@dash0/sdk-web 0.18.5 → 0.20.0

package/dist/modules/api/init.js

@@ -1,6 +1,6 @@
 import { vars } from "../vars";
 import { DEPLOYMENT_ENVIRONMENT_NAME, DEPLOYMENT_ID, DEPLOYMENT_NAME, PAGE_LOAD_ID, SERVICE_NAME, SERVICE_NAMESPACE, SERVICE_VERSION, USER_AGENT, } from "../semantic-conventions";
-import { fetch, generateUniqueId, PAGE_LOAD_ID_BYTES, warn, debug, perf, nav, win, NO_VALUE_FALLBACK, pick, loc, } from "../utils";
+import { fetch, generateUniqueId, isSafeServiceName, PAGE_LOAD_ID_BYTES, warn, debug, perf, nav, win, NO_VALUE_FALLBACK, pick, loc, } from "../utils";
 import { trackSessions } from "./session";
 import { startWebVitalsInstrumentation } from "../instrumentations/web-vitals";
 import { startErrorInstrumentation } from "../instrumentations/errors";
@@ -23,10 +23,15 @@ export function init(opts) {
         debug("Stopping Dash0 Web SDK initialization. This browser does not support the necessary APIs.");
         return;
     }
-    if (!opts.serviceName.trim()) {
+    const trimmedServiceName = opts.serviceName.trim();
+    if (!trimmedServiceName) {
         debug("Missing or empty serviceName value. Falling back to location.hostname.");
         opts.serviceName = loc?.hostname ?? "unknown";
     }
+    else if (opts.rejectSuspiciousServiceName !== false && !isSafeServiceName(trimmedServiceName)) {
+        debug("serviceName contains disallowed characters. Falling back to location.hostname.");
+        opts.serviceName = loc?.hostname ?? "unknown";
+    }
     vars.endpoints = opts.endpoint instanceof Array ? opts.endpoint : [opts.endpoint];
     if (vars.endpoints.length === 0) {
         warn("No telemetry endpoint configured. Aborting Dash0 Web SDK initialization process.");

package/dist/modules/api/init_test.js

@@ -236,6 +236,64 @@ describe("init", () => {
             const serviceNameAttr = vars.resource.attributes.find((attr) => attr.key === SERVICE_NAME);
             expect(serviceNameAttr?.value.stringValue).toBe("test-hostname.example.com");
         });
+        it.each([
+            ["single quote", "evil';DROP TABLE users;--"],
+            ["double quote", 'svc"name'],
+            ["semicolon", "svc;injected"],
+            ["open brace", "svc${tpl}"],
+            ["close brace", "svc}name"],
+            ["less-than", "<script>"],
+            ["greater-than", "svc>name"],
+            ["embedded newline", "svc\nname"],
+            ["NUL byte", "svc\x00name"],
+        ])("should fallback to location.hostname by default when serviceName contains %s", async (_label, suspicious) => {
+            init({
+                ...baseOptions,
+                serviceName: suspicious,
+            });
+            const serviceNameAttr = vars.resource.attributes.find((attr) => attr.key === SERVICE_NAME);
+            expect(serviceNameAttr?.value.stringValue).toBe("test-hostname.example.com");
+        });
+        it.each([
+            ["single quote", "evil';DROP TABLE users;--"],
+            ["double quote", 'svc"name'],
+            ["semicolon", "svc;injected"],
+            ["embedded newline", "svc\nname"],
+        ])("should also fallback when rejectSuspiciousServiceName is explicitly true and serviceName contains %s", async (_label, suspicious) => {
+            init({
+                ...baseOptions,
+                serviceName: suspicious,
+                rejectSuspiciousServiceName: true,
+            });
+            const serviceNameAttr = vars.resource.attributes.find((attr) => attr.key === SERVICE_NAME);
+            expect(serviceNameAttr?.value.stringValue).toBe("test-hostname.example.com");
+        });
+        it.each([
+            ["single quote", "evil';DROP TABLE users;--"],
+            ["semicolon", "svc;injected"],
+            ["less-than", "<script>"],
+        ])("should keep suspicious serviceName unchanged when rejectSuspiciousServiceName is explicitly false (%s)", async (_label, suspicious) => {
+            init({
+                ...baseOptions,
+                serviceName: suspicious,
+                rejectSuspiciousServiceName: false,
+            });
+            const serviceNameAttr = vars.resource.attributes.find((attr) => attr.key === SERVICE_NAME);
+            expect(serviceNameAttr?.value.stringValue).toBe(suspicious);
+        });
+        it.each([
+            ["forward slash", "myteam/myservice"],
+            ["backslash", "myteam\\myservice"],
+            ["spaces", "my service"],
+            ["dots and hyphens", "svc-name.v2"],
+        ])("should keep serviceName with allowed characters like %s under the default configuration", async (_label, allowed) => {
+            init({
+                ...baseOptions,
+                serviceName: allowed,
+            });
+            const serviceNameAttr = vars.resource.attributes.find((attr) => attr.key === SERVICE_NAME);
+            expect(serviceNameAttr?.value.stringValue).toBe(allowed);
+        });
         it("should fallback to 'unknown' when serviceName is empty and location.hostname is not available", async () => {
             vi.resetModules();
             // Mock utils module with loc as undefined

