fix: Ensure we never mutate options passed to init (#9162)

mydea · web-flow · commit 25f1c49a4670 · 2023-10-03T15:36:23.000+02:00
In various places we mutate the `options` passed to `init()`, which is a) not a great pattern and b) may break if users pass in frozen or similar objects (for whatever reason). I also normalized this to ensure a passed in `_metadata.sdk` always takes precedent (we had this in most places, but not all). Closes #9155
diff --git a/packages/angular-ivy/src/sdk.ts b/packages/angular-ivy/src/sdk.ts
@@ -1,6 +1,7 @@
 import { VERSION } from '@angular/core';
 import type { BrowserOptions } from '@sentry/browser';
 import { defaultIntegrations, init as browserInit, SDK_VERSION, setContext } from '@sentry/browser';
+import type { SdkMetadata } from '@sentry/types';
 import { logger } from '@sentry/utils';
 
 import { IS_DEBUG_BUILD } from './flags';
@@ -9,8 +10,21 @@ import { IS_DEBUG_BUILD } from './flags';
  * Inits the Angular SDK
  */
 export function init(options: BrowserOptions): void {
-  options._metadata = options._metadata || {};
-  options._metadata.sdk = {
+  const opts = {
+    _metadata: {} as SdkMetadata,
+    // Filter out TryCatch integration as it interferes with our Angular `ErrorHandler`:
+    // TryCatch would catch certain errors before they reach the `ErrorHandler` and thus provide a
+    // lower fidelity error than what `SentryErrorHandler` (see errorhandler.ts) would provide.
+    // see:
+    //  - https://github.com/getsentry/sentry-javascript/issues/5417#issuecomment-1453407097
+    //  - https://github.com/getsentry/sentry-javascript/issues/2744
+    defaultIntegrations: defaultIntegrations.filter(integration => {
+      return integration.name !== 'TryCatch';
+    }),
+    ...options,
+  };
+
+  opts._metadata.sdk = opts._metadata.sdk || {
     name: 'sentry.javascript.angular-ivy',
     packages: [
       {
@@ -21,20 +35,8 @@ export function init(options: BrowserOptions): void {
     version: SDK_VERSION,
   };
 
-  // Filter out TryCatch integration as it interferes with our Angular `ErrorHandler`:
-  // TryCatch would catch certain errors before they reach the `ErrorHandler` and thus provide a
-  // lower fidelity error than what `SentryErrorHandler` (see errorhandler.ts) would provide.
-  // see:
-  //  - https://github.com/getsentry/sentry-javascript/issues/5417#issuecomment-1453407097
-  //  - https://github.com/getsentry/sentry-javascript/issues/2744
-  if (options.defaultIntegrations === undefined) {
-    options.defaultIntegrations = defaultIntegrations.filter(integration => {
-      return integration.name !== 'TryCatch';
-    });
-  }
-
   checkAndSetAngularVersion();
-  browserInit(options);
+  browserInit(opts);
 }
 
 function checkAndSetAngularVersion(): void {
diff --git a/packages/angular/src/sdk.ts b/packages/angular/src/sdk.ts
@@ -1,6 +1,7 @@
 import { VERSION } from '@angular/core';
 import type { BrowserOptions } from '@sentry/browser';
 import { defaultIntegrations, init as browserInit, SDK_VERSION, setContext } from '@sentry/browser';
+import type { SdkMetadata } from '@sentry/types';
 import { logger } from '@sentry/utils';
 
 import { IS_DEBUG_BUILD } from './flags';
@@ -9,8 +10,21 @@ import { IS_DEBUG_BUILD } from './flags';
  * Inits the Angular SDK
  */
 export function init(options: BrowserOptions): void {
-  options._metadata = options._metadata || {};
-  options._metadata.sdk = {
+  const opts = {
+    _metadata: {} as SdkMetadata,
+    // Filter out TryCatch integration as it interferes with our Angular `ErrorHandler`:
+    // TryCatch would catch certain errors before they reach the `ErrorHandler` and thus provide a
+    // lower fidelity error than what `SentryErrorHandler` (see errorhandler.ts) would provide.
+    // see:
+    //  - https://github.com/getsentry/sentry-javascript/issues/5417#issuecomment-1453407097
+    //  - https://github.com/getsentry/sentry-javascript/issues/2744
+    defaultIntegrations: defaultIntegrations.filter(integration => {
+      return integration.name !== 'TryCatch';
+    }),
+    ...options,
+  };
+
+  opts._metadata.sdk = opts._metadata.sdk || {
     name: 'sentry.javascript.angular',
     packages: [
       {
@@ -21,20 +35,8 @@ export function init(options: BrowserOptions): void {
     version: SDK_VERSION,
   };
 
