fix(sentry): repair CSP eval ignore filter that silently never matched

The /unsafe-eval is not an allowed source of script/ regex never matched
the real browser message ('unsafe-eval' is … — note the closing quote
between the token and 'is'), so the unactionable CSP EvalError kept
flowing into Sentry despite the filter shipping weeks ago in 0e70af4.

Anchor on the stable, browser-agnostic prefix 'Refused to evaluate a
string as JavaScript' instead, and extract all ignoreErrors patterns into
a tested src/lib/sentry-filters.ts so a typo'd pattern can't silently let
noise through again — the test pins each pattern against the verbatim
production message it targets. Also covers the RSC 'Connection closed.'
abort and the in-app-WebView 'Unexpected identifier https' injection.

Fixes Sentry issue 7551992835.

Author: kevinkiklee

src/instrumentation-client.ts

@@ -1,4 +1,5 @@
 import * as Sentry from '@sentry/nextjs'
+import { IGNORE_SENTRY_ERRORS } from '@/lib/sentry-filters'
 
 Sentry.init({
   dsn: process.env.NEXT_PUBLIC_SENTRY_DSN,
@@ -17,9 +18,10 @@ Sentry.init({
   replaysSessionSampleRate: 0,
   replaysOnErrorSampleRate: 0,
 
-  // Browser-extension content scripts that hit our production CSP raise an
-  // unactionable error here. The CSP is working as intended; drop the noise.
-  ignoreErrors: [/unsafe-eval is not an allowed source of script/],
+  // Unactionable browser noise (extensions, in-app WebViews, RSC stream
+  // aborts). Kept in a tested module so a typo'd pattern can't silently let
+  // the noise through — see src/lib/sentry-filters.ts.
+  ignoreErrors: IGNORE_SENTRY_ERRORS,
 })
 
 // Instrument App Router navigations

src/lib/sentry-filters.test.ts

@@ -0,0 +1,73 @@
+import { describe, it, expect } from 'vitest'
+import { IGNORE_SENTRY_ERRORS } from './sentry-filters'
+
+// Mirror of Sentry's own matching (eventFilters.ts / string.ts): an event is
+// dropped if ANY ignore pattern matches ANY of its candidate messages — the
+// bare exception value and the `Type: value` string. Regex patterns use
+// `.test()`, string patterns use substring `.includes()`. Keeping this in sync
+// with the SDK is the whole point of the test: it proves each pattern actually
+// fires against the real-world message it was written for.
+function isIgnored(type: string, value: string): boolean {
+  const candidates = [value, `${type}: ${value}`]
+  return candidates.some((message) =>
+    IGNORE_SENTRY_ERRORS.some((pattern) =>
+      typeof pattern === 'string'
+        ? message.includes(pattern)
+        : pattern.test(message),
+    ),
+  )
+}
+
+describe('IGNORE_SENTRY_ERRORS', () => {
+  it('every entry is a string or RegExp', () => {
+    expect(IGNORE_SENTRY_ERRORS.length).toBeGreaterThan(0)
+    for (const pattern of IGNORE_SENTRY_ERRORS) {
+      expect(['string', 'object']).toContain(typeof pattern)
+      if (typeof pattern !== 'string') expect(pattern).toBeInstanceOf(RegExp)
+    }
+  })
+
+  // Real messages seen in production (verbatim values from the browser engines
+  // that raise them). If a pattern is ever edited into one that no longer
+  // matches its message — the silent-filter bug this module exists to prevent —
+  // the corresponding case here fails loudly.
+  describe('drops unactionable browser noise', () => {
+    const noise: [name: string, type: string, value: string][] = [
+      [
+        'CSP unsafe-eval refusal (browser-extension content script)',
+        'EvalError',
+        `Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".`,
+      ],
+      ['RSC stream abort', 'Error', 'Connection closed.'],
+      [
+        'in-app WebView https injection (issue 7556617342)',
+        'SyntaxError',
+        "Unexpected identifier 'https'",
+      ],
+    ]
+
+    it.each(noise)('drops: %s', (_name, type, value) => {
+      expect(isIgnored(type, value)).toBe(true)
+    })
+  })
+
+  // The filters must stay narrow: a genuine app error — including syntax errors
+  // that AREN'T the https-injection signature — has to reach Sentry.
+  describe('keeps genuine, actionable errors', () => {
+    const real: [name: string, type: string, value: string][] = [
+      [
+        'app TypeError',
+        'TypeError',
+        "Cannot read properties of undefined (reading 'map')",
+      ],
+      ['old-browser optional chaining in our bundle', 'SyntaxError', "Unexpected token '.'"],
+      ['genuine async syntax error in our bundle', 'SyntaxError', "Unexpected identifier 'await'"],
+      ['network failure', 'Error', 'Failed to fetch'],
+      ['unrelated React error', 'Error', 'Minified React error #418'],
+    ]
+
+    it.each(real)('keeps: %s', (_name, type, value) => {
+      expect(isIgnored(type, value)).toBe(false)
+    })
+  })
+})

src/lib/sentry-filters.ts

@@ -0,0 +1,38 @@
+// Client-side Sentry `ignoreErrors` patterns.
+//
+// Each entry drops a class of *unactionable* browser noise — errors raised by
+// browser extensions, in-app WebViews, content-injecting proxies, or RSC
+// stream aborts, none of which our application code can fix. Kept here as pure
+// data (rather than inline in `instrumentation-client.ts`) so the patterns can
+// be unit-tested: a regex that silently never matches its real-world message
+// is worse than no filter at all, because the noise keeps flowing while
+// looking handled. See `sentry-filters.test.ts`.
+//
+// Sentry matches these against the exception value, the `Type: value` string,
+// and `event.message`: regex entries via `.test()`, string entries via
+// substring `.includes()`. Anchor regexes on the STABLE prefix of a message,
+// never on a fragment that depends on quoting the browser may render
+// differently across engines.
+export const IGNORE_SENTRY_ERRORS: (string | RegExp)[] = [
+  // Browser-extension content scripts that hit our production CSP raise an
+  // unactionable EvalError here. The CSP is working as intended; drop the
+  // noise. Anchor on the stable message prefix — the real message reads
+  // `…because 'unsafe-eval' is not an allowed source…`, so a regex expecting
+  // `unsafe-eval is` (no closing quote) silently never matched.
+  /Refused to evaluate a string as JavaScript/,
+  // React Server Components stream abort. React's flight client throws this
+  // when the RSC payload connection closes before it finishes reading —
+  // overwhelmingly caused by the user navigating away (or a prefetch being
+  // cancelled, or a bot closing the socket early) mid-stream, not by app
+  // code. A genuine server-side streaming failure surfaces separately in the
+  // server-side Sentry instrumentation, so dropping it here only removes noise.
+  'Connection closed.',
+  // In-app browsers, old Android WebViews, and content-injecting
+  // proxies/extensions splice a mangled script into the page — a raw
+  // `https://…` URL pasted into a script context parses as a bare `https`
+  // identifier and throws this SyntaxError. The global onerror handler
+  // attributes it to the document URL at line 1 with no chunk file in the
+  // stack, confirming it isn't our bundle (which never emits an unquoted
+  // `https` token), so this only drops third-party injection noise.
+  /Unexpected identifier 'https'/,
+]