@microsoft/omnichannel-chat-widget 1.8.4-main.51ef6e3 → 1.8.4-main.5b3f077

package/lib/cjs/common/telemetry/TelemetryManager.js

@@ -11,6 +11,7 @@ var _appInsightsLogger = require("./loggers/appInsightsLogger");
 var _ariaTelemetryLogger = require("./loggers/ariaTelemetryLogger");
 var _consoleLogger = require("./loggers/consoleLogger");
 var _defaultAriaConfig = require("./defaultConfigs/defaultAriaConfig");
+var _sanitizeSasInPayload = require("./sanitizeSasInPayload");
 function _defineProperties(target, props) { for (var i = 0; i < props.length; i++) { var descriptor = props[i]; descriptor.enumerable = descriptor.enumerable || false; descriptor.configurable = true; if ("value" in descriptor) descriptor.writable = true; Object.defineProperty(target, _toPropertyKey(descriptor.key), descriptor); } }
 function _createClass(Constructor, protoProps, staticProps) { if (protoProps) _defineProperties(Constructor.prototype, protoProps); if (staticProps) _defineProperties(Constructor, staticProps); Object.defineProperty(Constructor, "prototype", { writable: false }); return Constructor; }
 function _classCallCheck(instance, Constructor) { if (!(instance instanceof Constructor)) { throw new TypeError("Cannot call a class as a function"); } }
@@ -81,11 +82,15 @@ const RegisterLoggers = () => {
     };
   };
   const logTelemetry = telemetryEvent => {
+    // Redact Azure SAS credentials in any URL embedded in the payload (e.g.
+    // customer-supplied blob asset URLs in widget customization props) before
+    // it fans out to console, Aria, AppInsights, or any custom logger.
+    const sanitizedPayload = (0, _sanitizeSasInPayload.sanitizeSasInPayload)(telemetryEvent === null || telemetryEvent === void 0 ? void 0 : telemetryEvent.payload);
     loggers.map(logger => {
       var _payload, _telemetryInput$paylo;
       const logLevel = telemetryEvent.logLevel ?? _TelemetryConstants.LogLevel.INFO;
       const scenarioType = ((_payload = telemetryEvent.payload) === null || _payload === void 0 ? void 0 : _payload.scenarioType) ?? _TelemetryConstants.ScenarioType.UNDEFINED;
-      const telemetryInput = parseInput(telemetryEvent === null || telemetryEvent === void 0 ? void 0 : telemetryEvent.payload, scenarioType);
+      const telemetryInput = parseInput(sanitizedPayload, scenarioType);
       telemetryInput.telemetryInfo = {
         telemetryInfo: _TelemetryHelper.TelemetryHelper.buildTelemetryEvent(logLevel, telemetryInput)
       };

package/lib/cjs/common/telemetry/sanitizeSasInPayload.js

@@ -0,0 +1,82 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.sanitizeSasInPayload = void 0;
+/**
+ * Redacts the values of Azure Shared Access Signature (SAS) query parameters in any
+ * URL embedded in a telemetry payload, so customer-supplied SAS URLs (e.g. blob asset
+ * URLs in widget customization props) cannot leak credentials through Aria/AppInsights.
+ *
+ * Trigger: any URL whose query string contains `sig=`. When detected, every well-known
+ * SAS parameter value in that query is replaced with `[REDACTED]`. Other URLs and other
+ * substrings of the payload pass through unchanged.
+ *
+ * Coverage of SAS parameter names:
+ *  - Service/Blob SAS:        sig, sv, se, st, sp, spr, sr, sip
+ *  - Account SAS:             ss, srt
+ *  - User-delegation key SAS: skoid, sktid, skt, ske, sks, skv, saoid, suoid, sce, sdd
+ *  - Response header overrides: rscc, rscd, rsce, rscl, rsct
+ *
+ * Reference: https://learn.microsoft.com/en-us/rest/api/storageservices/create-service-sas
+ */
+
+const SAS_PARAM_NAMES = new Set(["sig", "sv", "se", "st", "sp", "spr", "sr", "sip", "ss", "srt", "skoid", "sktid", "skt", "ske", "sks", "skv", "saoid", "suoid", "sce", "sdd", "rscc", "rscd", "rsce", "rscl", "rsct"]);
+const REDACTED_VALUE = "[REDACTED]";
+
+// Matches any http(s) URL substring up to whitespace / closing quote / angle-bracket / paren.
+const URL_REGEX = /\bhttps?:\/\/[^\s"'<>)]+/gi;
+const redactQueryIfSas = url => {
+  const queryIdx = url.indexOf("?");
+  if (queryIdx < 0) {
+    return url;
+  }
+  // Separate the fragment (#...) before processing the query — fragments come
+  // after the query string in URL syntax and must not be folded into the last
+  // query parameter's value when we split on `&`.
+  const afterQuestionMark = url.slice(queryIdx + 1);
+  const fragIdx = afterQuestionMark.indexOf("#");
+  const query = fragIdx < 0 ? afterQuestionMark : afterQuestionMark.slice(0, fragIdx);
+  const fragment = fragIdx < 0 ? "" : afterQuestionMark.slice(fragIdx); // includes the leading '#'
+  if (!/(^|&)sig=/i.test(query)) {
+    // No SAS signature present — leave the URL alone so legitimate non-SAS query
+    // strings (e.g. ?utm_source=...) are not mangled.
+    return url;
+  }
+  const base = url.slice(0, queryIdx);
+  const sanitizedQuery = query.split("&").map(pair => {
+    const eqIdx = pair.indexOf("=");
+    if (eqIdx < 0) {
+      return pair;
+    }
+    const name = pair.slice(0, eqIdx).toLowerCase();
+    return SAS_PARAM_NAMES.has(name) ? `${pair.slice(0, eqIdx)}=${REDACTED_VALUE}` : pair;
+  }).join("&");
+  return `${base}?${sanitizedQuery}${fragment}`;
+};
+const sanitizeString = s => s.replace(URL_REGEX, redactQueryIfSas);
+
+/**
+ * Deep-walk a value and redact SAS credentials in any string it contains.
+ * Returns a new object/array (originals are not mutated); non-string leaves are
+ * passed through. Tree-shaped, JSON-like values only — not designed for class
+ * instances, prototype-bound objects, or cyclic graphs.
+ */
+const sanitizeSasInPayload = value => {
+  if (typeof value === "string") {
+    return sanitizeString(value);
+  }
+  if (Array.isArray(value)) {
+    return value.map(sanitizeSasInPayload);
+  }
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = sanitizeSasInPayload(v);
+    }
+    return out;
+  }
+  return value;
+};
+exports.sanitizeSasInPayload = sanitizeSasInPayload;

package/lib/cjs/components/prechatsurveypanestateful/common/defaultStyles/defaultGeneralPreChatSurveyPaneStyleProps.js

@@ -12,7 +12,6 @@ const defaultGeneralPreChatSurveyPaneStyleProps = {
   borderColor: "#F1F1F1",
   overflowY: "auto",
   height: "inherit",
-  width: "inherit",
-  overscrollBehavior: "none"
+  width: "inherit"
 };
 exports.defaultGeneralPreChatSurveyPaneStyleProps = defaultGeneralPreChatSurveyPaneStyleProps;

package/lib/esm/common/telemetry/TelemetryManager.js

@@ -11,6 +11,7 @@ import { appInsightsLogger } from "./loggers/appInsightsLogger";
 import { ariaTelemetryLogger } from "./loggers/ariaTelemetryLogger";
 import { consoleLogger } from "./loggers/consoleLogger";
 import { defaultAriaConfig } from "./defaultConfigs/defaultAriaConfig";
+import { sanitizeSasInPayload } from "./sanitizeSasInPayload";
 export let TelemetryTimers = /*#__PURE__*/_createClass(function TelemetryTimers() {
   _classCallCheck(this, TelemetryTimers);
 });
@@ -72,11 +73,15 @@ export const RegisterLoggers = () => {
     };
   };
   const logTelemetry = telemetryEvent => {
+    // Redact Azure SAS credentials in any URL embedded in the payload (e.g.
+    // customer-supplied blob asset URLs in widget customization props) before
+    // it fans out to console, Aria, AppInsights, or any custom logger.
+    const sanitizedPayload = sanitizeSasInPayload(telemetryEvent === null || telemetryEvent === void 0 ? void 0 : telemetryEvent.payload);
     loggers.map(logger => {
       var _payload, _telemetryInput$paylo;
       const logLevel = telemetryEvent.logLevel ?? LogLevel.INFO;
       const scenarioType = ((_payload = telemetryEvent.payload) === null || _payload === void 0 ? void 0 : _payload.scenarioType) ?? ScenarioType.UNDEFINED;
-      const telemetryInput = parseInput(telemetryEvent === null || telemetryEvent === void 0 ? void 0 : telemetryEvent.payload, scenarioType);
+      const telemetryInput = parseInput(sanitizedPayload, scenarioType);
       telemetryInput.telemetryInfo = {
         telemetryInfo: TelemetryHelper.buildTelemetryEvent(logLevel, telemetryInput)
       };

