@mushi-mushi/core 1.19.1 → 1.19.2

package/dist/index.cjs

@@ -115,8 +115,9 @@ function createApiClient(options) {
         const errorBody = await response.json().catch(() => ({}));
         if ((response.status === 401 || response.status === 403) && !_credWarningEmitted) {
           _credWarningEmitted = true;
+          const where = baseUrl === DEFAULT_API_ENDPOINT ? "Get the correct values at: https://kensaur.us/mushi-mushi/admin/projects" : "Get the correct values from your Mushi console's Projects page.";
           console.error(
-            `[Mushi] Credentials rejected (HTTP ${response.status}). Check your Project ID and API key scope (must be "report:write"). Get the correct values at: https://kensaur.us/mushi-mushi/admin/projects`
+            `[Mushi] Credentials rejected (HTTP ${response.status}). Check your Project ID and API key scope (must be "report:write"). ` + where
           );
         }
         if (response.status >= 500 && retries > 0) {
@@ -1996,10 +1997,20 @@ function readPageFaviconHref() {
   ];
   for (const sel of selectors) {
     const link = document.querySelector(sel);
-    if (link?.href) return link.href;
+    const href = link?.href;
+    if (href && isSafeFaviconHref(href)) return href;
   }
   return null;
 }
+function isSafeFaviconHref(href) {
+  try {
+    const base = typeof location !== "undefined" ? location.href : void 0;
+    const protocol = new URL(href, base).protocol;
+    return protocol === "http:" || protocol === "https:";
+  } catch {
+    return false;
+  }
+}
 
 exports.DEFAULT_API_ENDPOINT = DEFAULT_API_ENDPOINT;
 exports.MAX_REPORT_PAYLOAD_BYTES = MAX_REPORT_PAYLOAD_BYTES;