@debugbundle/sdk-react-native 1.3.0 → 2.0.0

package/ios/DebugBundleReactNative.swift

@@ -4,7 +4,7 @@ import DebugBundle
 
 @objc(DebugBundleReactNative)
 final class DebugBundleReactNative: NSObject {
-	private var currentSDKVersion = "1.3.0"
+	private var currentSDKVersion = "2.0.0"
 	private var currentService = "react-native-app"
 	private var currentEnvironment = "production"
 
@@ -14,7 +14,7 @@ final class DebugBundleReactNative: NSObject {
 		resolver resolve: @escaping RCTPromiseResolveBlock,
 		rejecter reject: @escaping RCTPromiseRejectBlock
 	) {
-		currentSDKVersion = config["sdkVersion"] as? String ?? "1.3.0"
+		currentSDKVersion = config["sdkVersion"] as? String ?? "2.0.0"
 		currentService = config["service"] as? String ?? "react-native-app"
 		currentEnvironment = config["environment"] as? String ?? "production"
 		let sdkConfig = DebugBundleConfig(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@debugbundle/sdk-react-native",
-  "version": "1.3.0",
+  "version": "2.0.0",
   "description": "React Native SDK for DebugBundle mobile event capture.",
   "license": "Apache-2.0",
   "type": "module",
@@ -41,7 +41,7 @@
   },
   "files": [
     "android/build.gradle",
-    "android/src",
+    "android/src/main",
     "ios",
     "src",
     "dist",
@@ -104,9 +104,9 @@
   },
   "devDependencies": {
     "@types/react": "^19.1.2",
-    "@vitest/coverage-v8": "^4.1.2",
+    "@vitest/coverage-v8": "^4.1.11",
     "react": "^19.2.4",
     "typescript": "^6.0.2",
-    "vitest": "^4.1.2"
+    "vitest": "^4.1.11"
   }
 }

package/src/client.ts

@@ -1,6 +1,7 @@
 import { getNativeModule, degradedNativeState, safeNativeCall } from "./native.js";
 import { applyBeforeSend } from "./before-send.js";
 import { defaultRedactFields, DEFAULT_HEADER_ALLOWLIST, sanitizeHeaders, sanitizeValue } from "./redaction.js";
+import { sanitizeTelemetry } from "./privacy-telemetry.js";
 import type {
   DebugBundleCaptureContext,
   DebugBundleClient,
@@ -18,7 +19,7 @@ import type {
 } from "./types.js";
 
 const SDK_NAME = "@debugbundle/sdk-react-native" as const;
-const DEFAULT_SDK_VERSION = "1.3.0";
+const DEFAULT_SDK_VERSION = "2.0.0";
 const LOG_LEVELS: Record<DebugBundleLogLevel, number> = {
   debug: 10,
   info: 20,
@@ -27,6 +28,39 @@ const LOG_LEVELS: Record<DebugBundleLogLevel, number> = {
   critical: 50
 };
 
