MINOR - React and Java telemetry

[TeddyCr]

Describe your changes:

Added telemetry for UI and Java

Type of change:

• Bug fix
• Improvement
• New feature
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation

Checklist:

• I have read the CONTRIBUTING document.
• My PR title is Fixes <issue-number>: <short explanation>
• I have commented on my code, particularly in hard-to-understand areas.
• For JSON Schema changes: I updated the migration scripts or explained why it is not needed.

---

Summary by Gitar

• Configuration:
  • Introduced SentryConfiguration schema to manage error tracking and performance monitoring settings.
  • Updated OpenMetadataApplicationConfig to include the new Sentry configuration block.
• Telemetry initialization:
  • Initialized IndexResource on application startup to inject Sentry configuration details into the UI index.html.
  • Added helper methods in IndexResource for safe JavaScript variable escaping.

_{This will update automatically on new commits.}

[Copilot]

Pull request overview

This PR adds server-side placeholder substitution to the UI index.html payload so telemetry-related configuration (e.g., Sentry settings), cluster name, and application version can be injected at render time.

Changes:

• Populate additional index.html placeholders (sentryDsn, sentryEnvironment, sentryTraceSampleRate) from environment variables.
• Populate clusterName from OPENMETADATA_CLUSTER_NAME.
• Populate appVersion from VersionResource’s catalog version.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

[Copilot]

New logic injects multiple telemetry-related placeholders into the index HTML, but there are no tests asserting that these new placeholders are correctly replaced and safely escaped. Adding a test fixture /assets/index.html that includes the new tokens (or updating the existing test resource) and asserting the output of getIndexFile(...) contains the resolved values would prevent regressions (e.g., placeholders leaking to the client).

[Copilot]

The static HTML preprocessing replaces ${sentryDsn}, ${sentryEnvironment}, ${sentryTraceSampleRate}, ${clusterName}, and ${appVersion}. In the current repo, neither openmetadata-ui/src/main/resources/ui/index.html nor the test /assets/index.html contains these placeholders, so these replacements will be no-ops unless the built /assets/index.html template is also updated during the UI build/packaging. Please ensure the served /assets/index.html actually includes these tokens (or adjust the replacement keys accordingly), otherwise the telemetry config won’t be injected.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.

[gitar-bot]

Code Review 👍 Approved with suggestions 4 resolved / 5 findings

Refactored telemetry to ensure proper Sentry placeholder replacement and secure HTML injection, though the lazy initialization in getSentryConfiguration() requires synchronization for thread safety.

💡 Bug: Lazy getSentryConfiguration() is not thread-safe

📄 openmetadata-service/src/main/java/org/openmetadata/service/OpenMetadataApplicationConfig.java:171-179

The getSentryConfiguration() method at line 174 performs lazy initialization (if (sentryConfiguration == null) { sentryConfiguration = new SentryConfiguration(); }) without synchronization, and the field is not volatile. In theory, two threads could each see null and create separate instances. In practice this is likely only called during single-threaded startup, but it's inconsistent with defensive patterns used elsewhere. Other similar getters in the same class (e.g., getAdminOpsConfiguration) appear to follow the same pattern, so this is a pre-existing style — but worth noting for the new field.

✅ 4 resolved

✅ Bug: Sentry placeholders not replaced in getIndex() endpoint path

📄 openmetadata-service/src/main/java/org/openmetadata/service/resources/system/IndexResource.java:46-48 📄 openmetadata-service/src/main/java/org/openmetadata/service/resources/system/IndexResource.java:87-96
The new sentry/cluster/version replacements (lines 56-66) are only applied in the static getIndexFile(String basePath) method, which is used by OpenMetadataAssetServlet. However, the getIndex() JAX-RS endpoint (line 87-96) serves this.indexHtml, which is only processed by initialize() (line 46-48). Since initialize() only replaces ${basePath}, the getIndex() endpoint will serve HTML containing literal unreplaced placeholders like ${sentryDsn}, ${sentryEnvironment}, ${sentryTraceSampleRate}, ${clusterName}, and ${appVersion}.

The same replacements need to be applied in initialize() (or indexHtml should be computed using getIndexFile).

✅ Performance: Env vars and VersionResource re-evaluated on every request

📄 openmetadata-service/src/main/java/org/openmetadata/service/resources/system/IndexResource.java:53-66
getIndexFile() is called on every HTML-serving request from OpenMetadataAssetServlet. Each call reads 4 environment variables via System.getenv(), instantiates a new VersionResource, and performs 6 string replacements on the full HTML. These values (env vars, app version) are effectively static for the lifetime of the process. The result should be computed once and cached, not recomputed per request.

✅ Security: Env var values injected into HTML without escaping

📄 openmetadata-service/src/main/java/org/openmetadata/service/resources/system/IndexResource.java:56-65
Environment variable values (SENTRY_UI_DSN, SENTRY_ENVIRONMENT, OPENMETADATA_CLUSTER_NAME, etc.) are interpolated directly into the HTML template without HTML/JS escaping. If any env var contains characters like </script> or similar HTML-significant content, it could break the page or introduce an XSS vector. While these values are controlled by server administrators (reducing practical risk), defensive escaping is good practice for any value injected into HTML.

✅ Bug: NPE if getIndexFile() called before initialize()

📄 openmetadata-service/src/main/java/org/openmetadata/service/resources/system/IndexResource.java:27 📄 openmetadata-service/src/main/java/org/openmetadata/service/resources/system/IndexResource.java:69
The field configProcessedHtml was changed from a static final (guaranteed initialized in the static block) to a static volatile field that is only set when initialize() is called. If any code path invokes getIndexFile() before initialize() completes (e.g., during startup race or a misconfigured test), configProcessedHtml.replace(...) at line 69 will throw a NullPointerException.

The previous code was safe because CONFIG_PROCESSED_HTML was assigned in the static initializer, guaranteeing it was non-null by the time the class was loaded.

🤖 Prompt for agents

Code Review: Refactored telemetry to ensure proper Sentry placeholder replacement and secure HTML injection, though the lazy initialization in getSentryConfiguration() requires synchronization for thread safety.

1. 💡 Bug: Lazy getSentryConfiguration() is not thread-safe
   Files: openmetadata-service/src/main/java/org/openmetadata/service/OpenMetadataApplicationConfig.java:171-179

   The `getSentryConfiguration()` method at line 174 performs lazy initialization (`if (sentryConfiguration == null) { sentryConfiguration = new SentryConfiguration(); }`) without synchronization, and the field is not `volatile`. In theory, two threads could each see `null` and create separate instances. In practice this is likely only called during single-threaded startup, but it's inconsistent with defensive patterns used elsewhere. Other similar getters in the same class (e.g., `getAdminOpsConfiguration`) appear to follow the same pattern, so this is a pre-existing style — but worth noting for the new field.

Options

Display: compact → Showing less information.

Comment with these commands to change:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed for 'open-metadata-ui'

Issues
1060 New issues
0 Accepted issues

Measures
17 Security Hotspots
0.0% Coverage on New Code
3.8% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed for 'open-metadata-ingestion'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud