@ogcio/o11y-sdk-react 0.4.0 → 0.4.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [0.4.2](https://github.com/ogcio/o11y/compare/@ogcio/o11y-sdk-react@v0.4.0...@ogcio/o11y-sdk-react@v0.4.2) (2025-09-09)
+
+### Miscellaneous Chores
+
+* **sdk-react:** propagate url encoding detection to react-sdk AB[#30758](https://github.com/ogcio/o11y/issues/30758) ([#202](https://github.com/ogcio/o11y/issues/202)) ([aaf0d5a](https://github.com/ogcio/o11y/commit/aaf0d5a9b30a186d804fc839a23180891d9ef883))
+
 ## [0.4.0](https://github.com/ogcio/o11y/compare/@ogcio/o11y-sdk-react@v0.3.0...@ogcio/o11y-sdk-react@v0.4.0) (2025-09-02)
 
 

package/dist/lib/internals/redaction/pii-detection.d.ts

@@ -1,5 +1,12 @@
 import { TransportItemType } from "@grafana/faro-web-sdk";
 import { Redactor } from "./redactors/index.js";
+/**
+ * Checks whether a string contains URI-encoded components.
+ *
+ * @param {string} value - The string to inspect.
+ * @returns {boolean} `true` if the string is encoded, `false` otherwise.
+ */
+export declare function _containsEncodedComponents(value: string): boolean;
 /**
  * Cleans a string by redacting configured PIIs and emitting metrics for redacted values.
  *

package/dist/lib/internals/redaction/pii-detection.js

@@ -4,13 +4,21 @@
  * @param {string} value - The string to inspect.
  * @returns {boolean} `true` if the string is encoded, `false` otherwise.
  */
-function _containsEncodedComponents(value) {
+export function _containsEncodedComponents(value) {
     try {
-        return decodeURI(value) !== decodeURIComponent(value);
+        const decodedURIComponent = decodeURIComponent(value);
+        if (decodeURI(value) !== decodedURIComponent) {
+            return true;
+        }
+        if (value !== decodedURIComponent) {
+            return (encodeURIComponent(decodedURIComponent) === value ||
+                encodeURI(decodedURIComponent) === value);
+        }
     }
     catch {
         return false;
     }
+    return false;
 }
 /**
  * Cleans a string by redacting configured PIIs and emitting metrics for redacted values.

package/lib/internals/redaction/pii-detection.ts

@@ -7,12 +7,24 @@ import { Redactor } from "./redactors/index.js";
  * @param {string} value - The string to inspect.
  * @returns {boolean} `true` if the string is encoded, `false` otherwise.
  */
-function _containsEncodedComponents(value: string) {
+export function _containsEncodedComponents(value: string): boolean {
   try {
-    return decodeURI(value) !== decodeURIComponent(value);
+    const decodedURIComponent = decodeURIComponent(value);
+    if (decodeURI(value) !== decodedURIComponent) {
+      return true;
+    }
+
+    if (value !== decodedURIComponent) {
+      return (
+        encodeURIComponent(decodedURIComponent) === value ||
+        encodeURI(decodedURIComponent) === value
+      );
+    }
   } catch {
     return false;
   }
+
+  return false;
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ogcio/o11y-sdk-react",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Opentelemetry standard instrumentation SDK for React based project",
   "main": "dist/index.js",
   "type": "module",

package/test/lib/pii-detection.test.ts

@@ -1,6 +1,11 @@
 import { TransportItemType } from "@grafana/faro-web-sdk";
 import { beforeEach, describe, expect, it, vi } from "vitest";
-import { _cleanStringPII } from "../../lib/internals/redaction/pii-detection";
+import {
+  _cleanStringPII,
+  _containsEncodedComponents,
+} from "../../lib/internals/redaction/pii-detection";
+import { faro } from "@grafana/faro-web-sdk";
+import { redactors } from "../../lib/internals/redaction/redactors";
 
 // Mock faro.api.pushMeasurement
 vi.mock("@grafana/faro-web-sdk", async () => {
@@ -15,9 +20,6 @@ vi.mock("@grafana/faro-web-sdk", async () => {
   };
 });
 
