From 3c3b3906d9006c67fbf74baf686b4f56888a0963 Mon Sep 17 00:00:00 2001
From: deimantas Jakovlevas <deimantas@zappar.com>
Date: Wed, 25 Mar 2026 20:53:39 +0900
Subject: [PATCH 1/3] test: false positive on sourceMappingURL in string
 literal

---
 .../bundler.worker.js                         |  7 ++++++
 tests/integration/sourcemaps/inject.rs        | 23 +++++++++++++++++++
 2 files changed, 30 insertions(+)
 create mode 100644 tests/integration/_fixtures/inject_sourcemap_in_string_literal/bundler.worker.js

diff --git a/tests/integration/_fixtures/inject_sourcemap_in_string_literal/bundler.worker.js b/tests/integration/_fixtures/inject_sourcemap_in_string_literal/bundler.worker.js
new file mode 100644
index 0000000000..1c9259e52e
--- /dev/null
+++ b/tests/integration/_fixtures/inject_sourcemap_in_string_literal/bundler.worker.js
@@ -0,0 +1,7 @@
+var x = 1 + 2;
+var output =
+  code +
+  `
+//# sourceMappingURL=data:application/json;base64,` +
+  btoa(json);
+console.log(x);
diff --git a/tests/integration/sourcemaps/inject.rs b/tests/integration/sourcemaps/inject.rs
index b52aabba8e..c958bf2143 100644
--- a/tests/integration/sourcemaps/inject.rs
+++ b/tests/integration/sourcemaps/inject.rs
@@ -241,6 +241,29 @@ fn command_sourcemaps_inject_malformed_map() {
     );
 }
 
+#[test]
+fn command_sourcemaps_inject_sourcemap_url_in_string_literal() {
+    // When tools like terser or babel are bundled into a worker, their minified
+    // code contains string concatenations that produce sourceMappingURL comments.
+    // After minification these can land at column 0, making them look like real
+    // sourcemap directives. sentry-cli should not treat them as embedded
+    // sourcemaps and should not fail.
+    let testcase_cwd_path =
+        "tests/integration/_cases/sourcemaps/sourcemaps-inject-sourcemap-in-string-literal.in/";
+    if std::path::Path::new(testcase_cwd_path).exists() {
+        remove_dir_all(testcase_cwd_path).unwrap();
+    }
+    copy_recursively(
+        "tests/integration/_fixtures/inject_sourcemap_in_string_literal/",
+        testcase_cwd_path,
+    )
+    .unwrap();
+
+    TestManager::new()
+        .assert_cmd(vec!["sourcemaps", "inject", testcase_cwd_path])
+        .run_and_assert(AssertCommand::Success);
+}
+
 /// Recursively assert that the contents of two directories are equal.
 ///
 /// We only support directories that contain exclusively text files.

From 2b8ddad22296df9519c70dae7aa627dbdd096204 Mon Sep 17 00:00:00 2001
From: deimantas Jakovlevas <deimantas@zappar.com>
Date: Wed, 25 Mar 2026 21:08:34 +0900
Subject: [PATCH 2/3] fix: skip embedded sourcemaps with invalid base64 instead
 of failing

---
 src/utils/sourcemaps.rs | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/utils/sourcemaps.rs b/src/utils/sourcemaps.rs
index aa1cfd2e4d..91bee68f1e 100644
--- a/src/utils/sourcemaps.rs
+++ b/src/utils/sourcemaps.rs
@@ -790,7 +790,12 @@ impl SourceMapProcessor {
 
                         let Ok(mut decoded) = data_encoding::BASE64.decode(encoded.as_bytes())
                         else {
-                            bail!("Invalid embedded sourcemap in source file {source_url}");
+                            // The data URL isn't valid base64, so we can't use it.
+                            // This commonly happens when minified bundles contain
+                            // sourceMappingURL strings inside template literals
+                            // (e.g from bundled terser or babel)
+                            warn!("Skipping {source_url}: embedded sourcemap is not valid base64");
+                            continue;
                         };
 
                         let mut sourcemap =

From 9316d8558e37abb395cd0254aefd3733dc399aa2 Mon Sep 17 00:00:00 2001
From: Sebastian Zivota <loewenheim@mailbox.org>
Date: Thu, 26 Mar 2026 10:12:17 +0100
Subject: [PATCH 3/3] changelog

---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 14719a076f..754f12a5e1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+### Fixes
+
+- (sourcemaps) Skip non-base64 embedded sourcemaps during injection ([#3243](https://github.com/getsentry/sentry-cli/pull/3243))
+
 ### New Features ✨
 
 - Add `sentry-cli build download` command to download installable builds (IPA/APK) by build ID ([#3221](https://github.com/getsentry/sentry-cli/pull/3221)).