@honeybadger-io/js 6.16.5 → 6.16.6

package/dist/server/honeybadger.js

@@ -200,6 +200,17 @@ var stackTraceParser_esm = /*#__PURE__*/Object.freeze({
 var require$$0$1 = /*@__PURE__*/getAugmentedNamespace(stackTraceParser_esm);
 
 (function (exports) {
+	var __assign = (commonjsGlobal && commonjsGlobal.__assign) || function () {
+	    __assign = Object.assign || function(t) {
+	        for (var s, i = 1, n = arguments.length; i < n; i++) {
+	            s = arguments[i];
+	            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+	                t[p] = s[p];
+	        }
+	        return t;
+	    };
+	    return __assign.apply(this, arguments);
+	};
 	var __createBinding = (commonjsGlobal && commonjsGlobal.__createBinding) || (Object.create ? (function(o, m, k, k2) {
 	    if (k2 === undefined) k2 = k;
 	    var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -260,7 +271,7 @@ var require$$0$1 = /*@__PURE__*/getAugmentedNamespace(stackTraceParser_esm);
 	    }
 	};
 	Object.defineProperty(exports, "__esModule", { value: true });
-	exports.logDeprecatedMethod = exports.globalThisOrWindow = exports.isBrowserConfig = exports.clone = exports.formatCGIData = exports.filterUrl = exports.filter = exports.generateStackTrace = exports.endpoint = exports.instrumentConsole = exports.instrument = exports.isErrorObject = exports.makeNotice = exports.logger = exports.sanitize = exports.shallowClone = exports.runAfterNotifyHandlers = exports.shouldSampleEvent = exports.resolveInsights = exports.runBeforeEventHandlers = exports.runBeforeNotifyHandlers = exports.getSourceForBacktrace = exports.getCauses = exports.calculateBacktraceShift = exports.DEFAULT_BACKTRACE_SHIFT = exports.makeBacktrace = exports.objectIsExtensible = exports.objectIsEmpty = exports.mergeNotice = exports.merge = void 0;
+	exports.logDeprecatedMethod = exports.globalThisOrWindow = exports.isBrowserConfig = exports.clone = exports.formatCGIData = exports.filterBreadcrumbs = exports.filterUrl = exports.filter = exports.generateStackTrace = exports.endpoint = exports.instrumentConsole = exports.instrument = exports.isErrorObject = exports.makeNotice = exports.logger = exports.sanitize = exports.shallowClone = exports.runAfterNotifyHandlers = exports.shouldSampleEvent = exports.resolveInsights = exports.runBeforeEventHandlers = exports.runBeforeNotifyHandlers = exports.getSourceForBacktrace = exports.getCauses = exports.calculateBacktraceShift = exports.DEFAULT_BACKTRACE_SHIFT = exports.makeBacktrace = exports.objectIsExtensible = exports.objectIsEmpty = exports.mergeNotice = exports.merge = void 0;
 	/* eslint-disable prefer-rest-params */
 	var stackTraceParser = __importStar(require$$0$1);
 	function merge(obj1, obj2) {
@@ -846,6 +857,76 @@ var require$$0$1 = /*@__PURE__*/getAugmentedNamespace(stackTraceParser_esm);
 	    return result;
 	}
 	exports.filterUrl = filterUrl;
+	/**
+	 * Breadcrumb metadata keys whose value is a URL, and so may carry a query string.
+	 *
+	 * Checked by name rather than by running `filterUrl` over every string value: a `?` is
+	 * ordinary punctuation in a breadcrumb message or a console argument, and rewriting around
+	 * it would mangle text that is not a URL at all.
+	 */
+	var URL_METADATA_KEYS = ['url', 'from', 'to', 'href'];
+	/**
+	 * Recursively rewrites the query string of every URL-bearing value.
+	 *
+	 * Nested as well as top-level: a breadcrumb may well carry
+	 * `metadata: { request: { url: '/checkout?token=secret' } }`, and `filter` leaves that URL
+	 * alone because the key `request` matches no filter.
+	 *
+	 * Safe to recurse without a seen-list because `filter` has already run: it replaces a
+	 * circular reference with a string, so what arrives here is acyclic.