+function protectEventFields(
+  event: DebugBundleEventEnvelope,
+  additionalKeys: string[]
+): DebugBundleEventEnvelope | null {
+  // Preserve typed identities only when their scalar values pass the mandatory policy.
+  for (const value of [event.schema_version, event.sdk_name, event.sdk_version,
+    ...Object.values(event.correlation ?? {})]) {
+    if (typeof value !== "string") continue;
+    const checked = sanitizeTelemetry(value, { additionalKeys });
+    if (!checked.ok || checked.value !== value) return null;
+  }
+  const result = sanitizeTelemetry({
+    service: event.service,
+    payload: event.payload,
+    ...(event.context ? { context: event.context } : {})
+  }, { additionalKeys });
+  if (!result.ok || !result.value || typeof result.value !== "object" || Array.isArray(result.value)) {
+    return null;
+  }
+  const safeFields = result.value as Record<string, unknown>;
+  if (!safeFields.service || !safeFields.payload ||
+      typeof safeFields.service !== "object" || Array.isArray(safeFields.service) ||
+      typeof safeFields.payload !== "object" || Array.isArray(safeFields.payload)) {
+    return null;
+  }
+  return {
+    ...event,
+    service: safeFields.service as DebugBundleEventEnvelope["service"],
+    payload: safeFields.payload as Record<string, unknown>,
+    ...(event.context ? { context: safeFields.context as Record<string, unknown> } : {})
+  };
+}
+
 export class DebugBundleReactNativeClient implements DebugBundleClient {
   private config: ResolvedDebugBundleConfig;
   private nativeModule: NativeDebugBundleModule | null = null;
@@ -268,18 +302,22 @@ export class DebugBundleReactNativeClient implements DebugBundleClient {
         ? { ...payload, device: canonicalDevice(this.nativeState.device, this.config) }
         : payload
     };
-    const event = applyBeforeSend(authoredEvent, this.config.beforeSend);
+    const initial = protectEventFields(authoredEvent, this.config.redactFields);
+    if (!initial) return;
+    const event = applyBeforeSend(initial, this.config.beforeSend);
     if (!event || !localPolicyAllows) {
       return;
     }
+    const safeEvent = protectEventFields(event, this.config.redactFields);
+    if (!safeEvent) return;
     if (!this.nativeModule) {
       this.nativeState = degradedNativeState("native_module_unavailable");
       return;
     }
     if (this.nativeModule.enqueueCanonicalEvent) {
-      void safeNativeCall(() => this.nativeModule!.enqueueCanonicalEvent!(event), undefined);
+      void safeNativeCall(() => this.nativeModule!.enqueueCanonicalEvent!(safeEvent), undefined);
     } else {
-      void safeNativeCall(() => this.nativeModule!.enqueueEvent(toLegacyNativeEvent(event)), undefined);
+      void safeNativeCall(() => this.nativeModule!.enqueueEvent(toLegacyNativeEvent(safeEvent)), undefined);
     }
   }
 

package/src/privacy-keys.ts

@@ -0,0 +1,39 @@
+export const DEFAULT_SENSITIVE_KEYS = [
+  "password", "secret", "token", "api_key", "apikey", "access_token", "refresh_token",
+  "private_key", "authorization", "bearer", "cookie", "session_id", "passwd", "ssn",
+  "credit_card", "card_number", "cvv", "cvc", "pin", "expiry", "phone", "otp",
+  "verification_code"
+] as const;
+
+function canonicalizeSensitiveKey(value: string): string {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "");
+}
+
+function splitKeyIntoSegments(key: string): string[] {
+  return key
+    .trim()
+    .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+    .toLowerCase()
+    .split(/[^a-z0-9]+/)
+    .filter((segment) => segment.length > 0);
+}
+
+export function isSensitiveKey(key: string, sensitiveKeys: readonly string[]): boolean {
+  const normalized = key.trim().toLowerCase();
+  if (sensitiveKeys.includes(normalized)) {
+    return true;
+  }
+
+  const canonicalSensitiveKeys = new Set(sensitiveKeys.map(canonicalizeSensitiveKey));
+  const segments = splitKeyIntoSegments(key);
+  for (let start = 0; start < segments.length; start += 1) {
+    let combined = "";
+    for (let end = start; end < segments.length; end += 1) {
+      combined += segments[end];
+      if (canonicalSensitiveKeys.has(combined)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}

