Skip to content

[DO NOT MERGE] feat(core): add opt-in assertion instrumentation - #6592

Draft
antonis wants to merge 11 commits into
mainfrom
feat/loud-invariants
Draft

[DO NOT MERGE] feat(core): add opt-in assertion instrumentation#6592
antonis wants to merge 11 commits into
mainfrom
feat/loud-invariants

fix(core): harden loud-invariants transform and reporter

6bdfccf
Select commit
Loading
Failed to load commit list.
@sentry/warden / warden: find-bugs completed Aug 18, 2026

4 issues

find-bugs: Found 4 issues (4 medium)

Medium

flattenValues is not defensive against throwing getters - `packages/core/src/js/assertion.ts:136-139`

Accessing values[key] in the loop can trigger a throwing getter, breaking the reporting path's no-throw guarantee.

`values` guard does not prevent `null`, crashing the reporter path - `packages/core/src/js/assertion.ts:199-200`

values !== undefined on line 201 allows null into flattenValues, where Object.keys(null) throws a TypeError and breaks the reporting path. The Babel transform emits only object literals, but manual calls that bypass the TypeScript contract can crash the safe reporter.

Also found at:

  • packages/core/src/js/index.ts:119
  • packages/core/src/js/assertion.ts:170-171
`includeNodeModules` allowlist silently skips Windows node_modules paths - `packages/core/src/js/tools/sentryAssertionBabelPlugin.ts:217-219`

The Metro transformer wrapper (addSentryCaptureAssertionsPlugin) mirrors the plugin's isNodeModulesExcluded check but omits toPosixPath normalization, so allowlist fragments with forward slashes never match Windows backslash filenames and the plugin is never pushed for those dependencies.

Also found at:

  • packages/core/src/js/tools/sentryAssertionBabelPlugin.ts:378
  • packages/core/src/js/tools/sentryBabelTransformerUtils.ts:17
  • packages/core/src/js/tools/sentryBabelTransformerUtils.ts:169-170
  • packages/core/test/tools/sentryBabelTransformer.test.ts:246-250
Dedup test relies on uncleaned module-level state - `packages/core/test/assertion.test.ts:120-130`

The deduplication test assumes a fresh reportedSites Set, but assertion.ts keeps it at module level with no reset mechanism, so siteIds accumulate across tests and can cause order-dependent failures.


⏱ 32m 31s · 12.0M in / 583.9k out · $8.48

Annotations

Check warning on line 139 in packages/core/src/js/assertion.ts

See this annotation in the file changed.

@sentry-warden sentry-warden / warden: find-bugs

flattenValues is not defensive against throwing getters

Accessing values[key] in the loop can trigger a throwing getter, breaking the reporting path's no-throw guarantee.

Check warning on line 200 in packages/core/src/js/assertion.ts

See this annotation in the file changed.

@sentry-warden sentry-warden / warden: find-bugs

`values` guard does not prevent `null`, crashing the reporter path

`values !== undefined` on line 201 allows `null` into `flattenValues`, where `Object.keys(null)` throws a `TypeError` and breaks the reporting path. The Babel transform emits only object literals, but manual calls that bypass the TypeScript contract can crash the safe reporter.

Check warning on line 119 in packages/core/src/js/index.ts

See this annotation in the file changed.

@sentry-warden sentry-warden / warden: find-bugs

[9LT-YKN] `values` guard does not prevent `null`, crashing the reporter path (additional location)

`values !== undefined` on line 201 allows `null` into `flattenValues`, where `Object.keys(null)` throws a `TypeError` and breaks the reporting path. The Babel transform emits only object literals, but manual calls that bypass the TypeScript contract can crash the safe reporter.

Check warning on line 171 in packages/core/src/js/assertion.ts

See this annotation in the file changed.

@sentry-warden sentry-warden / warden: find-bugs

[9LT-YKN] `values` guard does not prevent `null`, crashing the reporter path (additional location)

`values !== undefined` on line 201 allows `null` into `flattenValues`, where `Object.keys(null)` throws a `TypeError` and breaks the reporting path. The Babel transform emits only object literals, but manual calls that bypass the TypeScript contract can crash the safe reporter.

Check warning on line 219 in packages/core/src/js/tools/sentryAssertionBabelPlugin.ts

See this annotation in the file changed.

@sentry-warden sentry-warden / warden: find-bugs

`includeNodeModules` allowlist silently skips Windows node_modules paths

The Metro transformer wrapper (`addSentryCaptureAssertionsPlugin`) mirrors the plugin's `isNodeModulesExcluded` check but omits `toPosixPath` normalization, so allowlist fragments with forward slashes never match Windows backslash filenames and the plugin is never pushed for those dependencies.

Check warning on line 378 in packages/core/src/js/tools/sentryAssertionBabelPlugin.ts

See this annotation in the file changed.

@sentry-warden sentry-warden / warden: find-bugs

[L7G-4G5] `includeNodeModules` allowlist silently skips Windows node_modules paths (additional location)

The Metro transformer wrapper (`addSentryCaptureAssertionsPlugin`) mirrors the plugin's `isNodeModulesExcluded` check but omits `toPosixPath` normalization, so allowlist fragments with forward slashes never match Windows backslash filenames and the plugin is never pushed for those dependencies.

Check warning on line 17 in packages/core/src/js/tools/sentryBabelTransformerUtils.ts

See this annotation in the file changed.

@sentry-warden sentry-warden / warden: find-bugs

[L7G-4G5] `includeNodeModules` allowlist silently skips Windows node_modules paths (additional location)

The Metro transformer wrapper (`addSentryCaptureAssertionsPlugin`) mirrors the plugin's `isNodeModulesExcluded` check but omits `toPosixPath` normalization, so allowlist fragments with forward slashes never match Windows backslash filenames and the plugin is never pushed for those dependencies.

Check warning on line 170 in packages/core/src/js/tools/sentryBabelTransformerUtils.ts

See this annotation in the file changed.

@sentry-warden sentry-warden / warden: find-bugs

[L7G-4G5] `includeNodeModules` allowlist silently skips Windows node_modules paths (additional location)

The Metro transformer wrapper (`addSentryCaptureAssertionsPlugin`) mirrors the plugin's `isNodeModulesExcluded` check but omits `toPosixPath` normalization, so allowlist fragments with forward slashes never match Windows backslash filenames and the plugin is never pushed for those dependencies.

Check warning on line 250 in packages/core/test/tools/sentryBabelTransformer.test.ts

See this annotation in the file changed.

@sentry-warden sentry-warden / warden: find-bugs

[L7G-4G5] `includeNodeModules` allowlist silently skips Windows node_modules paths (additional location)

The Metro transformer wrapper (`addSentryCaptureAssertionsPlugin`) mirrors the plugin's `isNodeModulesExcluded` check but omits `toPosixPath` normalization, so allowlist fragments with forward slashes never match Windows backslash filenames and the plugin is never pushed for those dependencies.

Check warning on line 130 in packages/core/test/assertion.test.ts

See this annotation in the file changed.

@sentry-warden sentry-warden / warden: find-bugs

Dedup test relies on uncleaned module-level state

The deduplication test assumes a fresh `reportedSites` Set, but `assertion.ts` keeps it at module level with no reset mechanism, so siteIds accumulate across tests and can cause order-dependent failures.