpad uses a separate path: reporter paths are passed to StartHandler, and crashpad_handler calls LaunchCrashReporter() without checking consent.
crashpad_backend_user_consent_changed() only gates minidump HTTP upload (SetUploadsEnabled), not the external reporter.
Expected
Consent revoked → no reporter launch, no upload. With cache-keep, crash data cached for later.
Update
Init-time consent covered in 8da0eeb — reporter paths skipped at StartHandler when upload is blocked; test added.
Runtime revoke after consent was GIVEN at init still not covered (follow-up).
Problem
With
require_user_consentand consent revoked, Crashpad still launches the external crash reporter on crash. That reporter can upload via HTTP, bypassing consent.Other backends (inproc, breakpad, native) block this in
sentry__launch_external_crash_reporter()(solved in #1906). Crashpad uses a separate path: reporter paths are passed toStartHandler, andcrashpad_handlercallsLaunchCrashReporter()without checking consent.crashpad_backend_user_consent_changed()only gates minidump HTTP upload (SetUploadsEnabled), not the external reporter.Expected
Consent revoked → no reporter launch, no upload. With
cache-keep, crash data cached for later.Update
Init-time consent covered in
8da0eeb— reporter paths skipped at StartHandler when upload is blocked; test added.Runtime revoke after consent was GIVEN at init still not covered (follow-up).