Whitelisting broken? - Failed to import - @sentry/astro

[Johannes-Andersen]

Failing module

• GitHub: https://github.com/getsentry/sentry-javascript
• npm: https://www.npmjs.com/package/@sentry/astro

import Sentry from "https://www.vg.no/esm/@sentry/astro@8.20.0?target=es2020"

Error message

Package import: https://www.vg.no/esm/@sentry/astro@8.20.0?target=es2020

Resolves this:

/* esm.sh - @sentry/astro@8.20.0 */
import "/esm/esm/v135/@sentry/browser@8.20.0/es2020/browser.mjs";
import "/esm/esm/v135/@sentry/core@8.20.0/es2020/core.mjs";
export * from "/esm/v135/@sentry/astro@8.20.0/es2020/astro.mjs";

When the browser then tries to resolve those URLS, it fails (those with esm/esm)

Responds with 403 forbidden:
https://www.vg.no/esm/esm/v135/@sentry/browser@8.20.0/es2020/browser.mjs

Allow list is:

Is this check failing due to not extracting the package name/scope correctly? Only happens for URLs that has the double esm/esm

esm.sh/server/router.go

Line 565 in 72fb460

if !pkgAllowed || pkgBanned {

Additional info

• esm.sh version: v135_3
• Browser version: Any

[ije]

do you set basepath to esm/esm?

[Johannes-Andersen]

do you set basepath to esm/esm?

No, just /esm/ :)

For example these work:
https://www.vg.no/esm/stable/react@18.3.1/es2020/react.mjs
https://www.vg.no/esm/stable/react@18.3.1/es2020/jsx-runtime.js
https://www.vg.no/esm/v133/@schibsted/data-controller@4.0.1/es2020/data-controller.mjs
https://www.vg.no/esm/v133/@schibsted/data-controller@4.0.1

[ije]

i see, thanks! i will look into it