getsentry / getsentry/sentry-javascript

wrapFetchWithSentry quote scan breaks across chunks

Abierto
#23,468 1 comentario 0 reacciones 1 asignado Reclamado por @nicohrubec Ver en GitHub
Bug Cloudflare Cloudflare Workers Tanstack Start React
Lenguaje dominante
TypeScript
Estrellas
8.7k
Forks
1.8k
Merge medio
1 d 17 h
PR fusionados (30 d)
515

Descripción

`wrapFetchWithSentry` rewrites the HTML response stream chunk-by-chunk to inject trace meta tags. The quote-scanning path in `addMetaTagToHead` is not sound across chunk boundaries, and a partner integration hit a build-breaking TanStack prerender failure that is separate from the already-fixed React #418 newline issue.

Reported by a Cloudflare + TanStack Start partner integration. Observed on `@sentry/cloudflare` / related stack at `10.56.0`. The reporter confirmed the React hydration #418 half matches #21915 (fixed in `10.64.0`); this tracks the remaining stream-transform failure.

**Verified**
- On current `develop`, `packages/tanstackstart-react/src/server/wrapFetchWithSentry.ts` still processes each decoded chunk independently with:
```ts
// Skip quoted attribute values so we don't match inside e.g. data-code="......"
return htmlChunk.replace(/"[^"]*"|'[^']*'|()/g, ...)
```
- The same file still documents an optimistic assumption that HTML chunks will not split inside ``; if they do, injection is skipped rather than carried across chunks.
- Related closed issues do **not** cover this failure mode:
- #21915 — newline in `getTraceMetaTags` caused React #418 (fixed in `10.64.0` via #22004)
- #23305 — UTF-8 multi-byte characters corrupted across stream chunks in React Router injectors

**Reported symptoms**
- TanStack SSR stream transform threw `SSR stream tail exceeded maximum buffer` during prerender and failed the build
- Failure was timing/chunk-boundary dependent: passed locally, failed in CI
- Partner hypothesis (medium confidence): a chunk boundary inside a quoted attribute value can desynchronize the per-chunk quote scan and misparse markup, independent of the newline fix

**Workaround**
- Omit `wrapFetchWithSentry` when tracing is not needed (`tracesSampleRate: 0`); middleware-only setup was sufficient for the reporter
- Bump to `>=10.64.0` for the separate #418 newline fix, then re-test the wrapper if tracing is enabled

**Unknown**
- Exact TanStack Start / React versions in the failing app
- Minimal public reproduction
- Whether the buffer error is caused only by quote-scan desync, by `` split across chunks, by interaction with TanStack prerender buffering, or a combination

Requested by **Nicolas Hrubec**.

--

[View Junior Session](https://junior-prod.sentry.dev/conversations/slack%3ACA2V2LBDL%3A1787130280.267509) [[Sentry]](https://sentry.sentry.io/explore/conversations/slack%3ACA2V2LBDL%3A1787130280.267509/?project=4510944073809921)

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.