@openreplay/tracker 16.1.0-beta.9 → 16.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -171,6 +171,7 @@ export default class App {
171
171
  private pageFrames;
172
172
  private frameOderNumber;
173
173
  private features;
174
+ private emptyBatchCounter;
174
175
  constructor(projectKey: string, sessionToken: string | undefined, options: Partial<Options>, signalError: (error: string, apis: string[]) => void, insideIframe: boolean);
175
176
  /** used by child iframes for crossdomain only */
176
177
  parentActive: boolean;
@@ -28,18 +28,23 @@ export interface Options {
28
28
  *
29
29
  * */
30
30
  domSanitizer?: (node: Element) => SanitizeLevel;
31
+ /**
32
+ * private by default mode that will mask all elements not marked by data-openreplay-unmask
33
+ * */
34
+ privateMode?: boolean;
31
35
  }
32
36
  export declare const stringWiper: (input: string) => string;
33
37
  export default class Sanitizer {
34
38
  private readonly obscured;
35
39
  private readonly hidden;
36
40
  private readonly options;
41
+ readonly privateMode: boolean;
37
42
  private readonly app;
38
43
  constructor(params: {
39
44
  app: App;
40
45
  options?: Partial<Options>;
41
46
  });
42
- handleNode(id: number, parentID: number, node: Node): void;
47
+ handleNode(id: number, parentID: number, node: Node): Set<number> | undefined;
43
48
  sanitize(id: number, data: string): string;
44
49
  isObscured(id: number): boolean;
45
50
  isHidden(id: number): boolean;
@@ -5,11 +5,11 @@ export declare class StringDictionary {
5
5
  /** backwards dictionary of
6
6
  * [repeated str:key]
7
7
  * */
8
- backDict: Record<string, number>;
8
+ private backDict;
9
9
  getKey: (str: string) => [number, boolean];
10
10
  }
11
11
  export default class AttributeSender {
12
- dict: StringDictionary;
12
+ private dict;
13
13
  private readonly app;
14
14
  private readonly isDictDisabled;
15
15
  constructor(options: {
package/dist/lib/entry.js CHANGED
@@ -721,7 +721,9 @@ class StringDictionary {
721
721
  this.backDict = {};
722
722
  this.getKey = (str) => {
723
723
  let isNew = false;
724
- if (!this.backDict[str]) {
724
+ // avoiding potential native object properties
725
+ const safeKey = `__${str}`;
726
+ if (!this.backDict[safeKey]) {
725
727
  isNew = true;
726
728
  // shaving the first 2 digits of the timestamp (since they are irrelevant for next millennia)
727
729
  const shavedTs = Date.now() % 10 ** (13 - 2);
@@ -733,31 +735,26 @@ class StringDictionary {
733
735
  else {
734
736
  this.lastSuffix = 1;
735
737
  }
736
- this.backDict[str] = id;
738
+ this.backDict[safeKey] = id;
737
739
  this.lastTs = shavedTs;
738
740
  }
739
- return [this.backDict[str], isNew];
741
+ return [this.backDict[safeKey], isNew];
740
742
  };
741
743
  }
742
744
  }
743
745
  class AttributeSender {
744
746
  constructor(options) {
745
747
  this.sendSetAttribute = (id, name, value) => {
746
- // @ts-ignore
747
- const attr = typeof value === 'string' ? value : (value.toString?.() ?? '');
748
748
  if (this.isDictDisabled) {
749
- const msg = [12 /* Type.SetNodeAttribute */, id, name, attr];
749
+ const msg = [12 /* Type.SetNodeAttribute */, id, name, value];
750
750
  return this.app.send(msg);
751
751
  }
752
752
  else {
753
- if (typeof this.applyDict(attr) !== 'number') {
754
- console.log(id, name, value, this.app.nodes.getNode(id));
755
- }
756
753
