@honeybadger-io/js 6.16.4 → 6.16.6

package/dist/browser/honeybadger.js

@@ -182,6 +182,17 @@
 	var require$$0$1 = /*@__PURE__*/getAugmentedNamespace(stackTraceParser_esm);
 
 	(function (exports) {
+		var __assign = (commonjsGlobal && commonjsGlobal.__assign) || function () {
+		    __assign = Object.assign || function(t) {
+		        for (var s, i = 1, n = arguments.length; i < n; i++) {
+		            s = arguments[i];
+		            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+		                t[p] = s[p];
+		        }
+		        return t;
+		    };
+		    return __assign.apply(this, arguments);
+		};
 		var __createBinding = (commonjsGlobal && commonjsGlobal.__createBinding) || (Object.create ? (function(o, m, k, k2) {
 		    if (k2 === undefined) k2 = k;
 		    var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -242,7 +253,7 @@
 		    }
 		};
 		Object.defineProperty(exports, "__esModule", { value: true });
-		exports.logDeprecatedMethod = exports.globalThisOrWindow = exports.isBrowserConfig = exports.clone = exports.formatCGIData = exports.filterUrl = exports.filter = exports.generateStackTrace = exports.endpoint = exports.instrumentConsole = exports.instrument = exports.isErrorObject = exports.makeNotice = exports.logger = exports.sanitize = exports.shallowClone = exports.runAfterNotifyHandlers = exports.shouldSampleEvent = exports.resolveInsights = exports.runBeforeEventHandlers = exports.runBeforeNotifyHandlers = exports.getSourceForBacktrace = exports.getCauses = exports.calculateBacktraceShift = exports.DEFAULT_BACKTRACE_SHIFT = exports.makeBacktrace = exports.objectIsExtensible = exports.objectIsEmpty = exports.mergeNotice = exports.merge = void 0;
+		exports.logDeprecatedMethod = exports.globalThisOrWindow = exports.isBrowserConfig = exports.clone = exports.formatCGIData = exports.filterBreadcrumbs = exports.filterUrl = exports.filter = exports.generateStackTrace = exports.endpoint = exports.instrumentConsole = exports.instrument = exports.isErrorObject = exports.makeNotice = exports.logger = exports.sanitize = exports.shallowClone = exports.runAfterNotifyHandlers = exports.shouldSampleEvent = exports.resolveInsights = exports.runBeforeEventHandlers = exports.runBeforeNotifyHandlers = exports.getSourceForBacktrace = exports.getCauses = exports.calculateBacktraceShift = exports.DEFAULT_BACKTRACE_SHIFT = exports.makeBacktrace = exports.objectIsExtensible = exports.objectIsEmpty = exports.mergeNotice = exports.merge = void 0;
 		/* eslint-disable prefer-rest-params */
 		var stackTraceParser = __importStar(require$$0$1);
 		function merge(obj1, obj2) {
@@ -828,6 +839,76 @@
 		    return result;
 		}
 		exports.filterUrl = filterUrl;
+		/**
+		 * Breadcrumb metadata keys whose value is a URL, and so may carry a query string.
+		 *
+		 * Checked by name rather than by running `filterUrl` over every string value: a `?` is
+		 * ordinary punctuation in a breadcrumb message or a console argument, and rewriting around
+		 * it would mangle text that is not a URL at all.
+		 */
+		var URL_METADATA_KEYS = ['url', 'from', 'to', 'href'];
+		/**
+		 * Recursively rewrites the query string of every URL-bearing value.
+		 *
+		 * Nested as well as top-level: a breadcrumb may well carry
+		 * `metadata: { request: { url: '/checkout?token=secret' } }`, and `filter` leaves that URL
+		 * alone because the key `request` matches no filter.
+		 *
+		 * Safe to recurse without a seen-list because `filter` has already run: it replaces a
+		 * circular reference with a string, so what arrives here is acyclic.
+		 */
+		function filterUrlValues(value, filters) {
+		    if (is('Array', value)) {
+		        return value.map(function (entry) { return filterUrlValues(entry, filters); });
+		    }
+		    if (!is('Object', value)) {
+		        return value;
+		    }
+		    var result = {};
+		    var source = value;
+		    // Own enumerable keys only, assigned with `defineProperty`: a plain `result[key] =` would
+		    // reassign the prototype rather than create a property for a key named `__proto__`, and
+		    // breadcrumb metadata is host-supplied.
+		    Object.keys(source).forEach(function (key) {
+		        var entry = source[key];
+		        var filtered = URL_METADATA_KEYS.includes(key.toLowerCase()) && typeof entry === 'string'
+		            ? filterUrl(entry, filters)
+		            : filterUrlValues(entry, filters);
+		        Object.defineProperty(result, key, {
+		            value: filtered,
+		            enumerable: true,
+		            writable: true,
+		            configurable: true
+		        });
+		    });
+		    return result;
+		}
+		/**
+		 * Applies `filters` to a breadcrumb trail.