package/src/privacy-telemetry.ts

@@ -0,0 +1,168 @@
+type JsonValue = string | number | boolean | null | JsonValue[] | { [key: string]: JsonValue };
+import { DEFAULT_SENSITIVE_KEYS, isSensitiveKey } from "./privacy-keys.js";
+import { scrubCredentialText } from "./privacy-text.js";
+
+const REDACTED = "[REDACTED]";
+const MAX_DEPTH = 16;
+const MAX_NODES = 4096;
+const MAX_ENTRIES = 256;
+const MAX_STRING_BYTES = 16 * 1024;
+const MAX_TOTAL_BYTES = 256 * 1024;
+
+export interface TelemetrySanitizationOptions {
+  additionalKeys?: readonly string[];
+  maxTotalBytes?: number;
+}
+
+export type TelemetrySanitizationResult =
+  | { ok: true; value: JsonValue; redactionCount: number }
+  | { ok: false; reason: "unsafe_input" | "budget_exceeded" };
+
+interface WorkState {
+  nodes: number;
+  textBytes: number;
+  redactionCount: number;
+  seen: WeakSet<object>;
+  keys: string[];
+  extra: readonly string[];
+  maxTotalBytes: number;
+}
+
+class BudgetExceeded extends Error {}
+
+function byteLength(value: string): number {
+  let bytes = 0;
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code < 0x80) bytes += 1;
+    else if (code < 0x800) bytes += 2;
+    else if (code >= 0xd800 && code <= 0xdbff && index + 1 < value.length &&
+             value.charCodeAt(index + 1) >= 0xdc00 && value.charCodeAt(index + 1) <= 0xdfff) {
+      bytes += 4;
+      index += 1;
+    } else bytes += 3;
+  }
+  return bytes;
+}
+
+function mask(state: WorkState): string {
+  state.redactionCount += 1;
+  return REDACTED;
+}
+
+function sanitizeString(value: string, state: WorkState, allowStructured: boolean): JsonValue {
+  if (value.length > MAX_STRING_BYTES) return mask(state);
+  const length = byteLength(value);
+  if (length > MAX_STRING_BYTES) return mask(state);
+  state.textBytes += length;
+  if (state.textBytes > state.maxTotalBytes) throw new BudgetExceeded();
+
+  if (allowStructured && (value.startsWith("{") || value.startsWith("["))) {
+    try {
+      const parsed: unknown = JSON.parse(value);
+      if (typeof parsed === "object" && parsed !== null) {
+        const nested = sanitizeValue(parsed, state, 0, false);
+        const encoded = JSON.stringify(nested);
+        if (encoded !== value) state.redactionCount += 1;
+        return encoded;
+      }
+    } catch (error) {
+      if (error instanceof BudgetExceeded) throw error;
+      // Malformed structured content with a recognizable sensitive label is withheld below.
+    }
+  }
+
+  const result = scrubCredentialText(value, state.extra);
+  if (result !== value) state.redactionCount += 1;
+  if ((value.startsWith("{") || value.startsWith("[")) && result === value &&
+      /(?:password|token|secret|authorization|cookie)["']?\s*[:=]/i.test(value)) {
+    return mask(state);
+  }
+  return result;
+}
+
+function sanitizeValue(value: unknown, state: WorkState, depth: number, allowStructured: boolean): JsonValue {
+  state.nodes += 1;
+  if (state.nodes > MAX_NODES) throw new BudgetExceeded();
+  if (depth > MAX_DEPTH) return mask(state);
+  if (typeof value === "string") return sanitizeString(value, state, allowStructured);
+  if (value === null || typeof value === "boolean") return value;
