fix(tracing): Fix empty orgId bypassing DSN fallback

The getEffectiveOrgId() method only checked orgId != null, allowing
empty strings and whitespace-only values to bypass the DSN fallback
mechanism. This caused empty org IDs to propagate to outgoing baggage
headers as sentry-org_id=, silently breaking trace continuation in
strict mode.

Update getEffectiveOrgId() to trim the orgId value and check if it's
empty after trimming. Empty or blank values now correctly fall back
to the DSN org ID instead of propagating as empty strings.

Add comprehensive test coverage for all edge cases including empty
strings, whitespace-only values, and their impact on baggage
propagation and strict trace continuation.

Co-Authored-By: Claude <noreply@anthropic.com>

sentry/src/main/java/io/sentry/SentryOptions.java

@@ -2334,11 +2334,15 @@ public void setOrgId(final @Nullable String orgId) {
 
   /**
    * Returns the effective org ID, preferring the explicit config option over the DSN-parsed value.
+   * Empty or whitespace-only explicit org IDs are treated as unset and fall back to the DSN.
    */
   @ApiStatus.Internal
   public @Nullable String getEffectiveOrgId() {
     if (orgId != null) {
-      return orgId;
+      final @NotNull String trimmed = orgId.trim();
+      if (!trimmed.isEmpty()) {
+        return trimmed;
+      }
     }
     try {
       final @Nullable String dsnOrgId = retrieveParsedDsn().getOrgId();

sentry/src/test/java/io/sentry/BaggageTest.kt

@@ -4,6 +4,7 @@ import com.github.javafaker.Faker
 import io.sentry.Baggage.MAX_BAGGAGE_LIST_MEMBER_COUNT
 import io.sentry.Baggage.MAX_BAGGAGE_STRING_LENGTH
 import io.sentry.protocol.SentryId
+import io.sentry.protocol.TransactionNameSource
 import java.util.UUID
 import kotlin.test.BeforeTest
 import kotlin.test.Test
@@ -736,6 +737,90 @@ class BaggageTest {
     assertNull(baggage.sampleRate)
   }
 
+  @Test
+  fun `setValuesFromScope falls back to DSN org id when explicit orgId is empty`() {
+    val options =
+      SentryOptions().apply {
+        dsn = "https://key@o123.ingest.sentry.io/456"
+        orgId = ""
+      }
+    val scope = Scope(options)
+    val baggage = Baggage(logger)
+
+    baggage.setValuesFromScope(scope, options)
+
+    assertEquals("123", baggage.orgId)
+  }
+
+  @Test
+  fun `setValuesFromScope falls back to DSN org id when explicit orgId is whitespace`() {
+    val options =
+      SentryOptions().apply {
+        dsn = "https://key@o123.ingest.sentry.io/456"
+        orgId = "   "
+      }
+    val scope = Scope(options)
+    val baggage = Baggage(logger)
+
+    baggage.setValuesFromScope(scope, options)
+
+    assertEquals("123", baggage.orgId)
+  }
+
+  @Test
+  fun `setValuesFromTransaction falls back to DSN org id when explicit orgId is empty`() {
+    val options =
+      SentryOptions().apply {
+        dsn = "https://key@o123.ingest.sentry.io/456"
+        orgId = ""
+      }
+    val baggage = Baggage(logger)
+
+    baggage.setValuesFromTransaction(
+      SentryId(),
+      SentryId(),
+      options,
+      TracesSamplingDecision(true, 1.0),
+      "test-transaction",
+      TransactionNameSource.CUSTOM,
+    )
+
+    assertEquals("123", baggage.orgId)
+  }
+
+  @Test
+  fun `fromEvent falls back to DSN org id when explicit orgId is empty`() {
+    val options =
+      SentryOptions().apply {
+        dsn = "https://key@o123.ingest.sentry.io/456"
+        orgId = ""
+      }
+    val event = SentryEvent()
+    event.contexts.setTrace(SpanContext("test-op"))
+
+    val baggage = Baggage.fromEvent(event, "test-transaction", options)
+
+    assertEquals("123", baggage.orgId)
+  }
+
+  @Test
+  fun `baggage header does not include org id when both explicit and DSN org ids are empty`() {
+    val options =
+      SentryOptions().apply {
+        dsn = "https://key@sentry.io/456"
+        orgId = ""
+        release = "1.0.0"
+      }
+    val scope = Scope(options)
+    val baggage = Baggage(logger)
+
+    baggage.setValuesFromScope(scope, options)
+    val headerString = baggage.toHeaderString(null)
+
+    // Should not contain sentry-org_id if both explicit and DSN org ids are null/empty
+    assertFalse(headerString.contains("sentry-org_id"))
+  }
+
   /**
    * token = 1*tchar tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." / "^" / "_" /
    * "`" / "|" / "~" / DIGIT / ALPHA ; any VCHAR, except delimiters

