Skip to content

fix(core): Avoid functionToStringIntegration causing infinite recursions#22515

Open
Lms24 wants to merge 1 commit into
developfrom
lms/fix-core-function-to-string-recursion
Open

fix(core): Avoid functionToStringIntegration causing infinite recursions#22515
Lms24 wants to merge 1 commit into
developfrom
lms/fix-core-function-to-string-recursion

Conversation

@Lms24

@Lms24 Lms24 commented Jul 22, 2026

Copy link
Copy Markdown
Member

Prevent FunctionToString from delegating through mutable Reflect.apply, which can re-enter the integration when another library performs function integrity checks.

This PR restores the plain wrapper while retaining the cross-origin fallback from #2227 and adds a regression test for reentrant Reflect.apply.

To be clear, the repro for this seems extremely superficial. When inspecting the supplied stack trace of the customer reporting this issue, we found some evidence for another library mocking with the functino prototype's toString(). No concrete evidence though for re-entering via Reflect.apply().

Refs #21965
fixes https://linear.app/getsentry/issue/JS-3120/investigate-possible-functionprototypetostring-regression-causing

Avoid delegating through mutable Reflect.apply, which can re-enter the
FunctionToString patch when other libraries instrument native functions.
Retain the cross-origin carrier fallback while using the plain wrapper.

Co-Authored-By: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
@linear-code

linear-code Bot commented Jul 22, 2026

Copy link
Copy Markdown

JS-3120

@Lms24
Lms24 marked this pull request as ready for review July 22, 2026 17:05
@Lms24
Lms24 requested review from mydea and nicohrubec July 22, 2026 17:05
@Lms24 Lms24 changed the title fix(core): Avoid FunctionToString recursion fix(core): Avoid functionToStringIntegration causing infinite recursions Jul 22, 2026
@Lms24 Lms24 self-assigned this Jul 22, 2026
@github-actions

Copy link
Copy Markdown
Contributor

size-limit report 📦

⚠️ Warning: Base artifact is not the latest one, because the latest workflow run is not done yet. This may lead to incorrect results. Try to re-run all tests to get up to date results.

Path Size % Change Change
@sentry/browser 27.78 kB +0.01% +2 B 🔺
@sentry/browser - with treeshaking flags 26.23 kB +0.02% +3 B 🔺
@sentry/browser (incl. Tracing) 46.3 kB +0.02% +5 B 🔺
@sentry/browser (incl. Tracing + Span Streaming) 48.08 kB -0.04% -16 B 🔽
@sentry/browser (incl. Tracing, Profiling) 51.11 kB -0.03% -15 B 🔽
@sentry/browser (incl. Tracing, Replay) 85.58 kB +0.01% +2 B 🔺
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 75.22 kB -0.01% -5 B 🔽
@sentry/browser (incl. Tracing, Replay with Canvas) 90.29 kB +0.01% +2 B 🔺
@sentry/browser (incl. Tracing, Replay, Feedback) 102.97 kB +0.03% +21 B 🔺
@sentry/browser (incl. Feedback) 44.96 kB -0.04% -14 B 🔽
@sentry/browser (incl. sendFeedback) 32.58 kB +0.01% +2 B 🔺
@sentry/browser (incl. FeedbackAsync) 37.63 kB -0.03% -8 B 🔽
@sentry/browser (incl. Metrics) 28.87 kB +0.03% +8 B 🔺
@sentry/browser (incl. Logs) 29.1 kB +0.05% +14 B 🔺
@sentry/browser (incl. Metrics & Logs) 29.8 kB +0.03% +8 B 🔺
@sentry/react 29.58 kB +0.04% +11 B 🔺
@sentry/react (incl. Tracing) 48.6 kB -0.02% -6 B 🔽
@sentry/vue 33.22 kB +0.02% +6 B 🔺
@sentry/vue (incl. Tracing) 48.27 kB +0.03% +12 B 🔺
@sentry/svelte 27.81 kB +0.02% +5 B 🔺
CDN Bundle 30.11 kB -0.03% -9 B 🔽
CDN Bundle (incl. Tracing) 48.16 kB -0.01% -3 B 🔽
CDN Bundle (incl. Logs, Metrics) 31.69 kB -0.02% -6 B 🔽
CDN Bundle (incl. Tracing, Logs, Metrics) 49.48 kB -0.02% -5 B 🔽
CDN Bundle (incl. Replay, Logs, Metrics) 70.95 kB -0.02% -8 B 🔽
CDN Bundle (incl. Tracing, Replay) 85.73 kB -0.01% -3 B 🔽
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) 87.02 kB -0.02% -11 B 🔽
CDN Bundle (incl. Tracing, Replay, Feedback) 91.5 kB -0.02% -10 B 🔽
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) 92.78 kB -0.02% -12 B 🔽
CDN Bundle - uncompressed 89.75 kB -0.01% -5 B 🔽
CDN Bundle (incl. Tracing) - uncompressed 144.85 kB -0.01% -5 B 🔽
CDN Bundle (incl. Logs, Metrics) - uncompressed 94.46 kB -0.01% -5 B 🔽
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed 148.83 kB -0.01% -5 B 🔽
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed 219.22 kB -0.01% -5 B 🔽
CDN Bundle (incl. Tracing, Replay) - uncompressed 264.09 kB -0.01% -5 B 🔽
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed 268.05 kB -0.01% -5 B 🔽
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 277.79 kB -0.01% -5 B 🔽
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed 281.74 kB -0.01% -5 B 🔽
@sentry/nextjs (client) 51.13 kB +0.03% +14 B 🔺
@sentry/sveltekit (client) 46.75 kB +0.05% +19 B 🔺
@sentry/core/server 80.19 kB +0.07% +53 B 🔺
@sentry/core/browser 51.99 kB +0.01% +4 B 🔺
@sentry/node 124.31 kB +0.04% +47 B 🔺
@sentry/node (incl. diagnostics channel injection) 149.73 kB +0.03% +31 B 🔺
@sentry/node/import (ESM hook with diagnostics-channel injection) 70.03 kB +0.01% +2 B 🔺
@sentry/node - without tracing 74.41 kB -0.04% -27 B 🔽
@sentry/aws-serverless 83.92 kB -0.01% -1 B 🔽
@sentry/cloudflare (withSentry) - minified 196.64 kB -0.01% -5 B 🔽
@sentry/cloudflare (withSentry) 483.87 kB -0.01% -45 B 🔽

View base workflow run

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant