Skip to content
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 38 additions & 2 deletions packages/nextjs/src/common/utils/dropMiddlewareTunnelRequests.ts
Original file line number Diff line number Diff line change
@@ -1,6 +1,12 @@
import { SEMATTRS_HTTP_TARGET } from '@opentelemetry/semantic-conventions';
import { GLOBAL_OBJ, SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN, type Span, type SpanAttributes } from '@sentry/core';
import { isSentryRequestSpan } from '@sentry/opentelemetry';
import {
getClient,
GLOBAL_OBJ,
isSentryRequestUrl,
SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,
type Span,
type SpanAttributes,
} from '@sentry/core';
import { ATTR_NEXT_SPAN_TYPE } from '../nextSpanAttributes';
import { TRANSACTION_ATTR_SHOULD_DROP_TRANSACTION } from '../span-attributes-with-logic-attached';

Expand Down Expand Up @@ -36,6 +42,36 @@ export function dropMiddlewareTunnelRequests(span: Span, attrs: SpanAttributes |
}
}

/**
* Local copy of `@sentry/opentelemetry`'s `isSentryRequestSpan`, to avoid pulling the whole package into Edge bundles.
*/
function isSentryRequestSpan(span: Span): boolean {
const attributes = spanToAttributes(span);
if (!attributes) {
return false;
}

const httpUrl = attributes['http.url'] || attributes['url.full'];
if (!httpUrl) {
return false;
}

return isSentryRequestUrl(httpUrl.toString(), getClient());
}

function spanToAttributes(span: Span): Record<string, unknown> | undefined {
// OTEL spans expose attributes in different shapes depending on implementation.
// We only need best-effort read access.
type MaybeSpanAttributes = {
attributes?: Record<string, unknown>;
_attributes?: Record<string, unknown>;
};

const maybeSpan = span as unknown as MaybeSpanAttributes;
const attrs = maybeSpan.attributes || maybeSpan._attributes;
return attrs;
}

/**
* Checks if a span's HTTP target matches the tunnel route.
*/
Expand Down
30 changes: 28 additions & 2 deletions packages/nextjs/src/edge/index.ts
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
// import/export got a false positive, and affects most of our index barrel files
// can be removed once following issue is fixed: https://github.com/import-js/eslint-plugin-import/issues/703
/* eslint-disable import/export */
import { context } from '@opentelemetry/api';
import { context, createContextKey } from '@opentelemetry/api';
import {
applySdkMetadata,
type EventProcessor,
Expand All @@ -12,14 +12,14 @@ import {
getRootSpan,
GLOBAL_OBJ,
registerSpanErrorInstrumentation,
type Scope,
SEMANTIC_ATTRIBUTE_SENTRY_OP,
SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,
SEMANTIC_ATTRIBUTE_SENTRY_SOURCE,
setCapturedScopesOnSpan,
spanToJSON,
stripUrlQueryAndFragment,
} from '@sentry/core';
import { getScopesFromContext } from '@sentry/opentelemetry';
import type { VercelEdgeOptions } from '@sentry/vercel-edge';
import { getDefaultIntegrations, init as vercelEdgeInit } from '@sentry/vercel-edge';
import { DEBUG_BUILD } from '../common/debug-build';
Expand All @@ -42,6 +42,32 @@ export { wrapApiHandlerWithSentry } from './wrapApiHandlerWithSentry';

export type EdgeOptions = VercelEdgeOptions;

type CurrentScopes = {
scope: Scope;
isolationScope: Scope;
};

// This key must match `@sentry/opentelemetry`'s `SENTRY_SCOPES_CONTEXT_KEY`.
// We duplicate it here so the Edge bundle does not need to import the full `@sentry/opentelemetry` package.
const SENTRY_SCOPES_CONTEXT_KEY = createContextKey('sentry_scopes');

This comment was marked as outdated.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Context key mismatch breaks scope lookup in Edge

High Severity

The createContextKey function from @opentelemetry/api uses Symbol() (not Symbol.for()), so each call creates a unique symbol. The local SENTRY_SCOPES_CONTEXT_KEY created here will be a different symbol than the one created in @sentry/opentelemetry, despite having the same description. This means getScopesFromContext will always return undefined because the context was set using @sentry/opentelemetry's symbol but is being read with a different symbol. The isolation scope mutation in lines 138-140 will silently fail, breaking scope isolation for Edge runtime requests.

Additional Locations (1)

Fix in Cursor Fix in Web


type ContextWithGetValue = {
getValue(key: unknown): unknown;
};

function getScopesFromContext(otelContext: unknown): CurrentScopes | undefined {
if (!otelContext || typeof otelContext !== 'object') {
return undefined;
}

const maybeContext = otelContext as Partial<ContextWithGetValue>;
if (typeof maybeContext.getValue !== 'function') {
return undefined;
}

return maybeContext.getValue(SENTRY_SCOPES_CONTEXT_KEY) as CurrentScopes | undefined;
}

const globalWithInjectedValues = GLOBAL_OBJ as typeof GLOBAL_OBJ & {
_sentryRewriteFramesDistDir?: string;
_sentryRelease?: string;
Expand Down
171 changes: 100 additions & 71 deletions packages/vercel-edge/rollup.npm.config.mjs
Original file line number Diff line number Diff line change
@@ -1,79 +1,108 @@
import replace from '@rollup/plugin-replace';
import { makeBaseNPMConfig, makeNPMConfigVariants, plugins } from '@sentry-internal/rollup-utils';

export default makeNPMConfigVariants(
makeBaseNPMConfig({
entrypoints: ['src/index.ts'],
bundledBuiltins: ['perf_hooks', 'util'],
packageSpecificConfig: {
context: 'globalThis',
output: {
preserveModules: false,
},
plugins: [
plugins.makeCommonJSPlugin({ transformMixedEsModules: true }), // Needed because various modules in the OTEL toolchain use CJS (require-in-the-middle, shimmer, etc..)
plugins.makeJsonPlugin(), // Needed because `require-in-the-middle` imports json via require
replace({
preventAssignment: true,
values: {
'process.argv0': JSON.stringify(''), // needed because otel relies on process.argv0 for the default service name, but that api is not available in the edge runtime.
},
}),
{
// This plugin is needed because otel imports `performance` from `perf_hooks` and also uses it via the `performance` global.
// It also imports `inspect` and `promisify` from node's `util` which are not available in the edge runtime so we need to define a polyfill.
// Both of these APIs are not available in the edge runtime so we need to define a polyfill.
// Vercel does something similar in the `@vercel/otel` package: https://github.com/vercel/otel/blob/087601ae585cb116bb2b46c211d014520de76c71/packages/otel/build.ts#L62
name: 'edge-runtime-polyfills',
banner: `
{
if (globalThis.performance === undefined) {
globalThis.performance = {
timeOrigin: 0,
now: () => Date.now()
};
}
}
`,
resolveId: source => {
if (source === 'perf_hooks') {
return '\0perf_hooks_sentry_shim';
} else if (source === 'util') {
return '\0util_sentry_shim';
} else {
return null;
const baseConfig = makeBaseNPMConfig({
entrypoints: ['src/index.ts'],
bundledBuiltins: ['perf_hooks', 'util'],
packageSpecificConfig: {
context: 'globalThis',
output: {
preserveModules: false,
},
plugins: [
plugins.makeCommonJSPlugin({ transformMixedEsModules: true }), // Needed because various modules in the OTEL toolchain use CJS (require-in-the-middle, shimmer, etc..)
plugins.makeJsonPlugin(), // Needed because `require-in-the-middle` imports json via require
replace({
preventAssignment: true,
values: {
'process.argv0': JSON.stringify(''), // needed because otel relies on process.argv0 for the default service name, but that api is not available in the edge runtime.
},
}),
{
// This plugin is needed because otel imports `performance` from `perf_hooks` and also uses it via the `performance` global.
// It also imports `inspect` and `promisify` from node's `util` which are not available in the edge runtime so we need to define a polyfill.
// Both of these APIs are not available in the edge runtime so we need to define a polyfill.
// Vercel does something similar in the `@vercel/otel` package: https://github.com/vercel/otel/blob/087601ae585cb116bb2b46c211d014520de76c71/packages/otel/build.ts#L62
name: 'edge-runtime-polyfills',
banner: `
{
if (globalThis.performance === undefined) {
globalThis.performance = {
timeOrigin: 0,
now: () => Date.now()
};
}
},
load: id => {
if (id === '\0perf_hooks_sentry_shim') {
return `
export const performance = {
timeOrigin: 0,
now: () => Date.now()
}
`;
} else if (id === '\0util_sentry_shim') {
return `
export const inspect = (object) =>
JSON.stringify(object, null, 2);
}
`,
resolveId: source => {
if (source === 'perf_hooks') {
return '\0perf_hooks_sentry_shim';
} else if (source === 'util') {
return '\0util_sentry_shim';
} else {
return null;
}
},
load: id => {
if (id === '\0perf_hooks_sentry_shim') {
return `
export const performance = {
timeOrigin: 0,
now: () => Date.now()
}
`;
} else if (id === '\0util_sentry_shim') {
return `
export const inspect = (object) =>
JSON.stringify(object, null, 2);

export const promisify = (fn) => {
return (...args) => {
return new Promise((resolve, reject) => {
fn(...args, (err, result) => {
if (err) reject(err);
else resolve(result);
});
export const promisify = (fn) => {
return (...args) => {
return new Promise((resolve, reject) => {
fn(...args, (err, result) => {
if (err) reject(err);
else resolve(result);
});
};
});
};
`;
} else {
return null;
}
},
};
`;
} else {
return null;
}
},
],
},
}),
);
},
],
},
});

// `makeBaseNPMConfig` marks dependencies/peers as external by default.
// For Edge, we must ensure the OTEL SDK bits which reference `process.argv0` are bundled so our replace() plugin applies.
const baseExternal = baseConfig.external;
baseConfig.external = (source, importer, isResolved) => {
// Never treat these as external - they need to be inlined so `process.argv0` can be replaced.
if (
source === '@opentelemetry/resources' ||
source.startsWith('@opentelemetry/resources/') ||
source === '@opentelemetry/sdk-trace-base' ||
source.startsWith('@opentelemetry/sdk-trace-base/')
) {
return false;
}

if (typeof baseExternal === 'function') {
return baseExternal(source, importer, isResolved);
}

if (Array.isArray(baseExternal)) {
return baseExternal.includes(source);
}

if (baseExternal instanceof RegExp) {
return baseExternal.test(source);
}

return false;
};

export default makeNPMConfigVariants(baseConfig);
Loading