+		 *
+		 * Metadata is filtered by key, exactly as `params` and `session` are, and any value under a
+		 * URL-bearing key additionally has its query string filtered. Breadcrumb metadata is mostly
+		 * generated by this library -- the XHR, fetch and navigation integrations all record a full
+		 * URL -- so a query string lands there without the user ever choosing to put it there.
+		 */
+		function filterBreadcrumbs(trail, filters) {
+		    if (!is('Array', trail)) {
+		        return [];
+		    }
+		    return trail.map(function (breadcrumb) {
+		        // Leave a crumb that never carried metadata exactly as it is, so the payload shape does
+		        // not change for it.
+		        if (!is('Object', breadcrumb === null || breadcrumb === void 0 ? void 0 : breadcrumb.metadata)) {
+		            return breadcrumb;
+		        }
+		        // `filter` runs first, so a key-matched value is already '[FILTERED]' by the time the
+		        // URL pass sees it. Passing that through `filterUrl` is harmless: it holds no '?', so
+		        // it is returned untouched.
+		        var metadata = filterUrlValues(filter(breadcrumb.metadata, filters), filters);
+		        return __assign(__assign({}, breadcrumb), { metadata: metadata });
+		    });
+		}
+		exports.filterBreadcrumbs = filterBreadcrumbs;
 		function formatCGIData(vars, prefix) {
 		    if (prefix === void 0) { prefix = ''; }
 		    var formattedVars = {};
@@ -1455,7 +1536,7 @@
 	        this.__notifier = {
 	            name: '@honeybadger-io/core',
 	            url: 'https://github.com/honeybadger-io/honeybadger-js/tree/master/packages/core',
-	            version: '6.16.4'
+	            version: '6.16.6'
 	        };
 	        this.config = __assign$1(__assign$1({}, defaults_1.CONFIG), opts);
 	        this.__initStore();
@@ -1816,7 +1897,7 @@
 	            notifier: this.__notifier,
 	            breadcrumbs: {
 	                enabled: !!this.config.breadcrumbsEnabled,
-	                trail: notice.__breadcrumbs || []
+	                trail: (0, util_1$1.filterBreadcrumbs)(notice.__breadcrumbs || [], this.config.filters)
 	            },
 	            error: {
 	                class: notice.name,
@@ -2556,7 +2637,10 @@
 	                            method = method.toUpperCase();
 	                        }
 	                        // localURLPathname cant be constructed for CF workers due to reliance on "document".
-	                        var message = "".concat(method, " ").concat(typeof document === 'undefined' ? url : (0, util_1.localURLPathname)(url));
+	                        // Drop the query string by hand there: nothing filters a breadcrumb message, and
+	                        // localURLPathname would have removed it on the branch we cannot take, so leaving
+	                        // the raw url in would report a secret the configured `filters` were meant to catch.
+	                        var message = "".concat(method, " ").concat(typeof document === 'undefined' ? url.split('?')[0] : (0, util_1.localURLPathname)(url));
 	                        var metadata = {
 	                            type: 'fetch',
 	                            method: method,
@@ -2883,6 +2967,104 @@
 	}());
 	feedbackForm.BrowserFeedbackForm = BrowserFeedbackForm;
 
+	var globalSingleton = {};
+
+	(function (exports) {
+		Object.defineProperty(exports, "__esModule", { value: true });
+		exports.getOrCreateSingleton = exports.singletonKey = exports.DISABLE_GLOBAL_SINGLETON_KEY = void 0;
+		var core_1 = src;
+		/**
+		 * Set this on the global object before the package is loaded to opt out of sharing.
+		 * Two independently bundled copies on one page then keep their own clients, the way
+		 * they did before the singleton was shared.
+		 */
+		exports.DISABLE_GLOBAL_SINGLETON_KEY = '__HONEYBADGER_DISABLE_GLOBAL_SINGLETON__';
+		/**
+		 * Stamped on the client when it is stored, and required when it is read back, so the slot
+		 * is only ever trusted when this package wrote it. Duck typing would not do: a value that
+		 * happens to carry a `notify` method would be handed out as the client.
+		 */
+		var CLIENT_MARKER = '__honeybadger_client__';
+		function singletonKey(target, version) {
+		    return "__honeybadger_singleton_".concat(target, "_").concat(version, "__");
+		}
+		exports.singletonKey = singletonKey;
+		function isSingleton(value) {
+		    return !!value && value[CLIENT_MARKER] === true;
+		}
+		function markAsSingleton(client) {
+		    Object.defineProperty(client, CLIENT_MARKER, {
+		        value: true,
+		        writable: false,
+		        configurable: true,
+		        enumerable: false,
+		    });
+		}
+		/**
+		 * Returns the client stored on the global object, creating and storing it the first time.