  const message = [
757
754
  35 /* Type.SetNodeAttributeDictGlobal */,
758
755
  id,
759
756
  this.applyDict(name),
760
- this.applyDict(attr),
757
+ this.applyDict(value),
761
758
  ];
762
759
  return this.app.send(message);
763
760
  }
@@ -2203,7 +2200,7 @@ function Performance (app, opts) {
2203
2200
  app.attachStopCallback(() => {
2204
2201
  ticks = frames = undefined;
2205
2202
  });
2206
- app.ticker.attach(sendPerformanceTrack, 40, false);
2203
+ app.ticker.attach(sendPerformanceTrack, 165, false);
2207
2204
  if (document.hidden !== undefined) {
2208
2205
  app.attachEventListener(document, 'visibilitychange', sendPerformanceTrack, false, false);
2209
2206
  }
@@ -3710,9 +3707,26 @@ async function parseUseEl(useElement, mode, domParser) {
3710
3707
  console.debug('Openreplay: xlink:href or href not found on <use>.');
3711
3708
  return;
3712
3709
  }
3713
- const [url, symbolId] = href.split('#');
3714
- if (!url || !symbolId) {
3715
- console.debug('Openreplay: Invalid xlink:href or href found on <use>.');
3710
+ let [url, symbolId] = href.split('#');
3711
+ // happens if svg spritemap is local, fastest case for us
3712
+ if (!url && symbolId) {
3713
+ const symbol = document.querySelector(href);
3714
+ if (symbol) {
3715
+ const inlineSvg = `
3716
+ <svg xmlns="http://www.w3.org/2000/svg" viewBox="${symbol.getAttribute('viewBox') || '0 0 24 24'}">
3717
+ ${symbol.innerHTML}
3718
+ </svg>
3719
+ `.trim();
3720
+ iconCache[symbolId] = inlineSvg;
3721
+ return inlineSvg;
3722
+ }
3723
+ else {
3724
+ console.warn('Openreplay: Sprite symbol not found in the document.');
3725
+ return;
3726
+ }
3727
+ }
3728
+ if (!url && !symbolId) {
3729
+ console.warn('Openreplay: Invalid xlink:href or href found on <use>.');
3716
3730
  return;
3717
3731
  }
3718
3732
  if (iconCache[symbolId]) {
@@ -3963,6 +3977,9 @@ class Observer {
3963
3977
  if (name === 'href' || value.length > 1e5) {
3964
3978
  value = '';
3965
3979
  }
3980
+ if (['alt', 'placeholder'].includes(name) && this.app.sanitizer.privateMode) {
3981
+ value = value.replaceAll(/./g, '*');
3982
+ }
3966
3983
  this.app.attributeSender.sendSetAttribute(id, name, value);
3967
3984
  }
3968
3985
  sendNodeData(id, parentElement, data) {
@@ -3990,7 +4007,7 @@ class Observer {
3990
4007
  const walker = document.createTreeWalker(node, NodeFilter.SHOW_ELEMENT + NodeFilter.SHOW_TEXT, {
3991
4008
  acceptNode: (node) => {
3992
4009
  if (this.app.nodes.getID(node) !== undefined) {
3993
- this.app.debug.warn('! Node is already bound', node);
4010
+ this.app.debug.info('! Node is already bound', node);
3994
4011
  }
3995
4012
  return isIgnored(node) || this.app.nodes.getID(node) !== undefined
3996
4013
  ? NodeFilter.FILTER_REJECT
@@ -4403,18 +4420,30 @@ var SanitizeLevel;
4403
4420
  })(SanitizeLevel || (SanitizeLevel = {}));
4404
4421
  const stringWiper = (input) => input
4405
4422
  .trim()
4406
- .replace(/[^\f\n\r\t\v\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]/g, '');
4423
+ .replace(/[^\f\n\r\t\v\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff\s]/g, '*');
4407
4424
  class Sanitizer {
4408
4425
  constructor(params) {
4409
4426
  this.obscured = new Set();
4410
4427
  this.hidden = new Set();
4411
4428
  this.app = params.app;
4412
- this.options = Object.assign({
4429
+ const defaultOptions = {
4413
4430
  obscureTextEmails: true,
4414
