[DO NOT MERGE] feat(core): add opt-in assertion instrumentation - #6592
[DO NOT MERGE] feat(core): add opt-in assertion instrumentation#6592antonis wants to merge 11 commits into
8 issues
High
String() throws TypeError on Symbol values in flattenValues - `packages/core/src/js/assertion.ts:117`
String(symbol) throws a TypeError and crashes the assertion reporter when runtime values contains a Symbol.
Medium
Sentry SDK path markers assume POSIX separators and fail on Windows - `packages/core/src/js/tools/sentryAssertionBabelPlugin.ts:120`
SENTRY_SDK_PATH_MARKERS uses forward-slash literals, but Metro/Babel filename may contain backslashes on Windows, causing the plugin to instrument the SDK's own files and inject a self-referential require('@sentry/react-native').
collectValueIdentifiers captures identifiers from nested scopes, causing ReferenceError in generated code - `packages/core/src/js/tools/sentryAssertionBabelPlugin.ts:289-293`
Identifiers bound inside nested function expressions (e.g., arrow-function parameters) are collected and then referenced in the emitted values object at the assertion call site, where they are out of scope and throw a ReferenceError at runtime.
Destructured console.assert miscompiled as throwing assert - `packages/core/etc/sentry-react-native.api.md:162`
The assertion Babel plugin rewrites const { assert } = console; assert(false) with rethrow: true, turning a report-only console.assert into a throwing assertion that crashes after capturing.
flattenValues crashes when captured value has throwing toString - `packages/core/src/js/assertion.ts:127`
Wrap String(value) in a try-catch so a throwing toString or [Symbol.toPrimitive] doesn't break the reporting path and cause double-capture.
SDK self-exclusion breaks on Windows paths - `packages/core/src/js/index.ts:120-197`
SENTRY_SDK_PATH_MARKERS uses forward-slash literals, but Metro/Babel filename may contain backslashes on Windows, causing the plugin to fail to skip Sentry's own files and risking a self-referential require('@sentry/react-native') if any assertion pragma exists in SDK source.
Also found at:
packages/core/src/js/tools/sentryAssertionBabelPlugin.ts:197
collectValueIdentifiers emits out-of-scope references for nested bindings - `packages/core/src/js/tools/sentryAssertionBabelPlugin.ts:278`
Identifiers bound inside nested functions (e.g. arrow-function parameters) are collected and then referenced in the emitted values object at the assertion call site, where they are out of scope and cause a ReferenceError at runtime.
Low
captureAssertionViolation crashes when values is null - `packages/core/src/js/assertion.ts:186-188`
The guard if (values !== undefined) allows null to reach flattenValues, where Object.keys(null) throws a TypeError. Change the check to if (values != null) to safely reject both null and undefined.
4 skills analyzed
| Skill | Findings | Duration | Cost |
|---|---|---|---|
| security-review | 0 | 3m 41s | $1.21 |
| code-review | 3 | 45m 26s | $3.07 |
| find-bugs | 5 | 65m 4s | $4.69 |
| gha-security-review | 0 | 42m 3s | $0.09 |
⏱ 156m 14s · 11.8M in / 796.3k out · $9.05