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  if (typeof value !== "object") throw new TypeError("unsafe_input");
+
+  if (state.seen.has(value)) return "[Circular]";
+  state.seen.add(value);
+  try {
+    if (Array.isArray(value)) {
+      if (value.length > MAX_ENTRIES) return mask(state);
+      return Array.from({ length: value.length }, (_, index) => {
+        const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+        if (descriptor === undefined || !("value" in descriptor)) throw new TypeError("unsafe_input");
+        return sanitizeValue(descriptor.value, state, depth + 1, allowStructured);
+      });
+    }
+    if (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) {
+      throw new TypeError("unsafe_input");
+    }
+    const keys = Object.keys(value);
+    if (keys.length > MAX_ENTRIES) return mask(state);
+    const result: Record<string, JsonValue> = {};
+    for (const key of keys) {
+      if (key.length > 128) {
+        state.redactionCount += 1;
+        continue;
+      }
+      state.textBytes += byteLength(key);
+      if (state.textBytes > state.maxTotalBytes) throw new BudgetExceeded();
+      const safeKey = scrubCredentialText(key, state.extra);
+      if (safeKey !== key) {
+        state.redactionCount += 1;
+        continue;
+      }
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      if (descriptor === undefined || !("value" in descriptor)) throw new TypeError("unsafe_input");
+      const safeValue = isSensitiveKey(key, state.keys)
+        ? mask(state)
+        : sanitizeValue(descriptor.value, state, depth + 1, allowStructured);
+      Object.defineProperty(result, key, {
+        value: safeValue,
+        enumerable: true,
+        configurable: true,
+        writable: true
+      });
+    }
+    return result;
+  } finally {
+    state.seen.delete(value);
+  }
+}
+
+/** Mandatory telemetry policy; unlike the legacy `redact` helper, custom keys are additive. */
+export function sanitizeTelemetry(value: unknown, options: TelemetrySanitizationOptions = {}): TelemetrySanitizationResult {
+  try {
+    const extra = options.additionalKeys ?? [];
+    if (extra.length > 128 || extra.some((key) => typeof key !== "string" || key.length > 64 || !key.trim())) {
+      return { ok: false, reason: "unsafe_input" };
+    }
+    const maxTotalBytes = options.maxTotalBytes ?? MAX_TOTAL_BYTES;
+    if (!Number.isInteger(maxTotalBytes) || maxTotalBytes < 1 || maxTotalBytes > 512 * 1024) {
+      return { ok: false, reason: "unsafe_input" };
+    }
+    const state: WorkState = {
+      nodes: 0,
+      textBytes: 0,
+      redactionCount: 0,
+      seen: new WeakSet<object>(),
+      keys: [...DEFAULT_SENSITIVE_KEYS, ...extra],
+      extra,
+      maxTotalBytes
+    };
+    const sanitized = sanitizeValue(value, state, 0, true);
+    if (byteLength(JSON.stringify(sanitized)) > maxTotalBytes) {
+      return { ok: false, reason: "budget_exceeded" };
+    }
+    return { ok: true, value: sanitized, redactionCount: state.redactionCount };
+  } catch (error) {
+    return { ok: false, reason: error instanceof BudgetExceeded ? "budget_exceeded" : "unsafe_input" };
+  }
+}