4431
  obscureTextNumbers: false,
4415
- }, params.options);
4432
+ privateMode: false,
4433
+ domSanitizer: undefined,
4434
+ };
4435
+ this.privateMode = params.options?.privateMode ?? false;
4436
+ this.options = Object.assign(defaultOptions, params.options);
4416
4437
  }
4417
4438
  handleNode(id, parentID, node) {
4439
+ if (this.options.privateMode) {
4440
+ if (isElementNode(node) && !hasOpenreplayAttribute(node, 'unmask')) {
4441
+ return this.obscured.add(id);
4442
+ }
4443
+ if (isTextNode(node) && !hasOpenreplayAttribute(node.parentNode, 'unmask')) {
4444
+ return this.obscured.add(id);
4445
+ }
4446
+ }
4418
4447
  if (this.obscured.has(parentID) ||
4419
4448
  (isElementNode(node) &&
4420
4449
  (hasOpenreplayAttribute(node, 'masked') || hasOpenreplayAttribute(node, 'obscured')))) {
@@ -4657,7 +4686,7 @@ class Ticker {
4657
4686
  * this value is injected during build time via rollup
4658
4687
  * */
4659
4688
  // @ts-ignore
4660
- const workerBodyFn = "!function(){\"use strict\";class t{constructor(t,s,i,e=10,n=250,h,r){this.onUnauthorised=s,this.onFailure=i,this.MAX_ATTEMPTS_COUNT=e,this.ATTEMPT_TIMEOUT=n,this.onCompress=h,this.pageNo=r,this.attemptsCount=0,this.busy=!1,this.queue=[],this.token=null,this.lastBatchNum=0,this.ingestURL=t+\"/v1/web/i\",this.isCompressing=void 0!==h}getQueueStatus(){return 0===this.queue.length&&!this.busy}authorise(t){this.token=t,this.busy||this.sendNext()}push(t){if(this.busy||!this.token)this.queue.push(t);else if(this.busy=!0,this.isCompressing&&this.onCompress)this.onCompress(t);else{const s=++this.lastBatchNum;this.sendBatch(t,!1,s)}}sendNext(){const t=this.queue.shift();if(t)if(this.busy=!0,this.isCompressing&&this.onCompress)this.onCompress(t);else{const s=++this.lastBatchNum;this.sendBatch(t,!1,s)}else this.busy=!1}retry(t,s,i){this.attemptsCount>=this.MAX_ATTEMPTS_COUNT?this.onFailure(`Failed to send batch after ${this.attemptsCount} attempts.`):(this.attemptsCount++,setTimeout((()=>this.sendBatch(t,s,i)),this.ATTEMPT_TIMEOUT*this.attemptsCount))}sendBatch(t,s,i){var e;const n=null==i?void 0:i.toString().replace(/^([^_]+)_([^_]+).*/,\"$1_$2_$3\");this.busy=!0;const h={Authorization:`Bearer ${this.token}`};s&&(h[\"Content-Encoding\"]=\"gzip\"),null!==this.token?fetch(`${this.ingestURL}?batch=${null!==(e=this.pageNo)&&void 0!==e?e:\"noPageNum\"}_${null!=n?n:\"noBatchNum\"}`,{body:t,method:\"POST\",headers:h,keepalive:t.length<65536}).then((e=>{if(401===e.status)return this.busy=!1,void this.onUnauthorised();e.status>=400?this.retry(t,s,`${null!=i?i:\"noBatchNum\"}_network:${e.status}`):(this.attemptsCount=0,this.sendNext())})).catch((e=>{console.warn(\"OpenReplay:\",e),this.retry(t,s,`${null!=i?i:\"noBatchNum\"}_reject:${e.message}`)})):setTimeout((()=>{this.sendBatch(t,s,`${null!=i?i:\"noBatchNum\"}_newToken`)}),500)}sendCompressed(t){const s=++this.lastBatchNum;this.sendBatch(t,!0,s)}sendUncompressed(t){const s=++this.lastBatchNum;this.sendBatch(t,!1,s)}clean(){this.sendNext(),setTimeout((()=>{this.token=null,this.queue.length=0}),10)}}const s=\"function\"==typeof TextEncoder?new TextEncoder:{encode(t){const s=t.length,i=new Uint8Array(3*s);let e=-1;for(let n=0,h=0,r=0;r!==s;){if(n=t.charCodeAt(r),r+=1,n>=55296&&n<=56319){if(r===s){i[e+=1]=239,i[e+=1]=191,i[e+=1]=189;break}if(h=t.charCodeAt(r),!