fix: use sanitized filename for chunk name with preserveModulesRoot by younggglcy · Pull Request #8817 · rolldown/rolldown

younggglcy · 2026-03-20T10:03:07Z

Summary

When preserveModulesRoot is set, the chunk name was derived from the unsanitized absolute filename, causing query string characters (?, &) to leak into chunk.name and subsequently into fileName when entryFileNames is a function
This affected Vue SFC virtual modules (e.g. Comp.vue?vue&type=script&setup=true&lang.ts) in Vite lib mode, producing invalid filenames like Comp.vue?vue&type=script&setup=true&lang.js
Fix: use the already-sanitized filename (sanitized_absolute_filename) instead of the raw one (absolute_chunk_file_name) when stripping the preserveModulesRoot prefix

Closes #8761

Test plan

Added test fixture sanitize-filename-query-string that reproduces the bug with preserveModulesRoot + function-form entryFileNames + query string module IDs
Verified existing sanitize-filename test still passes
Verified with the reproduction repo

codspeed-hq · 2026-03-20T10:26:32Z

Merging this PR will not alter performance

✅ 4 untouched benchmarks
⏩ 10 skipped benchmarks¹

_{Comparing younggglcy:younggglcy/fix-sanitize-name (553dde9) with main (a52d258)²}

10 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩
No successful run was found on main (a41a709) during the generation of this report, so a52d258 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

Copilot

Pull request overview

Fixes preserve-modules chunk naming so that when preserveModulesRoot is set, the computed chunk.name (and therefore fileName when entryFileNames is a function) is derived from a sanitized filename, preventing query-string characters from leaking into output filenames (e.g., Vue SFC virtual module ids).

Changes:

Use sanitized_absolute_filename (instead of the raw absolute filename) when stripping the preserveModulesRoot prefix during chunk name generation.
Add a new preserve-modules fixture to cover query-string virtual module ids with function-form entryFileNames.
Add a minimal entry module for the new fixture.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
`crates/rolldown/src/stages/generate_stage/mod.rs`	Ensures chunk name prefix-stripping uses the sanitized path so `chunk.name`/`fileName` can’t include `?`/`&`.
`packages/rolldown/tests/fixtures/topics/preserve-modules/sanitize-filename-query-string/_config.ts`	Adds regression test that asserts `chunk.name` and `chunk.fileName` don’t contain query-string characters under `preserveModulesRoot` + function `entryFileNames`.
`packages/rolldown/tests/fixtures/topics/preserve-modules/sanitize-filename-query-string/entry.js`	New fixture entry that imports the virtual module used by the regression test.

hyfdev

LGTM. Looks like related to preserveModules, so @IWANABETHATGUY cc

require change

sapphi-red · 2026-03-30T06:41:24Z

                  if let Some(ref preserve_modules_root) = preserve_modules_root {
-                    if absolute_chunk_file_name.starts_with(preserve_modules_root.as_str()) {
-                      absolute_chunk_file_name[preserve_modules_root.len()..]
+                    if sanitized_absolute_filename.starts_with(preserve_modules_root.as_str()) {


I think this will incorrectly match when two directories are sanitized to the same value:

preserve_modules_root: './somewhere/foo+bar' -> (sanitized) ./somewhere/foo__bar

chunk 1 filename: ./somewhere/foo+bar/baz.js -> (sanitized) ./somewhere/foo__bar/baz.js

chunk 2 filename: ./somewhere/foo#bar/baz.js -> (sanitized) ./somewhere/foo__bar/baz.js

…eserveModulesRoot When preserveModulesRoot is set, the chunk name was derived from the unsanitized absolute filename, causing query string characters (? &) to leak into chunk.name and subsequently into fileName when entryFileNames is a function. This affected Vue SFC virtual modules in Vite lib mode. Closes rolldown#8761

…-sanitizer

…ized filenames When a custom sanitizeFileName transforms characters in the root path (e.g. '+' → '__'), the starts_with check against the sanitized absolute filename would fail, producing invalid relative paths like '../__libs/helper'.

