fix: Allow injection plugins to apply to files with query parameters and fragments in their name#597
Conversation
…uery parameters in their name
|
Thanks for the contribution, I'd like for this to work consistently across bundlers (esbuild, vite, rollup) before going through with the change so we need to cook a bit more here. Do you feel like also adjusting the logic for the other bundlers? Otherwise I can take over. |
Maybe this is delusional and we can do this iteratively, idk |
also: lol |
Lms24
left a comment
There was a problem hiding this comment.
Thanks for opening this PR @thristhart
I have no objections to giving this a try. If people actually write in with issues about this (aside from the spacebar problem) we can always revert.
Just had a concern about the regex but otherwise let's give it a try :)
| debugIdChunkFilePath.endsWith(".js") || | ||
| debugIdChunkFilePath.endsWith(".mjs") || | ||
| debugIdChunkFilePath.endsWith(".cjs") | ||
| (debugIdChunkFilePath) => !!debugIdChunkFilePath.match(/\.(js|mjs|cjs)(\?.*)?(#.*)?$/) |
There was a problem hiding this comment.
This regex can lead to polynomial buildup. While I don't think that this is likely to produce a real ReDos situation we can change the regex a bit to avoid it:
| (debugIdChunkFilePath) => !!debugIdChunkFilePath.match(/\.(js|mjs|cjs)(\?.*)?(#.*)?$/) | |
| (debugIdChunkFilePath) => !!debugIdChunkFilePath.match(/\.(js|mjs|cjs)(\?[^\?]*)?(#[^#]*)?$/) |
I might have been burned by this a while ago, so I just wanna be extra careful 😅
There was a problem hiding this comment.
Alternatively, could we not also just use stripQueryAndHashFromPath here?
There was a problem hiding this comment.
damn, good catch - this realistically should never receive unsanitized user input but it's definitely good to change in any case. I think I'll do stripQueryAndHash here.
packages/webpack-plugin/src/index.ts
Outdated
| new BannerPlugin({ | ||
| raw: true, | ||
| include: /\.(js|ts|jsx|tsx|mjs|cjs)$/, | ||
| include: /\.(js|ts|jsx|tsx|mjs|cjs)(\?.*)?(#.*)?$/, |
There was a problem hiding this comment.
I'd also change these regexes here as shown above
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 2.22.1 | 2.22.4 | ## [v2.22.4](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2224) - feat(react-component-annotate): Handle function body returning a ternary ([#598](getsentry/sentry-javascript-bundler-plugins#598)) - fix: Allow injection plugins to apply to files with query parameters and fragments in their name ([#597](getsentry/sentry-javascript-bundler-plugins#597)) Work in this release contributed by [@thristhart](https://github.com/Thristhart). Thank you for your contribution! ## [v2.22.3](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2223) - fix(core): Always instantiate global `Error` class in injected code snippets ([#594](getsentry/sentry-javascript-bundler-plugins#594)) ## [v2.22.2](https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/HEAD/CHANGELOG.md#2222) - fix: Disable debug ID injection when `sourcemaps.disable` is set ([#589](getsentry/sentry-javascript-bundler-plugins#589))
Fixes #596
The previous regex excluded entry points that have query parameters. The common use case for this is content hashes, e.g.:
The new regex will match the same things as before, but additionally allows those filenames to end with a
?followed by any number of characters. I think this should be fairly safe? The only edge case I can think of is a spacebar heating situation where someone was using the previous behavior to opt out of sentry injection for specific entry points, but that seems unlikely.