[DO NOT MERGE] feat(core): add opt-in assertion instrumentation - #6592
[DO NOT MERGE] feat(core): add opt-in assertion instrumentation#6592antonis wants to merge 11 commits into
4 issues
find-bugs: Found 4 issues (4 medium)
Medium
flattenValues is not defensive against throwing getters - `packages/core/src/js/assertion.ts:136-139`
Accessing values[key] in the loop can trigger a throwing getter, breaking the reporting path's no-throw guarantee.
`values` guard does not prevent `null`, crashing the reporter path - `packages/core/src/js/assertion.ts:199-200`
values !== undefined on line 201 allows null into flattenValues, where Object.keys(null) throws a TypeError and breaks the reporting path. The Babel transform emits only object literals, but manual calls that bypass the TypeScript contract can crash the safe reporter.
Also found at:
packages/core/src/js/index.ts:119packages/core/src/js/assertion.ts:170-171
`includeNodeModules` allowlist silently skips Windows node_modules paths - `packages/core/src/js/tools/sentryAssertionBabelPlugin.ts:217-219`
The Metro transformer wrapper (addSentryCaptureAssertionsPlugin) mirrors the plugin's isNodeModulesExcluded check but omits toPosixPath normalization, so allowlist fragments with forward slashes never match Windows backslash filenames and the plugin is never pushed for those dependencies.
Also found at:
packages/core/src/js/tools/sentryAssertionBabelPlugin.ts:378packages/core/src/js/tools/sentryBabelTransformerUtils.ts:17packages/core/src/js/tools/sentryBabelTransformerUtils.ts:169-170packages/core/test/tools/sentryBabelTransformer.test.ts:246-250
Dedup test relies on uncleaned module-level state - `packages/core/test/assertion.test.ts:120-130`
The deduplication test assumes a fresh reportedSites Set, but assertion.ts keeps it at module level with no reset mechanism, so siteIds accumulate across tests and can cause order-dependent failures.
⏱ 32m 31s · 12.0M in / 583.9k out · $8.48
Annotations
Check warning on line 139 in packages/core/src/js/assertion.ts
sentry-warden / warden: find-bugs
flattenValues is not defensive against throwing getters
Accessing values[key] in the loop can trigger a throwing getter, breaking the reporting path's no-throw guarantee.
Check warning on line 200 in packages/core/src/js/assertion.ts
sentry-warden / warden: find-bugs
`values` guard does not prevent `null`, crashing the reporter path
`values !== undefined` on line 201 allows `null` into `flattenValues`, where `Object.keys(null)` throws a `TypeError` and breaks the reporting path. The Babel transform emits only object literals, but manual calls that bypass the TypeScript contract can crash the safe reporter.
Check warning on line 119 in packages/core/src/js/index.ts
sentry-warden / warden: find-bugs
[9LT-YKN] `values` guard does not prevent `null`, crashing the reporter path (additional location)
`values !== undefined` on line 201 allows `null` into `flattenValues`, where `Object.keys(null)` throws a `TypeError` and breaks the reporting path. The Babel transform emits only object literals, but manual calls that bypass the TypeScript contract can crash the safe reporter.
Check warning on line 171 in packages/core/src/js/assertion.ts
sentry-warden / warden: find-bugs
[9LT-YKN] `values` guard does not prevent `null`, crashing the reporter path (additional location)
`values !== undefined` on line 201 allows `null` into `flattenValues`, where `Object.keys(null)` throws a `TypeError` and breaks the reporting path. The Babel transform emits only object literals, but manual calls that bypass the TypeScript contract can crash the safe reporter.
Check warning on line 219 in packages/core/src/js/tools/sentryAssertionBabelPlugin.ts
sentry-warden / warden: find-bugs
`includeNodeModules` allowlist silently skips Windows node_modules paths
The Metro transformer wrapper (`addSentryCaptureAssertionsPlugin`) mirrors the plugin's `isNodeModulesExcluded` check but omits `toPosixPath` normalization, so allowlist fragments with forward slashes never match Windows backslash filenames and the plugin is never pushed for those dependencies.
Check warning on line 378 in packages/core/src/js/tools/sentryAssertionBabelPlugin.ts
sentry-warden / warden: find-bugs
[L7G-4G5] `includeNodeModules` allowlist silently skips Windows node_modules paths (additional location)
The Metro transformer wrapper (`addSentryCaptureAssertionsPlugin`) mirrors the plugin's `isNodeModulesExcluded` check but omits `toPosixPath` normalization, so allowlist fragments with forward slashes never match Windows backslash filenames and the plugin is never pushed for those dependencies.
Check warning on line 17 in packages/core/src/js/tools/sentryBabelTransformerUtils.ts
sentry-warden / warden: find-bugs
[L7G-4G5] `includeNodeModules` allowlist silently skips Windows node_modules paths (additional location)
The Metro transformer wrapper (`addSentryCaptureAssertionsPlugin`) mirrors the plugin's `isNodeModulesExcluded` check but omits `toPosixPath` normalization, so allowlist fragments with forward slashes never match Windows backslash filenames and the plugin is never pushed for those dependencies.
Check warning on line 170 in packages/core/src/js/tools/sentryBabelTransformerUtils.ts
sentry-warden / warden: find-bugs
[L7G-4G5] `includeNodeModules` allowlist silently skips Windows node_modules paths (additional location)
The Metro transformer wrapper (`addSentryCaptureAssertionsPlugin`) mirrors the plugin's `isNodeModulesExcluded` check but omits `toPosixPath` normalization, so allowlist fragments with forward slashes never match Windows backslash filenames and the plugin is never pushed for those dependencies.
Check warning on line 250 in packages/core/test/tools/sentryBabelTransformer.test.ts
sentry-warden / warden: find-bugs
[L7G-4G5] `includeNodeModules` allowlist silently skips Windows node_modules paths (additional location)
The Metro transformer wrapper (`addSentryCaptureAssertionsPlugin`) mirrors the plugin's `isNodeModulesExcluded` check but omits `toPosixPath` normalization, so allowlist fragments with forward slashes never match Windows backslash filenames and the plugin is never pushed for those dependencies.
Check warning on line 130 in packages/core/test/assertion.test.ts
sentry-warden / warden: find-bugs
Dedup test relies on uncleaned module-level state
The deduplication test assumes a fresh `reportedSites` Set, but `assertion.ts` keeps it at module level with no reset mechanism, so siteIds accumulate across tests and can cause order-dependent failures.