package/dist/modules/instrumentations/http/fetch.js

@@ -1,7 +1,7 @@
 import { debug, observeResourcePerformance, perf, win, setTimeout, isSameOrigin, wrap, parseUrl, clearTimeout, } from "../../utils";
 import { isUrlIgnored, matchesAny } from "../../utils/ignore-rules";
 import { addAttribute, setSpanStatus, addW3CTraceContextHttpHeaders, addXRayTraceContextHttpHeaders, endSpan, errorToSpanStatus, recordException, startSpan, } from "../../utils/otel";
-import { ERROR_TYPE, HTTP_REQUEST_METHOD, HTTP_REQUEST_METHOD_ORIGINAL, HTTP_RESPONSE_STATUS_CODE, SPAN_STATUS_ERROR, SPAN_STATUS_UNSET, } from "../../semantic-conventions";
+import { ERROR_TYPE, HTTP_REQUEST_METHOD, HTTP_REQUEST_METHOD_ORIGINAL, HTTP_RESPONSE_STATUS_CODE, SPAN_STATUS_ERROR, SPAN_STATUS_UNSET, WEB_REQUEST_CANCELLED, } from "../../semantic-conventions";
 import { vars } from "../../vars";
 import { httpRequestHeaderKey, httpResponseHeaderKey } from "../../utils/otel/http";
 import { sendSpan } from "../../transport";
@@ -86,12 +86,22 @@ function wrapFetch(original) {
             addResponseData(span, origResponse);
             return wrapResponse(origResponse, vars.maxToleranceForResourceTimingsMillis, () => performanceObserver.end(), (e) => {
                 performanceObserver.cancel();
-                endSpanOnError(span, e);
+                if (request.signal?.aborted) {
+                    endSpanOnAbort(span);
+                }
+                else {
+                    endSpanOnError(span, e);
+                }
             });
         }
         catch (e) {
             performanceObserver.cancel();
-            endSpanOnError(span, e);
+            if (request.signal?.aborted) {
+                endSpanOnAbort(span);
+            }
+            else {
+                endSpanOnError(span, e);
+            }
             throw e;
         }
     };
@@ -224,6 +234,10 @@ function endSpanOnError(span, error) {
     recordException(span, error);
     sendSpan(endSpan(span, errorToSpanStatus(error), undefined));
 }
+function endSpanOnAbort(span) {
+    addAttribute(span.attributes, WEB_REQUEST_CANCELLED, true);
+    sendSpan(endSpan(span, undefined, undefined));
+}
 function determinePropagatorTypes(url) {
     const matchingTypes = [];
     const isUrlSameOrigin = isSameOrigin(url);

