@anyreplay/browser 0.2.0 → 0.2.1

package/README.md

@@ -77,7 +77,10 @@ Some fields are masked in every mode and no option records them: passwords and
 one-time codes; card numbers, security codes, expiry dates and cardholder names
 (from `autocomplete="cc-…"` or from a name, label or placeholder that reads like
 one); IBANs, routing numbers and sort codes; any value of 13–19 digits that
-passes the card-number check. Masking always happens in the page, before
+passes the card-number check — and, because a number is typed one key at a
+time, any value that could still become one: digits only, starting 2–6,
+grouped like a card, more than six digits long. At most the first six digits
+of a card number are ever recorded. Masking always happens in the page, before
 anything is sent.
 
 `type="email"` and `type="tel"` are not on that list. An address and a phone

package/dist/index.cjs

@@ -3864,10 +3864,12 @@ var AssetCollector = class {
       body: JSON.stringify(body)
     });
     const known = await post("/v1/ingest/assets/known", { projectKey, hashes: [sha256], ...app });
-    if (known.ok) {
-      const body = await known.json();
-      if (Array.isArray(body.known) && body.known.includes(sha256)) return true;
+    if (!known.ok) {
+      if (known.status === 401 || known.status === 403) this.stop();
+      return false;
     }
+    const answer = await known.json();
+    if (Array.isArray(answer.known) && answer.known.includes(sha256)) return true;
     const upload = await post("/v1/ingest/assets", { projectKey, sha256, data: toBase64(bytes), ...app });
     return upload.ok;
   }
@@ -4172,6 +4174,13 @@ function looksLikeCardNumber(text) {
   }
   return sum % 10 === 0;
 }
+function mayBecomeCardNumber(text) {
+  if (!/^[2-6][0-9 -]*$/.test(text)) return false;
+  const groups = text.split(/[ -]+/);
+  if (groups.slice(0, -1).some((group) => group.length < 4)) return false;
+  const digits = groups.join("").length;
+  return digits > 6 && digits <= 19;
+}
 function isMarkedByCustomer(node, maskClass) {
   var _a;
   let element = asElement(node);
@@ -4186,8 +4195,19 @@ function shouldMaskValue(text, node, policy) {
   if (policy.maskEveryField) return true;
   if (isSensitiveField(node)) return true;
   if (isMarkedByCustomer(node, policy.maskClass)) return true;
-  return looksLikeCardNumber(text);
+  return cardShaped(text);
+}
+var cardShaped = (text) => looksLikeCardNumber(text) || mayBecomeCardNumber(text);
+var EDITABLE = '[contenteditable]:not([contenteditable="false"])';
+function insideEditable(node) {
+  var _a;
+  const live = node;
+  const element = (live == null ? void 0 : live.nodeType) === 3 ? (_a = live.parentElement) != null ? _a : null : asElement(live);
+  return typeof (element == null ? void 0 : element.closest) === "function" && element.closest(EDITABLE) !== null;
 }
+var isEditableSerialised = (attributes) => attributes.contenteditable !== void 0 && attributes.contenteditable !== "false";
+var typedCardShaped = (text) => cardShaped(text.replace(/\u00a0/g, " ").trim());
+var maskText = (text) => text.replace(/\S/g, "*");
 var MUTATION = 0;
 var INPUT = 5;
 var ELEMENT_NODE = 2;
@@ -4202,23 +4222,27 @@ function maskTextChildren(node) {
     maskTextChildren(child);
   }
 }
-function scrubTree(node, policy, masked) {
+function scrubTree(node, policy, masked, editable = false) {
   var _a, _b;
   if (!node) return;
   const attributes = (_a = node.attributes) != null ? _a : {};
   const inheritedMask = masked || hasClass(attributes, policy.maskClass);
+  const inheritedEditable = editable || node.type === ELEMENT_NODE && isEditableSerialised(attributes);
+  if (editable && node.type === TEXT_NODE && typeof node.textContent === "string" && typedCardShaped(node.textContent)) {
+    node.textContent = maskText(node.textContent);
+  }
   if (node.type === ELEMENT_NODE && node.tagName && FIELD_TAGS.has(node.tagName.toLowerCase())) {
     const value = attributes.value;
-    const shouldMask = policy.maskEveryField || inheritedMask || isSensitiveSerialised(attributes) || typeof value === "string" && looksLikeCardNumber(value);
+    const shouldMask = policy.maskEveryField || inheritedMask || isSensitiveSerialised(attributes) || typeof value === "string" && cardShaped(value);
     if (shouldMask) {
       if (typeof value === "string" && value !== "") attributes.value = maskValue(value);
       if (node.tagName.toLowerCase() === "textarea") maskTextChildren(node);
     }
   }
-  for (const child of (_b = node.childNodes) != null ? _b : []) scrubTree(child, policy, inheritedMask);
+  for (const child of (_b = node.childNodes) != null ? _b : []) scrubTree(child, policy, inheritedMask, inheritedEditable);
 }
 function scrubEvent(event, getNode, policy) {
-  var _a, _b, _c, _d, _e;
+  var _a, _b, _c, _d, _e, _f;
   if (!event.data) return;
   if (event.type === 2) {
     scrubTree(event.data.node, policy, false);
@@ -4243,7 +4267,11 @@ function scrubEvent(event, getNode, policy) {
   }
   for (const add of (_e = data.adds) != null ? _e : []) {
     const parent = typeof (add == null ? void 0 : add.parentId) === "number" ? getNode(add.parentId) : null;
-    scrubTree(add == null ? void 0 : add.node, policy, isMarkedByCustomer(parent, policy.maskClass));
+    scrubTree(add == null ? void 0 : add.node, policy, isMarkedByCustomer(parent, policy.maskClass), insideEditable(parent));
+  }
+  for (const change of (_f = data.texts) != null ? _f : []) {
+    if (typeof (change == null ? void 0 : change.value) !== "string" || !typedCardShaped(change.value)) continue;
+    if (typeof change.id === "number" && insideEditable(getNode(change.id))) change.value = maskText(change.value);
   }
 }
 
@@ -5049,7 +5077,7 @@ var Transport = class {
 
 // src/version.ts
 var SDK_NAME = "@anyreplay/browser";
-var SDK_VERSION = true ? "0.2.0" : "0.0.0-dev";
+var SDK_VERSION = true ? "0.2.1" : "0.0.0-dev";
 var PLATFORM = "web";
 
 // src/visitor.ts
@@ -5156,6 +5184,8 @@ function forgetVisitor(local, session) {
 }
 
 // src/recorder.ts
+var RRWEB_DOM_CONTENT_LOADED = 0;
+var RRWEB_LOAD = 1;
 var RAGE_CLICK_COUNT = 3;
 var RAGE_CLICK_WINDOW_MS = 1e3;
 var RAGE_CLICK_RADIUS_PX = 30;
@@ -5353,6 +5383,7 @@ function createRecorder(rawOptions, shell) {
     stopRecording = record({
       emit: (event) => {
         const typed = event;
+        if (typed.type === RRWEB_DOM_CONTENT_LOADED || typed.type === RRWEB_LOAD) return;
         scrubEvent(typed, (id) => record.mirror.getNode(id), policy);
         assets == null ? void 0 : assets.scan(typed);
         noteInteraction(typed, channel);