-  // Filter out TryCatch integration as it interferes with our Angular `ErrorHandler`:
-  // TryCatch would catch certain errors before they reach the `ErrorHandler` and thus provide a
-  // lower fidelity error than what `SentryErrorHandler` (see errorhandler.ts) would provide.
-  // see:
-  //  - https://github.com/getsentry/sentry-javascript/issues/5417#issuecomment-1453407097
-  //  - https://github.com/getsentry/sentry-javascript/issues/2744
-  if (options.defaultIntegrations === undefined) {
-    options.defaultIntegrations = defaultIntegrations.filter(integration => {
-      return integration.name !== 'TryCatch';
-    });
-  }
-
   checkAndSetAngularVersion();
-  browserInit(options);
+  browserInit(opts);
 }
 
 function checkAndSetAngularVersion(): void {
diff --git a/packages/nextjs/src/client/index.ts b/packages/nextjs/src/client/index.ts
@@ -44,14 +44,17 @@ const globalWithInjectedValues = global as typeof global & {
 
 /** Inits the Sentry NextJS SDK on the browser with the React SDK. */
 export function init(options: BrowserOptions): void {
-  applyTunnelRouteOption(options);
-  buildMetadata(options, ['nextjs', 'react']);
+  const opts = {
+    environment: getVercelEnv(true) || process.env.NODE_ENV,
+    ...options,
+  };
 
-  options.environment = options.environment || getVercelEnv(true) || process.env.NODE_ENV;
+  applyTunnelRouteOption(opts);
+  buildMetadata(opts, ['nextjs', 'react']);
 
-  addClientIntegrations(options);
+  addClientIntegrations(opts);
 
-  reactInit(options);
+  reactInit(opts);
 
   configureScope(scope => {
     scope.setTag('runtime', 'browser');
diff --git a/packages/nextjs/src/edge/index.ts b/packages/nextjs/src/edge/index.ts
@@ -1,13 +1,18 @@
 import { SDK_VERSION } from '@sentry/core';
+import type { SdkMetadata } from '@sentry/types';
 import type { VercelEdgeOptions } from '@sentry/vercel-edge';
 import { init as vercelEdgeInit } from '@sentry/vercel-edge';
 
 export type EdgeOptions = VercelEdgeOptions;
 
 /** Inits the Sentry NextJS SDK on the Edge Runtime. */
 export function init(options: VercelEdgeOptions = {}): void {
-  options._metadata = options._metadata || {};
-  options._metadata.sdk = options._metadata.sdk || {
+  const opts = {
+    _metadata: {} as SdkMetadata,
+    ...options,
+  };
+
+  opts._metadata.sdk = opts._metadata.sdk || {
     name: 'sentry.javascript.nextjs',
     packages: [
       {
@@ -18,7 +23,7 @@ export function init(options: VercelEdgeOptions = {}): void {
     version: SDK_VERSION,
   };
 
-  vercelEdgeInit(options);
+  vercelEdgeInit(opts);
 }
 
 /**
diff --git a/packages/nextjs/src/server/index.ts b/packages/nextjs/src/server/index.ts
@@ -64,7 +64,14 @@ const IS_VERCEL = !!process.env.VERCEL;
 
 /** Inits the Sentry NextJS SDK on node. */
 export function init(options: NodeOptions): void {
-  if (__DEBUG_BUILD__ && options.debug) {
+  const opts = {
+    environment: process.env.SENTRY_ENVIRONMENT || getVercelEnv(false) || process.env.NODE_ENV,
+    ...options,
+    // Right now we only capture frontend sessions for Next.js
+    autoSessionTracking: false,
+  };
+
+  if (__DEBUG_BUILD__ && opts.debug) {
     logger.enable();
   }
 
@@ -75,16 +82,11 @@ export function init(options: NodeOptions): void {
     return;
   }
 
-  buildMetadata(options, ['nextjs', 'node']);
-
-  options.environment =
-    options.environment || process.env.SENTRY_ENVIRONMENT || getVercelEnv(false) || process.env.NODE_ENV;
+  buildMetadata(opts, ['nextjs', 'node']);
 
-  addServerIntegrations(options);
-  // Right now we only capture frontend sessions for Next.js
-  options.autoSessionTracking = false;
+  addServerIntegrations(opts);
 
-  nodeInit(options);
+  nodeInit(opts);
 
   const filterTransactions: EventProcessor = event => {
     return event.type === 'transaction' && event.transaction === '/404' ? null : event;
diff --git a/packages/react/src/sdk.ts b/packages/react/src/sdk.ts
@@ -1,12 +1,17 @@
 import type { BrowserOptions } from '@sentry/browser';
 import { init as browserInit, SDK_VERSION } from '@sentry/browser';
+import type { SdkMetadata } from '@sentry/types';
 