Derive preserve-modules names from the original path and reuse the computed pre-rendered name when rendering filenames. This prevents sanitized path prefixes from flattening sibling directories onto the same preserveModulesRoot output. Made-with: Cursor

Align the issue 7146 Rust snapshot with the corrected preserveModules output name so JSON inputs keep their .json segment before the generated .js extension. Made-with: Cursor

sapphi-red · 2026-04-17T06:39:48Z

-      if let Some(ref preserve_modules_root) = options.preserve_modules_root {
-        if chunk_name.starts_with(preserve_modules_root) {


I think this has the same problem with #8817 (comment)

younggglcy · 2026-04-17T18:57:42Z

Thanks a lot for the patient reviews here. This needs a broader
design pass than I can take on, so I'll close in favor of leaving
it open for someone else to pick up.

hyfdev requested a review from Copilot March 20, 2026 12:29

Copilot started reviewing on behalf of hyfdev March 20, 2026 12:29 View session

Copilot AI reviewed Mar 20, 2026

View reviewed changes

Comment thread ...es/rolldown/tests/fixtures/topics/preserve-modules/sanitize-filename-query-string/_config.ts

hyfdev previously approved these changes Mar 20, 2026

View reviewed changes

hyfdev assigned IWANABETHATGUY Mar 20, 2026

sapphi-red reviewed Mar 20, 2026

View reviewed changes

Comment thread crates/rolldown/src/stages/generate_stage/mod.rs Outdated

younggglcy force-pushed the younggglcy/fix-sanitize-name branch from 5516a49 to 6bfa611 Compare March 23, 2026 06:46

hanspagel mentioned this pull request Mar 24, 2026

fix: type declarations don't use the full path for imports scalar/scalar#8563

Merged

4 tasks

younggglcy requested a review from sapphi-red March 24, 2026 11:04

sapphi-red reviewed Mar 30, 2026

View reviewed changes

younggglcy and others added 8 commits April 15, 2026 23:48

[autofix.ci] apply automated fixes

5df2517

test: add testcase for sanitize-filename-preserve-modules-root-custom…

8414a5e

…-sanitizer

test: make ls-lint happy

9b7ac38

test: add testcase for sanitize-filename-with-preserve-modules-root

585729d

test: make ls-lint happy

08bb945

younggglcy force-pushed the younggglcy/fix-sanitize-name branch from d4be8b2 to d6431c0 Compare April 15, 2026 15:55

autofix-ci Bot and others added 2 commits April 15, 2026 15:56

[autofix.ci] apply automated fixes

4ceb2e4

test: update issue 7146 preserveModules snapshot

553dde9

Align the issue 7146 Rust snapshot with the corrected preserveModules output name so JSON inputs keep their .json segment before the generated .js extension. Made-with: Cursor

sapphi-red reviewed Apr 17, 2026

View reviewed changes

younggglcy closed this Apr 17, 2026

sapphi-red mentioned this pull request May 19, 2026

fix: sanitize preserveModules chunk names from query ids #9289

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: use sanitized filename for chunk name with preserveModulesRoot#8817

fix: use sanitized filename for chunk name with preserveModulesRoot#8817
younggglcy wants to merge 10 commits into
rolldown:mainfrom
younggglcy:younggglcy/fix-sanitize-name

younggglcy commented Mar 20, 2026 •

edited

Loading

Uh oh!

codspeed-hq Bot commented Mar 20, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

hyfdev left a comment

Uh oh!

Uh oh!

sapphi-red Mar 30, 2026

Uh oh!

sapphi-red Apr 17, 2026

Uh oh!

younggglcy commented Apr 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

		if let Some(ref preserve_modules_root) = options.preserve_modules_root {
		if chunk_name.starts_with(preserve_modules_root) {

Uh oh!

Conversation

younggglcy commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

codspeed-hq Bot commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Footnotes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

hyfdev left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sapphi-red Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

sapphi-red Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

younggglcy commented Apr 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

younggglcy commented Mar 20, 2026 •

edited

Loading

codspeed-hq Bot commented Mar 20, 2026 •

edited

Loading