@dash0/sdk-web 0.18.4 → 0.19.0

package/dist/modules/api/init.js

@@ -1,6 +1,6 @@
 import { vars } from "../vars";
-import { DEPLOYMENT_ENVIRONMENT_NAME, DEPLOYMENT_ID, DEPLOYMENT_NAME, PAGE_LOAD_ID, SERVICE_NAME, SERVICE_VERSION, USER_AGENT, } from "../semantic-conventions";
-import { fetch, generateUniqueId, PAGE_LOAD_ID_BYTES, warn, debug, perf, nav, win, NO_VALUE_FALLBACK, pick, loc, } from "../utils";
+import { DEPLOYMENT_ENVIRONMENT_NAME, DEPLOYMENT_ID, DEPLOYMENT_NAME, PAGE_LOAD_ID, SERVICE_NAME, SERVICE_NAMESPACE, SERVICE_VERSION, USER_AGENT, } from "../semantic-conventions";
+import { fetch, generateUniqueId, isSafeServiceName, PAGE_LOAD_ID_BYTES, warn, debug, perf, nav, win, NO_VALUE_FALLBACK, pick, loc, } from "../utils";
 import { trackSessions } from "./session";
 import { startWebVitalsInstrumentation } from "../instrumentations/web-vitals";
 import { startErrorInstrumentation } from "../instrumentations/errors";
@@ -23,10 +23,15 @@ export function init(opts) {
         debug("Stopping Dash0 Web SDK initialization. This browser does not support the necessary APIs.");
         return;
     }
-    if (!opts.serviceName.trim()) {
+    const trimmedServiceName = opts.serviceName.trim();
+    if (!trimmedServiceName) {
         debug("Missing or empty serviceName value. Falling back to location.hostname.");
         opts.serviceName = loc?.hostname ?? "unknown";
     }
+    else if (opts.rejectSuspiciousServiceName !== false && !isSafeServiceName(trimmedServiceName)) {
+        debug("serviceName contains disallowed characters. Falling back to location.hostname.");
+        opts.serviceName = loc?.hostname ?? "unknown";
+    }
     vars.endpoints = opts.endpoint instanceof Array ? opts.endpoint : [opts.endpoint];
     if (vars.endpoints.length === 0) {
         warn("No telemetry endpoint configured. Aborting Dash0 Web SDK initialization process.");
@@ -66,6 +71,9 @@ export function init(opts) {
 }
 function initializeResourceAttributes(opts) {
     addAttribute(vars.resource.attributes, SERVICE_NAME, opts["serviceName"]);
+    if (opts.serviceNamespace) {
+        addAttribute(vars.resource.attributes, SERVICE_NAMESPACE, opts["serviceNamespace"]);
+    }
     if (opts.serviceVersion) {
         addAttribute(vars.resource.attributes, SERVICE_VERSION, opts["serviceVersion"]);
     }

package/dist/modules/api/init_test.js

@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { SERVICE_NAME } from "../semantic-conventions";
+import { SERVICE_NAME, SERVICE_NAMESPACE } from "../semantic-conventions";
 // Mock all the instrumentation modules
 vi.mock("../instrumentations/web-vitals", () => ({
     startWebVitalsInstrumentation: vi.fn(),
@@ -188,6 +188,21 @@ describe("init", () => {
             expect(spyOnWarn).not.toHaveBeenCalled();
         });
     });
+    describe("serviceNamespace", () => {
+        it("should add serviceNamespace to resource attributes when provided", async () => {
+            init({
+                ...baseOptions,
+                serviceNamespace: "my-namespace",
+            });
+            const namespaceAttr = vars.resource.attributes.find((attr) => attr.key === SERVICE_NAMESPACE);
+            expect(namespaceAttr?.value.stringValue).toBe("my-namespace");
+        });
+        it("should not add serviceNamespace to resource attributes when not provided", async () => {
+            init(baseOptions);
+            const namespaceAttr = vars.resource.attributes.find((attr) => attr.key === SERVICE_NAMESPACE);
+            expect(namespaceAttr).toBeUndefined();
+        });
+    });
     describe("serviceName fallback", () => {
         it("should use provided serviceName when it is valid", async () => {
             init({
@@ -221,6 +236,64 @@ describe("init", () => {
             const serviceNameAttr = vars.resource.attributes.find((attr) => attr.key === SERVICE_NAME);
             expect(serviceNameAttr?.value.stringValue).toBe("test-hostname.example.com");
         });
+        it.each([
+            ["single quote", "evil';DROP TABLE users;--"],
+            ["double quote", 'svc"name'],
+            ["semicolon", "svc;injected"],
+            ["open brace", "svc${tpl}"],
+            ["close brace", "svc}name"],
+            ["less-than", "<script>"],
+            ["greater-than", "svc>name"],
+            ["embedded newline", "svc\nname"],
+            ["NUL byte", "svc\x00name"],
+        ])("should fallback to location.hostname by default when serviceName contains %s", async (_label, suspicious) => {
+            init({
+                ...baseOptions,
+                serviceName: suspicious,
+            });
+            const serviceNameAttr = vars.resource.attributes.find((attr) => attr.key === SERVICE_NAME);
+            expect(serviceNameAttr?.value.stringValue).toBe("test-hostname.example.com");
+        });
+        it.each([
+            ["single quote", "evil';DROP TABLE users;--"],
+            ["double quote", 'svc"name'],
+            ["semicolon", "svc;injected"],
+            ["embedded newline", "svc\nname"],
+        ])("should also fallback when rejectSuspiciousServiceName is explicitly true and serviceName contains %s", async (_label, suspicious) => {
+            init({
+                ...baseOptions,
+                serviceName: suspicious,
+                rejectSuspiciousServiceName: true,
+            });
+            const serviceNameAttr = vars.resource.attributes.find((attr) => attr.key === SERVICE_NAME);
+            expect(serviceNameAttr?.value.stringValue).toBe("test-hostname.example.com");
+        });
+        it.each([
+            ["single quote", "evil';DROP TABLE users;--"],
+            ["semicolon", "svc;injected"],
+            ["less-than", "<script>"],
+        ])("should keep suspicious serviceName unchanged when rejectSuspiciousServiceName is explicitly false (%s)", async (_label, suspicious) => {
+            init({
+                ...baseOptions,
+                serviceName: suspicious,
+                rejectSuspiciousServiceName: false,
+            });
+            const serviceNameAttr = vars.resource.attributes.find((attr) => attr.key === SERVICE_NAME);
+            expect(serviceNameAttr?.value.stringValue).toBe(suspicious);
+        });
+        it.each([
+            ["forward slash", "myteam/myservice"],
+            ["backslash", "myteam\\myservice"],
+            ["spaces", "my service"],
+            ["dots and hyphens", "svc-name.v2"],
+        ])("should keep serviceName with allowed characters like %s under the default configuration", async (_label, allowed) => {
+            init({
+                ...baseOptions,
+                serviceName: allowed,
+            });
+            const serviceNameAttr = vars.resource.attributes.find((attr) => attr.key === SERVICE_NAME);
+            expect(serviceNameAttr?.value.stringValue).toBe(allowed);
+        });
         it("should fallback to 'unknown' when serviceName is empty and location.hostname is not available", async () => {
             vi.resetModules();
             // Mock utils module with loc as undefined

