Skip to content

Commit 2b3ce34

Browse files
chargomeclaude
andauthored
fix(sveltekit): Fix file system race condition in source map cleaning (#19714)
Replace `existsSync` guard with try/catch around read+write operations to eliminate the time-of-check to time-of-use race condition (CWE-367) flagged by CodeQL (code-scanning alert #439). closes https://github.com/getsentry/sentry-javascript/security/code-scanning/439 Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 98be6b0 commit 2b3ce34

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

packages/sveltekit/src/vite/sourceMaps.ts

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -213,14 +213,16 @@ export async function makeCustomSentryVitePlugins(
213213
// We need to remove the query string from the source map files that our auto-instrument plugin added
214214
// to proxy the load functions during building.
215215
const mapFile = `${file}.map`;
216-
if (fs.existsSync(mapFile)) {
216+
try {
217217
const mapContent = (await fs.promises.readFile(mapFile, 'utf-8')).toString();
218218
const cleanedMapContent = mapContent.replace(
219219
// oxlint-disable-next-line sdk/no-regexp-constructor -- no user input + escaped anyway
220220
new RegExp(escapeStringForRegex(WRAPPED_MODULE_SUFFIX), 'gm'),
221221
'',
222222
);
223223
await fs.promises.writeFile(mapFile, cleanedMapContent);
224+
} catch {
225+
// Map file doesn't exist, nothing to clean
224226
}
225227
}
226228

0 commit comments

Comments
 (0)