@formo/analytics-react-native 1.0.2 → 1.1.0

package/lib/commonjs/utils/sanitize.js

@@ -0,0 +1,260 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.sanitizeUtm = exports.sanitizeTrafficSources = exports.sanitizeReferrer = exports.sanitizeRef = void 0;
+/**
+ * Traffic-source value sanitization.
+ *
+ * Ported from the Formo web SDK, where vulnerability scanners (e.g. Acunetix)
+ * crawling customer sites injected XSS probes such as
+ * `javascript:domxssExecutionSink(1,"'\"><xsstag>()locxss")` or
+ * `<script>alert(1)</script>` into every query parameter. Without validation
+ * those payloads are captured verbatim as utm_* / ref values, persisted as
+ * sticky session traffic sources, and pollute attribution reporting.
+ *
+ * React Native has the same exposure through two attacker-reachable inputs:
+ *
+ * - Deep links handed to `setTrafficSourceFromUrl`. Anyone who can get a user
+ *   to open `myapp://x?utm_source=<script>alert(1)</script>` controls the
+ *   value verbatim, and it is persisted for the whole session.
+ * - The Android Play Install Referrer string, which is derived from the
+ *   `referrer` parameter of a Play Store URL and is likewise attacker-supplied.
+ *
+ * Each field class gets the tightest rule its legitimate values allow:
+ *
+ * - Referral codes are short tokens; >99.5% of production values match the
+ *   strict pattern and none of the remainder are legitimate (scanner
+ *   payloads, mangled encodings, URLs glued to codes).
+ * - UTM values are free-form (spaces, unicode, `+` are legitimate), so they
+ *   only reject markup/quote characters, dangerous URL schemes, control and
+ *   zero-width characters, and absurd lengths.
+ * - `referrer` diverges from the web SDK, which leaves it untouched because
+ *   there it is a browser-set `document.referrer` already handled by redactUrl.
+ *   In React Native `referrer` holds the raw deep-link URL the attacker
+ *   supplied, so sanitizing only the utm_ and ref fields would still let the
+ *   payload through. It gets a URL-sized length budget and is checked both raw
+ *   and percent-decoded — a URL encodes its payload, so a raw-only check would
+ *   pass `?utm_source=%3Cscript%3E` straight through.
+ *
+ * Invalid values are dropped to "" — the same representation as "parameter
+ * absent" — rather than repaired, so a poisoned value can never be persisted
+ * or reported.
+ *
+ * The web SDK additionally sanitizes ad-platform click IDs (gclid, fbclid,
+ * ...). This SDK does not capture them, so that rule is intentionally absent;
+ * add it here alongside the capture if click IDs are ever supported.
+ */
+
+const REF_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
+const UTM_MAX_LENGTH = 255;
+
+// URLs are legitimately much longer than a UTM value, but not unbounded —
+// this is well above any real deep link and still bounds what gets persisted.
+const REFERRER_MAX_LENGTH = 2_048;
+
+// Markup/quote/backslash characters plus C0/C1 control characters and
+// zero-width / bidi / BOM / replacement characters (mangled-encoding
+// markers). Explicit ranges instead of \p{C} to avoid the `u`-flag
+// property-escape requirement.
+const FORBIDDEN_CHARS = /[<>"'`\\\u0000-\u001f\u007f-\u009f\u200b-\u200f\u2028-\u202e\u2060\ufeff\ufffd]/;
+
+// Applied to the percent-DECODED form of a referrer. Narrower than the raw
+// set on purpose: a decoded query value legitimately contains quotes and
+// backslashes (`?q=%22running%20shoes%22`), and those are harmless in an
+// analytics field. Markup and invisible characters are what indicate an
+// injected payload rather than a real deep link.
+const DECODED_FORBIDDEN_CHARS = /[<>\u0000-\u001f\u007f-\u009f\u200b-\u200f\u2028-\u202e\u2060\ufeff\ufffd]/;
+
+// Values smuggling an executable/URL scheme, e.g. `javascript:alert(1)`.
+const FORBIDDEN_SCHEME_PREFIX = /^\s*(javascript|data|vbscript):/i;
+
+/**
+ * Whether a value smuggles a dangerous scheme, anywhere a URL parser would
+ * consider the start of a value.
+ *
+ * The pattern is anchored, so testing the string as a whole is not enough once
+ * decoding can reveal separators that were themselves encoded: with the `=` in
+ * `?utm_source%3Djavascript%253Aalert(1)` encoded, URLSearchParams reports one
+ * key that decodes to `utm_source=javascript:alert(1)`, which the anchored test
+ * never matches. Splitting on the separators after decoding puts the payload
+ * back at the start of a segment.
+ */
+const hasForbiddenScheme = value => FORBIDDEN_SCHEME_PREFIX.test(value) || value.split(/[?&=#]/).some(segment => FORBIDDEN_SCHEME_PREFIX.test(segment));
+
+/**
+ * Percent-decode one layer without ever throwing. `decodeURIComponent` rejects
+ * the entire string on a single malformed escape (a stray `%`), which would let
+ * `...%3Cscript%3E%` skip the decoded checks completely.
+ *
+ * Each *run* of consecutive escapes is decoded as a unit rather than byte by
+ * byte, because a multi-byte character spans several escapes: `%E3%80%80` is
+ * one ideographic space, and decoding `%E3` alone throws. Byte-wise decoding
+ * would therefore never produce the whitespace that lets `^\s*javascript:`
+ * match `%E3%80%80javascript%3Aalert(1)`. A run that is not valid UTF-8, and
+ * any stray `%`, is left as-is.
+ */
+const decodeRun = run => {
+  try {
+    return decodeURIComponent(run);
+  } catch {
+    // One invalid byte anywhere in the run would otherwise blind the whole
+    // run — appending `%C0` next to `%3C` is enough to hide a `<`. Decode the
+    // largest valid group at each position instead, longest first so multi-byte
+    // sequences (up to four escapes) still group correctly, and pass through
+    // any escape that cannot be decoded at all.
