fix(sourcemaps): Prevent Debug ID collisions

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## Unreleased
+
+### Fixes
+
+- (sourcemaps) Prevent Debug ID collisions between distinct JS files that share identical sourcemaps by hashing both the JS and sourcemap bytes when injecting Debug IDs ([#3356](https://github.com/getsentry/sentry-cli/pull/3356))
+
 ## 3.6.0
 
 ### Features

src/utils/sourcemaps.rs

@@ -803,9 +803,19 @@ impl SourceMapProcessor {
                                 format!("Invalid embedded sourcemap in source file {source_url}")
                             })?;
 
-                        let debug_id = sourcemap
-                            .debug_id()
-                            .unwrap_or_else(|| inject::debug_id_from_bytes_hashed(&decoded));
+                        let debug_id = match sourcemap.debug_id() {
+                            Some(debug_id) => debug_id,
+                            None => {
+                                let source_file = self
+                                    .sources
+                                    .get(source_url)
+                                    .expect("source file must exist when processing its sourcemap");
+                                inject::debug_id_from_js_and_sourcemap_bytes_hashed(
+                                    source_file.contents.as_slice(),
+                                    &decoded,
+                                )
+                            }
+                        };
 
                         let source_file = self.sources.get_mut(source_url).unwrap();
 
@@ -896,9 +906,14 @@ impl SourceMapProcessor {
                                 match sm.debug_id() {
                                     Some(debug_id) => (sm, debug_id, false),
                                     None => {
-                                        let debug_id = inject::debug_id_from_bytes_hashed(
-                                            &sourcemap_file.contents,
+                                        let source_file = self.sources.get(source_url).expect(
+                                            "source file must exist when processing its sourcemap",
                                         );
+                                        let debug_id =
+                                            inject::debug_id_from_js_and_sourcemap_bytes_hashed(
+                                                source_file.contents.as_slice(),
+                                                sourcemap_file.contents.as_slice(),
+                                            );
                                         (sm, debug_id, true)
                                     }
                                 }

src/utils/sourcemaps/inject.rs

@@ -330,6 +330,24 @@ pub fn debug_id_from_bytes_hashed(bytes: &[u8]) -> DebugId {
     DebugId::from_uuid(uuid::Builder::from_sha1_bytes(sha1_bytes).into_uuid())
 }
 
+/// Generates a debug ID from generated JS bytes and sourcemap bytes.
+pub fn debug_id_from_js_and_sourcemap_bytes_hashed(
+    js_bytes: &[u8],
+    sourcemap_bytes: &[u8],
+) -> DebugId {
+    let mut hash = sha1_smol::Sha1::new();
+    hash.update(b"js");
+    hash.update(&(js_bytes.len() as u64).to_le_bytes());
+    hash.update(js_bytes);
+    hash.update(b"sourcemap");
+    hash.update(&(sourcemap_bytes.len() as u64).to_le_bytes());
+    hash.update(sourcemap_bytes);
+
+    let mut sha1_bytes = [0u8; 16];
+    sha1_bytes.copy_from_slice(&hash.digest().bytes()[..16]);
+    DebugId::from_uuid(uuid::Builder::from_sha1_bytes(sha1_bytes).into_uuid())
+}
+
 /// Ensures paths are always separated by `/` even on Windows
 pub fn canonicalize_path_sep_to_unix(path: &str) -> String {
     path.replace(std::path::MAIN_SEPARATOR, "/")
@@ -751,6 +769,28 @@ more text
         );
     }
 
+    #[test]
+    fn debug_id_from_js_and_sourcemap_bytes_is_deterministic() {
+        let first = debug_id_from_js_and_sourcemap_bytes_hashed(b"console.log(1);", b"{}");
+        let second = debug_id_from_js_and_sourcemap_bytes_hashed(b"console.log(1);", b"{}");
+        assert_eq!(first, second);
+    }
+
+    #[test]
+    fn debug_id_from_js_and_sourcemap_bytes_changes_with_js() {
+        let first = debug_id_from_js_and_sourcemap_bytes_hashed(b"console.log(1);", b"{}");
+        let second = debug_id_from_js_and_sourcemap_bytes_hashed(b"console.log(2);", b"{}");
+        assert_ne!(first, second);
+    }
+
+    #[test]
+    fn debug_id_from_js_and_sourcemap_bytes_changes_with_sourcemap() {
+        let first = debug_id_from_js_and_sourcemap_bytes_hashed(b"console.log(1);", b"{}");
+        let second =
+            debug_id_from_js_and_sourcemap_bytes_hashed(b"console.log(1);", b"{\"version\":3}");
+        assert_ne!(first, second);
+    }
+
     #[test]
     fn inject_debug_id_empty_source() {
         let source = "\n";