package/dist/modules/instrumentations/http/fetch_test.js

@@ -1,6 +1,10 @@
 import { expect, vi, beforeEach, afterEach } from "vitest";
 import { vars } from "../../vars";
 import { instrumentFetch } from "./fetch";
+import { sendSpan } from "../../transport";
+vi.mock("../../transport", () => ({
+    sendSpan: vi.fn(),
+}));
 describe("fetch test", () => {
     let fetchMock;
     beforeEach(() => {
@@ -167,4 +171,103 @@ describe("fetch test", () => {
         expect(fetchHeaders.get("traceparent")).not.toBeNull();
         expect(fetchHeaders.get("X-Amzn-Trace-Id")).toBeNull();
     });
+    describe("aborted requests", () => {
+        const sendSpanMock = sendSpan;
+        const NativeRequest = Request;
+        const lastSpan = () => {
+            const calls = sendSpanMock.mock.calls;
+            return calls[calls.length - 1][0];
+        };
+        const hasAttribute = (span, key, expectedValue) => span.attributes.some((a) => a.key === key && JSON.stringify(a.value) === JSON.stringify(expectedValue));
+        beforeEach(() => {
+            sendSpanMock.mockClear();
+            // jsdom's Request rejects its own AbortSignal instances (known jsdom bug).
+            // Stub Request with a minimal implementation that preserves signals verbatim.
+            class FakeRequest {
+                url;
+                method;
+                headers;
+                signal;
+                constructor(input, init) {
+                    if (input instanceof FakeRequest) {
+                        this.url = input.url;
+                        this.method = init?.method ?? input.method;
+                        this.headers = new Headers(init?.headers ?? input.headers);
+                        this.signal = init?.signal ?? input.signal;
+                    }
+                    else {
+                        this.url = String(input);
+                        this.method = init?.method ?? "GET";
+                        this.headers = new Headers(init?.headers);
+                        this.signal = init?.signal ?? undefined;
+                    }
+                }
+            }
+            vi.stubGlobal("Request", FakeRequest);
+        });
+        afterEach(() => {
+            vi.stubGlobal("Request", NativeRequest);
+        });
+        it("marks fetch as cancelled when the abort signal fires before the response arrives", async () => {
+            const controller = new AbortController();
+            fetchMock.mockImplementation((_input, init) => new Promise((_resolve, reject) => {
+                const signal = init?.signal;
+                if (signal?.aborted) {
+                    reject(new DOMException("aborted", "AbortError"));
+                    return;
+                }
+                signal?.addEventListener("abort", () => reject(new DOMException("aborted", "AbortError")));
+            }));
+            instrumentFetch();
+            // eslint-disable-next-line no-restricted-globals
+            const pending = fetch("http://localhost:3000/api/test", { signal: controller.signal });
+            controller.abort();
+            await expect(pending).rejects.toBeInstanceOf(DOMException);
+            expect(sendSpanMock).toHaveBeenCalledTimes(1);
+            const span = lastSpan();
+            expect(span.status?.code).toBe(0);
+            expect(span.status?.message).toBeUndefined();
+            expect(hasAttribute(span, "dash0.web.request.cancelled", { boolValue: true })).toBe(true);
+            expect(span.events.find((e) => e.name === "exception")).toBeUndefined();
+        });
+        it("marks fetch as cancelled when the abort signal fires while reading the response body", async () => {
+            const controller = new AbortController();
+            const body = new ReadableStream({
+                start(streamController) {
+                    streamController.enqueue(new Uint8Array([0x68, 0x69]));
+                    controller.signal.addEventListener("abort", () => {
+                        streamController.error(new DOMException("aborted", "AbortError"));
+                    });
+                },
+            });
+            fetchMock.mockImplementation(() => Promise.resolve(new Response(body, { status: 200 })));
+            instrumentFetch();
+            // eslint-disable-next-line no-restricted-globals
+            const response = await fetch("http://localhost:3000/api/test", { signal: controller.signal });
+            const reader = response.body.getReader();
+            await reader.read();
+            controller.abort();
+            await expect(reader.read()).rejects.toBeInstanceOf(DOMException);
+            expect(sendSpanMock).toHaveBeenCalledTimes(1);
+            const span = lastSpan();
+            // status was set from the 200 response and should not be overwritten
+            expect(span.status?.code).toBe(0);
+            expect(span.status?.message).toBeUndefined();
+            expect(hasAttribute(span, "dash0.web.request.cancelled", { boolValue: true })).toBe(true);
+            expect(hasAttribute(span, "http.response.status_code", { stringValue: "200" })).toBe(true);
+            expect(span.events.find((e) => e.name === "exception")).toBeUndefined();
+        });
+        it("still treats non-abort rejections as failures", async () => {
+            fetchMock.mockImplementation(() => Promise.reject(new TypeError("network down")));
+            instrumentFetch();
+            // eslint-disable-next-line no-restricted-globals
+            await expect(fetch("http://localhost:3000/api/test")).rejects.toBeInstanceOf(TypeError);
+            expect(sendSpanMock).toHaveBeenCalledTimes(1);
+            const span = lastSpan();
+            expect(span.status?.code).toBe(2);
+            expect(span.status?.message).toBe("network down");
+            expect(hasAttribute(span, "dash0.web.request.cancelled", { boolValue: true })).toBe(false);
+            expect(span.events.some((e) => e.name === "exception")).toBe(true);
+        });
+    });
 });

