Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(nuxt): Add Rollup plugin to wrap server entry with import() #13945

Merged
merged 3 commits into from
Oct 14, 2024

Conversation

s1gr1d
Copy link
Member

@s1gr1d s1gr1d commented Oct 10, 2024

Feature Issue: #13943

Adds a Rollup plugin to wrap the server entry with import() to load it after Sentry was initialized.

The plugin is not yet in use (will do this in another PR - see linked issue above)

Copy link
Member

@lforst lforst left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

First pass. Generally looks good to me!

);
}

function wrapEntryWithDynamicImport(resolvedSentryConfigPath: string): InputPluginOption {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: If a function is only called in one place, and the calling function is already not that big, I always consider inlining it.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I considered this function as the rollup plugin so I didn't want to inline it in the push(). However, I could add a JSDoc here for the plugin.

Comment on lines 162 to 169
if (source === 'import-in-the-middle/hook.mjs') {
return { id: source, moduleSideEffects: true, external: true };
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Did this end up working? If so, we should probably add a comment what this is doing here. Somebody coming across this is probably like "what the hell is this?".

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, that prevented the "Cannot find module" error in Netlify. I added a comment


moduleInfo.moduleSideEffects = true;

const exportedFunctions = moduleInfo.exportedBindings?.['.'];
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

l: Quick comment what the '.' is about?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

According to the rollup docs it's the "path of from". As the . entry includes the exports from the file I figured the dot means exactly that: The exports from this file 🤔

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yup, I know but I think we should add a comment about that 😄

const exportedFunctions = moduleInfo.exportedBindings?.['.'];

// checks are needed to prevent multiple attachment of the suffix
return containsSuffix(source) || containsSuffix(resolution.id)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Aren't we already checking for containsSuffix(source) at the top of the hook?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, for the source. I changed the code a bit so there is only the check for resolution.id at this point.

Comment on lines 72 to 79
`export function ${currFunctionName}(...args) {\n` +
` return import(${JSON.stringify(entryId)}).then((res) => res.${currFunctionName}(...args));\n` +
'}\n',
),
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would gravitate woards making this function async, awaiting the import, and calling it with .call(this, args), just so that the this is preserved in case it is passed. This is usually important when monkepatching.

*
* Only exported for testing.
*/
export function stripQueryPart(url: string): string {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: Maybe we can make this function name a bit more representative of what it does.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Renamed it to removeSentryQueryFromPath

.split(',')
.filter(param => param !== '' && param !== 'default')
// sanitize
.map((str: string) => str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'))
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What cases are we sanitizing for here?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This function gets the functions from a file to re-export them. Theoretically, another rollup plugin could inject code here. As discussed in person, this is code a user can control so it is unlikely to be used by attackers but I'll keep it with a small comment - just to be safe.

@s1gr1d s1gr1d force-pushed the sig/server-entry-wrap-plugin branch from b5d568c to 0a7cd3c Compare October 14, 2024 10:52
@s1gr1d s1gr1d requested a review from lforst October 14, 2024 10:53
@s1gr1d s1gr1d force-pushed the sig/server-entry-wrap-plugin branch from 0a7cd3c to 5f4c53d Compare October 14, 2024 11:50
@s1gr1d s1gr1d merged commit 8249a5e into develop Oct 14, 2024
118 checks passed
@s1gr1d s1gr1d deleted the sig/server-entry-wrap-plugin branch October 14, 2024 14:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants