@dash0/sdk-web 0.18.5 → 0.20.0

package/src/api/init_test.ts

@@ -297,6 +297,81 @@ describe("init", () => {
       expect(serviceNameAttr?.value.stringValue).toBe("test-hostname.example.com");
     });
 
+    it.each([
+      ["single quote", "evil';DROP TABLE users;--"],
+      ["double quote", 'svc"name'],
+      ["semicolon", "svc;injected"],
+      ["open brace", "svc${tpl}"],
+      ["close brace", "svc}name"],
+      ["less-than", "<script>"],
+      ["greater-than", "svc>name"],
+      ["embedded newline", "svc\nname"],
+      ["NUL byte", "svc\x00name"],
+    ])("should fallback to location.hostname by default when serviceName contains %s", async (_label, suspicious) => {
+      init({
+        ...baseOptions,
+        serviceName: suspicious,
+      });
+
+      const serviceNameAttr = vars.resource.attributes.find((attr) => attr.key === SERVICE_NAME);
+      expect(serviceNameAttr?.value.stringValue).toBe("test-hostname.example.com");
+    });
+
+    it.each([
+      ["single quote", "evil';DROP TABLE users;--"],
+      ["double quote", 'svc"name'],
+      ["semicolon", "svc;injected"],
+      ["embedded newline", "svc\nname"],
+    ])(
+      "should also fallback when rejectSuspiciousServiceName is explicitly true and serviceName contains %s",
+      async (_label, suspicious) => {
+        init({
+          ...baseOptions,
+          serviceName: suspicious,
+          rejectSuspiciousServiceName: true,
+        });
+
+        const serviceNameAttr = vars.resource.attributes.find((attr) => attr.key === SERVICE_NAME);
+        expect(serviceNameAttr?.value.stringValue).toBe("test-hostname.example.com");
+      }
+    );
+
+    it.each([
+      ["single quote", "evil';DROP TABLE users;--"],
+      ["semicolon", "svc;injected"],
+      ["less-than", "<script>"],
+    ])(
+      "should keep suspicious serviceName unchanged when rejectSuspiciousServiceName is explicitly false (%s)",
+      async (_label, suspicious) => {
+        init({
+          ...baseOptions,
+          serviceName: suspicious,
+          rejectSuspiciousServiceName: false,
+        });
+
+        const serviceNameAttr = vars.resource.attributes.find((attr) => attr.key === SERVICE_NAME);
+        expect(serviceNameAttr?.value.stringValue).toBe(suspicious);
+      }
+    );
+
+    it.each([
+      ["forward slash", "myteam/myservice"],
+      ["backslash", "myteam\\myservice"],
+      ["spaces", "my service"],
+      ["dots and hyphens", "svc-name.v2"],
+    ])(
+      "should keep serviceName with allowed characters like %s under the default configuration",
+      async (_label, allowed) => {
+        init({
+          ...baseOptions,
+          serviceName: allowed,
+        });
+
+        const serviceNameAttr = vars.resource.attributes.find((attr) => attr.key === SERVICE_NAME);
+        expect(serviceNameAttr?.value.stringValue).toBe(allowed);
+      }
+    );
+
     it("should fallback to 'unknown' when serviceName is empty and location.hostname is not available", async () => {
       vi.resetModules();
 

package/src/instrumentations/http/fetch.ts

@@ -29,6 +29,7 @@ import {
   HTTP_RESPONSE_STATUS_CODE,
   SPAN_STATUS_ERROR,
   SPAN_STATUS_UNSET,
+  WEB_REQUEST_CANCELLED,
 } from "../../semantic-conventions";
 import { vars, PropagatorType } from "../../vars";
 import { httpRequestHeaderKey, httpResponseHeaderKey } from "../../utils/otel/http";
@@ -129,12 +130,20 @@ function wrapFetch(original: typeof fetch) {
         () => performanceObserver.end(),
         (e) => {
           performanceObserver.cancel();
-          endSpanOnError(span, e);
+          if (request.signal?.aborted) {
+            endSpanOnAbort(span);
+          } else {
+            endSpanOnError(span, e);
+          }
         }
       );
     } catch (e) {
       performanceObserver.cancel();
-      endSpanOnError(span, e as Exception);
+      if (request.signal?.aborted) {
+        endSpanOnAbort(span);
+      } else {
+        endSpanOnError(span, e as Exception);
+      }
       throw e;
     }
   };
@@ -277,6 +286,11 @@ function endSpanOnError(span: InProgressSpan, error: Exception) {
   sendSpan(endSpan(span, errorToSpanStatus(error), undefined));
 }
 
+function endSpanOnAbort(span: InProgressSpan) {
+  addAttribute(span.attributes, WEB_REQUEST_CANCELLED, true);
+  sendSpan(endSpan(span, undefined, undefined));
+}
+
 function determinePropagatorTypes(url: string): PropagatorType[] {
   const matchingTypes: PropagatorType[] = [];
   const isUrlSameOrigin = isSameOrigin(url);

package/src/instrumentations/http/fetch_test.ts

@@ -1,6 +1,12 @@
 import { expect, vi, beforeEach, afterEach } from "vitest";
 import { vars } from "../../vars";
 import { instrumentFetch } from "./fetch";
+import { sendSpan } from "../../transport";
+import type { Span } from "../../types/otlp";
+
+vi.mock("../../transport", () => ({
+  sendSpan: vi.fn(),
+}));
 
 describe("fetch test", () => {
   let fetchMock: any;
@@ -188,4 +194,121 @@ describe("fetch test", () => {
     expect(fetchHeaders.get("traceparent")).not.toBeNull();
     expect(fetchHeaders.get("X-Amzn-Trace-Id")).toBeNull();
   });
+
+  describe("aborted requests", () => {
+    const sendSpanMock = sendSpan as unknown as ReturnType<typeof vi.fn>;
+    const NativeRequest = Request;
+
+    const lastSpan = (): Span => {
+      const calls = sendSpanMock.mock.calls;
+      return calls[calls.length - 1]![0] as Span;
+    };
+
+    const hasAttribute = (span: Span, key: string, expectedValue: unknown) =>
+      span.attributes.some((a) => a.key === key && JSON.stringify(a.value) === JSON.stringify(expectedValue));
+
+    beforeEach(() => {
+      sendSpanMock.mockClear();
+      // jsdom's Request rejects its own AbortSignal instances (known jsdom bug).
+      // Stub Request with a minimal implementation that preserves signals verbatim.
+      class FakeRequest {
+        url: string;
+        method: string;
+        headers: Headers;
+        signal: AbortSignal | undefined;
+        constructor(input: string | FakeRequest, init?: RequestInit) {
+          if (input instanceof FakeRequest) {
+            this.url = input.url;
+            this.method = init?.method ?? input.method;
+            this.headers = new Headers(init?.headers ?? input.headers);
+            this.signal = init?.signal ?? input.signal;
+          } else {
+            this.url = String(input);
+            this.method = init?.method ?? "GET";
+            this.headers = new Headers(init?.headers);
+            this.signal = init?.signal ?? undefined;
+          }
+        }
+      }
+      vi.stubGlobal("Request", FakeRequest);
+    });
+
+    afterEach(() => {
+      vi.stubGlobal("Request", NativeRequest);
+    });
+
+    it("marks fetch as cancelled when the abort signal fires before the response arrives", async () => {
+      const controller = new AbortController();
+      fetchMock.mockImplementation(
+        (_input: RequestInfo, init?: RequestInit) =>
+          new Promise((_resolve, reject) => {
+            const signal = init?.signal;
+            if (signal?.aborted) {
+              reject(new DOMException("aborted", "AbortError"));
+              return;
+            }
+            signal?.addEventListener("abort", () => reject(new DOMException("aborted", "AbortError")));
+          })
+      );
+
+      instrumentFetch();
+      // eslint-disable-next-line no-restricted-globals
+      const pending = fetch("http://localhost:3000/api/test", { signal: controller.signal });
+      controller.abort();
+      await expect(pending).rejects.toBeInstanceOf(DOMException);
+
+      expect(sendSpanMock).toHaveBeenCalledTimes(1);
+      const span = lastSpan();
+      expect(span.status?.code).toBe(0);
+      expect(span.status?.message).toBeUndefined();
+      expect(hasAttribute(span, "dash0.web.request.cancelled", { boolValue: true })).toBe(true);
+      expect(span.events.find((e) => e.name === "exception")).toBeUndefined();
+    });
+
+    it("marks fetch as cancelled when the abort signal fires while reading the response body", async () => {
+      const controller = new AbortController();
+      const body = new ReadableStream({
+        start(streamController) {
+          streamController.enqueue(new Uint8Array([0x68, 0x69]));
+          controller.signal.addEventListener("abort", () => {
+            streamController.error(new DOMException("aborted", "AbortError"));
+          });
+        },
+      });
+
+      fetchMock.mockImplementation(() => Promise.resolve(new Response(body, { status: 200 })));
+
+      instrumentFetch();
+      // eslint-disable-next-line no-restricted-globals
+      const response = await fetch("http://localhost:3000/api/test", { signal: controller.signal });
+      const reader = response.body!.getReader();
+      await reader.read();
+      controller.abort();
+      await expect(reader.read()).rejects.toBeInstanceOf(DOMException);
+
+      expect(sendSpanMock).toHaveBeenCalledTimes(1);
+      const span = lastSpan();
+      // status was set from the 200 response and should not be overwritten
+      expect(span.status?.code).toBe(0);
+      expect(span.status?.message).toBeUndefined();
+      expect(hasAttribute(span, "dash0.web.request.cancelled", { boolValue: true })).toBe(true);
+      expect(hasAttribute(span, "http.response.status_code", { stringValue: "200" })).toBe(true);
+      expect(span.events.find((e) => e.name === "exception")).toBeUndefined();
+    });
+
+    it("still treats non-abort rejections as failures", async () => {
+      fetchMock.mockImplementation(() => Promise.reject(new TypeError("network down")));
+
+      instrumentFetch();
+      // eslint-disable-next-line no-restricted-globals
+      await expect(fetch("http://localhost:3000/api/test")).rejects.toBeInstanceOf(TypeError);
+
+      expect(sendSpanMock).toHaveBeenCalledTimes(1);
+      const span = lastSpan();
+      expect(span.status?.code).toBe(2);
+      expect(span.status?.message).toBe("network down");
+      expect(hasAttribute(span, "dash0.web.request.cancelled", { boolValue: true })).toBe(false);
+      expect(span.events.some((e) => e.name === "exception")).toBe(true);
+    });
+  });
 });

