-
Notifications
You must be signed in to change notification settings - Fork 37
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: Allow injection plugins to apply to files with query parameters and fragments in their name #597
fix: Allow injection plugins to apply to files with query parameters and fragments in their name #597
Conversation
…uery parameters in their name
Thanks for the contribution, I'd like for this to work consistently across bundlers (esbuild, vite, rollup) before going through with the change so we need to cook a bit more here. Do you feel like also adjusting the logic for the other bundlers? Otherwise I can take over. |
Maybe this is delusional and we can do this iteratively, idk |
also: lol |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for opening this PR @Thristhart
I have no objections to giving this a try. If people actually write in with issues about this (aside from the spacebar problem) we can always revert.
Just had a concern about the regex but otherwise let's give it a try :)
debugIdChunkFilePath.endsWith(".js") || | ||
debugIdChunkFilePath.endsWith(".mjs") || | ||
debugIdChunkFilePath.endsWith(".cjs") | ||
(debugIdChunkFilePath) => !!debugIdChunkFilePath.match(/\.(js|mjs|cjs)(\?.*)?(#.*)?$/) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This regex can lead to polynomial buildup. While I don't think that this is likely to produce a real ReDos situation we can change the regex a bit to avoid it:
(debugIdChunkFilePath) => !!debugIdChunkFilePath.match(/\.(js|mjs|cjs)(\?.*)?(#.*)?$/) | |
(debugIdChunkFilePath) => !!debugIdChunkFilePath.match(/\.(js|mjs|cjs)(\?[^\?]*)?(#[^#]*)?$/) |
I might have been burned by this a while ago, so I just wanna be extra careful 😅
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Alternatively, could we not also just use stripQueryAndHashFromPath
here?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
damn, good catch - this realistically should never receive unsanitized user input but it's definitely good to change in any case. I think I'll do stripQueryAndHash here.
packages/webpack-plugin/src/index.ts
Outdated
@@ -39,7 +39,7 @@ function webpackReleaseInjectionPlugin(injectionCode: string): UnpluginOptions { | |||
// eslint-disable-next-line @typescript-eslint/no-unsafe-argument, @typescript-eslint/no-unsafe-call | |||
new BannerPlugin({ | |||
raw: true, | |||
include: /\.(js|ts|jsx|tsx|mjs|cjs)$/, | |||
include: /\.(js|ts|jsx|tsx|mjs|cjs)(\?.*)?(#.*)?$/, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'd also change these regexes here as shown above
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@Thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@Thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@Thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@Thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@Thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@Thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@Thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@Thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@Thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@Thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@Thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@Thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@Thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@Thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@Thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@Thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
Fixes #596
The previous regex excluded entry points that have query parameters. The common use case for this is content hashes, e.g.:
The new regex will match the same things as before, but additionally allows those filenames to end with a
?
followed by any number of characters. I think this should be fairly safe? The only edge case I can think of is a spacebar heating situation where someone was using the previous behavior to opt out of sentry injection for specific entry points, but that seems unlikely.