@angular/build: source-map comment scanner corrupts valid JS containing a regex literal

Aperta
  • Qualcosa non va?
#34,590 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@alan-agius4 ci sta già lavorando.

Dal 29/10/2026.

  • #34591 di @alan-agius4 — aperta
  • #34632 di @clydin — aperta

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
76/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
angular, typescript
Ambito
build-system, devtools

Direzione di ricerca

The issue identifies removeSourceMappingURL in @angular/build/src/utils/source-map.js and provides a standalone reproduction. Start by running the reproduction against the affected package version, then inspect the scanner and the related fix in PR #33545. Done means source-map removal preserves the given valid JavaScript and the reproduction assertion passes.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

area: @angular/build
Command

serve

Is this a regression?
  • Yes, this behavior used to work in the previous version
The previous version in which this bug was not present was

@angular/build 22.0.9 passes the isolated source-map removal test. @angular/cli remains at 22.2.4; Angular framework packages remain at 22.2.3.

Description

With @angular/build 22.2.4, ng serve fails when optimization and script
source maps are enabled. Vite reports invalid JavaScript during import
analysis. However, ng build succeeds, and the built application worked
when served separately using a local static server.

The failure was traced to removeSourceMappingURL in @angular/build.
The development-server memory plugin calls this function before handing
generated JavaScript to Vite when a source map is present.

The scanner appears to interpret a double quote inside a valid
regular-expression literal as the beginning of a string. It then loses
track of the actual string boundaries and removes a sourceMappingURL-like
sequence that is string content, not a JavaScript comment.

This can be reproduced directly using the published build package,
without application code, authentication libraries, or Vite itself.

Expected:
Source-map comment removal preserves valid JavaScript, including
regular-expression literals and strings containing sourceMappingURL text.

Actual:
Valid JavaScript is truncated into invalid JavaScript. Vite subsequently
reports the parsing error.

The desired behavior is to keep both optimization and script source maps
enabled.

Minimal Reproduction

With @angular/[email protected] installed, save the following as repro.cjs
and run:

node repro.cjs

This intentionally calls the internal utility to isolate the defect.
It is a standalone scanner reproduction, not a complete Angular app.

const assert = require('node:assert/strict');
const path = require('node:path');
const vm = require('node:vm');

const packageRoot = path.dirname(
  require.resolve('@angular/build/package.json')
);

const { removeSourceMappingURL } = require(
  path.join(packageRoot, 'src', 'utils', 'source-map.js')
);

const input =
  'const pattern = /"/; const text = "//# sourceMappingURL=not-a-comment";';

new vm.Script(input); // The input is valid JavaScript.

const output = removeSourceMappingURL(input);
console.log(output);

assert.equal(
  output,
  input,
  'Input without an actual source-map comment should remain unchanged'
);

Expected:
The assertion passes and the input is preserved unchanged.

Actual:
The assertion fails. The output is:

const pattern = /"/; const text = "

The output is invalid JavaScript. The sourceMappingURL text was inside
a quoted string, not an actual comment.

Exception or Error
[vite] Internal server error: Failed to parse source for import analysis
because the content contains invalid JS syntax. If you are using JSX,
make sure to name the file with the .jsx or .tsx extension.
Plugin: vite:import-analysis

The standalone reproduction fails its equality assertion.
Parsing the truncated output also produces:
SyntaxError: Invalid or unexpected token
Your Environment
Original failing environment:
@angular/build: 22.2.4
@angular/cli: 22.2.4
@angular/core: 22.2.3
@angular/compiler: 22.2.3
@angular/compiler-cli: 22.2.3
TypeScript: 6.0.3
Vite: 8.3.0
Node.js: 24.20.0
OS: Windows

Current version-pin configuration:
@angular/build: 22.0.9
@angular/cli: 22.2.4 — unchanged
Angular core/compiler/compiler-cli: 22.2.3 — unchanged
Vite resolved by @angular/build: 7.3.6
Anything else relevant?
Temporary workaround applied

Pinned @angular/build to exactly 22.0.9 instead of 22.2.4:

"@angular/build": "22.0.9"

This is the workaround currently used, not a fix to the scanner.

  • @angular/cli remains at 22.2.4 — it was not downgraded.
  • Angular core/compiler/compiler-cli remain at 22.2.3.
  • Optimization and script source maps remain enabled.

The pinned build package uses Vite 7.3.6 instead of 8.3.0.
However, the minimal reproduction demonstrates the corruption directly
in @angular/build's source-map scanner without invoking Vite.

Related issue and fix

The earlier issue concerned source-map text inside template literals.
Its fix introduced the replacement scanner. This report concerns
regular-expression literal handling in that scanner.

Lingua principale
TypeScript
Stelle
27k
Fork
11.8k
Merge medio
1g 52m
PR unite (30g)
268

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di angular/angular-cli

Tutte le issue di angular/angular-cli

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.