TF-4343 Fix load Sentry from Sentry CDN (#4348)

2026-04-14 11:59:27 +07:00
parent eeaab49e93
commit 16376fccb4
4 changed files with 91 additions and 1 deletions
@@ -41,6 +41,10 @@
  <script src="worker_service/worker_service.js"></script>
  <script src="i18n/translater.js"></script>
  <script src="https://unpkg.com/@dotlottie/player-component@2.7.12/dist/dotlottie-player.mjs" type="module"></script>
+  <!-- Load Sentry SDK first (self-hosted bundle), then interceptor to block any subsequent CDN injection.
+       Order matters: the interceptor must activate after the SDK is ready so it can patch document.createElement. -->
+  <script src="js/sentry-tracing.min.js?v=1.0.0" integrity="sha384-SFODEb3T2QkMjTr3S1it5zIK0cIW7jsComFUkmJ9nU9uaWs3AzA6cubt8xn0zW7A" crossorigin="anonymous"></script>
+  <script src="js/sentry-interceptor.js?v=1.0.0" integrity="sha384-uThyomTT1K0+gzqsKuq4UoZXu3SABtbtP7Y3NXFyvabuIQPGYszSO41UBrcs5czI" crossorigin="anonymous"></script>
 </head>
 <body>

@@ -0,0 +1,83 @@
+(function() {
+  const originalCreateElement = document.createElement;
+
+  // Only block the specific tracing bundle we self-host. Narrowing to this pathname
+  // prevents silently swallowing future CDN assets that have no local replacement.
+  const BLOCKED_PATHNAME = '/bundle.tracing.min.js';
+
+  function isSentryCdnHostname(hostname) {
+    return hostname === 'sentry-cdn.com' || hostname.endsWith('.sentry-cdn.com');
+  }
+
+  function shouldBlockSentryUrl(urlString) {
+    if (!urlString) return false;
+    try {
+      const parsed = new URL(urlString, document.baseURI);
+      const hostname = parsed.hostname.toLowerCase();
+      const pathname = parsed.pathname.toLowerCase();
+      return isSentryCdnHostname(hostname) && pathname.endsWith(BLOCKED_PATHNAME);
+    } catch (e) {
+      // Fallback for non-parseable URLs: check if it looks like a plain hostname
+      // (no whitespace, no path/query/fragment separators).
+      const str = String(urlString).trim().toLowerCase();
+      const isHostLike = str.length > 0 && !/[\s/?#]/.test(str);
+      return isHostLike && isSentryCdnHostname(str);
+    }
+  }
+
+  function blockAndNotify(element, channel, urlString) {
+    console.log('[Sentry Interceptor] 🛑 Blocked CDN request (' + channel + '):', urlString);
+    // Fire a synthetic 'load' event so the Sentry SDK's internal Promise resolves
+    // cleanly instead of hanging indefinitely waiting for a CDN script we blocked.
+    setTimeout(() => element.dispatchEvent(new Event('load')), 10);
+  }
+
+  function makeSrcSetter(nativeSrcDescriptor) {
+    return function(val) {
+      const urlString = val ? String(val) : '';
+      if (shouldBlockSentryUrl(urlString)) {
+        blockAndNotify(this, 'Property', urlString);
+      } else {
+        nativeSrcDescriptor?.set?.call(this, val);
+      }
+    };
+  }
+
+  function makeSrcGetter(nativeSrcDescriptor) {
+    return function() {
+      return nativeSrcDescriptor?.get?.call(this) ?? '';
+    };
+  }
+
+  function makeSetAttribute(originalSetAttribute) {
+    return function(name, value) {
+      const urlString = value ? String(value) : '';
+      if (String(name).toLowerCase() === 'src' && shouldBlockSentryUrl(urlString)) {
+        blockAndNotify(this, 'Attribute', urlString);
+        return;
+      }
+      originalSetAttribute.call(this, name, value);
+    };
+  }
+
+  function patchScriptElement(element) {
+    const nativeSrcDescriptor = Object.getOwnPropertyDescriptor(HTMLScriptElement.prototype, 'src');
+    Object.defineProperty(element, 'src', {
+      configurable: true,
+      set: makeSrcSetter(nativeSrcDescriptor),
+      get: makeSrcGetter(nativeSrcDescriptor),
+    });
+    element.setAttribute = makeSetAttribute(element.setAttribute);
+  }
+
+  // Load order: sentry-tracing.min.js (self-hosted SDK) must run before this interceptor.
+  // This interceptor patches document.createElement to block any subsequent CDN injection
+  // the SDK may attempt at runtime.
+  document.createElement = function(tagName, options) {
+    const element = originalCreateElement.call(document, tagName, options);
+    if (String(tagName).toLowerCase() === 'script') {
+      patchScriptElement(element);
+    }
+    return element;
+  };
+})();