Some assets don't get delivered anymore after update to 4.1.1 because of funky name conflict (dashes make them look like digest for the Regexp)

[fwolfst]

Expected behavior

Our app flags 404s on SOME static assets. It should just serve out all assets are equal.

Actual behavior

404 for some static assets.

System configuration

We see this while migrating a Rails 6.1 Sprockets 4.0.3 Ruby 3.0.x to upstream versions (7.0, 4.1, 3.1).

Example App (Reproduction) - THIS IS IMPORTANT YOUR ISSUE LIKELY WILL NOT BE RESOLVED WITHOUT THIS

https://github.com/econya/sprockets_digest_muncher

The issue only happens if a pseudo "digest" is stripped from an existing asset file, e.g. file-notadigestbutmatchesregexp.txt becomes file.txt (related commit: https://github.com/rails/sprockets/commit/53ce8d6735fc5e8923728b4068186a04b059f640). If now, file.txt really exists, this conflict will somehow grow into a RouteNotFound.

See https://github.com/econya/sprockets_digest_muncher for easy reproducible instructions (its a vanilla rails 7.0.1 app without any modifications, see commits)

Btw, the code references fingerprint and digest - I assume its the same? Also, the regexp differ, not sure if they should and if it doesnt make sense to move it into a constant.

It did not fail us earlier because our filenames contain letters outside of [a-f] ...

[fwolfst]

• link to test repo was private, fixed now: https://github.com/econya/sprockets_digest_muncher :facepalm:

[dorner]

Getting hurt by this now on development - when using importmaps, the stimulus-loading.js file isn't being served because Sprockets interprets loading as the fingerprint, and then when it calculates the actual fingerprint, it doesn't match, resulting in a 404 error. Spent hours trying to track this down as every other asset was loading fine.

[flivni]

This bit me too. And was pretty confusing to figure out what was going on.

I created a PR (https://github.com/rails/sprockets/pull/793). Would love to see it merged.

[fwolfst]

@flivni Awesome. If anyone needs a quick remedy, you can use this initializer https://gist.github.com/fwolfst/3aa45686b912bfcb3bea102aeb1bfda5

[botandrose]

I got bit by this, also. I think part of the issue might be very simple to resolve: the fingerprint detection regex could be tightened to only hexadecimal 0-9a-f, rather than full 0-9a-zA-Z.

My hotfix initializer is very short:

require "sprockets/server"
Sprockets::Server.prepend Module.new {
  private def path_fingerprint(path)
    path[/-([0-9a-f]{7,128})\.[^.]+\z/, 1]
  end
}

Will create a PR for this as well.