@mhosaic/feedback 0.10.0 → 0.11.0

package/dist/{chunk-XSAUJEJN.mjs → chunk-AO3BXEG5.mjs}

@@ -1,3 +1,7 @@
+import {
+  scrubCredentials
+} from "./chunk-DKE6ELJ4.mjs";
+
 // src/api/client.ts
 var SCALAR_FIELDS = [
   "description",
@@ -33,9 +37,15 @@ function createApiClient(options) {
     if (payload.widget_version) {
       form.append("widget_version", payload.widget_version);
     }
+    const headers = {
+      Authorization: `Bearer ${options.apiKey}`
+    };
+    if (payload.synthetic) {
+      headers["X-Mhosaic-Capture-Source"] = "error-tracking";
+    }
     const response = await fetcher(`${endpoint}/api/feedback/v1/reports/`, {
       method: "POST",
-      headers: { Authorization: `Bearer ${options.apiKey}` },
+      headers,
       body: form
     });
     if (!response.ok) {
@@ -128,7 +138,28 @@ function createApiClient(options) {
 }
 
 // src/capture/urlSanitizer.ts
-var SENSITIVE = /token|key|password|secret|auth|session|sig/i;
+var SENSITIVE_NAME = /token|key|password|secret|auth|session|sig|credential|bearer|cookie/i;
+var SENSITIVE_VALUE_PATTERNS = [
+  // JWT: three base64url segments separated by dots, header begins with eyJ.
+  /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/,
+  // Mhosaic feedback keys (the project's own format).
+  /^(?:sk|pk)_proj_[A-Za-z0-9_-]{16,}$/,
+  // GitHub PATs (ghp/gho/ghu/ghs/ghr prefixes, 36+ chars).
+  /^gh[pousr]_[A-Za-z0-9]{30,}$/,
+  // Stripe live/test secret keys.
+  /^(?:sk|pk|rk|whsec)_(?:live|test)_[A-Za-z0-9]{16,}$/,
+  // AWS access key id.
+  /^AKIA[0-9A-Z]{12,}$/,
+  // Slack bot tokens.
+  /^xox[abprso]-[A-Za-z0-9-]{12,}$/,
+  // Generic high-entropy: hex 40+ chars (SHA-1, SHA-256) or long alnum 32+.
+  /^[a-f0-9]{40,}$/i,
+  // Long opaque base64-ish string (common for OAuth codes & session ids).
+  /^[A-Za-z0-9_-]{40,}$/
+];
+function looksLikeCredential(value) {
+  return SENSITIVE_VALUE_PATTERNS.some((re) => re.test(value));
+}
 function sanitizeUrl(url) {
   try {
     const isAbsolute = /^https?:\/\//i.test(url);
@@ -138,9 +169,14 @@ function sanitizeUrl(url) {
     const u = new URL(url, base);
     const clean = new URLSearchParams();
     u.searchParams.forEach((value, name) => {
-      clean.set(name, SENSITIVE.test(name) ? "[redacted]" : value);
+      if (SENSITIVE_NAME.test(name) || looksLikeCredential(value)) {
+        clean.set(name, "[redacted]");
+      } else {
+        clean.set(name, value);
+      }
     });
     u.search = clean.toString();
+    u.hash = u.hash ? "#[redacted]" : "";
     return u.toString();
   } catch {
     return url;
@@ -152,7 +188,16 @@ function collectDevice() {
   const nav = navigator;
   const connection = nav.connection?.effectiveType;
   const deviceMemory = nav.deviceMemory;
-  const referrer = document.referrer || void 0;
+  const rawReferrer = document.referrer || void 0;
+  const referrer = rawReferrer !== void 0 ? sanitizeUrl(rawReferrer) : void 0;
+  const sanitizedHere = sanitizeUrl(window.location.pathname + window.location.search);
+  let pathname;
+  try {
+    const parsed = new URL(sanitizedHere, window.location.origin);
+    pathname = parsed.pathname + parsed.search;
+  } catch {
+    pathname = window.location.pathname;
+  }
   return {
     viewport: { w: window.innerWidth, h: window.innerHeight, dpr: window.devicePixelRatio || 1 },
     screen: { w: window.screen.width, h: window.screen.height },
@@ -165,8 +210,12 @@ function collectDevice() {
     ...deviceMemory !== void 0 && { deviceMemory },
     hardwareConcurrency: nav.hardwareConcurrency,
     ...referrer !== void 0 && { referrer },
-    title: document.title,
-    pathname: window.location.pathname
+    // Hosts commonly stuff credentials / PII into page titles
+    // ("Inbox (3) — bob@x.com", "Reset password — token=abc"). Cap to a
+    // sane length and run through the same scrubber the console/error
+    // paths use.
+    title: scrubCredentials(document.title || "").slice(0, 200),
+    pathname
   };
 }
 
