Chrome Extension using @sentry/react gets rejected

[FedorT22]

Is there an existing issue for this?

• I have checked for existing issues https://github.com/getsentry/sentry-javascript/issues
• I have reviewed the documentation https://docs.sentry.io/
• I am using the latest SDK release https://github.com/getsentry/sentry-javascript/releases

How do you use Sentry?

Sentry Saas (sentry.io)

Which SDK are you using?

@sentry/react

SDK Version

9.5.0

Framework Version

React 18.3.1

Link to Sentry event

No response

Reproduction Example/SDK Setup

1. Build the project with @sentry feedbackIntegration function using @sentry/browser or @sentry/react. You can follow README.md file in the project.
2. See in the /dist/sidePanel.js and dist/sidePanel.js.map the piece of code wtih CDN link:

const o=Cn.document.createElement("script");o.async=!0,o.crossOrigin="anonymous",o.src=OZ(r,e),e.onLoad&&(o.onload=e.onLoad);

3. Submit the extension to the Chrome Webstore
4. Wait for the Chrome Webstore answer

Steps to Reproduce

See #14891 (comment)

For the reference, here is a previous problem related fix:
https://github.com/getsentry/sentry-javascript/releases/tag/8.48.0

Expected Result

Extension is approved by the reviewers.

Actual Result

Extension is rejected by the reviewers
The given reason:

Violation reference ID: [Blue Argon](https://developer.chrome.com/docs/webstore/troubleshooting/#additional-requirements-for-manifest-v3)

Technical Requirements - Additional Requirements for Manifest V3:

Violation:
Including remotely hosted code in a Manifest V3 item.
Violating Content:
Code snippet: sidePanel.js: const o = jt.document.createElement("script"); o.async = !0, o.crossOrigin = "anonymous", o.src = vee(r, e), e.onLoad && (o.onload = e.onLoad);

The current work-around:
Clear up @sentry CDN setup during the build process with a help of patch-package.

[FedorT22]

Previously it was enough not to have an CDN link in the bundle. Currently, seems like there should be no code, related to the external resources loading

[andreiborza]

Hi @FedorT22, thanks for writing in.

I don't have a chrome extension codebase lying around, but tried building a react app locally with Sentry.feedbackIntegration. I did find a script in the output bundle with crossOrigin=anonymous but it is also present when I remove all the Sentry code.

Are you using feedbackAsyncIntegration by any chance?

Also, could you please provide your patch-package code?

[FedorT22]

Hi @FedorT22, thanks for writing in.

I don't have a chrome extension codebase lying around, but tried building a react app locally with Sentry.feedbackIntegration. I did find a script in the output bundle with crossOrigin=anonymous but it is also present when I remove all the Sentry code.

Are you using feedbackAsyncIntegration by any chance?

Also, could you please provide your patch-package code?

Hi, @andreiborza! Thank you for the quick reply.
Here you can find a basic example of my setup:
https://github.com/FedorT22/sandbox-chrome-extension

I tried to follow typescript-definition of the method I am using. Looks like it's feedbackSyncIntegration

I also tried:

• just using @sentry/react or @sentry/browser in https://github.com/FedorT22/sandbox-chrome-extension/blob/main/src/sidepanel/App.tsx#L4
• attaching integration here first before using it as above: https://github.com/FedorT22/sandbox-chrome-extension/blob/main/src/sidepanel/sentry-react.config.ts#L11
  nothing helps.

[FedorT22]

@andreiborza I tried to experiment a little bit more by removing all sentry related code from the app and adding it step by step again. As result, I found out, that ErrorBoundary from @sentry/react is guilty. See example here:
https://github.com/FedorT22/sandbox-chrome-extension/pull/1/files

[andreiborza]

@FedorT22 great find, thanks!

The issue stems from our error boundary setting up the crash report dialog which in turn is done via injecting a script for legacy reasons (the whole dialog is rendered on the backend).

This will likely take a big rework and won't happen any time soon, so my suggestion for now is to

1. not use the Sentry ErrorBoundary and
2. ensure it's tree-shaken out of your build

Thanks for digging deeper into this!