+    const escapes = run.match(/%[0-9A-Fa-f]{2}/g) ?? [];
+    let out = "";
+    let i = 0;
+    while (i < escapes.length) {
+      let taken = 0;
+      for (let len = Math.min(4, escapes.length - i); len >= 1; len--) {
+        try {
+          out += decodeURIComponent(escapes.slice(i, i + len).join(""));
+          taken = len;
+          break;
+        } catch {
+          // Try a shorter group.
+        }
+      }
+      if (taken === 0) {
+        out += escapes[i];
+        taken = 1;
+      }
+      i += taken;
+    }
+    return out;
+  }
+};
+const decodeOnce = value => value.replace(/(?:%[0-9A-Fa-f]{2})+/g, decodeRun);
+
+/**
+ * Decode to a fixed point, so a payload encoded any number of times
+ * (`%253Cscript%253E`, `%25252525253Cscript...`) is compared in a form the
+ * markup check can see.
+ *
+ * The bound is the input length rather than a fixed number of layers, because
+ * a fixed number is reachable: re-encoding `javascript:alert(1)` only grows the
+ * single `%` by two characters per layer, so 66 layers fit in 151 characters
+ * and any small constant can be encoded past. Every productive pass turns a
+ * three-character escape into one character, so a string of length n admits
+ * fewer than n productive passes — this bound is always sufficient and still
+ * guarantees termination.
+ */
+const decodeDeep = value => {
+  let current = value;
+  for (let i = 0; i < value.length; i++) {
+    const next = decodeOnce(current);
+    if (next === current) break;
+    current = next;
+  }
+  return current;
+};
+const sanitizeRef = value => REF_PATTERN.test(value) ? value : "";
+
+/**
+ * URLSearchParams has already decoded one layer by the time a UTM value gets
+ * here, so a payload encoded twice arrives still encoded:
+ * `utm_source=%253Cscript%253E` reads as the literal `%3Cscript%3E`, which
+ * contains no raw markup and would pass a raw-only check. Test the decoded
+ * form as well.
+ */
+exports.sanitizeRef = sanitizeRef;
+const sanitizeUtm = value => {
+  if (value.length > UTM_MAX_LENGTH) return "";
+  if (FORBIDDEN_CHARS.test(value) || hasForbiddenScheme(value)) {
+    return "";
+  }
+  const decoded = decodeDeep(value);
+  if (DECODED_FORBIDDEN_CHARS.test(decoded) || hasForbiddenScheme(decoded)) {
+    return "";
+  }
+  return value;
+};
+
+/**
+ * The decoded parts of a referrer's query string — keys as well as values.
+ * Handles both a full URL ("myapp://x?utm_source=...") and the bare query
+ * string the Android install referrer supplies ("utm_source=...&utm_medium=").
+ * Returns nothing when there is no query to read; the caller still checks the
+ * whole string.
+ *
+ * Keys matter because a parameter with no "=" parses entirely as a key with an
+ * empty value: "?%6Aavascript:alert(1)" would otherwise contribute nothing to
+ * inspect.
+ */
+exports.sanitizeUtm = sanitizeUtm;
+const referrerParamParts = value => {
+  const queryStart = value.indexOf("?");
+  const query = queryStart === -1 ? value : value.slice(queryStart + 1);
+  if (!query || queryStart === -1 && !query.includes("=")) return [];
+  try {
+    // URLSearchParams decodes leniently and does not throw on a stray "%".
+    const parts = [];
+    for (const [key, paramValue] of new URLSearchParams(query)) {
+      parts.push(key, paramValue);
+    }
+    return parts;
+  } catch {
+    return [];
+  }
+};
+
+/**
+ * A URL carries its payload percent-encoded — `Linking` and the browser both
+ * encode `<` and `>` — so a raw-only check would pass
+ * `?utm_source=%3Cscript%3E` straight through.
+ *
+ * Checked three ways, because pattern-matching the URL as one opaque string
+ * misses what a structural read catches: the whole value raw, the whole value
+ * decoded, and each decoded query part — keys included — on its own. The last
+ * is what catches a smuggled scheme, since FORBIDDEN_SCHEME_PREFIX is anchored
+ * and `?utm_source=javascript:alert(1)` only matches once that parameter is
+ * read apart from the `myapp://` URL containing it.
+ */
+const sanitizeReferrer = value => {
+  if (value.length > REFERRER_MAX_LENGTH) return "";
+  if (FORBIDDEN_CHARS.test(value) || hasForbiddenScheme(value)) {
+    return "";
+  }
+  const decodedWhole = decodeDeep(value);
+  if (DECODED_FORBIDDEN_CHARS.test(decodedWhole) || hasForbiddenScheme(decodedWhole)) {
+    return "";
+  }
+  for (const part of referrerParamParts(value)) {
+    const decoded = decodeDeep(part);
+    if (DECODED_FORBIDDEN_CHARS.test(decoded) || hasForbiddenScheme(decoded)) {
+      return "";
+    }
+  }
+  return value;
+};
+
+/**
+ * Sanitize every traffic-source field of a (possibly sparse) traffic-source
+ * object. Unknown keys fall through to the UTM rule, the most permissive of
+ * the value rules.