@@ -196,7 +245,8 @@ function installConsolePatch(buffer) {
     originals[level] = original;
     console[level] = function patched(...args) {
       try {
-        const message = args.map(safeStringify).join(" ").slice(0, 2e3);
+        const rawMessage = args.map(safeStringify).join(" ");
+        const message = scrubCredentials(rawMessage).slice(0, 2e3);
         const entry = { level, message, ts: Date.now() };
         if (level === "error") {
           const stack = new Error().stack;
@@ -229,13 +279,14 @@ function installFetchPatch(buffer, sanitize) {
       buffer.push({ url: sanitize(url), method, status: response.status, durationMs: Math.round(performance.now() - start), ts: Date.now() });
       return response;
     } catch (err) {
+      const rawErr = err instanceof Error ? err.message : String(err);
       buffer.push({
         url: sanitize(url),
         method,
         status: 0,
         durationMs: Math.round(performance.now() - start),
         ts: Date.now(),
-        error: err instanceof Error ? err.message : String(err)
+        error: scrubCredentials(rawErr)
       });
       throw err;
     }
@@ -282,9 +333,10 @@ function installErrorHandlers(buffer) {
   if (typeof window === "undefined") return () => {
   };
   const onError = (e) => {
-    const stack = e.error instanceof Error ? e.error.stack : void 0;
+    const rawStack = e.error instanceof Error ? e.error.stack : void 0;
+    const stack = rawStack !== void 0 ? scrubCredentials(rawStack) : void 0;
     buffer.push({
-      message: e.message || "Unknown error",
+      message: scrubCredentials(e.message || "Unknown error"),
       ...stack !== void 0 && { stack },
       ts: Date.now(),
       source: "window.error"
@@ -292,16 +344,17 @@ function installErrorHandlers(buffer) {
   };
   const onRejection = (e) => {
     const reason = e.reason;
-    const message = reason instanceof Error ? reason.message : typeof reason === "string" ? reason : (() => {
+    const rawMessage = reason instanceof Error ? reason.message : typeof reason === "string" ? reason : (() => {
       try {
         return JSON.stringify(reason);
       } catch {
         return String(reason);
       }
     })();
-    const stack = reason instanceof Error ? reason.stack : void 0;
+    const rawStack = reason instanceof Error ? reason.stack : void 0;
+    const stack = rawStack !== void 0 ? scrubCredentials(rawStack) : void 0;
     buffer.push({
-      message,
+      message: scrubCredentials(rawMessage),
       ...stack !== void 0 && { stack },
       ts: Date.now(),
       source: "unhandledrejection"
@@ -330,7 +383,7 @@ function createPerformanceCollector(slowResourceMs = 1e3) {
           } else if (entry.entryType === "resource") {
             const e = entry;
             if (e.duration > slowResourceMs) {
-              slowResources.push({ name: e.name, duration: e.duration, initiatorType: e.initiatorType });
+              slowResources.push({ name: sanitizeUrl(e.name), duration: e.duration, initiatorType: e.initiatorType });
               while (slowResources.length > 20) slowResources.shift();
             }
           }
@@ -413,6 +466,19 @@ function installCapture(options = {}) {
 }
 
