fix(core): harden assertion transform against Error shadowing, __proto__ keys, and @sentry-internal

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: antonis

packages/core/src/js/tools/sentryAssertionBabelPlugin.ts

@@ -116,10 +116,12 @@ const DEFAULT_ASSERTION_MODULES = ['invariant', 'tiny-invariant', 'warning', 'as
  * Path fragments identifying the Sentry SDK's own source. Files matching any of
  * these are never instrumented — the plugin injects a `require` of the SDK, so
  * rewriting the SDK's own asserts would create a self-referential require. The
- * second marker covers the monorepo dev symlink, whose path has no
- * `node_modules/@sentry` segment.
+ * `@sentry-internal` scope holds packages the SDK depends on transitively, so
+ * instrumenting them would create the same circular require. The last marker
+ * covers the monorepo dev symlink, whose path has no `node_modules/@sentry`
+ * segment.
  */
-const SENTRY_SDK_PATH_MARKERS = ['/@sentry/', 'sentry-react-native/packages/'];
+const SENTRY_SDK_PATH_MARKERS = ['/@sentry/', '/@sentry-internal/', 'sentry-react-native/packages/'];
 
 export interface SentryAssertionBabelPluginOptions {
   /**
@@ -471,9 +473,18 @@ function ensureErrorBinding(
   }
   uid = path.scope.generateUidIdentifier('Error');
   const program = path.scope.getProgramParent().path as NodePath<BabelTypes.Program>;
-  program.unshiftContainer('body', [
-    t.variableDeclaration('var', [t.variableDeclarator(t.cloneNode(uid), t.identifier('Error'))]),
-  ]);
+  // `var _Error = typeof globalThis !== 'undefined' ? globalThis.Error : Error;`
+  // Reading `globalThis.Error` (not the bare `Error` identifier) means a
+  // module-level `const`/`let`/`class Error` — which would put the bare
+  // identifier in its TDZ at program top, or a `var Error` shadow that reads
+  // `undefined` — can't corrupt the alias. The bare-`Error` fallback is only
+  // reached on ancient runtimes without `globalThis`, where the shadow is moot.
+  const errorInit = t.conditionalExpression(
+    t.binaryExpression('!==', t.unaryExpression('typeof', t.identifier('globalThis')), t.stringLiteral('undefined')),
+    t.memberExpression(t.identifier('globalThis'), t.identifier('Error')),
+    t.identifier('Error'),
+  );
+  program.unshiftContainer('body', [t.variableDeclaration('var', [t.variableDeclarator(t.cloneNode(uid), errorInit)])]);
   state.set(ERROR_UID_KEY, uid);
   return uid;
 }
@@ -505,7 +516,16 @@ function buildReportProperties(
     properties.push(
       t.objectProperty(
         t.identifier('values'),
-        t.objectExpression(valueNames.map(name => t.objectProperty(t.identifier(name), t.identifier(name)))),
+        t.objectExpression(
+          valueNames.map(name =>
+            // A bare `__proto__: v` key is the prototype-setter syntax, not a
+            // data property, and throws for a non-object value. Emit it as a
+            // computed key (`['__proto__']: v`) so it stays an own property.
+            name === '__proto__'
+              ? t.objectProperty(t.stringLiteral('__proto__'), t.identifier('__proto__'), /* computed */ true)
+              : t.objectProperty(t.identifier(name), t.identifier(name)),
+          ),
+        ),
       ),
     );
   }

packages/core/test/tools/sentryAssertionBabelPlugin.test.ts

@@ -43,20 +43,38 @@ describe('sentryAssertionBabelPlugin', () => {
     // without relying on framesToPop or the in_app heuristic. It goes through a
     // hoisted global-`Error` alias so a call-site shadow can't break it.
     const out = transform(`invariant(total >= 0, 'bad total');`);
-    expect(out).toMatch(/var _Error\d* = Error;/);
+    expect(out).toMatch(/var _Error\d* = typeof globalThis !== ["']undefined["'] \? globalThis\.Error : Error;/);
     expect(out).toMatch(/error: new _Error\d*\(\)/);
   });
 
   it('is immune to a call-site `Error` shadow (hoisted alias captures the global)', () => {
     // A parameter named `Error` shadows the global at the call site. The hoisted
-    // `var _Error = Error;` at program top captured the real constructor first,
-    // so the injected `new _Error()` never resolves to the shadow (which would
-    // throw `TypeError: Error is not a constructor` when the assertion fires).
+    // alias at program top captured the real constructor first, so the injected
+    // `new _Error()` never resolves to the shadow (which would throw
+    // `TypeError: Error is not a constructor` when the assertion fires).
     const out = transform(`function f(Error) {\n  invariant(ok);\n}`);
-    expect(out).toMatch(/var _Error\d* = Error;/);
+    expect(out).toMatch(/var _Error\d* = typeof globalThis !== ["']undefined["'] \? globalThis\.Error : Error;/);
     expect(out).toMatch(/error: new _Error\d*\(\)/);
   });
 
+  it('is immune to a module-level `Error` shadow (alias reads globalThis.Error)', () => {
+    // A module-scope `const Error` would put the bare `Error` identifier in its
+    // TDZ at program top, so `var _Error = Error;` would throw at load time. The
+    // alias reads `globalThis.Error` instead, which the lexical shadow can't
+    // capture.
+    const out = transform(`const Error = 1;\ninvariant(ok);`);
+    expect(out).toMatch(/var _Error\d* = typeof globalThis !== ["']undefined["'] \? globalThis\.Error : Error;/);
+    expect(out).toMatch(/error: new _Error\d*\(\)/);
+  });
+
+  it('emits a `__proto__` value as a computed key, not a prototype setter', () => {
+    // `{ __proto__: v }` sets the prototype and throws for a non-object value;
+    // the computed form `{ ['__proto__']: v }` keeps it an own data property.
+    const out = transform(`const __proto__ = 1;\ninvariant(__proto__ > 0);`);
+    expect(out).toMatch(/\[["']__proto__["']\]: __proto__/);
+    expect(out).not.toMatch(/\{\s*__proto__: __proto__/);
+  });
+
   it('forwards variadic substitution args as messageArgs for interpolation', () => {
     // RN's Dimensions invariant is `invariant(dims, 'No dimension set for key %s',
     // dimension)` — the extra arg must reach the reporter so `%s` interpolates.
@@ -250,6 +268,18 @@ describe('sentryAssertionBabelPlugin', () => {
     expect(out).toMatch(/invariant\(ok\)/);
   });
 
+  it('never instruments `@sentry-internal` packages (SDK transitive deps)', () => {
+    // `@sentry-internal/*` packages are dependencies of `@sentry/react-native`;
+    // instrumenting them injects a require of the SDK into its own dependency
+    // graph, creating a circular require that can leave the reporter undefined.
+    const out = transform(`import invariant from 'invariant';\ninvariant(ok);`, {
+      filename: '/proj/node_modules/@sentry-internal/browser-utils/index.js',
+      options: { includeNodeModules: true },
+    });
+    expect(out).not.toContain('_captureAssertionViolation');
+    expect(out).toMatch(/invariant\(ok\)/);
+  });
+
   it('never instruments the Sentry SDK’s own source (monorepo symlink path)', () => {
     // The dev symlink resolves the SDK through a path with no node_modules/@sentry
     // segment, so it must be excluded by the packages/ marker too.