@mushi-mushi/web 1.7.7 → 1.7.8

package/dist/index.js

@@ -3658,18 +3658,18 @@ function createScreenshotCapture(options = {}) {
       const url = URL.createObjectURL(blob);
       return new Promise((resolve) => {
         img.onload = () => {
-          ctx.drawImage(img, 0, 0, width, height);
-          URL.revokeObjectURL(url);
           try {
-            const dataUrl = canvas.toDataURL("image/jpeg", 0.7);
-            resolve(dataUrl);
+            ctx.drawImage(img, 0, 0, width, height);
+            URL.revokeObjectURL(url);
+            resolve(canvas.toDataURL("image/jpeg", 0.7));
           } catch {
-            resolve(null);
+            URL.revokeObjectURL(url);
+            resolve(buildDegradedScreenshot(width, height));
           }
         };
         img.onerror = () => {
           URL.revokeObjectURL(url);
-          resolve(null);
+          resolve(buildDegradedScreenshot(width, height));
         };
         img.src = url;
       });
@@ -3691,6 +3691,7 @@ var DEFAULT_REDACT_SELECTORS = [
 function buildPrivacySafeDocument(privacy) {
   const clone = document.documentElement.cloneNode(true);
   clone.querySelector("#mushi-mushi-widget")?.remove();
+  stripTaintSources(clone);
   const redactSelectors = privacy?.redactSelectors !== void 0 ? privacy.redactSelectors : DEFAULT_REDACT_SELECTORS;
   for (const selector of redactSelectors) {
     for (const el of safeQueryAll(clone, selector)) {
@@ -3729,6 +3730,46 @@ function redactElement(el) {
   el.setAttribute("data-mushi-redacted", "true");
   while (el.firstChild) el.removeChild(el.firstChild);
 }
+function stripTaintSources(root) {
+  const pageOrigin = typeof location !== "undefined" ? location.origin : "";
+  for (const el of root.querySelectorAll("img, video, iframe, object, embed, picture")) {
+    el.remove();
+  }
+  for (const link of root.querySelectorAll('link[rel="stylesheet"], link[as="style"]')) {
+    const href = link.getAttribute("href");
+    if (!href || isCrossOriginUrl(href, pageOrigin)) link.remove();
+  }
+  for (const script of root.querySelectorAll("script")) {
+    script.remove();
+  }
+}
+function isCrossOriginUrl(raw, pageOrigin) {
+  if (!raw || raw.startsWith("data:") || raw.startsWith("blob:")) return false;
+  try {
+    const resolved = new URL(raw, typeof location !== "undefined" ? location.href : "http://localhost/");
+    return Boolean(pageOrigin) && resolved.origin !== pageOrigin;
+  } catch {
+    return true;
+  }
+}
+function buildDegradedScreenshot(width, height) {
+  const canvas = document.createElement("canvas");
+  const ctx = canvas.getContext("2d");
+  if (!ctx) return null;
+  canvas.width = width;
+  canvas.height = height;
+  ctx.fillStyle = "#111827";
+  ctx.fillRect(0, 0, width, height);
+  ctx.fillStyle = "#e5e7eb";
+  ctx.font = "13px system-ui, sans-serif";
+  ctx.fillText("Screenshot: layout captured (external media stripped)", 16, 28);
+  ctx.fillText(`${width}\xD7${height}px`, 16, 48);
+  try {
+    return canvas.toDataURL("image/jpeg", 0.7);
+  } catch {
+    return null;
+  }
+}
 function maskElement(el) {
   if (el instanceof HTMLInputElement || el instanceof HTMLTextAreaElement) {
     el.value = "";