+ */
+exports.sanitizeReferrer = sanitizeReferrer;
+const sanitizeTrafficSources = trafficSources => {
+  const result = {
+    ...trafficSources
+  };
+  for (const key of Object.keys(result)) {
+    const value = result[key];
+    if (typeof value !== "string" || value === "") {
+      continue;
+    }
+    if (key === "ref") {
+      result[key] = sanitizeRef(value);
+    } else if (key === "referrer") {
+      result[key] = sanitizeReferrer(value);
+    } else {
+      result[key] = sanitizeUtm(value);
+    }
+  }
+  return result;
+};
+exports.sanitizeTrafficSources = sanitizeTrafficSources;
+//# sourceMappingURL=sanitize.js.map

package/lib/commonjs/utils/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["REF_PATTERN","UTM_MAX_LENGTH","REFERRER_MAX_LENGTH","FORBIDDEN_CHARS","DECODED_FORBIDDEN_CHARS","FORBIDDEN_SCHEME_PREFIX","hasForbiddenScheme","value","test","split","some","segment","decodeRun","run","decodeURIComponent","escapes","match","out","i","length","taken","len","Math","min","slice","join","decodeOnce","replace","decodeDeep","current","next","sanitizeRef","exports","sanitizeUtm","decoded","referrerParamParts","queryStart","indexOf","query","includes","parts","key","paramValue","URLSearchParams","push","sanitizeReferrer","decodedWhole","part","sanitizeTrafficSources","trafficSources","result","Object","keys"],"sourceRoot":"../../../src","sources":["utils/sanitize.ts"],"mappings":";;;;;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,MAAMA,WAAW,GAAG,wBAAwB;AAE5C,MAAMC,cAAc,GAAG,GAAG;;AAE1B;AACA;AACA,MAAMC,mBAAmB,GAAG,KAAK;;AAEjC;AACA;AACA;AACA;AACA,MAAMC,eAAe,GACnB,iFAAiF;;AAEnF;AACA;AACA;AACA;AACA;AACA,MAAMC,uBAAuB,GAC3B,4EAA4E;;AAE9E;AACA,MAAMC,uBAAuB,GAAG,kCAAkC;;AAElE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,kBAAkB,GAAIC,KAAa,IACvCF,uBAAuB,CAACG,IAAI,CAACD,KAAK,CAAC,IACnCA,KAAK,CAACE,KAAK,CAAC,QAAQ,CAAC,CAACC,IAAI,CAAEC,OAAO,IAAKN,uBAAuB,CAACG,IAAI,CAACG,OAAO,CAAC,CAAC;;AAEhF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,SAAS,GAAIC,GAAW,IAAa;EACzC,IAAI;IACF,OAAOC,kBAAkB,CAACD,GAAG,CAAC;EAChC,CAAC,CAAC,MAAM;IACN;IACA;IACA;IACA;IACA;IACA,MAAME,OAAO,GAAGF,GAAG,CAACG,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE;IACnD,IAAIC,GAAG,GAAG,EAAE;IACZ,IAAIC,CAAC,GAAG,CAAC;IACT,OAAOA,CAAC,GAAGH,OAAO,CAACI,MAAM,EAAE;MACzB,IAAIC,KAAK,GAAG,CAAC;MACb,KAAK,IAAIC,GAAG,GAAGC,IAAI,CAACC,GAAG,CAAC,CAAC,EAAER,OAAO,CAACI,MAAM,GAAGD,CAAC,CAAC,EAAEG,GAAG,IAAI,CAAC,EAAEA,GAAG,EAAE,EAAE;QAC/D,IAAI;UACFJ,GAAG,IAAIH,kBAAkB,CAACC,OAAO,CAACS,KAAK,CAACN,CAAC,EAAEA,CAAC,GAAGG,GAAG,CAAC,CAACI,IAAI,CAAC,EAAE,CAAC,CAAC;UAC7DL,KAAK,GAAGC,GAAG;UACX;QACF,CAAC,CAAC,MAAM;UACN;QAAA;MAEJ;MACA,IAAID,KAAK,KAAK,CAAC,EAAE;QACfH,GAAG,IAAIF,OAAO,CAACG,CAAC,CAAC;QACjBE,KAAK,GAAG,CAAC;MACX;MACAF,CAAC,IAAIE,KAAK;IACZ;IACA,OAAOH,GAAG;EACZ;AACF,CAAC;AAED,MAAMS,UAAU,GAAInB,KAAa,IAC/BA,KAAK,CAACoB,OAAO,CAAC,uBAAuB,EAAEf,SAAS,CAAC;;AAEnD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMgB,UAAU,GAAIrB,KAAa,IAAa;EAC5C,IAAIsB,OAAO,GAAGtB,KAAK;EACnB,KAAK,IAAIW,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAGX,KAAK,CAACY,MAAM,EAAED,CAAC,EAAE,EAAE;IACrC,MAAMY,IAAI,GAAGJ,UAAU,CAACG,OAAO,CAAC;IAChC,IAAIC,IAAI,KAAKD,OAAO,EAAE;IACtBA,OAAO,GAAGC,IAAI;EAChB;EACA,OAAOD,OAAO;AAChB,CAAC;AAED,MAAME,WAAW,GAAIxB,KAAa,IAChCP,WAAW,CAACQ,IAAI,CAACD,KAAK,CAAC,GAAGA,KAAK,GAAG,EAAE;;AAEtC;AACA;AACA;AACA;AACA;AACA;AACA;AANAyB,OAAA,CAAAD,WAAA,GAAAA,WAAA;AAOA,MAAME,WAAW,GAAI1B,KAAa,IAAa;EAC7C,IAAIA,KAAK,CAACY,MAAM,GAAGlB,cAAc,EAAE,OAAO,EAAE;EAC5C,IAAIE,eAAe,CAACK,IAAI,CAACD,KAAK,CAAC,IAAID,kBAAkB,CAACC,KAAK,CAAC,EAAE;IAC5D,OAAO,EAAE;EACX;EACA,MAAM2B,OAAO,GAAGN,UAAU,CAACrB,KAAK,CAAC;EACjC,IACEH,uBAAuB,CAACI,IAAI,CAAC0B,OAAO,CAAC,IACrC5B,kBAAkB,CAAC4B,OAAO,CAAC,EAC3B;IACA,OAAO,EAAE;EACX;EACA,OAAO3B,KAAK;AACd,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAVAyB,OAAA,CAAAC,WAAA,GAAAA,WAAA;AAWA,MAAME,kBAAkB,GAAI5B,KAAa,IAAe;EACtD,MAAM6B,UAAU,GAAG7B,KAAK,CAAC8B,OAAO,CAAC,GAAG,CAAC;EACrC,MAAMC,KAAK,GAAGF,UAAU,KAAK,CAAC,CAAC,GAAG7B,KAAK,GAAGA,KAAK,CAACiB,KAAK,CAACY,UAAU,GAAG,CAAC,CAAC;EACrE,IAAI,CAACE,KAAK,IAAKF,UAAU,KAAK,CAAC,CAAC,IAAI,CAACE,KAAK,CAACC,QAAQ,CAAC,GAAG,CAAE,EAAE,OAAO,EAAE;EACpE,IAAI;IACF;IACA,MAAMC,KAAe,GAAG,EAAE;IAC1B,KAAK,MAAM,CAACC,GAAG,EAAEC,UAAU,CAAC,IAAI,IAAIC,eAAe,CAACL,KAAK,CAAC,EAAE;MAC1DE,KAAK,CAACI,IAAI,CAACH,GAAG,EAAEC,UAAU,CAAC;IAC7B;IACA,OAAOF,KAAK;EACd,CAAC,CAAC,MAAM;IACN,OAAO,EAAE;EACX;AACF,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMK,gBAAgB,GAAItC,KAAa,IAAa;EAClD,IAAIA,KAAK,CAACY,MAAM,GAAGjB,mBAAmB,EAAE,OAAO,EAAE;EACjD,IAAIC,eAAe,CAACK,IAAI,CAACD,KAAK,CAAC,IAAID,kBAAkB,CAACC,KAAK,CAAC,EAAE;IAC5D,OAAO,EAAE;EACX;EAEA,MAAMuC,YAAY,GAAGlB,UAAU,CAACrB,KAAK,CAAC;EACtC,IACEH,uBAAuB,CAACI,IAAI,CAACsC,YAAY,CAAC,IAC1CxC,kBAAkB,CAACwC,YAAY,CAAC,EAChC;IACA,OAAO,EAAE;EACX;EAEA,KAAK,MAAMC,IAAI,IAAIZ,kBAAkB,CAAC5B,KAAK,CAAC,EAAE;IAC5C,MAAM2B,OAAO,GAAGN,UAAU,CAACmB,IAAI,CAAC;IAChC,IACE3C,uBAAuB,CAACI,IAAI,CAAC0B,OAAO,CAAC,IACrC5B,kBAAkB,CAAC4B,OAAO,CAAC,EAC3B;MACA,OAAO,EAAE;IACX;EACF;EAEA,OAAO3B,KAAK;AACd,CAAC;;AAED;AACA;AACA;AACA;AACA;AAJAyB,OAAA,CAAAa,gBAAA,GAAAA,gBAAA;AAKO,MAAMG,sBAAsB,GACjCC,cAAiB,IACX;EACN,MAAMC,MAA+B,GAAG;IAAE,GAAGD;EAAe,CAAC;EAC7D,KAAK,MAAMR,GAAG,IAAIU,MAAM,CAACC,IAAI,CAACF,MAAM,CAAC,EAAE;IACrC,MAAM3C,KAAK,GAAG2C,MAAM,CAACT,GAAG,CAAC;IACzB,IAAI,OAAOlC,KAAK,KAAK,QAAQ,IAAIA,KAAK,KAAK,EAAE,EAAE;MAC7C;IACF;IACA,IAAIkC,GAAG,KAAK,KAAK,EAAE;MACjBS,MAAM,CAACT,GAAG,CAAC,GAAGV,WAAW,CAACxB,KAAK,CAAC;IAClC,CAAC,MAAM,IAAIkC,GAAG,KAAK,UAAU,EAAE;MAC7BS,MAAM,CAACT,GAAG,CAAC,GAAGI,gBAAgB,CAACtC,KAAK,CAAC;IACvC,CAAC,MAAM;MACL2C,MAAM,CAACT,GAAG,CAAC,GAAGR,WAAW,CAAC1B,KAAK,CAAC;IAClC;EACF;EACA,OAAO2C,MAAM;AACf,CAAC;AAAClB,OAAA,CAAAgB,sBAAA,GAAAA,sBAAA","ignoreList":[]}

package/lib/commonjs/utils/trafficSource.js

@@ -13,6 +13,7 @@ exports.updateStoredTrafficSource = updateStoredTrafficSource;
 var _index = require("../lib/logger/index.js");
 var _index2 = require("../lib/storage/index.js");
 var _index3 = require("../constants/index.js");
+var _sanitize = require("./sanitize.js");
 /**
  * Traffic Source Utilities
  * Parse UTM parameters and referral information from URLs
@@ -21,8 +22,14 @@ var _index3 = require("../constants/index.js");
 /**
  * Parse UTM parameters and referral info from URL
  * Supports both web URLs (https://) and deep link URLs (myapp://)
+ *
+ * Every return path is sanitized (see ./sanitize) so scanner-injected or
+ * hand-crafted payloads in a deep link can never be persisted or reported.
  */
 function parseTrafficSource(url, customRefParams, pathPattern) {
+  return (0, _sanitize.sanitizeTrafficSources)(extractTrafficSource(url, customRefParams, pathPattern));
+}
+function extractTrafficSource(url, customRefParams, pathPattern) {
   try {
     // Handle deep link URLs that may not have standard URL format
     let urlObj;
@@ -110,7 +117,9 @@ function getStoredTrafficSource() {
   try {
     const stored = (0, _index2.storage)().get(_index3.SESSION_TRAFFIC_SOURCE_KEY);
     if (stored && typeof stored === "string") {
-      return JSON.parse(stored);
+      // Sanitize on the way out too, so values persisted by a pre-sanitization
+      // SDK version are flushed rather than replayed onto every event.