package/src/semantic-conventions.ts

@@ -10,6 +10,7 @@ export const DEPLOYMENT_ID = "deployment.id";
 export const EVENT_NAME = "event.name";
 export const WEB_EVENT_TITLE = "dash0.web.event.title";
 export const WEB_EVENT_ID = "dash0.web.event.id";
+export const WEB_REQUEST_CANCELLED = "dash0.web.request.cancelled";
 export const PAGE_LOAD_ID = "page.load.id";
 export const SESSION_ID = "session.id";
 export const USER_AGENT = "user_agent.original";

package/src/types/options.ts

@@ -17,6 +17,17 @@ export type InitOptions = {
    */
   additionalSignalAttributes?: Record<string, AttributeValueType | AnyValue>;
 
+  /**
+   * When enabled (the default), reject `serviceName` values that contain
+   * characters commonly associated with injection payloads (quotes, angle
+   * brackets, braces, semicolons, control characters) and fall back to
+   * `location.hostname`. This guards against automated security scanners or
+   * untrusted callers influencing the value sent to `init()`.
+   *
+   * Set to `false` to opt out and pass the `serviceName` through unchanged.
+   */
+  rejectSuspiciousServiceName?: boolean;
+
   /**
    * OTLP endpoints to which the generated telemetry should be sent to.
    */

package/src/utils/index.ts

@@ -14,4 +14,5 @@ export * from "./math";
 export * from "./origin";
 export * from "./url";
 export * from "./pick";
+export * from "./sanitize";
 export * from "./wrap";

package/src/utils/sanitize.ts

@@ -0,0 +1,13 @@
+const SUSPICIOUS_CHARS = /['"<>{};\x00-\x1F\x7F]/;
+
+/**
+ * Returns true if the value is safe to use as a `service.name` resource attribute.
+ *
+ * Rejects values containing characters commonly used in injection payloads:
+ * quotes, angle brackets, braces, semicolons, and C0 control characters / DEL.
+ * Forward and back slashes are intentionally permitted so names like
+ * `myteam/myservice` remain valid.
+ */
+export function isSafeServiceName(value: string): boolean {
+  return !SUSPICIOUS_CHARS.test(value);
+}

package/src/utils/sanitize_test.ts

@@ -0,0 +1,60 @@
+import { describe, expect, it } from "vitest";
+import { isSafeServiceName } from "./sanitize";
+
+describe("isSafeServiceName", () => {
+  describe("accepts safe values", () => {
+    it.each([
+      "my-service",
+      "my_service",
+      "my.service",
+      "MyService123",
+      "myteam/myservice",
+      "myteam\\myservice",
+      "service with spaces",
+      "service-name.v2",
+      "résumé-service",
+      "サービス",
+      "a",
+    ])("accepts %j", (value) => {
+      expect(isSafeServiceName(value)).toBe(true);
+    });
+
+    it("accepts the empty string (empty/whitespace handling lives elsewhere)", () => {
+      expect(isSafeServiceName("")).toBe(true);
+    });
+  });
+
+  describe("rejects suspicious characters", () => {
+    it.each([
+      ["single quote", "evil';DROP TABLE"],
+      ["double quote", 'say "hi"'],
+      ["semicolon", "a;b"],
+      ["open brace", "${injected}"],
+      ["close brace", "trailing}"],
+      ["less-than", "<script>"],
+      ["greater-than", "value>other"],
+    ])("rejects %s", (_label, value) => {
+      expect(isSafeServiceName(value)).toBe(false);
+    });
+
+    it("rejects NUL", () => {
+      expect(isSafeServiceName("a\x00b")).toBe(false);
+    });
+
+    it("rejects embedded newline (log injection)", () => {
+      expect(isSafeServiceName("line1\nline2")).toBe(false);
+    });
+
+    it("rejects embedded carriage return", () => {
+      expect(isSafeServiceName("a\rb")).toBe(false);
+    });
+
+    it("rejects embedded tab", () => {
+      expect(isSafeServiceName("a\tb")).toBe(false);
+    });
+
+    it("rejects DEL", () => {
+      expect(isSafeServiceName("a\x7Fb")).toBe(false);
+    });
+  });
+});