package/lib/esm/common/telemetry/sanitizeSasInPayload.js

@@ -0,0 +1,75 @@
+/**
+ * Redacts the values of Azure Shared Access Signature (SAS) query parameters in any
+ * URL embedded in a telemetry payload, so customer-supplied SAS URLs (e.g. blob asset
+ * URLs in widget customization props) cannot leak credentials through Aria/AppInsights.
+ *
+ * Trigger: any URL whose query string contains `sig=`. When detected, every well-known
+ * SAS parameter value in that query is replaced with `[REDACTED]`. Other URLs and other
+ * substrings of the payload pass through unchanged.
+ *
+ * Coverage of SAS parameter names:
+ *  - Service/Blob SAS:        sig, sv, se, st, sp, spr, sr, sip
+ *  - Account SAS:             ss, srt
+ *  - User-delegation key SAS: skoid, sktid, skt, ske, sks, skv, saoid, suoid, sce, sdd
+ *  - Response header overrides: rscc, rscd, rsce, rscl, rsct
+ *
+ * Reference: https://learn.microsoft.com/en-us/rest/api/storageservices/create-service-sas
+ */
+
+const SAS_PARAM_NAMES = new Set(["sig", "sv", "se", "st", "sp", "spr", "sr", "sip", "ss", "srt", "skoid", "sktid", "skt", "ske", "sks", "skv", "saoid", "suoid", "sce", "sdd", "rscc", "rscd", "rsce", "rscl", "rsct"]);
+const REDACTED_VALUE = "[REDACTED]";
+
+// Matches any http(s) URL substring up to whitespace / closing quote / angle-bracket / paren.
+const URL_REGEX = /\bhttps?:\/\/[^\s"'<>)]+/gi;
+const redactQueryIfSas = url => {
+  const queryIdx = url.indexOf("?");
+  if (queryIdx < 0) {
+    return url;
+  }
+  // Separate the fragment (#...) before processing the query — fragments come
+  // after the query string in URL syntax and must not be folded into the last
+  // query parameter's value when we split on `&`.
+  const afterQuestionMark = url.slice(queryIdx + 1);
+  const fragIdx = afterQuestionMark.indexOf("#");
+  const query = fragIdx < 0 ? afterQuestionMark : afterQuestionMark.slice(0, fragIdx);
+  const fragment = fragIdx < 0 ? "" : afterQuestionMark.slice(fragIdx); // includes the leading '#'
+  if (!/(^|&)sig=/i.test(query)) {
+    // No SAS signature present — leave the URL alone so legitimate non-SAS query
+    // strings (e.g. ?utm_source=...) are not mangled.
+    return url;
+  }
+  const base = url.slice(0, queryIdx);
+  const sanitizedQuery = query.split("&").map(pair => {
+    const eqIdx = pair.indexOf("=");
+    if (eqIdx < 0) {
+      return pair;
+    }
+    const name = pair.slice(0, eqIdx).toLowerCase();
+    return SAS_PARAM_NAMES.has(name) ? `${pair.slice(0, eqIdx)}=${REDACTED_VALUE}` : pair;
+  }).join("&");
+  return `${base}?${sanitizedQuery}${fragment}`;
+};
+const sanitizeString = s => s.replace(URL_REGEX, redactQueryIfSas);
+
+/**
+ * Deep-walk a value and redact SAS credentials in any string it contains.
+ * Returns a new object/array (originals are not mutated); non-string leaves are
+ * passed through. Tree-shaped, JSON-like values only — not designed for class
+ * instances, prototype-bound objects, or cyclic graphs.
+ */
+export const sanitizeSasInPayload = value => {
+  if (typeof value === "string") {
+    return sanitizeString(value);
+  }
+  if (Array.isArray(value)) {
+    return value.map(sanitizeSasInPayload);
+  }
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = sanitizeSasInPayload(v);
+    }
+    return out;
+  }
+  return value;
+};

package/lib/esm/components/prechatsurveypanestateful/common/defaultStyles/defaultGeneralPreChatSurveyPaneStyleProps.js

@@ -6,6 +6,5 @@ export const defaultGeneralPreChatSurveyPaneStyleProps = {
   borderColor: "#F1F1F1",
   overflowY: "auto",
   height: "inherit",
-  width: "inherit",
-  overscrollBehavior: "none"
+  width: "inherit"
 };

package/lib/types/common/telemetry/sanitizeSasInPayload.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Redacts the values of Azure Shared Access Signature (SAS) query parameters in any
+ * URL embedded in a telemetry payload, so customer-supplied SAS URLs (e.g. blob asset
+ * URLs in widget customization props) cannot leak credentials through Aria/AppInsights.
+ *
+ * Trigger: any URL whose query string contains `sig=`. When detected, every well-known
+ * SAS parameter value in that query is replaced with `[REDACTED]`. Other URLs and other
+ * substrings of the payload pass through unchanged.
+ *
+ * Coverage of SAS parameter names:
+ *  - Service/Blob SAS:        sig, sv, se, st, sp, spr, sr, sip
+ *  - Account SAS:             ss, srt
+ *  - User-delegation key SAS: skoid, sktid, skt, ske, sks, skv, saoid, suoid, sce, sdd
+ *  - Response header overrides: rscc, rscd, rsce, rscl, rsct
+ *
+ * Reference: https://learn.microsoft.com/en-us/rest/api/storageservices/create-service-sas
+ */
+/**
+ * Deep-walk a value and redact SAS credentials in any string it contains.
+ * Returns a new object/array (originals are not mutated); non-string leaves are
+ * passed through. Tree-shaped, JSON-like values only — not designed for class
+ * instances, prototype-bound objects, or cyclic graphs.
+ */
+export declare const sanitizeSasInPayload: <T>(value: T) => T;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@microsoft/omnichannel-chat-widget",
-  "version": "1.8.4-main.51ef6e3",
+  "version": "1.8.4-main.5b3f077",
   "description": "Microsoft Omnichannel Chat Widget",
   "main": "lib/cjs/index.js",
   "types": "lib/types/index.d.ts",