InboundFilters lacks confuguration for "valid url"

[amakhrov]

• Review the documentation: https://docs.sentry.io/
• Search for existing issues: https://github.com/getsentry/sentry-javascript/issues
• Use the latest release: https://github.com/getsentry/sentry-javascript/releases
• Provide a link to the affected event from your Sentry account: example with Zone.js polyfills, example with PerimeterX patch

Package + Version

• @sentry/browser
• @sentry/node
• raven-js
• raven-node (raven for node)
• other:

Version:

all

Description

This PR (https://github.com/getsentry/sentry-javascript/pull/3842/files) introduced a concept of "last valid url" in the InboundFilters plugin. It is hardcoded to skip anonymous/native frames.

Some apps include polyfills that patch native apis (e.g. Zone.js included in Angular apps by default). In such apps many errors include stack frames from the polyfill. This makes InboundFilters plugin consider such events as being allowed, even if they really come from 3rd party code.
Stack trace could look like this:

<anonymous> in copy2 at line 1:216 <-- anonymous frame skipped by InboundFilters
https://my-host.com/polyfills.f53d21d8acae075a3369.js in S at line 1:11404 <-- async apis patched by Zone.js
https://connect.facebook.com/en_US/fbevents.js at line 24:60903 <-- Facebook SDK - 3rd party!

It would be helpful if I could instruct InboundFilters plugin to skip certain frames, the same way it already skips anonymous frames.

Considered alternatives:

• Create our own version of InboundFilters. It would be hard (or rather not typesafe) to actually extend the original InboundFilters class from the SDK, since its _getLastValidUrl method is marked as private.
• Use RewriteFrames plugin before InboundFilters and rewrite all polyfills related frames to look like anonymous. A drawback - we lose the source information of those frames, can be misleading in Sentry dashboard

[AbhiPrasad]

Hey thanks for writing in!

An additional option here is for you to vendor in your own custom copy of InboundFilters.

It would be helpful if I could instruct InboundFilters plugin to skip certain frames, the same way it already skips anonymous frames.

I agree this would be useful functionality. Backlogging this for now, but PRs are welcome for anyone who wants to make improvements!

[amakhrov]

An additional option here is for you to vendor in your own custom copy of InboundFilters.

Yep! The only issue is that it should be implemented from scratch instead of extending Sentry's one - because important parts of the functionality I would need to override are in private methods (_getLastValidUrl, in particular)