Sourcemap inject breaks with paperjs

[netpok]

CLI Version

2.39.1

Operating System and Architecture

• macOS (arm64)
• macOS (x86_64)
• Linux (i686)
• Linux (x86_64)
• Linux (armv7)
• Linux (aarch64)
• Windows (i686)
• Windows (x86_64)

Operating System Version

Linux Mint 21.3

Link to reproduction repository

https://github.com/netpok/paperjs-vite-sentry-inject-poc

CLI Command

sentry-cli sourcemaps inject dist/assets

Exact Reproduction Steps

1. Clone the provided repository
2. Run npm install and npm build (optional, prebuilt dist files are also in the repo)
3. Run sentry-cli sourcemaps inject dist/assets

Expected Results

Debug ids successfully injected

Actual Results

CLI throws error: Invalid embedded sourcemap in source file dist/assets/index-DAUKG_fp.js because it finds string literal of sourceMappingURL

https://github.com/netpok/paperjs-vite-sentry-inject-poc/blob/main/dist/assets/index-DAUKG_fp.js#L35

Logs

  INFO    2024-11-27 08:19:42.740070385 +01:00 Loaded config from /home/<user>/.sentryclirc
  DEBUG   2024-11-27 08:19:42.740133483 +01:00 sentry-cli version: 2.39.1, platform: "linux", architecture: "x86_64"
  INFO    2024-11-27 08:19:42.740686605 +01:00 sentry-cli was invoked with the following command line: "/usr/lib/node_modules/@sentry/cli/node_modules/@sentry/cli-linux-x64/bin/sentry-cli" "sourcemaps" "inject" "dist/assets" "--log-level=debug"
> Searching dist/assets
  DEBUG   2024-11-27 08:19:42.741958980 +01:00 built glob set; 0 literals, 0 basenames, 0 extensions, 0 prefixes, 0 suffixes, 4 required extensions, 0 regexes  (from globset)
  DEBUG   2024-11-27 08:19:42.742822727 +01:00 ignoring dist/assets/index-DRNMkqs8.css: Ignore(IgnoreMatch(Types(Glob(UnmatchedIgnore))))  (from ignore)
  DEBUG   2024-11-27 08:19:42.742868142 +01:00 whitelisting dist/assets/index-DAUKG_fp.js: Whitelist(IgnoreMatch(Types(Glob(Matched { def: FileTypeDef { name: "js", globs: ["*.js"] } }))))  (from ignore)
  INFO    2024-11-27 08:19:42.742903318 +01:00 found: dist/assets/index-DAUKG_fp.js (244313 bytes)
> Found 1 file
> Analyzing 1 sources
> Analyzing completed in 0s
> Injecting debug ids
error: Invalid embedded sourcemap in source file dist/assets/index-DAUKG_fp.js
  INFO    2024-11-27 08:19:42.743514409 +01:00 Skipping update nagger update check

[szokeasaurusrex]

Hi @netpok, thank you for reaching out, and thank you for providing a full reproduction of the issue; it makes it much easier for us to help.

Unfortunately, the error you are observing is to be expected, since the sourceMappingURL is invalid.

For an embedded sourcemap, the sourceMapURL should look like the following:

//# sourceMappingURL=data:application/json;base64,[base-64 encoded data here]

But, in your case, the part where we would expect the base-64 encoded data to be instead contains this string: `+wt.btoa(unescape(encodeURIComponent(JSON.stringify(Z))))),v+\`.

Most likely, a template engine is supposed to replace this string with the actual base-64 encoded sourcemap data, but due to some bug or misconfiguration with your bundler, this is not happening, and so the template string is being copied into your compiled JavaScript source file.

I would suggest checking your bundler configuration, and if you cannot find any problems, I would recommend raising an issue with your bundler or possibly with PaperJS. Something is going wrong in the compilation process, before Sentry CLI is invoked.

[netpok]

Hi @szokeasaurusrex,

I still think this is an error because it's not an embedded sourcemap, it's a javascript string literal that is used to add a sourcemap to a file, originating from here: https://github.com/paperjs/paper.js/blob/92775f5279c05fb7f0a743e9e7fa02cd40ec1e70/src/core/PaperScript.js#L441

The \n is replaced with a new line by esbuild.

For example this bug also makes impossible to strip similar sourcemaps with the following code:

• original: https://github.com/netpok/paperjs-vite-sentry-inject-poc/blob/regex/src/main.js
• compiled: https://github.com/netpok/paperjs-vite-sentry-inject-poc/blob/regex/dist/assets/index-CgDcqyAQ.js

[szokeasaurusrex]

Oh, I think I missed the ` on the previous line:

`)+v),/^(inline|both)$/.test(A)&&(v+=`
//# sourceMappingURL=data:application/json;base64,`+wt.btoa(unescape(encodeURIComponent(JSON.stringify(Z))))),v+=`

So, the //# sourceMappingURL is not a code comment, just a part of a multiline string literal.

In this case, I think that yes, this is a bug.

[szokeasaurusrex]

After further investigation, I have traced the source of this bug to one of our dependencies, symbolic-debuginfo, which lives in Sentry's symbolic repository. I am going to transfer this issue over to that repository, since we need to fix this bug there. Afterwards, we can update the dependency in Sentry CLI.

Specifically, the problem lies with the following function, which is supposed to find //# sourceMappingUrl comments.

symbolic/symbolic-debuginfo/src/js.rs

Lines 13 to 29 in 67b533b

	pub fn discover_sourcemaps_location(contents: &str) -> Option<&str> {
	for line in contents.lines().rev() {
	if line.starts_with("//# sourceMappingURL=") || line.starts_with("//@ sourceMappingURL=") {
	let url = line[21..].trim();
	// The URL might contain a query string or fragment. Strip those away before recording the URL.
	let without_query = url.split_once('?').map(|x| x.0).unwrap_or(url);
	let without_fragment = without_query
	.split_once('#')
	.map(|x| x.0)
	.unwrap_or(without_query);
	return Some(without_fragment);
	}
	}
	None
	}

This function does not consider the possibility of a //# sourceMappingUrl comment appearing in a multiline string. We will likely need to implement some more robust parsing logic here. Perhaps, there is a crate which can parse JS files.