Function injectSourcesContent

packages/vite/src/node/server/sourcemap.ts:69–134

(
  map: SourceMapLike,
  file: string,
  logger: Logger,
)

}

export async function injectSourcesContent(
  map: SourceMapLike,
  file: string,
  logger: Logger,
): Promise<void> {
  let sourceRootPromise: Promise<string | undefined>

  const packageRoot = getNodeModulesPackageRoot(file)
  const missingSources: string[] = []
  const sourcesContent = map.sourcesContent || []
  const sourcesContentPromises: Promise<void>[] = []
  for (let index = 0; index < map.sources.length; index++) {
    const sourcePath = map.sources[index]
    if (
      sourcesContent[index] == null &&
      sourcePath &&
      !virtualSourceRE.test(sourcePath)
    ) {
      sourcesContentPromises.push(
        (async () => {
          class="cm">// inject content from source file when sourcesContent is null
          sourceRootPromise ??= computeSourceRoute(map, file)
          const sourceRoot = await sourceRootPromise
          let resolvedSourcePath = cleanUrl(decodeURI(sourcePath))
          if (sourceRoot) {
            resolvedSourcePath = path.resolve(sourceRoot, resolvedSourcePath)
          }
          class="cm">// Block path traversal outside the package boundary for node_modules
          class="cm">// A malicious package may point to a sensitive file
          if (packageRoot) {
            const resolvedSourcePathNormalized = normalizePath(
              path.resolve(resolvedSourcePath),
            )
            if (!isParentDirectory(packageRoot, resolvedSourcePathNormalized)) {
              sourcesContent[index] = null
              logger.warnOnce(
                colors.yellow(
                  `Sourcemap for ${JSON.stringify(file)} points to a source file outside its package: ${JSON.stringify(resolvedSourcePathNormalized)}`,
                ),
              )
              return
            }
          }
          sourcesContent[index] = await fsp
            .readFile(resolvedSourcePath, class="st">'utf-8')
            .catch(() => {
              missingSources.push(resolvedSourcePath)
              return null
            })
        })(),
      )
    }
  }

  await Promise.all(sourcesContentPromises)

  map.sourcesContent = sourcesContent