+      return (0, _sanitize.sanitizeTrafficSources)(JSON.parse(stored));
     }
   } catch (error) {
     _index.logger.debug("Failed to get stored traffic source:", error);

package/lib/commonjs/utils/trafficSource.js.map

@@ -1 +1 @@
-{"version":3,"names":["_index","require","_index2","_index3","parseTrafficSource","url","customRefParams","pathPattern","urlObj","URL","queryStart","indexOf","referrer","substring","params","searchParams","trafficSource","has","utm_source","get","utm_medium","utm_campaign","utm_term","utm_content","defaultRefParams","refParams","Set","param","ref","pathRegex","RegExp","pathname","match","e","logger","error","storeTrafficSource","hasData","storage","set","SESSION_TRAFFIC_SOURCE_KEY","JSON","stringify","debug","getStoredTrafficSource","stored","parse","undefined","clearTrafficSource","remove","mergeWithStoredTrafficSource","context","TRAFFIC_SOURCE_KEYS","updateStoredTrafficSource","incoming","existing","merged","key","incomingVal","existingVal","mergeTrafficSourceFill","changed","value","Object","entries","String"],"sourceRoot":"../../../src","sources":["utils/trafficSource.ts"],"mappings":";;;;;;;;;;;;AAKA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,OAAA,GAAAD,OAAA;AACA,IAAAE,OAAA,GAAAF,OAAA;AAPA;AACA;AACA;AACA;;AAOA;AACA;AACA;AACA;AACO,SAASG,kBAAkBA,CAChCC,GAAW,EACXC,eAA0B,EAC1BC,WAAoB,EACK;EACzB,IAAI;IACF;IACA,IAAIC,MAAW;IAEf,IAAI;MACFA,MAAM,GAAG,IAAIC,GAAG,CAACJ,GAAG,CAAC;IACvB,CAAC,CAAC,MAAM;MACN;MACA,MAAMK,UAAU,GAAGL,GAAG,CAACM,OAAO,CAAC,GAAG,CAAC;MACnC,IAAID,UAAU,KAAK,CAAC,CAAC,EAAE;QACrB,OAAO;UAAEE,QAAQ,EAAEP;QAAI,CAAC;MAC1B;;MAEA;MACAG,MAAM,GAAG,IAAIC,GAAG,CAAC,mBAAmBJ,GAAG,CAACQ,SAAS,CAACH,UAAU,CAAC,EAAE,CAAC;IAClE;IAEA,MAAMI,MAAM,GAAGN,MAAM,CAACO,YAAY;IAClC,MAAMC,aAAsC,GAAG,CAAC,CAAC;;IAEjD;IACA,IAAIF,MAAM,CAACG,GAAG,CAAC,YAAY,CAAC,EAAED,aAAa,CAACE,UAAU,GAAGJ,MAAM,CAACK,GAAG,CAAC,YAAY,CAAE;IAClF,IAAIL,MAAM,CAACG,GAAG,CAAC,YAAY,CAAC,EAAED,aAAa,CAACI,UAAU,GAAGN,MAAM,CAACK,GAAG,CAAC,YAAY,CAAE;IAClF,IAAIL,MAAM,CAACG,GAAG,CAAC,cAAc,CAAC,EAAED,aAAa,CAACK,YAAY,GAAGP,MAAM,CAACK,GAAG,CAAC,cAAc,CAAE;IACxF,IAAIL,MAAM,CAACG,GAAG,CAAC,UAAU,CAAC,EAAED,aAAa,CAACM,QAAQ,GAAGR,MAAM,CAACK,GAAG,CAAC,UAAU,CAAE;IAC5E,IAAIL,MAAM,CAACG,GAAG,CAAC,aAAa,CAAC,EAAED,aAAa,CAACO,WAAW,GAAGT,MAAM,CAACK,GAAG,CAAC,aAAa,CAAE;;IAErF;IACA,MAAMK,gBAAgB,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,CAAC;IACxE,MAAMC,SAAS,GAAGnB,eAAe,GAC7B,CAAC,GAAG,IAAIoB,GAAG,CAAC,CAAC,GAAGF,gBAAgB,EAAE,GAAGlB,eAAe,CAAC,CAAC,CAAC,GACvDkB,gBAAgB;IACpB,KAAK,MAAMG,KAAK,IAAIF,SAAS,EAAE;MAC7B,IAAIX,MAAM,CAACG,GAAG,CAACU,KAAK,CAAC,EAAE;QACrBX,aAAa,CAACY,GAAG,GAAGd,MAAM,CAACK,GAAG,CAACQ,KAAK,CAAE;QACtC;MACF;IACF;;IAEA;IACA,IAAIpB,WAAW,IAAI,CAACS,aAAa,CAACY,GAAG,EAAE;MACrC,IAAI;QACF,MAAMC,SAAS,GAAG,IAAIC,MAAM,CAACvB,WAAW,CAAC;QACzC,MAAMwB,QAAQ,GAAGvB,MAAM,CAACuB,QAAQ;QAChC,MAAMC,KAAK,GAAGD,QAAQ,CAACC,KAAK,CAACH,SAAS,CAAC;QACvC,IAAIG,KAAK,IAAIA,KAAK,CAAC,CAAC,CAAC,EAAE;UACrBhB,aAAa,CAACY,GAAG,GAAGI,KAAK,CAAC,CAAC,CAAC;QAC9B;MACF,CAAC,CAAC,OAAOC,CAAC,EAAE;QACVC,aAAM,CAACC,KAAK,CAAC,yCAAyC,EAAEF,CAAC,CAAC;MAC5D;IACF;;IAEA;IACAjB,aAAa,CAACJ,QAAQ,GAAGP,GAAG;IAE5B,OAAOW,aAAa;EACtB,CAAC,CAAC,OAAOmB