Sourcemap inject breaks with paperjs

[netpok]

CLI Version

2.39.1

Operating System and Architecture

• macOS (arm64)
• macOS (x86_64)
• Linux (i686)
• Linux (x86_64)
• Linux (armv7)
• Linux (aarch64)
• Windows (i686)
• Windows (x86_64)

Operating System Version

Linux Mint 21.3

Link to reproduction repository

https://github.com/netpok/paperjs-vite-sentry-inject-poc

CLI Command

sentry-cli sourcemaps inject dist/assets

Exact Reproduction Steps

1. Clone the provided repository
2. Run npm install and npm build (optional, prebuilt dist files are also in the repo)
3. Run sentry-cli sourcemaps inject dist/assets

Expected Results

Debug ids successfully injected

Actual Results

CLI throws error: Invalid embedded sourcemap in source file dist/assets/index-DAUKG_fp.js because it finds string literal of sourceMappingURL

https://github.com/netpok/paperjs-vite-sentry-inject-poc/blob/main/dist/assets/index-DAUKG_fp.js#L35

Logs

  INFO    2024-11-27 08:19:42.740070385 +01:00 Loaded config from /home/<user>/.sentryclirc
  DEBUG   2024-11-27 08:19:42.740133483 +01:00 sentry-cli version: 2.39.1, platform: "linux", architecture: "x86_64"
  INFO    2024-11-27 08:19:42.740686605 +01:00 sentry-cli was invoked with the following command line: "/usr/lib/node_modules/@sentry/cli/node_modules/@sentry/cli-linux-x64/bin/sentry-cli" "sourcemaps" "inject" "dist/assets" "--log-level=debug"
> Searching dist/assets
  DEBUG   2024-11-27 08:19:42.741958980 +01:00 built glob set; 0 literals, 0 basenames, 0 extensions, 0 prefixes, 0 suffixes, 4 required extensions, 0 regexes  (from globset)
  DEBUG   2024-11-27 08:19:42.742822727 +01:00 ignoring dist/assets/index-DRNMkqs8.css: Ignore(IgnoreMatch(Types(Glob(UnmatchedIgnore))))  (from ignore)
  DEBUG   2024-11-27 08:19:42.742868142 +01:00 whitelisting dist/assets/index-DAUKG_fp.js: Whitelist(IgnoreMatch(Types(Glob(Matched { def: FileTypeDef { name: "js", globs: ["*.js"] } }))))  (from ignore)
  INFO    2024-11-27 08:19:42.742903318 +01:00 found: dist/assets/index-DAUKG_fp.js (244313 bytes)
> Found 1 file
> Analyzing 1 sources
> Analyzing completed in 0s
> Injecting debug ids
error: Invalid embedded sourcemap in source file dist/assets/index-DAUKG_fp.js
  INFO    2024-11-27 08:19:42.743514409 +01:00 Skipping update nagger update check

[szokeasaurusrex]

Hi @netpok, thank you for reaching out, and thank you for providing a full reproduction of the issue; it makes it much easier for us to help.

Unfortunately, the error you are observing is to be expected, since the sourceMappingURL is invalid.

For an embedded sourcemap, the sourceMapURL should look like the following:

//# sourceMappingURL=data:application/json;base64,[base-64 encoded data here]

But, in your case, the part where we would expect the base-64 encoded data to be instead contains this string: `+wt.btoa(unescape(encodeURIComponent(JSON.stringify(Z))))),v+\`.

Most likely, a template engine is supposed to replace this string with the actual base-64 encoded sourcemap data, but due to some bug or misconfiguration with your bundler, this is not happening, and so the template string is being copied into your compiled JavaScript source file.

I would suggest checking your bundler configuration, and if you cannot find any problems, I would recommend raising an issue with your bundler or possibly with PaperJS. Something is going wrong in the compilation process, before Sentry CLI is invoked.

[netpok]

Hi @szokeasaurusrex,

I still think this is an error because it's not an embedded sourcemap, it's a javascript string literal that is used to add a sourcemap to a file, originating from here: https://github.com/paperjs/paper.js/blob/92775f5279c05fb7f0a743e9e7fa02cd40ec1e70/src/core/PaperScript.js#L441

The \n is replaced with a new line by esbuild.

For example this bug also makes impossible to strip similar sourcemaps with the following code:

• original: https://github.com/netpok/paperjs-vite-sentry-inject-poc/blob/regex/src/main.js
• compiled: https://github.com/netpok/paperjs-vite-sentry-inject-poc/blob/regex/dist/assets/index-CgDcqyAQ.js

[szokeasaurusrex]

Oh, I think I missed the ` on the previous line:

`)+v),/^(inline|both)$/.test(A)&&(v+=`
//# sourceMappingURL=data:application/json;base64,`+wt.btoa(unescape(encodeURIComponent(JSON.stringify(Z))))),v+=`

So, the //# sourceMappingURL is not a code comment, just a part of a multiline string literal.

In this case, I think that yes, this is a bug.