@diegotsi/flint-core 1.10.1 → 1.10.2

package/dist/index.d.ts

@@ -6,6 +6,8 @@ interface NetworkCollector {
 interface NetworkCollectorOptions {
     maxEntries?: number;
     maxResponseBody?: number;
+    /** Extra key names (substring, case-insensitive) to redact from URLs, bodies and headers. */
+    redactKeys?: string[];
 }
 declare function createNetworkCollector(extraBlockedHosts?: string[], options?: NetworkCollectorOptions): NetworkCollector;
 
@@ -157,6 +159,8 @@ interface FlintConfig {
     enableReplay?: boolean;
     replayBufferMs?: number;
     blockedHosts?: string[];
+    /** Extra key names (substring, case-insensitive) to redact from captured network URLs, bodies and headers, on top of the built-in defaults (password, token, secret, …). */
+    redactKeys?: string[];
     frustration?: {
         rageClickThreshold?: number;
         rageClickWindow?: number;
@@ -184,7 +188,7 @@ interface FlintConfig {
     /** @internal Inject platform-specific collectors (e.g. React Native) */
     _collectors?: {
         console?: () => ConsoleCollector;
-        network?: (blockedHosts: string[]) => NetworkCollector;
+        network?: (blockedHosts: string[], options?: NetworkCollectorOptions) => NetworkCollector;
         environment?: () => EnvironmentInfo;
     };
     /** @internal Injected by framework packages to start replay without rrweb in core */

