test(cloudflare): Add Vite-build support to the integration-test runner#22422
Conversation
| pathe "^2.0.3" | ||
| source-map-js "^1.2.1" | ||
|
|
||
| vite@7.3.2: |
There was a problem hiding this comment.
High severity vulnerability may affect your project—review required:
Line 30374 lists a dependency (vite) with a known High severity vulnerability.
ℹ️ Why this matters
Affected versions of vite and vite-plus are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor / Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Vite's server.fs.deny blocklist—which protects sensitive files such as .env and certificate files from being served—can be bypassed on Windows using alternate path representations (NTFS Alternate Data Stream syntax like /.env::$DATA?raw, or 8.3 short filenames), allowing an attacker to read otherwise-denied files when the dev server is exposed to the network.
To resolve this comment:
Check if you expose the Vite dev server or vite-plus to the network by configuring a non-loopback address using the --host CLI flag on Windows.
- If you're affected, upgrade this dependency to at least version 7.3.5 at yarn.lock.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
7fa0bdf to
f794a64
Compare
fee009a to
61ecd75
Compare
| function builtFromSource(builtConfigPath: string, sourceConfigPath: string): boolean { | ||
| try { | ||
| const built = JSON.parse(readFileSync(builtConfigPath, 'utf8')) as { userConfigPath?: string; configPath?: string }; | ||
| return built.userConfigPath === sourceConfigPath || built.configPath === sourceConfigPath; | ||
| } catch { | ||
| return false; | ||
| } | ||
| } |
There was a problem hiding this comment.
Bug: The strict path comparison in builtFromSource() will likely fail because path.join() creates an OS-specific absolute path, while the Vite plugin may generate a relative or differently formatted path string.
Severity: MEDIUM
Suggested Fix
Before comparing the paths in builtFromSource(), normalize them. Convert both built.userConfigPath and sourceConfigPath to a consistent format, such as absolute paths with normalized separators, using functions from the path module.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: dev-packages/cloudflare-integration-tests/runner.ts#L66-L73
Potential issue: The `builtFromSource()` function compares a generated config path
(`built.userConfigPath`) with a locally constructed path (`sourceConfigPath`) using
strict string equality (`===`). The `sourceConfigPath` is an absolute path created with
`path.join()`, which uses OS-native separators. The `userConfigPath`, generated by the
`@cloudflare/vite-plugin`, is likely to be a relative path or use a different separator
format (e.g., forward slashes). This mismatch will cause the comparison to fail,
preventing Vite-built test suites from being located and throwing an error. This issue
is particularly likely to manifest on Windows due to path separator differences.
Did we get this right? 👍 / 👎 to inform future reviews.
f794a64 to
e5d9096
Compare
61ecd75 to
752340f
Compare
0015911 to
e0afe44
Compare
752340f to
18edf5c
Compare
e0afe44 to
2607d0b
Compare
12be617 to
9206a0e
Compare
2607d0b to
8864e2e
Compare
b4a2514 to
ecbeab8
Compare
Teach the integration-test runner to support suites that opt into the Sentry Vite plugin. When a suite ships a `vite.config.*`, the runner runs `vite build` first (so the plugin's auto-instrumentation transform runs) and points `wrangler dev` at the generated `dist/<worker>/wrangler.json`, matched to the right source config via its `userConfigPath`. Suites without a Vite config keep running straight from source, unchanged. No suite uses this path yet; the auto-instrument feature commits that follow add their own `vite-autoinstrument/*` integration suites. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
8864e2e to
989fd3d
Compare
ecbeab8 to
1225849
Compare
| function builtFromSource(builtConfigPath: string, sourceConfigPath: string): boolean { | ||
| try { | ||
| const built = JSON.parse(readFileSync(builtConfigPath, 'utf8')) as { userConfigPath?: string; configPath?: string }; | ||
| return built.userConfigPath === sourceConfigPath || built.configPath === sourceConfigPath; | ||
| } catch { | ||
| return false; | ||
| } |
There was a problem hiding this comment.
Bug: The code assumes the @cloudflare/vite-plugin generates userConfigPath or configPath in the output wrangler.json, but this behavior is unverified and likely does not exist.
Severity: HIGH
Suggested Fix
Verify the actual output of the @cloudflare/vite-plugin. If it does not generate userConfigPath or configPath, update the plugin to include this necessary metadata. Alternatively, find another reliable method to associate the built wrangler.json with its source vite.config.* file. Ensure the matching logic is robust before adding integration suites that depend on it.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: dev-packages/cloudflare-integration-tests/runner.ts#L66-L72
Potential issue: The test runner logic for Vite-based suites relies on matching a
generated `wrangler.json` to its source configuration file. This is done by checking for
a `userConfigPath` or `configPath` property within the generated JSON file. However, it
is unverified whether the `@cloudflare/vite-plugin` actually adds these properties to
its output. If these properties are missing, the `builtFromSource()` check will always
fail, `builtConfig` will remain `undefined`, and the runner will throw an error. This
will cause all Vite-based integration tests to fail as soon as they are added.
…runner Backport of: #22422
…runner Backport of: #22422
Teach the integration-test runner to support suites that opt into the Sentry Vite plugin. When a suite ships a
vite.config.*, the runner runsvite buildfirst (so the plugin's auto-instrumentation transform runs) and pointswrangler devat the generateddist/<worker>/wrangler.json, matched to the right source config via itsuserConfigPath. Suites without a Vite config keep running straight from source, unchanged (=wrangler).No suite uses this path yet; the auto-instrument feature commits that follow add their own
vite-autoinstrument/*integration suites.