-import { faro } from "@grafana/faro-web-sdk";
-import { redactors } from "../../lib/internals/redaction/redactors";
-
 describe("_cleanStringPII", () => {
   beforeEach(() => {
     vi.clearAllMocks();
@@ -77,3 +79,101 @@ describe("_cleanStringPII", () => {
     expect(faro.api.pushMeasurement).not.toHaveBeenCalled();
   });
 });
+
+describe("_containsEncodedComponents", () => {
+  describe("should return true for properly URL encoded strings", () => {
+    it.each([
+      ["hello%20world", "Space encoded as %20"],
+      ["test%2Bvalue", "Plus sign encoded as %2B"],
+      ["path%2Fto%2Ffile", "Forward slashes encoded"],
+      ["user%40domain.com", "@ symbol encoded"],
+      ["100%25%20off", "Percent and space encoded"],
+      ["a%3Db%26c%3Dd", "Query parameters (a=b&c=d)"],
+      ["caf%C3%A9", "UTF-8 encoded (café)"],
+      ["price%3A%20%2410", "Colon, space, dollar ($10)"],
+      ["%22quoted%22", "Double quotes encoded"],
+      ["https%3A%2F%2Fexample.com", "Full URL encoded"],
+      ["file%20name.txt", "filename encoded"],
+      ["search%3Fq%3Dhello%20world", "Query string encoded"],
+      ["%3C%3E%26%22%27", "HTML special chars encoded (<>&\"')"],
+      ["%E2%9C%93", "UTF-8 checkmark (✓) encoded"],
+      ["test%2b", "Lowercase hex"],
+      ["%E4%B8%AD%E6%96%87", "Chinese characters encoded"],
+    ])('should detect "%s" as URL encoded (%s)', (input, description) => {
+      expect(_containsEncodedComponents(input)).toBe(true);
+    });
+  });
+
+  describe("should return false for non-URL encoded strings", () => {
+    it.each([
+      ["test", "Simple ASCII string"],
+      ["hello world", "Unencoded space"],
+      ["user@domain.com", "Unencoded email"],
+      ["simple123", "Alphanumeric only"],
+      ["", "Empty string"],
+      ["25%%", "Literal percent signs"],
+      ["100% off", "Percent without hex digits"],
+      ["test%2", "Incomplete percent encoding"],
+      ["hello%ZZ", "Invalid hex digits"],
+      ["test%2G", "Invalid hex digit G"],
+      ["bad%encoding%here", "Percent without hex pairs"],
+      ["hello%20world and more", "Partially encoded string"],
+      ["hello%20world%21%20how%20are%20you", "Overly encoded string"],
+      ["café", "Unicode characters (unencoded)"],
+      ["hello+world", "Plus sign (form encoding style)"],
+      ["test%", "Trailing percent"],
+      ["hello%20world%", "Encoded content with trailing percent"],
+      ["%", "Single percent"],
+      ["%%", "Double percent"],
+      ["normal text with % symbols", "Text with percent but no encoding"],
+      ["price: $100%", "Currency with percent"],
+      ["file.txt", "Simple filename"],
+      ["path/to/file", "Unencoded path"],
+      ["query?param=value", "Unencoded query string"],
+      ["hello%world", "Percent without following hex"],
+      ["test%1", "Single hex digit after percent"],
+      ["hello%zz", "Non-hex characters after percent"],
+    ])('should not detect "%s" as URL encoded (%s)', (input, description) => {
+      expect(_containsEncodedComponents(input)).toBe(false);
+    });
+  });
+
+  describe("Error handling", () => {
+    it.each([
+      ["%C0%80", "Overlong UTF-8 encoding (security concern)"],
+      ["%ED%A0%80", "UTF-8 surrogate (invalid)"],
+      ["%FF%FE", "Invalid UTF-8 sequence"],
+      ["test%20%ZZ", "Mix of valid and invalid encoding"],
+    ])('should handle "%s" (%s)', (input, description) => {
+      // These should not throw errors
+      expect(() => _containsEncodedComponents(input)).not.toThrow();
+
+      // Most of these should return false due to invalid sequences
+      // or security-related encoding issues
+      const result = _containsEncodedComponents(input);
+      expect(typeof result).toBe("boolean");
+    });
+  });
+
+  describe("real-world url examples", () => {
+    it.each([
+      [
+        "https%3A%2F%2Fgoogle.com%2Fsearch%3Fq%3Djavascript",
+        "Encoded Google search URL",
+      ],
+      ["The%20quick%20brown%20fox", "Sentence with spaces encoded"],
+      [
+        "/api/user?body=here%20are%20all%20my%20secrets",
+        "contextually encoded API path",
+      ],
+      ["redirect_uri=https%3A%2F%2Fapp.com%2Fcallback", "OAuth redirect URI"],
+      ["data%3Atext%2Fplain%3Bbase64%2CSGVsbG8%3D", "Data URL encoded"],
+    ])('real-world case: "%s" (%s)', (input, description) => {
+      const result = _containsEncodedComponents(input);
+
+      // Verify the function doesn't crash
+      expect(typeof result).toBe("boolean");
+      expect(result).toBe(true);
+    });
+  });
+});