,KAAK,EAAE;IACdD,aAAM,CAACC,KAAK,CAAC,wCAAwC,EAAEA,KAAK,CAAC;IAC7D,OAAO;MAAEvB,QAAQ,EAAEP;IAAI,CAAC;EAC1B;AACF;;AAEA;AACA;AACA;AACA;AACO,SAAS+B,kBAAkBA,CAACpB,aAAsC,EAAQ;EAC/E,IAAI;IACF;IACA,MAAMqB,OAAO,GACXrB,aAAa,CAACE,UAAU,IACxBF,aAAa,CAACI,UAAU,IACxBJ,aAAa,CAACK,YAAY,IAC1BL,aAAa,CAACM,QAAQ,IACtBN,aAAa,CAACO,WAAW,IACzBP,aAAa,CAACY,GAAG;IAEnB,IAAIS,OAAO,IAAIrB,aAAa,CAACJ,QAAQ,EAAE;MACrC,IAAA0B,eAAO,EAAC,CAAC,CAACC,GAAG,CAACC,kCAA0B,EAAEC,IAAI,CAACC,SAAS,CAAC1B,aAAa,CAAC,CAAC;MACxEkB,aAAM,CAACS,KAAK,CAAC,wBAAwB,EAAE3B,aAAa,CAAC;IACvD;EACF,CAAC,CAAC,OAAOmB,KAAK,EAAE;IACdD,aAAM,CAACC,KAAK,CAAC,+BAA+B,EAAEA,KAAK,CAAC;EACtD;AACF;;AAEA;AACA;AACA;AACA;AACO,SAASS,sBAAsBA,CAAA,EAAwC;EAC5E,IAAI;IACF,MAAMC,MAAM,GAAG,IAAAP,eAAO,EAAC,CAAC,CAACnB,GAAG,CAACqB,kCAA0B,CAAC;IACxD,IAAIK,MAAM,IAAI,OAAOA,MAAM,KAAK,QAAQ,EAAE;MACxC,OAAOJ,IAAI,CAACK,KAAK,CAACD,MAAM,CAAC;IAC3B;EACF,CAAC,CAAC,OAAOV,KAAK,EAAE;IACdD,aAAM,CAACS,KAAK,CAAC,sCAAsC,EAAER,KAAK,CAAC;EAC7D;EACA,OAAOY,SAAS;AAClB;;AAEA;AACA;AACA;AACO,SAASC,kBAAkBA,CAAA,EAAS;EACzC,IAAI;IACF,IAAAV,eAAO,EAAC,CAAC,CAACW,MAAM,CAACT,kCAA0B,CAAC;IAC5CN,aAAM,CAACS,KAAK,CAAC,qCAAqC,CAAC;EACrD,CAAC,CAAC,OAAOR,KAAK,EAAE;IACdD,aAAM,CAACC,KAAK,CAAC,gCAAgC,EAAEA,KAAK,CAAC;EACvD;AACF;;AAEA;AACA;AACA;AACA;AACO,SAASe,4BAA4BA,CAC1CC,OAAiC,EACR;EACzB,MAAMN,MAAM,GAAGD,sBAAsB,CAAC,CAAC;EAEvC,IAAI,CAACC,MAAM,EAAE;IACX,OAAOM,OAAO,IAAI,CAAC,CAAC;EACtB;;EAEA;EACA,OAAO;IACL,GAAGN,MAAM;IACT,IAAIM,OAAO,IAAI,CAAC,CAAC;EACnB,CAAC;AACH;;AAEA;AACA,MAAMC,mBAA6C,GAAG,CACpD,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,UAAU,EACV,aAAa,EACb,KAAK,EACL,UAAU,CACX;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,yBAAyBA,CACvCC,QAAiC,EAC3B;EACN,IAAI;IACF,MAAMC,QAAQ,GAAGX,sBAAsB,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAMY,MAA+B,GAAG,CAAC,CAAC;IAE1C,KAAK,MAAMC,GAAG,IAAIL,mBAAmB,EAAE;MACrC,MAAMM,WAAW,GAAGJ,QAAQ,CAACG,GAAG,CAAC;MACjC,MAAME,WAAW,GAAGJ,QAAQ,CAACE,GAAG,CAAC;MACjC,IAAIC,WAAW,EAAE;QACfF,MAAM,CAACC,GAAG,CAAC,GAAGC,WAAW;MAC3B,CAAC,MAAM,IAAIC,WAAW,EAAE;QACtBH,MAAM,CAACC,GAAG,CAAC,GAAGE,WAAW;MAC3B;IACF;IAEAvB,kBAAkB,CAACoB,MAAM,CAAC;EAC5B,CAAC,CAAC,OAAOrB,KAAK,EAAE;IACdD,aAAM,CAACC,KAAK,CAAC,gCAAgC,EAAEA,KAAK,CAAC;EACvD;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,SAASyB,sBAAsBA,CACpCN,QAAiC,EAC3B;EACN,IAAI;IACF,MAAMC,QAAQ,GAAGX,sBAAsB,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAMY,MAA+B,GAAG;MAAE,GAAGD;IAAS,CAAC;IACvD,IAAIM,OAAO,GAAG,KAAK;IAEnB,KAAK,MAAM,CAACJ,GAAG,EAAEK,KAAK,CAAC,IAAIC,MAAM,CAACC,OAAO,CAACV,QAAQ,CAAC,EAAE;MACnD,IAAI,CAACQ,KAAK,EAAE,SAAS,CAAC;MACtB,MAAMP,QAAQ,GAAGC,MAAM,CAACC,GAAG,CAAyB;MACpD,IAAIF,QAAQ,KAAKR,SAAS,IAAIQ,QAAQ,KAAK,IAAI,IAAIA,QAAQ,KAAK,EAAE,EAAE;QAClEC,MAAM,CAACC,GAAG,CAAyB,GAAGQ,MAAM,CAACH,KAAK,CAAC;QACnDD,OAAO,GAAG,IAAI;MAChB;IACF;IAEA,IAAIA,OAAO,EAAE;MACXzB,kBAAkB,CAACoB,MAAM,CAAC;IAC5B;EACF,CAAC,CAAC,OAAOrB,KAAK,EAAE;IACdD,aAAM,CAACC,KAAK,CAAC,+BAA+B,EAAEA,KAAK,CAAC;EACtD;AACF","ignoreList":[]}
