sourcemaps inject fails on files containing sourceMappingURL inside string literals

[nyan-left]

CLI Version

3.3.3

Operating System and Architecture

• macOS (arm64)
• macOS (x86_64)
• Linux (i686)
• Linux (x86_64)
• Linux (armv7)
• Linux (aarch64)
• Windows (i686)
• Windows (x86_64)

Operating System Version

macOS 15.3, Debian 12 (node:24 Docker image)

Link to reproduction repository

See test here https://github.com/getsentry/sentry-cli/pull/3243/changes#diff-875ee27ec59c83f8fd42c15616c5baa3ba37041f06524816921a3b2ad14fcb70

CLI Command

sentry-cli sourcemaps inject ./my-dist

Exact Reproduction Steps

Reproduction Steps

1. Bundle a JS worker that includes terser or babel as dependencies (these tools generate sourceMappingURL comments as part of their output)
2. After minification, template literals in these tools produce lines like:

var output=code+`
//# sourceMappingURL=data:application/json;base64,`+btoa(map)

3. The backtick preserves the newline, so //# sourceMappingURL=data:application/json;base64, lands at column 0
4. discover_sourcemaps_location matches it as a real directive, but the "base64" content is JS code, so decoding fails
5. Run sentry-cli sourcemaps inject ./my-dist

Expected Results

The injection skips files where the embedded sourcemap data isn't valid base64 and processes the rest normally.

Actual Results

> Searching ./my-dist
> Found 236 files
> Analyzing 236 sources
> Injecting debug ids
error: Invalid embedded sourcemap in source file ./my-dist/assets/bundler.worker-CqhnNlN9.js

Exits with code 1, no other files are processed.

Logs

N/A

[linear-code]

CLI-309

[dingsdax]

I've created a reproduction for this issue: getsentry/repro#38

The key pattern that triggers the bug is a multi-line template literal where //# sourceMappingURL=data:application/json;base64, ends up on its own line inside the string (e.g. terser's inline sourcemap generation code bundled into a worker):

var appendSourceMap = function(code, map) {
  return code + `
//# sourceMappingURL=data:application/json;base64,` + btoa(JSON.stringify(map));
};

Running sentry-cli sourcemaps inject on a directory containing this file reproduces the Invalid embedded sourcemap error on 2.50.2.

You can run it by cloning the repo and following the instructions in the README:

git clone https://github.com/getsentry/repro
cd repro/sentry-cli/3244
sentry-cli sourcemaps inject ./dist

🤖 Generated with Claude Code