@honeybadger-io/js 6.16.5 → 6.16.6

package/dist/browser/honeybadger.js

@@ -182,6 +182,17 @@
 	var require$$0$1 = /*@__PURE__*/getAugmentedNamespace(stackTraceParser_esm);
 
 	(function (exports) {
+		var __assign = (commonjsGlobal && commonjsGlobal.__assign) || function () {
+		    __assign = Object.assign || function(t) {
+		        for (var s, i = 1, n = arguments.length; i < n; i++) {
+		            s = arguments[i];
+		            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+		                t[p] = s[p];
+		        }
+		        return t;
+		    };
+		    return __assign.apply(this, arguments);
+		};
 		var __createBinding = (commonjsGlobal && commonjsGlobal.__createBinding) || (Object.create ? (function(o, m, k, k2) {
 		    if (k2 === undefined) k2 = k;
 		    var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -242,7 +253,7 @@
 		    }
 		};
 		Object.defineProperty(exports, "__esModule", { value: true });
-		exports.logDeprecatedMethod = exports.globalThisOrWindow = exports.isBrowserConfig = exports.clone = exports.formatCGIData = exports.filterUrl = exports.filter = exports.generateStackTrace = exports.endpoint = exports.instrumentConsole = exports.instrument = exports.isErrorObject = exports.makeNotice = exports.logger = exports.sanitize = exports.shallowClone = exports.runAfterNotifyHandlers = exports.shouldSampleEvent = exports.resolveInsights = exports.runBeforeEventHandlers = exports.runBeforeNotifyHandlers = exports.getSourceForBacktrace = exports.getCauses = exports.calculateBacktraceShift = exports.DEFAULT_BACKTRACE_SHIFT = exports.makeBacktrace = exports.objectIsExtensible = exports.objectIsEmpty = exports.mergeNotice = exports.merge = void 0;
+		exports.logDeprecatedMethod = exports.globalThisOrWindow = exports.isBrowserConfig = exports.clone = exports.formatCGIData = exports.filterBreadcrumbs = exports.filterUrl = exports.filter = exports.generateStackTrace = exports.endpoint = exports.instrumentConsole = exports.instrument = exports.isErrorObject = exports.makeNotice = exports.logger = exports.sanitize = exports.shallowClone = exports.runAfterNotifyHandlers = exports.shouldSampleEvent = exports.resolveInsights = exports.runBeforeEventHandlers = exports.runBeforeNotifyHandlers = exports.getSourceForBacktrace = exports.getCauses = exports.calculateBacktraceShift = exports.DEFAULT_BACKTRACE_SHIFT = exports.makeBacktrace = exports.objectIsExtensible = exports.objectIsEmpty = exports.mergeNotice = exports.merge = void 0;
 		/* eslint-disable prefer-rest-params */
 		var stackTraceParser = __importStar(require$$0$1);
 		function merge(obj1, obj2) {
@@ -828,6 +839,76 @@
 		    return result;
 		}
 		exports.filterUrl = filterUrl;
+		/**
+		 * Breadcrumb metadata keys whose value is a URL, and so may carry a query string.
+		 *
+		 * Checked by name rather than by running `filterUrl` over every string value: a `?` is
+		 * ordinary punctuation in a breadcrumb message or a console argument, and rewriting around
+		 * it would mangle text that is not a URL at all.
+		 */
+		var URL_METADATA_KEYS = ['url', 'from', 'to', 'href'];
+		/**
+		 * Recursively rewrites the query string of every URL-bearing value.
+		 *
+		 * Nested as well as top-level: a breadcrumb may well carry
+		 * `metadata: { request: { url: '/checkout?token=secret' } }`, and `filter` leaves that URL
+		 * alone because the key `request` matches no filter.
+		 *
+		 * Safe to recurse without a seen-list because `filter` has already run: it replaces a
+		 * circular reference with a string, so what arrives here is acyclic.
+		 */
+		function filterUrlValues(value, filters) {
+		    if (is('Array', value)) {
+		        return value.map(function (entry) { return filterUrlValues(entry, filters); });
+		    }
+		    if (!is('Object', value)) {
+		        return value;
+		    }
+		    var result = {};
+		    var source = value;
+		    // Own enumerable keys only, assigned with `defineProperty`: a plain `result[key] =` would
+		    // reassign the prototype rather than create a property for a key named `__proto__`, and
+		    // breadcrumb metadata is host-supplied.
+		    Object.keys(source).forEach(function (key) {
+		        var entry = source[key];
+		        var filtered = URL_METADATA_KEYS.includes(key.toLowerCase()) && typeof entry === 'string'
+		            ? filterUrl(entry, filters)
+		            : filterUrlValues(entry, filters);
+		        Object.defineProperty(result, key, {
+		            value: filtered,
+		            enumerable: true,
+		            writable: true,
+		            configurable: true
+		        });
+		    });
+		    return result;
+		}
+		/**
+		 * Applies `filters` to a breadcrumb trail.
+		 *
+		 * Metadata is filtered by key, exactly as `params` and `session` are, and any value under a
+		 * URL-bearing key additionally has its query string filtered. Breadcrumb metadata is mostly
+		 * generated by this library -- the XHR, fetch and navigation integrations all record a full
+		 * URL -- so a query string lands there without the user ever choosing to put it there.
+		 */
+		function filterBreadcrumbs(trail, filters) {
+		    if (!is('Array', trail)) {
+		        return [];
+		    }
+		    return trail.map(function (breadcrumb) {
+		        // Leave a crumb that never carried metadata exactly as it is, so the payload shape does
+		        // not change for it.
+		        if (!is('Object', breadcrumb === null || breadcrumb === void 0 ? void 0 : breadcrumb.metadata)) {
+		            return breadcrumb;
+		        }
+		        // `filter` runs first, so a key-matched value is already '[FILTERED]' by the time the
+		        // URL pass sees it. Passing that through `filterUrl` is harmless: it holds no '?', so
+		        // it is returned untouched.
+		        var metadata = filterUrlValues(filter(breadcrumb.metadata, filters), filters);
+		        return __assign(__assign({}, breadcrumb), { metadata: metadata });
+		    });
+		}
+		exports.filterBreadcrumbs = filterBreadcrumbs;
 		function formatCGIData(vars, prefix) {
 		    if (prefix === void 0) { prefix = ''; }
 		    var formattedVars = {};
@@ -1455,7 +1536,7 @@
 	        this.__notifier = {
 	            name: '@honeybadger-io/core',
 	            url: 'https://github.com/honeybadger-io/honeybadger-js/tree/master/packages/core',
-	            version: '6.16.5'
+	            version: '6.16.6'
 	        };
 	        this.config = __assign$1(__assign$1({}, defaults_1.CONFIG), opts);
 	        this.__initStore();
@@ -1816,7 +1897,7 @@
 	            notifier: this.__notifier,
 	            breadcrumbs: {
 	                enabled: !!this.config.breadcrumbsEnabled,
-	                trail: notice.__breadcrumbs || []
+	                trail: (0, util_1$1.filterBreadcrumbs)(notice.__breadcrumbs || [], this.config.filters)
 	            },
 	            error: {
 	                class: notice.name,
@@ -2556,7 +2637,10 @@
 	                            method = method.toUpperCase();
 	                        }
 	                        // localURLPathname cant be constructed for CF workers due to reliance on "document".
-	                        var message = "".concat(method, " ").concat(typeof document === 'undefined' ? url : (0, util_1.localURLPathname)(url));
+	                        // Drop the query string by hand there: nothing filters a breadcrumb message, and
+	                        // localURLPathname would have removed it on the branch we cannot take, so leaving
+	                        // the raw url in would report a secret the configured `filters` were meant to catch.
+	                        var message = "".concat(method, " ").concat(typeof document === 'undefined' ? url.split('?')[0] : (0, util_1.localURLPathname)(url));
 	                        var metadata = {
 	                            type: 'fetch',
 	                            method: method,
@@ -3255,7 +3339,7 @@
 		var NOTIFIER = {
 		    name: '@honeybadger-io/js',
 		    url: 'https://github.com/honeybadger-io/honeybadger-js/tree/master/packages/js',
-		    version: '6.16.5'
+		    version: '6.16.6'
 		};
 		var userAgent = function () {
 		    if (typeof navigator !== 'undefined') {