@dash0/sdk-web 0.18.5 → 0.19.0

package/dist/modules/api/init.js

@@ -1,6 +1,6 @@
 import { vars } from "../vars";
 import { DEPLOYMENT_ENVIRONMENT_NAME, DEPLOYMENT_ID, DEPLOYMENT_NAME, PAGE_LOAD_ID, SERVICE_NAME, SERVICE_NAMESPACE, SERVICE_VERSION, USER_AGENT, } from "../semantic-conventions";
-import { fetch, generateUniqueId, PAGE_LOAD_ID_BYTES, warn, debug, perf, nav, win, NO_VALUE_FALLBACK, pick, loc, } from "../utils";
+import { fetch, generateUniqueId, isSafeServiceName, PAGE_LOAD_ID_BYTES, warn, debug, perf, nav, win, NO_VALUE_FALLBACK, pick, loc, } from "../utils";
 import { trackSessions } from "./session";
 import { startWebVitalsInstrumentation } from "../instrumentations/web-vitals";
 import { startErrorInstrumentation } from "../instrumentations/errors";
@@ -23,10 +23,15 @@ export function init(opts) {
         debug("Stopping Dash0 Web SDK initialization. This browser does not support the necessary APIs.");
         return;
     }
-    if (!opts.serviceName.trim()) {
+    const trimmedServiceName = opts.serviceName.trim();
+    if (!trimmedServiceName) {
         debug("Missing or empty serviceName value. Falling back to location.hostname.");
         opts.serviceName = loc?.hostname ?? "unknown";
     }
+    else if (opts.rejectSuspiciousServiceName !== false && !isSafeServiceName(trimmedServiceName)) {
+        debug("serviceName contains disallowed characters. Falling back to location.hostname.");
+        opts.serviceName = loc?.hostname ?? "unknown";
+    }
     vars.endpoints = opts.endpoint instanceof Array ? opts.endpoint : [opts.endpoint];
     if (vars.endpoints.length === 0) {
         warn("No telemetry endpoint configured. Aborting Dash0 Web SDK initialization process.");

package/dist/modules/api/init_test.js

@@ -236,6 +236,64 @@ describe("init", () => {
             const serviceNameAttr = vars.resource.attributes.find((attr) => attr.key === SERVICE_NAME);
             expect(serviceNameAttr?.value.stringValue).toBe("test-hostname.example.com");
         });
+        it.each([
+            ["single quote", "evil';DROP TABLE users;--"],
+            ["double quote", 'svc"name'],
+            ["semicolon", "svc;injected"],
+            ["open brace", "svc${tpl}"],
+            ["close brace", "svc}name"],
+            ["less-than", "<script>"],
+            ["greater-than", "svc>name"],
+            ["embedded newline", "svc\nname"],
+            ["NUL byte", "svc\x00name"],
+        ])("should fallback to location.hostname by default when serviceName contains %s", async (_label, suspicious) => {
+            init({
+                ...baseOptions,
+                serviceName: suspicious,
+            });
+            const serviceNameAttr = vars.resource.attributes.find((attr) => attr.key === SERVICE_NAME);
+            expect(serviceNameAttr?.value.stringValue).toBe("test-hostname.example.com");
+        });
+        it.each([
+            ["single quote", "evil';DROP TABLE users;--"],
+            ["double quote", 'svc"name'],
+            ["semicolon", "svc;injected"],
+            ["embedded newline", "svc\nname"],
+        ])("should also fallback when rejectSuspiciousServiceName is explicitly true and serviceName contains %s", async (_label, suspicious) => {
+            init({
+                ...baseOptions,
+                serviceName: suspicious,
+                rejectSuspiciousServiceName: true,
+            });
+            const serviceNameAttr = vars.resource.attributes.find((attr) => attr.key === SERVICE_NAME);
+            expect(serviceNameAttr?.value.stringValue).toBe("test-hostname.example.com");
+        });
+        it.each([
+            ["single quote", "evil';DROP TABLE users;--"],
+            ["semicolon", "svc;injected"],
+            ["less-than", "<script>"],
+        ])("should keep suspicious serviceName unchanged when rejectSuspiciousServiceName is explicitly false (%s)", async (_label, suspicious) => {
+            init({
+                ...baseOptions,
+                serviceName: suspicious,
+                rejectSuspiciousServiceName: false,
+            });
+            const serviceNameAttr = vars.resource.attributes.find((attr) => attr.key === SERVICE_NAME);
+            expect(serviceNameAttr?.value.stringValue).toBe(suspicious);
+        });
+        it.each([
+            ["forward slash", "myteam/myservice"],
+            ["backslash", "myteam\\myservice"],
+            ["spaces", "my service"],
+            ["dots and hyphens", "svc-name.v2"],
+        ])("should keep serviceName with allowed characters like %s under the default configuration", async (_label, allowed) => {
+            init({
+                ...baseOptions,
+                serviceName: allowed,
+            });
+            const serviceNameAttr = vars.resource.attributes.find((attr) => attr.key === SERVICE_NAME);
+            expect(serviceNameAttr?.value.stringValue).toBe(allowed);
+        });
         it("should fallback to 'unknown' when serviceName is empty and location.hostname is not available", async () => {
             vi.resetModules();
             // Mock utils module with loc as undefined

