Repository navigation
Drop crashes thrown by code injected inline into our pages - #310
Merged
Merged
Conversation
The /results crash on the bug board ("TypeError: undefined is not an
object", Brave on macOS) has a single frame,
"global code@https://fundermatch.org/results:1:16": inline code in the
page document itself. Our CSP allows no inline scripts and all our code is
served from /assets/*.js, so that code was injected by the browser or an
extension (a user script), which content scripts can do despite the CSP.
isNoise now treats a crash whose top frame is one of our own pages (not a
script file) like one whose top frame is an extension's. Frames from our
bundle above it still count as ours, and other sites' URLs are untouched.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GNg1jsnDVcemV3Ut9XhA7h
Deploying funder-finder with
|
| Latest commit: |
329ae9c
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://c7fad6b8.funder-finder.pages.dev |
| Branch Preview URL: | https://fix-injected-inline-script-c.funder-finder.pages.dev |
Review feedback: an explicit :443 left the path unparsed, so a frame from our own bundle counted as injected; and the rule now says what it means (our code is served from /assets/) instead of keying on a .js extension. PRODUCTION_HOST goes back where it was. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GNg1jsnDVcemV3Ut9XhA7h
Review round 2: a crash that brought up the error screen is reported even when its top frame is a page, like the network rule. The page check parses the frame's URL and reuses PRODUCTION_HOST, so any port or scheme works and the host lives in one place. Tests pin the error-screen case and Safari's failed module import pinned on the document (still a chunk-load error). The CSP comment in index.html points at the rule that depends on it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GNg1jsnDVcemV3Ut9XhA7h
Review round 3: a same-origin script file outside /assets/ is not a page, so it no longer counts as injected; the check sits with its own comment instead of splitting the network rule's; a test pins Vite's base and asset dir, which the check relies on; and the CSP notes sit beside all three policies. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GNg1jsnDVcemV3Ut9XhA7h
Review round 4: every file of our bundle ends in .js, so the extension test alone tells a script from a page, and the test pinning vite.config's text (which checked the source, not the build) goes with it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GNg1jsnDVcemV3Ut9XhA7h
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes Trello card [CRASH] TypeError: undefined is not an object (evaluating ) (https://trello.com/c/y2bVJwQO), seen on
/results.Root cause
The report's only stack frame is
global code@https://fundermatch.org/results:1:16, which is inline code in the page document itself. Our CSP (script-src 'self' https://gc.zgo.at, set inindex.html,public/_headersandpublic/_worker.js) allows no inline scripts, so the code that threw was injected by the browser or an extension (a user script, which runs despite the CSP). It's from the same family as thechrome-extension://frames we already filter, and there's nothing in our code to fix.Change
isNoise(insrc/lib/monitoring.ts) now drops a crash whose top frame (the first one with a URL) is a page on the live site rather than a.js/.mjs/.cjsscript. The newisOurPagehelper parses the frame URL and reusesPRODUCTION_HOST.Tests (written first, red before the fix)
New cases in
tests/monitoring.test.mjs:/,www,:443, the error event without an error object, an unhandled rejectionnpm test(75/75 afternpm run build),npm run lintandtsc -ball pass.Reviews
Four
/code-reviewrounds, with the fixes in follow-up commits. Two security reviews found nothing.🤖 Generated with Claude Code
https://claude.ai/code/session_01GNg1jsnDVcemV3Ut9XhA7h