+{"version":3,"names":["_index","require","_index2","_index3","_sanitize","parseTrafficSource","url","customRefParams","pathPattern","sanitizeTrafficSources","extractTrafficSource","urlObj","URL","queryStart","indexOf","referrer","substring","params","searchParams","trafficSource","has","utm_source","get","utm_medium","utm_campaign","utm_term","utm_content","defaultRefParams","refParams","Set","param","ref","pathRegex","RegExp","pathname","match","e","logger","error","storeTrafficSource","hasData","storage","set","SESSION_TRAFFIC_SOURCE_KEY","JSON","stringify","debug","getStoredTrafficSource","stored","parse","undefined","clearTrafficSource","remove","mergeWithStoredTrafficSource","context","TRAFFIC_SOURCE_KEYS","updateStoredTrafficSource","incoming","existing","merged","key","incomingVal","existingVal","mergeTrafficSourceFill","changed","value","Object","entries","String"],"sourceRoot":"../../../src","sources":["utils/trafficSource.ts"],"mappings":";;;;;;;;;;;;AAKA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,OAAA,GAAAD,OAAA;AACA,IAAAE,OAAA,GAAAF,OAAA;AACA,IAAAG,SAAA,GAAAH,OAAA;AARA;AACA;AACA;AACA;;AAQA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASI,kBAAkBA,CAChCC,GAAW,EACXC,eAA0B,EAC1BC,WAAoB,EACK;EACzB,OAAO,IAAAC,gCAAsB,EAC3BC,oBAAoB,CAACJ,GAAG,EAAEC,eAAe,EAAEC,WAAW,CACxD,CAAC;AACH;AAEA,SAASE,oBAAoBA,CAC3BJ,GAAW,EACXC,eAA0B,EAC1BC,WAAoB,EACK;EACzB,IAAI;IACF;IACA,IAAIG,MAAW;IAEf,IAAI;MACFA,MAAM,GAAG,IAAIC,GAAG,CAACN,GAAG,CAAC;IACvB,CAAC,CAAC,MAAM;MACN;MACA,MAAMO,UAAU,GAAGP,GAAG,CAACQ,OAAO,CAAC,GAAG,CAAC;MACnC,IAAID,UAAU,KAAK,CAAC,CAAC,EAAE;QACrB,OAAO;UAAEE,QAAQ,EAAET;QAAI,CAAC;MAC1B;;MAEA;MACAK,MAAM,GAAG,IAAIC,GAAG,CAAC,mBAAmBN,GAAG,CAACU,SAAS,CAACH,UAAU,CAAC,EAAE,CAAC;IAClE;IAEA,MAAMI,MAAM,GAAGN,MAAM,CAACO,YAAY;IAClC,MAAMC,aAAsC,GAAG,CAAC,CAAC;;IAEjD;IACA,IAAIF,MAAM,CAACG,GAAG,CAAC,YAAY,CAAC,EAAED,aAAa,CAACE,UAAU,GAAGJ,MAAM,CAACK,GAAG,CAAC,YAAY,CAAE;IAClF,IAAIL,MAAM,CAACG,GAAG,CAAC,YAAY,CAAC,EAAED,aAAa,CAACI,UAAU,GAAGN,MAAM,CAACK,GAAG,CAAC,YAAY,CAAE;IAClF,IAAIL,MAAM,CAACG,GAAG,CAAC,cAAc,CAAC,EAAED,aAAa,CAACK,YAAY,GAAGP,MAAM,CAACK,GAAG,CAAC,cAAc,CAAE;IACxF,IAAIL,MAAM,CAACG,GAAG,CAAC,UAAU,CAAC,EAAED,aAAa,CAACM,QAAQ,GAAGR,MAAM,CAACK,GAAG,CAAC,UAAU,CAAE;IAC5E,IAAIL,MAAM,CAACG,GAAG,CAAC,aAAa,CAAC,EAAED,aAAa,CAACO,WAAW,GAAGT,MAAM,CAACK,GAAG,CAAC,aAAa,CAAE;;IAErF;IACA,MAAMK,gBAAgB,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,CAAC;IACxE,MAAMC,SAAS,GAAGrB,eAAe,GAC7B,CAAC,GAAG,IAAIsB,GAAG,CAAC,CAAC,GAAGF,gBAAgB,EAAE,GAAGpB,eAAe,CAAC,CAAC,CAAC,GACvDoB,gBAAgB;IACpB,KAAK,MAAMG,KAAK,IAAIF,SAAS,EAAE;MAC7B,IAAIX,MAAM,CAACG,GAAG,CAACU,KAAK,CAAC,EAAE;QACrBX,aAAa,CAACY,GAAG,GAAGd,MAAM,CAACK,GAAG,CAACQ,KAAK,CAAE;QACtC;MACF;IACF;;IAEA;IACA,IAAItB,WAAW,IAAI,CAACW,aAAa,CAACY,GAAG,EAAE;MACrC,IAAI;QACF,MAAMC,SAAS,GAAG,IAAIC,MAAM,CAACzB,WAAW,CAAC;QACzC,MAAM0B,QAAQ,GAAGvB,MAAM,CAACuB,QAAQ;QAChC,MAAMC,KAAK,GAAGD,QAAQ,CAACC,KAAK,CAACH,SAAS,CAAC;QACvC,IAAIG,KAAK,IAAIA,KAAK,CAAC,CAAC,CAAC,EAAE;UACrBhB,aAAa,CAACY,GAAG,GAAGI,KAAK,CAAC,CAAC,CAAC;QAC9B;MACF,CAAC,CAAC,OAAOC,CAAC,EAAE;QACVC,aAAM,CAACC,KAAK,CAAC,yCAAyC,EAAEF,CAAC,CAAC;MAC5D;IACF;;IAEA;IACAjB,aAAa,CAACJ,QAAQ,GAAGT,GAAG;IAE5B,OAAOa,aAAa;EACtB,CAAC,CAAC,OAAOmB,KAAK,EAAE;IACdD,aAAM,CAACC,KAAK,CAAC,wCAAwC,EAAEA,KAAK,CAAC;IAC7D,OAAO;MAAEvB,QAAQ,EAAET;IAAI,CAAC;EAC1B;AACF;;AAEA;AACA;AACA;AACA;AACO,SAASiC,kBAAkBA,CAACpB,aAAsC,EAAQ;EAC/E,IAAI;IACF;IACA,MAAMqB,OAAO,GACXrB,aAAa,CAACE,UAAU,IACxBF,aAAa,CAACI,UAAU,IACxBJ,aAAa,CAACK,YAAY,IAC1BL,aAAa,CAACM,QAAQ,IACtBN,aAAa,CAACO,WAAW,IACzBP,aAAa,CAACY,GAAG;IAEnB,IAAIS,OAAO,IAAIrB,aAAa,CAACJ,QAAQ,EAAE;MACrC,IAAA0B,eAAO,EAAC,CAAC,CAACC,GAAG,CAACC,kCAA0B,EAAEC,IAAI,CAACC,SAAS,CAAC1B,aAAa,CAAC,CAAC;MACxEkB,aAAM,CAACS,KAAK,CAAC,wBAAwB,EAAE3B,aAAa,CAAC;IACvD;EACF,CAAC,CAAC,OAAOmB,KAAK,EAAE;IACdD,aAAM,CAACC,KAAK,CAAC,+BAA+B,EAAEA,KAAK,CAAC;EACtD;AACF;;AAEA;AACA;AACA;AACA;AACO,SAASS,sBAAsBA,CAAA,EAAwC;EAC5E,IAAI;IACF,MAAMC,MAAM,GAAG,IAAAP,eAAO,EAAC,CAAC,CAACnB,GAAG,CAACqB,kCAA0B,CAAC;IACxD,IAAIK,MAAM,IAAI,OAAOA,MAAM,KAAK,QAAQ,EAAE;MACxC;MACA;MACA,OAAO,IAAAvC,gCAAsB,EAC3BmC,IAAI,CAACK,KAAK,CAACD,MAAM,CACnB,CAAC;IACH;EACF,CAAC,CAAC,OAAOV,KAAK,EAAE;IACdD,aAAM,CAACS,KAAK,CAAC,sCAAsC,EAAER,KAAK,CAAC;EAC7D;EACA,OAAOY,SAAS;AAClB;;AAEA;AACA;AACA;AACO,SAASC,kBAAkBA,CAAA,EAAS;EACzC,IAAI;IACF,IAAAV,eAAO,EAAC,CAAC,CAACW,MAAM,CAACT,kCAA0B,CAAC;IAC5CN,aAAM,CAACS,KAAK,CAAC,qCAAqC,CAAC;EACrD,CAAC,CAAC,OAAOR,KAAK,EAAE;IACdD,aAAM,CAACC,KAAK,CAAC,gCAAgC,EAAEA,KAAK,CAAC;EACvD;AACF;;AAEA;AACA;AACA;AACA;AACO,SAASe,4BAA4BA,CAC1CC,OAAiC,EACR;EACzB,MAAMN,MAAM,GAAGD,sBAAsB,CAAC,CAAC;EAEvC,IAAI,CAACC,MAAM,EAAE;IACX,OAAOM,OAAO,IAAI,CAAC,CAAC;EACtB;;EAEA;EACA,OAAO;IACL,GAAGN,MAAM;IACT,IAAIM,OAAO,IAAI,CAAC,CAAC;EACnB,CAAC;AACH;;AAEA;AACA,MAAMC,mBAA6C,GAAG,CACpD,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,UAAU,EACV,aAAa,EACb,KAAK,EACL,UAAU,CACX;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,yBAAyBA,CACvCC,QAAiC,EAC3B;EACN,IAAI;IACF,MAAMC,QAAQ,GAAGX,sBAAsB,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAMY,MAA+B,GAAG,CAAC,CAAC;IAE1C,KAAK,MAAMC,GAAG,IAAIL,mBAAmB,EAAE;MACrC,MAAMM,WAAW,GAAGJ,QAAQ,CAACG,GAAG,CAAC;MACjC,MAAME,WAAW,GAAGJ,QAAQ,CAACE,GAAG,CAAC;MACjC,IAAIC,WAAW,EAAE;QACfF,MAAM,CAACC,GAAG,CAAC,GAAGC,WAAW;MAC3B,CAAC,MAAM,IAAIC,WAAW,EAAE;QACtBH,MAAM,CAACC,GAAG,CAAC,GAAGE,WAAW;MAC3B;IACF;IAEAvB,kBAAkB,CAACoB,MAAM,CAAC;EAC5B,CAAC,CAAC,OAAOrB,KAAK,EAAE;IACdD,aAAM,CAACC,KAAK,CAAC,gCAAgC,EAAEA,KAAK,CAAC;EACvD;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,SAASyB,sBAAsBA,CACpCN,QAAiC,EAC3B;EACN,IAAI;IACF,MAAMC,QAAQ,GAAGX,sBAAsB,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAMY,MAA+B,GAAG;MAAE,GAAGD;IAAS,CAAC;IACvD,IAAIM,OAAO,GAAG,KAAK;IAEnB,KAAK,MAAM,CAACJ,GAAG,EAAEK,KAAK,CAAC,IAAIC,MAAM,CAACC,OAAO,CAACV,QAAQ,CAAC,EAAE;MACnD,IAAI,CAACQ,KAAK,EAAE,SAAS,CAAC;MACtB,MAAMP,QAAQ,GAAGC,MAAM,CAACC,GAAG,CAAyB;MACpD,IAAIF,QAAQ,KAAKR,SAAS,IAAIQ,QAAQ,KAAK,IAAI,IAAIA,QAAQ,KAAK,EAAE,EAAE;QAClEC,MAAM,CAACC,GAAG,CAAyB,GAAGQ,MAAM,CAACH,KAAK,CAAC;QACnDD,OAAO,GAAG,IAAI;MAChB;IACF;IAEA,IAAIA,OAAO,EAAE;MACXzB,kBAAkB,CAACoB,MAAM,CAAC;IAC5B;EACF,CAAC,CAAC,OAAOrB,KAAK,EAAE;IACdD,aAAM,CAACC,KAAK,CAAC,+BAA+B,EAAEA,KAAK,CAAC;EACtD;AACF","ignoreList":[]}

package/lib/commonjs/version.js

@@ -6,5 +6,5 @@ Object.defineProperty(exports, "__esModule", {
 exports.version = void 0;
 // This file is auto-generated by scripts/update-version.js during npm version
 // Do not edit manually - it will be overwritten
-const version = exports.version = '1.0.2';
+const version = exports.version = '1.1.0';
 //# sourceMappingURL=version.js.map