package/dist/modules/semantic-conventions.js

@@ -9,6 +9,7 @@ export const DEPLOYMENT_ID = "deployment.id";
 export const EVENT_NAME = "event.name";
 export const WEB_EVENT_TITLE = "dash0.web.event.title";
 export const WEB_EVENT_ID = "dash0.web.event.id";
+export const WEB_REQUEST_CANCELLED = "dash0.web.request.cancelled";
 export const PAGE_LOAD_ID = "page.load.id";
 export const SESSION_ID = "session.id";
 export const USER_AGENT = "user_agent.original";

package/dist/modules/utils/index.js

@@ -14,4 +14,5 @@ export * from "./math";
 export * from "./origin";
 export * from "./url";
 export * from "./pick";
+export * from "./sanitize";
 export * from "./wrap";

package/dist/modules/utils/sanitize.js

@@ -0,0 +1,12 @@
+const SUSPICIOUS_CHARS = /['"<>{};\x00-\x1F\x7F]/;
+/**
+ * Returns true if the value is safe to use as a `service.name` resource attribute.
+ *
+ * Rejects values containing characters commonly used in injection payloads:
+ * quotes, angle brackets, braces, semicolons, and C0 control characters / DEL.
+ * Forward and back slashes are intentionally permitted so names like
+ * `myteam/myservice` remain valid.
+ */
+export function isSafeServiceName(value) {
+    return !SUSPICIOUS_CHARS.test(value);
+}

package/dist/modules/utils/sanitize_test.js

@@ -0,0 +1,52 @@
+import { describe, expect, it } from "vitest";
+import { isSafeServiceName } from "./sanitize";
+describe("isSafeServiceName", () => {
+    describe("accepts safe values", () => {
+        it.each([
+            "my-service",
+            "my_service",
+            "my.service",
+            "MyService123",
+            "myteam/myservice",
+            "myteam\\myservice",
+            "service with spaces",
+            "service-name.v2",
+            "résumé-service",
+            "サービス",
+            "a",
+        ])("accepts %j", (value) => {
+            expect(isSafeServiceName(value)).toBe(true);
+        });
+        it("accepts the empty string (empty/whitespace handling lives elsewhere)", () => {
+            expect(isSafeServiceName("")).toBe(true);
+        });
+    });
+    describe("rejects suspicious characters", () => {
+        it.each([
+            ["single quote", "evil';DROP TABLE"],
+            ["double quote", 'say "hi"'],
+            ["semicolon", "a;b"],
+            ["open brace", "${injected}"],
+            ["close brace", "trailing}"],
+            ["less-than", "<script>"],
+            ["greater-than", "value>other"],
+        ])("rejects %s", (_label, value) => {
+            expect(isSafeServiceName(value)).toBe(false);
+        });
+        it("rejects NUL", () => {
+            expect(isSafeServiceName("a\x00b")).toBe(false);
+        });
+        it("rejects embedded newline (log injection)", () => {
+            expect(isSafeServiceName("line1\nline2")).toBe(false);
+        });
+        it("rejects embedded carriage return", () => {
+            expect(isSafeServiceName("a\rb")).toBe(false);
+        });
+        it("rejects embedded tab", () => {
+            expect(isSafeServiceName("a\tb")).toBe(false);
+        });
+        it("rejects DEL", () => {
+            expect(isSafeServiceName("a\x7Fb")).toBe(false);
+        });
+    });
+});