+		 *
+		 * Bundlers can emit more than one copy of this module — Next.js compiles the
+		 * instrumentation, page-rendering and edge contexts into separate module graphs — and
+		 * each copy would otherwise build its own client. Only the copy the configuration code
+		 * ran in would be configured, so a `Honeybadger.notify()` made through any other copy
+		 * would silently do nothing. Keeping the instance on the realm's global object lets every
+		 * copy find the same configured client.
+		 *
+		 * The slot is keyed by build target and by exact version: an older copy must never be
+		 * handed to a newer caller that would then call a method it does not have. Two different
+		 * versions in one realm fall back to one client each, which is the behaviour that shipped
+		 * before the singleton was shared.
+		 */
+		function getOrCreateSingleton(target, version, create, _global) {
+		    if (_global === void 0) { _global = core_1.Util.globalThisOrWindow(); }
+		    if (!_global) {
+		        return create();
+		    }
+		    var key = singletonKey(target, version);
+		    var shared;
+		    var canShare = false;
+		    // Reading the global object can throw as easily as writing to it can: the opt-out
+		    // flag, the slot and the marker are all ordinary properties, and a host or another
+		    // script may have installed a getter on any of them. `create()` stays outside, so a
+		    // genuine failure to build the client still propagates.
+		    try {
+		        if (_global[exports.DISABLE_GLOBAL_SINGLETON_KEY] !== true) {
+		            canShare = true;
+		            var existing = _global[key];
+		            if (isSingleton(existing)) {
+		                shared = existing;
+		            }
+		        }
+		    }
+		    catch (_e) {
+		        canShare = false;
+		    }
+		    if (shared) {
+		        return shared;
+		    }
+		    var created = create();
+		    if (!canShare) {
+		        return created;
+		    }
+		    try {
+		        markAsSingleton(created);
+		        Object.defineProperty(_global, key, {
+		            value: created,
+		            writable: true,
+		            configurable: true,
+		            enumerable: false,
+		        });
+		    }
+		    catch (_e) {
+		        // A frozen global object (node --frozen-intrinsics, SES lockdown). Importing this
+		        // package must never throw, so this copy keeps the client to itself.
+		    }
+		    return created;
+		}
+		exports.getOrCreateSingleton = getOrCreateSingleton;
+		
+	} (globalSingleton));
+
 	(function (exports) {
 		var __extends = (commonjsGlobal && commonjsGlobal.__extends) || (function () {
 		    var extendStatics = function (d, b) {
@@ -2960,6 +3142,7 @@
 		var event_listeners_1 = __importDefault(event_listeners);
 		var transport_1 = transport;
 		var feedback_form_1 = feedbackForm;
+		var global_singleton_1 = globalSingleton;
 		var merge = core_1.Util.merge, filter = core_1.Util.filter, objectIsExtensible = core_1.Util.objectIsExtensible, globalThisOrWindow = core_1.Util.globalThisOrWindow;
 		var getProjectRoot = function () {
 		    var global = globalThisOrWindow();
@@ -3156,7 +3339,7 @@
 		var NOTIFIER = {
 		    name: '@honeybadger-io/js',
 		    url: 'https://github.com/honeybadger-io/honeybadger-js/tree/master/packages/js',
-		    version: '6.16.4'
+		    version: '6.16.6'
 		};
 		var userAgent = function () {
 		    if (typeof navigator !== 'undefined') {
@@ -3164,17 +3347,20 @@
 		    }
 		    return "Honeybadger JS Browser Client ".concat(NOTIFIER.version, "; n/a; n/a");
 		};
-		var singleton = new Honeybadger({
-		    __plugins: [
-		        (0, onerror_1.onError)(),
-		        (0, onunhandledrejection_1.default)(),
-		        (0, timers_1.default)(),
-		        (0, event_listeners_1.default)(),
-		        (0, breadcrumbs_1.default)(),
-		        core_1.Plugins.consoleEvents(),
-		    ]
+		var singleton = (0, global_singleton_1.getOrCreateSingleton)('browser', NOTIFIER.version, function () {
+		    var client = new Honeybadger({
+		        __plugins: [
+		            (0, onerror_1.onError)(),
+		            (0, onunhandledrejection_1.default)(),
+		            (0, timers_1.default)(),
+		            (0, event_listeners_1.default)(),
+		            (0, breadcrumbs_1.default)(),
+		            core_1.Plugins.consoleEvents(),
+		        ]
+		    });
+		    client.setNotifier(NOTIFIER);
+		    return client;
 		});
-		singleton.setNotifier(NOTIFIER);
 		var core_2 = src;
 		Object.defineProperty(exports, "Types", { enumerable: true, get: function () { return core_2.Types; } });
 		exports.default = singleton;