tests/integration/_cases/sourcemaps/sourcemaps-inject-double-association.trycmd

@@ -10,19 +10,19 @@ Source Map Debug ID Injection Report
   Modified: The following source files have been modified to have debug ids
     0fb38a98-fdda-5fd2-8e58-d8370f1596fb - ./app.min.js
         - warning: based on the file name, we guessed a source map reference (app.min.js.map), which is already associated with source ./references_app.min.js. Please explicitly set the sourcemap URL with a `//# sourceMappingURL=...` comment in the source file.
-    2de47eef-a93e-5d79-8c45-afb649b15f9e - ./mapInSubdirectory.min.js
+    fb752ba3-f8ff-5b2a-9289-d0743da085ed - ./mapInSubdirectory.min.js
     f369af08-3e09-58d4-92a9-7f432f7d51cb - ./otherApp.js
         - warning: Could not associate this source with a source map. We guessed the sourcemap reference otherApp.map for multiple sources, including this one. Please explicitly set the sourcemap URL with a `//# sourceMappingURL=...` comment in the source file, to make the association clear.
     4ee42454-c84d-5d2a-b0b9-8cda74c57838 - ./otherApp.min.js
         - warning: Could not associate this source with a source map. We guessed the sourcemap reference otherApp.map for multiple sources, including this one. Please explicitly set the sourcemap URL with a `//# sourceMappingURL=...` comment in the source file, to make the association clear.
-    44931b59-c632-5017-a624-3bb0ac2a0317 - ./references_app.min.js
-    edefb3dc-9f7a-5540-9db0-270bbd81b8fd - ./subdirectory/app.min.js
+    49ac875b-def6-52a7-8576-7603e500765e - ./references_app.min.js
+    09b052c2-da6b-5022-b995-8d9be43cf3ef - ./subdirectory/app.min.js
     228cdb31-bb0a-533c-ac4c-c2ab111ab148 - ./subdirectory/mapForFileInParentDirectory.min.js
         - warning: based on the file name, we guessed a source map reference (mapForFileInParentDirectory.min.js.map), which is already associated with source ./mapInSubdirectory.min.js. Please explicitly set the sourcemap URL with a `//# sourceMappingURL=...` comment in the source file.
   Modified: The following sourcemap files have been modified to have debug ids
-    44931b59-c632-5017-a624-3bb0ac2a0317 - ./app.min.js.map
-    edefb3dc-9f7a-5540-9db0-270bbd81b8fd - ./subdirectory/app.min.js.map
-    2de47eef-a93e-5d79-8c45-afb649b15f9e - ./subdirectory/mapForFileInParentDirectory.min.js.map
+    49ac875b-def6-52a7-8576-7603e500765e - ./app.min.js.map
+    09b052c2-da6b-5022-b995-8d9be43cf3ef - ./subdirectory/app.min.js.map
+    fb752ba3-f8ff-5b2a-9289-d0743da085ed - ./subdirectory/mapForFileInParentDirectory.min.js.map
 
 
 ```

tests/integration/_expected_outputs/sourcemaps/inject_indexed/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-"use strict";!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="85ee593b-6278-5da3-8f05-e762f00b888d")}catch(e){}}();
+"use strict";!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="cb0664d0-ce45-5b34-bc9d-783cc9b20168")}catch(e){}}();
 // this is a comment
 /*and
 another
@@ -10,4 +10,4 @@ function greet(name) {
 }
 console.log(greet("World"));
 //# sourceMappingURL=index.js.map
-//# debugId=85ee593b-6278-5da3-8f05-e762f00b888d
+//# debugId=cb0664d0-ce45-5b34-bc9d-783cc9b20168

tests/integration/_expected_outputs/sourcemaps/sourcemaps-inject-bundlers/esbuild/cjs.js

@@ -1,6 +1,6 @@
 "use strict";
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a9f9a996-4e6c-5119-b8b8-e64559a6554c")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e9628b74-186f-5418-94d8-ce5d7710b414")}catch(e){}}();
 function t(r,o){r(o)}function n(r,o){t(r,o)}function f(r,o){n(r,o)}f(function(o){throw new Error(o)},"boop");
 //# sourceMappingURL=cjs.js.map
 
-//# debugId=a9f9a996-4e6c-5119-b8b8-e64559a6554c
+//# debugId=e9628b74-186f-5418-94d8-ce5d7710b414

tests/integration/_expected_outputs/sourcemaps/sourcemaps-inject-bundlers/esbuild/iife.js

@@ -1,6 +1,6 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="dd751360-5eae-531d-87f4-5e00c846a9a3")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1376eb8d-6d4f-5c24-8ad7-1120c70dee97")}catch(e){}}();
 (()=>{function t(r,o){r(o)}function n(r,o){t(r,o)}function f(r,o){n(r,o)}f(function(o){throw new Error(o)},"boop");})();
 //# sourceMappingURL=iife.js.map
 
-//# debugId=dd751360-5eae-531d-87f4-5e00c846a9a3
+//# debugId=1376eb8d-6d4f-5c24-8ad7-1120c70dee97

tests/integration/_expected_outputs/sourcemaps/sourcemaps-inject-bundlers/rollup/cjs.js

@@ -1,6 +1,6 @@
 "use strict";
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="0b6cf2c0-b31e-5bb4-9e50-a0c0fd4837db")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1dd7a7c9-edd6-53e2-a9ea-fbcb8d7348e4")}catch(e){}}();
 var n;n=function(n){throw new Error(n)},function(n,o){!function(n,o){n(o)}(n,o)}(n,"boop");
 //# sourceMappingURL=cjs.js.map
 
-//# debugId=0b6cf2c0-b31e-5bb4-9e50-a0c0fd4837db
+//# debugId=1dd7a7c9-edd6-53e2-a9ea-fbcb8d7348e4

tests/integration/_expected_outputs/sourcemaps/sourcemaps-inject-bundlers/rollup/iife.js

@@ -1,6 +1,6 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="6cde0fde-8646-5aa5-90be-6540abac2d15")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b23fffbe-2e84-5ec2-8e51-8d8c5a061e4f")}catch(e){}}();
 !function(){"use strict";var n;n=function(n){throw new Error(n)},function(n,o){!function(n,o){n(o)}(n,o)}(n,"boop")}();
 //# sourceMappingURL=iife.js.map
 
-//# debugId=6cde0fde-8646-5aa5-90be-6540abac2d15
+//# debugId=b23fffbe-2e84-5ec2-8e51-8d8c5a061e4f