package/src/privacy-text.ts

@@ -0,0 +1,86 @@
+import { DEFAULT_SENSITIVE_KEYS, isSensitiveKey } from "./privacy-keys.js";
+
+const REDACTED = "[REDACTED]";
+const BUILTIN_LABELS = [...DEFAULT_SENSITIVE_KEYS, "client_secret", "x_api_key",
+  "accessToken", "refreshToken", "privateKey", "clientSecret"];
+const ASSIGNMENT = new RegExp(
+  `\\b(${BUILTIN_LABELS.join("|")})\\b(["']?\\s*[:=]\\s*)(?:"[^"]*"|'[^']*'|[^\\s&,;]+)`,
+  "gi"
+);
+const HEADER = /\b(Authorization|Proxy-Authorization|Cookie|Set-Cookie)\s*:\s*[^\r\n]*/gi;
+const PEM = /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/gi;
+const PEM_COMPLETE = new RegExp(PEM.source, "i");
+const PEM_START = /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/i;
+const DEBUGBUNDLE_TOKEN = /\bdbundle_(?:proj|mem|probe|agent)_[A-Za-z0-9_-]+\b/g;
+const BEARER = /\b(Bearer|Basic)\s+[A-Za-z0-9._~+\/-]{6,}/gi;
+const URL_TEXT = /\bhttps?:\/\/[^\s<>"']+/gi;
+// Do not treat numeric substrings inside UUIDs, hashes, or identifier slugs as cards.
+const CARD = /(?<![A-Za-z0-9_-])(?:\d[ -]?){12,18}\d(?![A-Za-z0-9_-])/g;
+
+function isValidCard(value: string): boolean {
+  const digits = value.replace(/[^0-9]/g, "");
+  if (digits.length < 13 || digits.length > 19 || /^(\d)\1+$/.test(digits)) {
+    return false;
+  }
+  let sum = 0;
+  for (let index = digits.length - 1; index >= 0; index -= 1) {
+    let digit = Number(digits[index]);
+    if ((digits.length - index) % 2 === 0) {
+      digit *= 2;
+      if (digit > 9) digit -= 9;
+    }
+    sum += digit;
+  }
+  return sum % 10 === 0;
+}
+
+function scrubUrl(raw: string, keys: readonly string[]): string {
+  try {
+    const url = new URL(raw);
+    if (url.username || url.password) {
+      url.username = "REDACTED";
+      url.password = "";
+    }
+    const nextQuery = new URLSearchParams();
+    for (const [key, value] of url.searchParams) {
+      if (key.length > 128 || scrubCredentialText(key, keys, false) !== key) continue;
+      nextQuery.append(key, isSensitiveKey(key, keys) || scrubCredentialText(value, keys, false) !== value ? REDACTED : value);
+    }
+    url.search = nextQuery.toString();
+    url.hash = "";
+    return url.toString();
+  } catch {
+    // A malformed URL with a recognizable credential must not be emitted verbatim.
+    return REDACTED;
+  }
+}
+
+/** Bounded caller input only. Returns stable replacement text, never the matching secret. */
+export function scrubCredentialText(input: string, additionalKeys: readonly string[], scanUrls = true): string {
+  const keys = [...DEFAULT_SENSITIVE_KEYS, ...additionalKeys];
+  if (PEM_START.test(input) && !PEM_COMPLETE.test(input)) return REDACTED;
+  let output = input;
+  if (/(?:password|token|secret|authorization|cookie)%3[ad]/i.test(output)) {
+    try {
+      output = decodeURIComponent(output);
+    } catch {
+      return REDACTED;
+    }
+  }
+  output = output.replace(PEM, REDACTED).replace(HEADER, "$1: [REDACTED]");
+  output = output.replace(BEARER, "$1 [REDACTED]").replace(DEBUGBUNDLE_TOKEN, REDACTED);
+  output = output.replace(ASSIGNMENT, "$1$2[REDACTED]");
+  if (additionalKeys.length > 0) {
+    for (const key of additionalKeys) {
+      const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const named = new RegExp(`\\b(${escaped})\\b(["']?\\s*[:=]\\s*)(?:"[^"]*"|'[^']*'|[^\\s&,;]+)`, "gi");
+      output = output.replace(named, "$1$2[REDACTED]");
+    }
+  }
+  output = output.replace(CARD, (candidate) => isValidCard(candidate) ? REDACTED : candidate);
+  if (!scanUrls) return output;
+  return output.replace(URL_TEXT, (matched) => {
+    const trailing = matched.match(/[).,;]+$/)?.[0] ?? "";
+    return scrubUrl(matched.slice(0, matched.length - trailing.length), keys) + trailing;
+  });
+}

package/src/redaction.ts

@@ -1,26 +1,8 @@
+import { DEFAULT_SENSITIVE_KEYS, isSensitiveKey as privacySensitiveKey } from "./privacy-keys.js";
+import { sanitizeTelemetry } from "./privacy-telemetry.js";
+
 const DEFAULT_REDACT_FIELDS = [
-  "password",
-  "secret",
-  "token",
-  "api_key",
-  "apikey",
-  "access_token",
-  "refresh_token",
-  "private_key",
-  "passwd",
-  "card_number",
-  "cvv",
-  "cvc",
-  "pin",
-  "expiry",
-  "phone",
-  "bearer",
-  "session_id",
-  "otp",
-  "verification_code",
-  "authorization",
-  "cookie",
-  "ssn"
+  ...DEFAULT_SENSITIVE_KEYS
 ];
 