sentry/src/test/java/io/sentry/SentryOptionsTest.kt

@@ -1032,4 +1032,44 @@ class SentryOptionsTest {
     options.dsn = "https://key@sentry.io/456"
     assertNull(options.effectiveOrgId)
   }
+
+  @Test
+  fun `getEffectiveOrgId falls back to DSN when explicit orgId is empty string`() {
+    val options = SentryOptions()
+    options.dsn = "https://key@o123.ingest.sentry.io/456"
+    options.orgId = ""
+    assertEquals("123", options.effectiveOrgId)
+  }
+
+  @Test
+  fun `getEffectiveOrgId falls back to DSN when explicit orgId is whitespace only`() {
+    val options = SentryOptions()
+    options.dsn = "https://key@o123.ingest.sentry.io/456"
+    options.orgId = "   "
+    assertEquals("123", options.effectiveOrgId)
+  }
+
+  @Test
+  fun `getEffectiveOrgId falls back to DSN when explicit orgId is tab and newline`() {
+    val options = SentryOptions()
+    options.dsn = "https://key@o123.ingest.sentry.io/456"
+    options.orgId = "\t\n"
+    assertEquals("123", options.effectiveOrgId)
+  }
+
+  @Test
+  fun `getEffectiveOrgId returns null when explicit orgId is empty and no DSN orgId`() {
+    val options = SentryOptions()
+    options.dsn = "https://key@sentry.io/456"
+    options.orgId = ""
+    assertNull(options.effectiveOrgId)
+  }
+
+  @Test
+  fun `getEffectiveOrgId trims whitespace from explicit orgId`() {
+    val options = SentryOptions()
+    options.dsn = "https://key@o123.ingest.sentry.io/456"
+    options.orgId = "  999  "
+    assertEquals("999", options.effectiveOrgId)
+  }
 }

sentry/src/test/java/io/sentry/util/TracingUtilsTest.kt

@@ -566,4 +566,28 @@ class TracingUtilsTest {
     val options = makeOptions(dsnOrgId = null, strict = true)
     assertTrue(TracingUtils.shouldContinueTrace(options, makeBaggage(null)))
   }
+
+  @Test
+  fun `shouldContinueTrace uses DSN fallback when explicit orgId is empty`() {
+    val options = makeOptions(dsnOrgId = "123", explicitOrgId = "", strict = true)
+    assertTrue(TracingUtils.shouldContinueTrace(options, makeBaggage("123")))
+  }
+
+  @Test
+  fun `shouldContinueTrace uses DSN fallback when explicit orgId is whitespace`() {
+    val options = makeOptions(dsnOrgId = "123", explicitOrgId = "   ", strict = true)
+    assertTrue(TracingUtils.shouldContinueTrace(options, makeBaggage("123")))
+  }
+
+  @Test
+  fun `shouldContinueTrace rejects mismatch after empty explicit orgId falls back to DSN`() {
+    val options = makeOptions(dsnOrgId = "123", explicitOrgId = "", strict = true)
+    assertFalse(TracingUtils.shouldContinueTrace(options, makeBaggage("999")))
+  }
+
+  @Test
+  fun `shouldContinueTrace strict=false with empty explicit orgId uses DSN fallback`() {
+    val options = makeOptions(dsnOrgId = "123", explicitOrgId = "", strict = false)
+    assertTrue(TracingUtils.shouldContinueTrace(options, makeBaggage("123")))
+  }
 }