 /**
  * Inits the React SDK
  */
 export function init(options: BrowserOptions): void {
-  options._metadata = options._metadata || {};
-  options._metadata.sdk = options._metadata.sdk || {
+  const opts = {
+    _metadata: {} as SdkMetadata,
+    ...options,
+  };
+
+  opts._metadata.sdk = opts._metadata.sdk || {
     name: 'sentry.javascript.react',
     packages: [
       {
@@ -16,5 +21,5 @@ export function init(options: BrowserOptions): void {
     ],
     version: SDK_VERSION,
   };
-  browserInit(options);
+  browserInit(opts);
 }
diff --git a/packages/serverless/src/awslambda.ts b/packages/serverless/src/awslambda.ts
@@ -2,7 +2,7 @@
 import type { Scope } from '@sentry/node';
 import * as Sentry from '@sentry/node';
 import { captureException, captureMessage, flush, getCurrentHub, withScope } from '@sentry/node';
-import type { Integration } from '@sentry/types';
+import type { Integration, SdkMetadata } from '@sentry/types';
 import { isString, logger, tracingContextFromHeaders } from '@sentry/utils';
 // NOTE: I have no idea how to fix this right now, and don't want to waste more time, as it builds just fine — Kamil
 // eslint-disable-next-line import/no-unresolved
@@ -61,12 +61,13 @@ interface AWSLambdaOptions extends Sentry.NodeOptions {
  * @see {@link Sentry.init}
  */
 export function init(options: AWSLambdaOptions = {}): void {
-  if (options.defaultIntegrations === undefined) {
-    options.defaultIntegrations = defaultIntegrations;
-  }
+  const opts = {
+    _metadata: {} as SdkMetadata,
+    defaultIntegrations,
+    ...options,
+  };
 
-  options._metadata = options._metadata || {};
-  options._metadata.sdk = {
+  opts._metadata.sdk = opts._metadata.sdk || {
     name: 'sentry.javascript.serverless',
     integrations: ['AWSLambda'],
     packages: [
@@ -78,7 +79,7 @@ export function init(options: AWSLambdaOptions = {}): void {
     version: Sentry.SDK_VERSION,
   };
 
-  Sentry.init(options);
+  Sentry.init(opts);
   Sentry.addGlobalEventProcessor(serverlessEventProcessor);
 }
 
diff --git a/packages/serverless/src/gcpfunction/index.ts b/packages/serverless/src/gcpfunction/index.ts
@@ -1,5 +1,5 @@
 import * as Sentry from '@sentry/node';
-import type { Integration } from '@sentry/types';
+import type { Integration, SdkMetadata } from '@sentry/types';
 
 import { GoogleCloudGrpc } from '../google-cloud-grpc';
 import { GoogleCloudHttp } from '../google-cloud-http';
@@ -19,12 +19,13 @@ export const defaultIntegrations: Integration[] = [
  * @see {@link Sentry.init}
  */
 export function init(options: Sentry.NodeOptions = {}): void {
-  if (options.defaultIntegrations === undefined) {
-    options.defaultIntegrations = defaultIntegrations;
-  }
+  const opts = {
+    _metadata: {} as SdkMetadata,
+    defaultIntegrations,
+    ...options,
+  };
 
-  options._metadata = options._metadata || {};
-  options._metadata.sdk = {
+  opts._metadata.sdk = opts._metadata.sdk || {
     name: 'sentry.javascript.serverless',
     integrations: ['GCPFunction'],
     packages: [
@@ -36,6 +37,6 @@ export function init(options: Sentry.NodeOptions = {}): void {
     version: Sentry.SDK_VERSION,
   };
 
-  Sentry.init(options);
+  Sentry.init(opts);
   Sentry.addGlobalEventProcessor(serverlessEventProcessor);
 }
diff --git a/packages/svelte/src/sdk.ts b/packages/svelte/src/sdk.ts
@@ -1,13 +1,17 @@
 import type { BrowserOptions } from '@sentry/browser';
 import { addGlobalEventProcessor, init as browserInit, SDK_VERSION } from '@sentry/browser';
-import type { EventProcessor } from '@sentry/types';
+import type { EventProcessor, SdkMetadata } from '@sentry/types';
 import { getDomElement } from '@sentry/utils';
 /**
  * Inits the Svelte SDK
  */
 export function init(options: BrowserOptions): void {
-  options._metadata = options._metadata || {};
-  options._metadata.sdk = options._metadata.sdk || {
+  const opts = {
+    _metadata: {} as SdkMetadata,
+    ...options,
+  };
+
+  opts._metadata.sdk = opts._metadata.sdk || {
     name: 'sentry.javascript.svelte',
     packages: [
       {
@@ -17,8 +21,7 @@ export function init(options: BrowserOptions): void {
     ],
     version: SDK_VERSION,
   };
-
-  browserInit(options);
+  browserInit(opts);
 
   detectAndReportSvelteKit();
 }