package/dist/index.js

@@ -763,6 +763,100 @@ function createFrustrationCollector(opts) {
   };
 }
 
+// src/collectors/sanitize.ts
+var REDACTED = "[REDACTED]";
+var DEFAULT_REDACT_KEYS = [
+  "password",
+  "passwd",
+  "pwd",
+  "secret",
+  "token",
+  "auth",
+  "credential",
+  "apikey",
+  "api_key",
+  "session",
+  "cookie",
+  "ssn",
+  "creditcard",
+  "credit_card",
+  "card_number",
+  "cardnumber",
+  "cvv",
+  "cvc",
+  "pin"
+];
+function createKeyMatcher(extra = []) {
+  const needles = [...DEFAULT_REDACT_KEYS, ...extra.map((k) => k.toLowerCase())];
+  return (key) => {
+    const lower = key.toLowerCase();
+    return needles.some((n) => lower.includes(n));
+  };
+}
+function redactValue(value, match) {
+  if (Array.isArray(value)) return value.map((v) => redactValue(v, match));
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = match(k) ? REDACTED : redactValue(v, match);
+    }
+    return out;
+  }
+  return value;
+}
+function redactQueryString(qs, match) {
+  if (!qs) return qs;
+  return qs.split("&").map((pair) => {
+    const eq = pair.indexOf("=");
+    if (eq === -1) return pair;
+    const rawKey = pair.slice(0, eq);
+    let key = rawKey;
+    try {
+      key = decodeURIComponent(rawKey.replace(/\+/g, " "));
+    } catch {
+    }
+    return match(key) ? `${rawKey}=${REDACTED}` : pair;
+  }).join("&");
+}
+function sanitizeBody(body, match) {
+  if (!body) return body;
+  const trimmed = body.trimStart();
+  if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+    try {
+      const parsed = JSON.parse(body);
+      return JSON.stringify(redactValue(parsed, match));
+    } catch {
+    }
+  }
+  if (body.includes("=") && !/\s/.test(body)) {
+    const redacted = redactQueryString(body, match);
+    if (redacted !== body) return redacted;
+  }
+  return body.replace(
+    /("?)([\w.-]+)\1\s*:\s*"(?:[^"\\]|\\.)*"/gi,
+    (full, q, key) => match(key) ? `${q}${key}${q}:"${REDACTED}"` : full
+  ).replace(/([\w.-]+)=([^&\s]+)/gi, (full, key) => match(key) ? `${key}=${REDACTED}` : full);
+}
+function sanitizeUrl(url, match) {
+  const qIdx = url.indexOf("?");
+  if (qIdx === -1) return url;
+  const base = url.slice(0, qIdx);
+  const query = url.slice(qIdx + 1);
+  const hashIdx = query.indexOf("#");
+  const qs = hashIdx === -1 ? query : query.slice(0, hashIdx);
+  const hash = hashIdx === -1 ? "" : query.slice(hashIdx);
+  const redacted = redactQueryString(qs, match);
+  return `${base}?${redacted}${hash}`;
+}
+function sanitizeHeaders(headers, match) {
+  if (!headers) return headers;
+  const out = {};
+  for (const [k, v] of Object.entries(headers)) {
+    out[k] = match(k) ? REDACTED : v;
+  }
+  return out;
+}
+
 // src/collectors/network.ts
 var MAX_ENTRIES3 = 50;
 var MAX_FULL_URL = 2e3;
@@ -938,6 +1032,7 @@ function extractContentType(headers) {
 function createNetworkCollector(extraBlockedHosts = [], options) {
   const maxEntries = options?.maxEntries ?? MAX_ENTRIES3;
   const maxResponseBody = options?.maxResponseBody ?? MAX_RESPONSE_BODY;
+  const matchSecret = createKeyMatcher(options?.redactKeys);
   const entries = [];
   const blocked = /* @__PURE__ */ new Set([...DEFAULT_BLOCKED_HOSTS, ...extraBlockedHosts]);
   let origFetch = null;
@@ -949,6 +1044,12 @@ function createNetworkCollector(extraBlockedHosts = [], options) {
   const seenUrls = /* @__PURE__ */ new Set();
   function push(entry) {
     seenUrls.add(entry.fullUrl ?? entry.url);
+    if (entry.fullUrl) entry.fullUrl = sanitizeUrl(entry.fullUrl, matchSecret);
+    entry.url = sanitizeUrl(entry.url, matchSecret);
+    entry.requestBody = sanitizeBody(entry.requestBody, matchSecret);
+    entry.responseBody = sanitizeBody(entry.responseBody, matchSecret);
+    entry.requestHeaders = sanitizeHeaders(entry.requestHeaders, matchSecret);
+    entry.responseHeaders = sanitizeHeaders(entry.responseHeaders, matchSecret);
     entries.push(entry);
     if (entries.length > maxEntries) entries.shift();
   }
@@ -1014,7 +1115,8 @@ function createNetworkCollector(extraBlockedHosts = [], options) {
           try {
             const clone = res.clone();
             clone.text().then((text) => {
-              entry.responseBody = text.length > maxResponseBody ? text.slice(0, maxResponseBody) + "\u2026" : text;
+              const truncated = text.length > maxResponseBody ? text.slice(0, maxResponseBody) + "\u2026" : text;
+              entry.responseBody = sanitizeBody(truncated, matchSecret);
               if (!entry.responseSize && text.length) entry.responseSize = text.length;
             }).catch(() => {
             });
@@ -1244,6 +1346,7 @@ function init(config) {
     enableReplay = false,
     replayBufferMs = DEFAULT_REPLAY_BUFFER_MS,
     blockedHosts = [],
+    redactKeys,
     frustration: frustrationOpts,
     onFrustration,
     _replayRecorder,
@@ -1267,7 +1370,7 @@ function init(config) {
   const allBlockedHosts = [...blockedHosts, ...flintHost ? [flintHost] : []];
   const consoleCol = enableConsole ? _collectors?.console?.() ?? createConsoleCollector() : null;
   consoleCol?.start();
-  const networkCol = enableNetwork ? _collectors?.network?.(allBlockedHosts) ?? createNetworkCollector(allBlockedHosts) : null;
+  const networkCol = enableNetwork ? _collectors?.network?.(allBlockedHosts, { redactKeys }) ?? createNetworkCollector(allBlockedHosts, { redactKeys }) : null;
   networkCol?.start();
   const formErrorsCol = enableFormErrors ? createFormErrorCollector() : null;
   if (formErrorsCol) {