Repository navigation
Conversation
size-limit report 📦
|
![sentry-warden[bot]](https://avatars.githubusercontent.com/in/2755838?s=60&v=4){kind=small}
|
bugbot run |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
0bd8edd to
a0d5655
Compare
|
bugbot run |
a0d5655 to
bff33ce
Compare
|
bugbot run |
bff33ce to
61392db
Compare
|
bugbot run |
5472088 to
ae51678
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 5472088. Configure here.
| basePath: userNextConfig.basePath ?? '', | ||
| ...(path && { path }), | ||
| ...(allowedDsns && { allowedDsns }), | ||
| }; |
There was a problem hiding this comment.
Tunnel ignores Next.js trailingSlash
Medium Severity
getManagedTunnelOptions copies basePath from the Next.js config but not trailingSlash, so the browser posts to the slashless DSN path. With trailingSlash: true, Next.js 308s that POST before beforeFiles rewrites, and the DSN rewrite source also omits the optional trailing slash that the fixed-path rewrite includes. Unload-time keepalive fetches often will not follow that redirect, so events never reach the tunnel.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 5472088. Configure here.
ae51678 to
9c50125
Compare
9c50125 to
e94f25d
Compare
e94f25d to
efc9b07
Compare
efc9b07 to
2e8e2b3
Compare
2e8e2b3 to
2c6c3d8
Compare
2c6c3d8 to
75baeeb
Compare
75baeeb to
f6df1c6
Compare
f6df1c6 to
331cf8f
Compare
…that differs from the server's
331cf8f to
08a41f8
Compare
|
Semgrep found 1 🟠 High severity issue identified in your code: Risk: Affected versions of h3 are vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'). The readRawBody function in h3 performs a strict, case-sensitive check for "chunked" in the Transfer-Encoding header. If an attacker sends a mixed-case value (e.g. "Transfer-Encoding: ChuNked") and no Content-Length, h3 will assume an empty body, immediately process the request, and leave the real payload data on the socket. When h3 is deployed behind a Layer 4 proxy (such as AWS NLB or raw TCP proxies that don't normalize headers), this enables a classic TE.TE HTTP request smuggling attack—allowing an attacker to bypass WAFs or desynchronize and poison other users' connections. Fix: Upgrade this library to at least version 1.15.5 at sentry-javascript/yarn.lock:16852. Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-2737, GHSA-mp2g-9vg9-f4cg, CVE-2026-23527 |
This branch has not been deployed
1 participant
tunnelRouterewrote envelopes straight to sentry.io, which leaked the user's cookies and only worked for SaaS DSNs, fixed by answering it from a generated app route on the DSN-derived path.The unit tests cover the rewrites, the injected options and the route file generation, and e2e variants check the App and Pages routers on Turbopack and webpack.
closes #25466