 // src/screenshot/index.ts
+var DEFAULT_REDACTED_INPUT_SELECTORS = [
+  'input[type="password"]',
+  'input[type="tel"]',
+  'input[autocomplete*="cc-"]',
+  'input[autocomplete*="current-password"]',
+  'input[autocomplete*="new-password"]',
+  'input[autocomplete*="one-time-code"]',
+  'input[name*="cvv" i]',
+  'input[name*="ccv" i]',
+  'input[name*="cardnum" i]',
+  'input[name*="card-num" i]'
+];
+var REDACTION_MASK = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
 function isMaskedElement(el) {
   return el.hasAttribute("data-mfb-mask") || el.classList.contains("mfb-mask");
 }
@@ -421,13 +487,33 @@ function prepareMaskMatcher(selectors) {
   if (!joined) return isMaskedElement;
   return (el) => isMaskedElement(el) || el.matches(joined);
 }
+function redactSensitiveInputs(clonedDoc, extraSelectors) {
+  const selectors = [
+    ...DEFAULT_REDACTED_INPUT_SELECTORS,
+    ...extraSelectors,
+    "[data-mfb-mask]",
+    ".mfb-mask"
+  ].join(",");
+  const elements = clonedDoc.querySelectorAll(selectors);
+  elements.forEach((el) => {
+    if (el instanceof HTMLInputElement || el instanceof HTMLTextAreaElement) {
+      const len = Math.min(Math.max(el.value.length || 8, 4), 16);
+      el.value = REDACTION_MASK.slice(0, len);
+      el.setAttribute("value", el.value);
+    } else if (el instanceof HTMLElement) {
+      el.textContent = REDACTION_MASK;
+    }
+  });
+}
 async function takeScreenshot(target, options = {}) {
   if (typeof document === "undefined") return null;
   try {
     const html2canvas = (await import("html2canvas-pro")).default;
-    const matcher = prepareMaskMatcher(options.mask ?? []);
+    const extraSelectors = options.mask ?? [];
+    const matcher = prepareMaskMatcher(extraSelectors);
     const canvas = await html2canvas(target, {
       ignoreElements: (el) => matcher(el),
+      onclone: (clonedDoc) => redactSensitiveInputs(clonedDoc, extraSelectors),
       useCORS: true,
       logging: false,
       backgroundColor: null
@@ -1181,28 +1267,36 @@ function Annotator({ imageBlob, strings, onSave, onCancel }) {
     }
   };
   const handleMouseMove = (e) => {
-    if (!isDrawingRef.current || !draftShape) return;
+    if (!isDrawingRef.current) return;
     const { x, y } = getCanvasCoords(e);
-    if (draftShape.kind === "rectangle" || draftShape.kind === "highlight" || draftShape.kind === "blur") {
-      setDraftShape({ ...draftShape, w: x - draftShape.x, h: y - draftShape.y });
-    } else if (draftShape.kind === "arrow") {
-      setDraftShape({ ...draftShape, x2: x, y2: y });
-    } else if (draftShape.kind === "freehand") {
-      setDraftShape({ ...draftShape, points: [...draftShape.points, { x, y }] });
-    }
+    setDraftShape((current) => {
+      if (!current) return current;
+      if (current.kind === "rectangle" || current.kind === "highlight" || current.kind === "blur") {
+        return { ...current, w: x - current.x, h: y - current.y };
+      }
+      if (current.kind === "arrow") {
+        return { ...current, x2: x, y2: y };
+      }
+      if (current.kind === "freehand") {
+        return { ...current, points: [...current.points, { x, y }] };
+      }
+      return current;
+    });
   };
   const handleMouseUp = () => {
-    if (isDrawingRef.current && draftShape) {
-      const isTiny = (draftShape.kind === "rectangle" || draftShape.kind === "highlight" || draftShape.kind === "blur") && Math.abs(draftShape.w) < 4 && Math.abs(draftShape.h) < 4 || draftShape.kind === "arrow" && Math.hypot(
-        draftShape.x2 - draftShape.x1,
-        draftShape.y2 - draftShape.y1
-      ) < 4 || draftShape.kind === "freehand" && draftShape.points.length < 3;
-      if (!isTiny) {
-        addShape(draftShape);
+    setDraftShape((current) => {
+      if (isDrawingRef.current && current) {
+        const isTiny = (current.kind === "rectangle" || current.kind === "highlight" || current.kind === "blur") && Math.abs(current.w) < 4 && Math.abs(current.h) < 4 || current.kind === "arrow" && Math.hypot(
+          current.x2 - current.x1,
+          current.y2 - current.y1
+        ) < 4 || current.kind === "freehand" && current.points.length < 3;
+        if (!isTiny) {
+          addShape(current);
+        }
       }
-    }
+      return null;
+    });
     isDrawingRef.current = false;
-    setDraftShape(null);
   };
   const handleSave = async () => {
     const canvas = canvasRef.current;
@@ -3483,8 +3577,8 @@ function createFeedback(config) {
       capture_method: screenshot ? manualScreenshot ? "manual" : "html2canvas" : "none",
       technical_context
     };
-    if ("0.10.0") {
-      payload.widget_version = "0.10.0";
+    if ("0.11.0") {
+      payload.widget_version = "0.11.0";
     }
     if (screenshot) payload.screenshot = screenshot;
     if (values.synthetic) payload.synthetic = true;
@@ -3570,4 +3664,4 @@ function createFeedback(config) {
 export {
   createFeedback
 };
-//# sourceMappingURL=chunk-XSAUJEJN.mjs.map
+//# sourceMappingURL=chunk-AO3BXEG5.mjs.map