javascript: support custom header name for source maps

[mattrobenolt]

This is being carried from GH-4017.

[getsentry-bot]

	1 Warning
⚠️	Changes require @getsentry/security sign-off

Security concerns found

• src/sentry/lang/javascript/processor.py
• src/sentry/templates/sentry/projects/manage.html
• src/sentry/web/frontend/project_settings.py

Generated by 🚫 danger

[mattrobenolt]

These patterns are effectively arbitrary and likely over conservative, but should be sufficient for anyone using this and prevents someone putting in complete garbage.

[mitsuhiko]

Basically you can basic auth this now. Might make sense to mention.

[graingert]

Should there really be a length limit here? JWT tokens can be very long

[mattrobenolt]

There is some limit. How long are you thinking? The value can't be say, 1MB long. :) I picked 40 as an arbitrary value since our auto generated value is a uuid which is 32 characters.

Just wondering what case you'd want to shove a JWT here.

[mattrobenolt]

Hmm, I guess if the goal is with basic auth, it'll probably need to be longer than 40 chars, and also accept a wider set of characters since it's base64 encoded.

Lemme revisit this and get a better pattern here. Thanks for bringing it to my attention. :)

[mattrobenolt]

Alright, I updated the regular expression here to actually accommodate basic auth and allow base64 characters and spaces and a length of 255. Unclear if we'd need more than that, but this seems reasonable now.

[mitsuhiko]

Basically you can basic auth this now. Might make sense to mention.

[graingert]

@mattrobenolt this is looking good! #4500 will also need fixing otherwise it's too dangerous to use basic auth

[mattrobenolt]

@graingert I agree, and I'll get #4500 addressed. In the meantime, gonna get this merged. :)