package/dist/modules/utils/index.js

@@ -14,4 +14,5 @@ export * from "./math";
 export * from "./origin";
 export * from "./url";
 export * from "./pick";
+export * from "./sanitize";
 export * from "./wrap";

package/dist/modules/utils/sanitize.js

@@ -0,0 +1,12 @@
+const SUSPICIOUS_CHARS = /['"<>{};\x00-\x1F\x7F]/;
+/**
+ * Returns true if the value is safe to use as a `service.name` resource attribute.
+ *
+ * Rejects values containing characters commonly used in injection payloads:
+ * quotes, angle brackets, braces, semicolons, and C0 control characters / DEL.
+ * Forward and back slashes are intentionally permitted so names like
+ * `myteam/myservice` remain valid.
+ */
+export function isSafeServiceName(value) {
+    return !SUSPICIOUS_CHARS.test(value);
+}

package/dist/modules/utils/sanitize_test.js

@@ -0,0 +1,52 @@
+import { describe, expect, it } from "vitest";
+import { isSafeServiceName } from "./sanitize";
+describe("isSafeServiceName", () => {
+    describe("accepts safe values", () => {
+        it.each([
+            "my-service",
+            "my_service",
+            "my.service",
+            "MyService123",
+            "myteam/myservice",
+            "myteam\\myservice",
+            "service with spaces",
+            "service-name.v2",
+            "résumé-service",
+            "サービス",
+            "a",
+        ])("accepts %j", (value) => {
+            expect(isSafeServiceName(value)).toBe(true);
+        });
+        it("accepts the empty string (empty/whitespace handling lives elsewhere)", () => {
+            expect(isSafeServiceName("")).toBe(true);
+        });
+    });
+    describe("rejects suspicious characters", () => {
+        it.each([
+            ["single quote", "evil';DROP TABLE"],
+            ["double quote", 'say "hi"'],
+            ["semicolon", "a;b"],
+            ["open brace", "${injected}"],
+            ["close brace", "trailing}"],
+            ["less-than", "<script>"],
+            ["greater-than", "value>other"],
+        ])("rejects %s", (_label, value) => {
+            expect(isSafeServiceName(value)).toBe(false);
+        });
+        it("rejects NUL", () => {
+            expect(isSafeServiceName("a\x00b")).toBe(false);
+        });
+        it("rejects embedded newline (log injection)", () => {
+            expect(isSafeServiceName("line1\nline2")).toBe(false);
+        });
+        it("rejects embedded carriage return", () => {
+            expect(isSafeServiceName("a\rb")).toBe(false);
+        });
+        it("rejects embedded tab", () => {
+            expect(isSafeServiceName("a\tb")).toBe(false);
+        });
+        it("rejects DEL", () => {
+            expect(isSafeServiceName("a\x7Fb")).toBe(false);
+        });
+    });
+});