 export const DEFAULT_HEADER_ALLOWLIST = [
@@ -46,8 +28,15 @@ export function defaultRedactFields(): string[] {
 }
 
 export function sanitizeValue(value: unknown, options: SanitizeOptions = {}): unknown {
-  const visited = new WeakSet<object>();
-  return sanitize(value, normalizeOptions(options), 0, visited, undefined);
+  try {
+    const normalized = normalizeOptions(options);
+    const visited = new WeakSet<object>();
+    const prepared = sanitize(value, normalized, 0, visited, undefined);
+    const protectedValue = sanitizeTelemetry(prepared, { additionalKeys: options.redactFields ?? [] });
+    return protectedValue.ok ? protectedValue.value : "[REDACTED]";
+  } catch {
+    return "[REDACTED]";
+  }
 }
 
 export function sanitizeHeaders(
@@ -71,7 +60,7 @@ export function sanitizeHeaders(
 
 function normalizeOptions(options: SanitizeOptions): Required<SanitizeOptions> {
   return {
-    redactFields: options.redactFields ?? DEFAULT_REDACT_FIELDS,
+    redactFields: [...DEFAULT_REDACT_FIELDS, ...(options.redactFields ?? [])],
     maxDepth: options.maxDepth ?? 8,
     maxStringLength: options.maxStringLength ?? 2048,
     maxArrayLength: options.maxArrayLength ?? 50,
@@ -87,13 +76,13 @@ function sanitize(
   key: string | undefined
 ): unknown {
   if (key && isSensitiveKey(key, options.redactFields)) {
-    return "[Redacted]";
+    return "[REDACTED]";
   }
   if (value === null || value === undefined) {
     return value ?? null;
   }
   if (typeof value === "string") {
-    return truncate(value, options.maxStringLength);
+    return truncate(value, options.maxStringLength, options.redactFields);
   }
   if (typeof value === "number" || typeof value === "boolean") {
     return value;
@@ -136,30 +125,21 @@ function sanitizeError(
   visited: WeakSet<object>
 ): Record<string, unknown> {
   return {
-    name: truncate(error.name || "Error", options.maxStringLength),
-    message: truncate(error.message || "", options.maxStringLength),
-    stack: typeof error.stack === "string" ? truncate(error.stack, options.maxStringLength * 4) : null,
+    name: truncate(error.name || "Error", options.maxStringLength, options.redactFields),
+    message: truncate(error.message || "", options.maxStringLength, options.redactFields),
+    stack: typeof error.stack === "string" ? truncate(error.stack, options.maxStringLength * 4, options.redactFields) : null,
     cause: "cause" in error ? sanitize(error.cause, options, depth + 1, visited, "cause") : null
   };
 }
 
-function truncate(value: string, maxLength: number): string {
-  if (value.length <= maxLength) {
-    return value;
-  }
-  return `${value.slice(0, maxLength)}...[Truncated]`;
+function truncate(value: string, maxLength: number, fields: string[]): string {
+  if (value.length > 16 * 1024) return "[REDACTED]";
+  const safe = sanitizeTelemetry(value, { additionalKeys: fields });
+  if (!safe.ok || typeof safe.value !== "string") return "[REDACTED]";
+  if (safe.value.length <= maxLength) return safe.value;
+  return `${safe.value.slice(0, maxLength)}...[Truncated]`;
 }
 
 function isSensitiveKey(key: string, sensitiveFields: string[]): boolean {
-  const segments = splitKey(key);
-  const sensitive = new Set(sensitiveFields.flatMap(splitKey));
-  return segments.some((segment) => sensitive.has(segment));
-}
-
-function splitKey(key: string): string[] {
-  return key
-    .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
-    .split(/[^a-zA-Z0-9]+/)
-    .map((segment) => segment.toLowerCase())
-    .filter(Boolean);
+  return privacySensitiveKey(key, [...DEFAULT_SENSITIVE_KEYS, ...sensitiveFields]);
 }