package/dist/modules/semantic-conventions.js

@@ -1,5 +1,6 @@
 // Resource Attribute Keys
 export const SERVICE_NAME = "service.name";
+export const SERVICE_NAMESPACE = "service.namespace";
 export const SERVICE_VERSION = "service.version";
 export const DEPLOYMENT_ENVIRONMENT_NAME = "deployment.environment.name";
 export const DEPLOYMENT_NAME = "deployment.name";

package/dist/modules/utils/index.js

@@ -14,4 +14,5 @@ export * from "./math";
 export * from "./origin";
 export * from "./url";
 export * from "./pick";
+export * from "./sanitize";
 export * from "./wrap";

package/dist/modules/utils/sanitize.js

@@ -0,0 +1,12 @@
+const SUSPICIOUS_CHARS = /['"<>{};\x00-\x1F\x7F]/;
+/**
+ * Returns true if the value is safe to use as a `service.name` resource attribute.
+ *
+ * Rejects values containing characters commonly used in injection payloads:
+ * quotes, angle brackets, braces, semicolons, and C0 control characters / DEL.
+ * Forward and back slashes are intentionally permitted so names like
+ * `myteam/myservice` remain valid.
+ */
+export function isSafeServiceName(value) {
+    return !SUSPICIOUS_CHARS.test(value);
+}

package/dist/modules/utils/sanitize_test.js

@@ -0,0 +1,52 @@
+import { describe, expect, it } from "vitest";
+import { isSafeServiceName } from "./sanitize";
+describe("isSafeServiceName", () => {
+    describe("accepts safe values", () => {
+        it.each([
+            "my-service",
+            "my_service",
+            "my.service",
+            "MyService123",
+            "myteam/myservice",
+            "myteam\\myservice",
+            "service with spaces",
+            "service-name.v2",
+            "résumé-service",
+            "サービス",
+            "a",
+        ])("accepts %j", (value) => {
+            expect(isSafeServiceName(value)).toBe(true);
+        });
+        it("accepts the empty string (empty/whitespace handling lives elsewhere)", () => {
+            expect(isSafeServiceName("")).toBe(true);
+        });
+    });
+    describe("rejects suspicious characters", () => {
+        it.each([
+            ["single quote", "evil';DROP TABLE"],
+            ["double quote", 'say "hi"'],
+            ["semicolon", "a;b"],
+            ["open brace", "${injected}"],
+            ["close brace", "trailing}"],
+            ["less-than", "<script>"],
+            ["greater-than", "value>other"],
+        ])("rejects %s", (_label, value) => {
+            expect(isSafeServiceName(value)).toBe(false);
+        });
+        it("rejects NUL", () => {
+            expect(isSafeServiceName("a\x00b")).toBe(false);
+        });
+        it("rejects embedded newline (log injection)", () => {
+            expect(isSafeServiceName("line1\nline2")).toBe(false);
+        });
+        it("rejects embedded carriage return", () => {
+            expect(isSafeServiceName("a\rb")).toBe(false);
+        });
+        it("rejects embedded tab", () => {
+            expect(isSafeServiceName("a\tb")).toBe(false);
+        });
+        it("rejects DEL", () => {
+            expect(isSafeServiceName("a\x7Fb")).toBe(false);
+        });
+    });
+});