fix(sourcemap): skip URL source roots when injecting sources content

packages/vite/src/node/server/__tests__/sourcemap.spec.ts

@@ -1,6 +1,7 @@
-import { describe, expect, test } from 'vitest'
+import { describe, expect, test, vi } from 'vitest'
 import { isWindows } from '../../../shared/utils'
-import { getNodeModulesPackageRoot } from '../sourcemap'
+import type { Logger } from '../../logger'
+import { getNodeModulesPackageRoot, injectSourcesContent } from '../sourcemap'
 
 describe('getNodeModulesPackageRoot', () => {
   const cases = [
@@ -69,3 +70,40 @@ describe('getNodeModulesPackageRoot', () => {
     })
   }
 })
+
+describe('injectSourcesContent', () => {
+  const createLogger = () => ({ warnOnce: vi.fn() }) as unknown as Logger
+
+  test('leaves maps with a remote sourceRoot alone', async () => {
+    const map: Parameters<typeof injectSourcesContent>[0] = {
+      sources: ['index.ts'],
+      sourceRoot: 'https://raw.githubusercontent.com/fb55/domutils/abc123/src/',
+    }
+    const logger = createLogger()
+
+    await injectSourcesContent(
+      map,
+      '/project/node_modules/domutils/lib/esm/index.js',
+      logger,
+    )
+
+    expect(logger.warnOnce).not.toHaveBeenCalled()
+    expect(map.sourcesContent).toBeUndefined()
+  })
+
+  test('warns for sources that resolve outside the package', async () => {
+    const map: Parameters<typeof injectSourcesContent>[0] = {
+      sources: ['/outside/project/index.ts'],
+    }
+    const logger = createLogger()
+
+    await injectSourcesContent(
+      map,
+      '/project/node_modules/foo/dist/index.js',
+      logger,
+    )
+
+    expect(logger.warnOnce).toHaveBeenCalledOnce()
+    expect(map.sourcesContent).toEqual([null])
+  })
+})

packages/vite/src/node/server/sourcemap.ts

@@ -9,6 +9,7 @@ import type { Logger } from '../logger'
 import {
   blankReplacer,
   createDebugger,
+  isExternalUrl,
   isParentDirectory,
   normalizePath,
 } from '../utils'
@@ -71,6 +72,15 @@ export async function injectSourcesContent(
   file: string,
   logger: Logger,
 ): Promise<void> {
+  // A `sourceRoot` can be a URL (e.g. raw.githubusercontent.com) for packages
+  // that want devtools to fetch the original sources from a remote host. There
+  // is nothing local to read, so leave the map untouched instead of resolving
+  // the relative `sources` against the cwd and warning that they escape the
+  // package.
+  if (map.sourceRoot && isExternalUrl(map.sourceRoot)) {
+    return
+  }
+
   let sourceRootPromise: Promise<string | undefined>
 
   const packageRoot = getNodeModulesPackageRoot(file)