+	 */
+	function filterUrlValues(value, filters) {
+	    if (is('Array', value)) {
+	        return value.map(function (entry) { return filterUrlValues(entry, filters); });
+	    }
+	    if (!is('Object', value)) {
+	        return value;
+	    }
+	    var result = {};
+	    var source = value;
+	    // Own enumerable keys only, assigned with `defineProperty`: a plain `result[key] =` would
+	    // reassign the prototype rather than create a property for a key named `__proto__`, and
+	    // breadcrumb metadata is host-supplied.
+	    Object.keys(source).forEach(function (key) {
+	        var entry = source[key];
+	        var filtered = URL_METADATA_KEYS.includes(key.toLowerCase()) && typeof entry === 'string'
+	            ? filterUrl(entry, filters)
+	            : filterUrlValues(entry, filters);
+	        Object.defineProperty(result, key, {
+	            value: filtered,
+	            enumerable: true,
+	            writable: true,
+	            configurable: true
+	        });
+	    });
+	    return result;
+	}
+	/**
+	 * Applies `filters` to a breadcrumb trail.
+	 *
+	 * Metadata is filtered by key, exactly as `params` and `session` are, and any value under a
+	 * URL-bearing key additionally has its query string filtered. Breadcrumb metadata is mostly
+	 * generated by this library -- the XHR, fetch and navigation integrations all record a full
+	 * URL -- so a query string lands there without the user ever choosing to put it there.
+	 */
+	function filterBreadcrumbs(trail, filters) {
+	    if (!is('Array', trail)) {
+	        return [];
+	    }
+	    return trail.map(function (breadcrumb) {
+	        // Leave a crumb that never carried metadata exactly as it is, so the payload shape does
+	        // not change for it.
+	        if (!is('Object', breadcrumb === null || breadcrumb === void 0 ? void 0 : breadcrumb.metadata)) {
+	            return breadcrumb;
+	        }
+	        // `filter` runs first, so a key-matched value is already '[FILTERED]' by the time the
+	        // URL pass sees it. Passing that through `filterUrl` is harmless: it holds no '?', so
+	        // it is returned untouched.
+	        var metadata = filterUrlValues(filter(breadcrumb.metadata, filters), filters);
+	        return __assign(__assign({}, breadcrumb), { metadata: metadata });
+	    });
+	}
+	exports.filterBreadcrumbs = filterBreadcrumbs;
 	function formatCGIData(vars, prefix) {
 	    if (prefix === void 0) { prefix = ''; }
 	    var formattedVars = {};
@@ -1473,7 +1554,7 @@ var Client = /** @class */ (function () {
         this.__notifier = {
             name: '@honeybadger-io/core',
             url: 'https://github.com/honeybadger-io/honeybadger-js/tree/master/packages/core',
-            version: '6.16.5'
+            version: '6.16.6'
         };
         this.config = __assign$1(__assign$1({}, defaults_1.CONFIG), opts);
         this.__initStore();
@@ -1834,7 +1915,7 @@ var Client = /** @class */ (function () {
             notifier: this.__notifier,
             breadcrumbs: {
                 enabled: !!this.config.breadcrumbsEnabled,
-                trail: notice.__breadcrumbs || []
+                trail: (0, util_1$5.filterBreadcrumbs)(notice.__breadcrumbs || [], this.config.filters)
             },
             error: {
                 class: notice.name,
@@ -4089,7 +4170,7 @@ var globalSingleton = {};
 	var NOTIFIER = {
 	    name: '@honeybadger-io/js',
 	    url: 'https://github.com/honeybadger-io/honeybadger-js/tree/master/packages/js',
-	    version: '6.16.5'
+	    version: '6.16.6'
 	};
 	var userAgent = function () {
 	    return "Honeybadger JS Server Client ".concat(NOTIFIER.version, ", ").concat(os_1.default.version(), "; ").concat(os_1.default.platform());