Skip to content

chore(rrweb): Replace fast-mhtml with inline MHTML parser#274

Open
chargome wants to merge 4 commits intosentry-v2from
chargome/chore/remove-fast-mhtml
Open

chore(rrweb): Replace fast-mhtml with inline MHTML parser#274
chargome wants to merge 4 commits intosentry-v2from
chargome/chore/remove-fast-mhtml

Conversation

@chargome
Copy link
Copy Markdown
Member

@chargome chargome commented Mar 26, 2026

Remove the fast-mhtml dependency which was only used in one test utility function (packages/rrweb/test/utils.ts) for parsing MHTML snapshots in replayer E2E tests.

Replace with a minimal inline parser (~30 lines) that handles multipart MIME boundary splitting and quoted-printable content decoding. All 47 replayer tests pass.

fast-mhtml pulled in cheerio, express, undici, qs, bluebird, and cookie — a massive transitive tree for a simple test helper. This removes ~584 lines from yarn.lock.

Dependabot alerts resolved

Fully resolved (vulnerable package completely removed from lockfile):

Alert Severity Package Summary
#166 MEDIUM qs arrayLimit bypass allows DoS via memory exhaustion
#183 LOW qs arrayLimit bypass in comma parsing allows DoS

Partially resolved (some entries removed, but package still exists via other dependency chains):

Alert Severity Package Remaining source
#225, #224, #223, #222, #221, #170, #130, #112 HIGH/MEDIUM/LOW undici Still pulled in by puppeteer (Phase 3)
#100 LOW cookie Still pulled in by @sveltejs/kit (Phase 5)

closes https://linear.app/getsentry/issue/SDK-1097/replace-fast-mhtml-9-alerts

@linear-code
Copy link
Copy Markdown

linear-code bot commented Mar 27, 2026

@chargome chargome marked this pull request as ready for review March 27, 2026 09:30
@chargome chargome force-pushed the chargome/chore/remove-fast-mhtml branch from 6d1bb58 to 4d604c3 Compare March 31, 2026 13:15
@chargome chargome force-pushed the chargome/chore/remove-fast-mhtml branch from 4d604c3 to 2001158 Compare March 31, 2026 13:43
Copy link
Copy Markdown

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

@chargome chargome requested review from andreiborza and billyvg March 31, 2026 15:34
chargome and others added 3 commits March 31, 2026 17:38
Remove the fast-mhtml dependency and replace it with a lightweight
inline parser in test utils. Trim QP-decoded output rather than raw
body to avoid corrupting trailing soft breaks, and fall back to
'frame' prefix when Content-Location is absent to produce distinct
snapshot labels like file-frame-0 instead of file-null-0.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Ignore compiled vitest/vite config outputs (vitest.config.js,
vitest.config.d.ts, vitest.config.js.map) and rrvideo temp directory.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@chargome chargome force-pushed the chargome/chore/remove-fast-mhtml branch from 7c4c608 to 013ceed Compare March 31, 2026 15:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant