Skip to content

ref(browser): Remove truncation when not needed #18051

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: develop
Choose a base branch
from
+2 −3
Open

ref(browser): Remove truncation when not needed #18051

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5ae0c52
ref(browser): Remove truncation when not needed
s1gr1d Oct 29, 2025
963a936
Merge branch 'develop' into sig/truncation-changes
s1gr1d Oct 29, 2025
a7dbd02
Merge branch 'develop' into sig/truncation-changes
s1gr1d Oct 30, 2025
d7e5cfe
Merge branch 'develop' into sig/truncation-changes
s1gr1d Nov 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions packages/browser-utils/src/metrics/lcp.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,8 +77,7 @@ export function _sendStandaloneLcpSpan(
entry.element && (attributes['lcp.element'] = htmlTreeAsString(entry.element));
entry.id && (attributes['lcp.id'] = entry.id);

// Trim URL to the first 200 characters.
entry.url && (attributes['lcp.url'] = entry.url.trim().slice(0, 200));
entry.url && (attributes['lcp.url'] = entry.url);
Copy link

@cursor cursor bot Nov 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Data URL Truncation Risk in URL Handling

Removing the truncation of entry.url without handling data URLs could cause issues when the LCP element uses a data URL (e.g., data:image/png;base64,<very long base64 string>). Unlike globalhandlers.ts which has special handling for data URLs (lines 210-215), this code directly assigns the URL without any length protection. Data URLs with embedded base64 images can be extremely long (potentially megabytes), which could cause problems with attribute storage, transmission, or display in the Sentry UI.

Fix in Cursor Fix in Web


// loadTime is the time of LCP that's related to receiving the LCP element response..
entry.loadTime != null && (attributes['lcp.loadTime'] = entry.loadTime);
Expand Down
2 changes: 1 addition & 1 deletion packages/browser/src/integrations/globalhandlers.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -214,5 +214,5 @@ function getFilenameFromUrl(url: string | undefined): string | undefined {
return `<data:${mimeType}${isBase64 ? ',base64' : ''}>`;
}

return url.slice(0, 1024);
return url; // it's fine to not truncate it as it's not put in a regex (https://codeql.github.com/codeql-query-help/javascript/js-polynomial-redos)
}
Loading