(h>=56320&&h<=57343)){i[e+=1]=239,i[e+=1]=191,i[e+=1]=189;continue}if(n=1024*(n-55296)+h-56320+65536,r+=1,n>65535){i[e+=1]=240|n>>>18,i[e+=1]=128|n>>>12&63,i[e+=1]=128|n>>>6&63,i[e+=1]=128|63&n;continue}}n<=127?i[e+=1]=0|n:n<=2047?(i[e+=1]=192|n>>>6,i[e+=1]=128|63&n):(i[e+=1]=224|n>>>12,i[e+=1]=128|n>>>6&63,i[e+=1]=128|63&n)}return i.subarray(0,e+1)}};class i{constructor(t){this.size=t,this.offset=0,this.checkpointOffset=0,this.data=new Uint8Array(t)}getCurrentOffset(){return this.offset}checkpoint(){this.checkpointOffset=this.offset}get isEmpty(){return 0===this.offset}skip(t){return this.offset+=t,this.offset<=this.size}set(t,s){this.data.set(t,s)}boolean(t){return this.data[this.offset++]=+t,this.offset<=this.size}uint(t){for((t<0||t>Number.MAX_SAFE_INTEGER)&&(t=0);t>=128;)this.data[this.offset++]=t%256|128,t=Math.floor(t/128);return this.data[this.offset++]=t,this.offset<=this.size}int(t){return t=Math.round(t),this.uint(t>=0?2*t:-2*t-1)}string(t){const i=s.encode(t),e=i.byteLength;return!(!this.uint(e)||this.offset+e>this.size)&&(this.data.set(i,this.offset),this.offset+=e,!0)}reset(){this.offset=0,this.checkpointOffset=0}flush(){const t=this.data.slice(0,this.checkpointOffset);return this.reset(),t}}class e extends i{encode(t){switch(t[0]){case 0:case 11:case 114:case 115:return this.uint(t[1]);case 4:case 44:case 47:return this.string(t[1])&&this.string(t[2])&&this.uint(t[3]);case 5:case 20:case 70:case 75:case 76:case 77:case 82:return this.uint(t[1])&&this.uint(t[2]);case 6:return this.int(t[1])&&this.int(t[2]);case 7:return!0;case 8:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3])&&this.string(t[4])&&this.boolean(t[5]);case 9:case 10:case 24:case 35:case 51:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3]);case 12:case 52:case 61:case 71:return this.uint(t[1])&&this.string(t[2])&&this.string(t[3]);case 13:case 14:case 17:case 34:case 50:case 54:return this.uint(t[1])&&this.string(t[2]);case 16:return this.uint(t[1])&&this.int(t[2])&&this.int(t[3]);case 18:return this.uint(t[1])&&this.string(t[2])&&this.int(t[3]);case 19:return this.uint(t[1])&&this.boolean(t[2]);case 21:return this.string(t[1])&&this.string(t[2])&&this.string(t[3])&&this.string(t[4])&&this.string(t[5])&&this.uint(t[6])&&this.uint(t[7])&&this.uint(t[8]);case 22:case 27:case 30:case 41:case 45:case 46:case 43:case 63:case 64:case 79:case 124:return this.string(t[1])&&this.string(t[2]);case 23:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3])&&this.uint(t[4])&&this.uint(t[5])&&this.uint(t[6])&&this.uint(t[7])&&this.uint(t[8])&&this.uint(t[9]);case 28:case 29:case 42:case 117:case 118:return this.string(t[1]);case 40:return this.string(t[1])&&this.uint(t[2])&&this.string(t[3])&&this.string(t[4]);case 48:return this.string(t[1])&&this.string(t[2])&&this.string(t[3])&&this.string(t[4])&&this.int(t[5]);case 49:return this.int(t[1])&&this.int(t[2])&&this.uint(t[3])&&this.uint(t[4]);case 53:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3])&&this.uint(t[4])&&this.uint(t[5])&&this.uint(t[6])&&this.string(t[7])&&this.string(t[8]);case 55:return this.boolean(t[1]);case 57:case 60:return this.uint(t[1])&&this.string(t[2])&&this.string(t[3])&&this.string(t[4]);case 58:case 120:return this.int(t[1]);case 68:return this.uint(t[1])&&this.uint(t[2])&&this.string(t[3])&&this.string(t[4])&&this.uint(t[5])&&this.uint(t[6]);case 69:return this.uint(t[1])&&this.uint(t[2])&&this.string(t[3])&&this.string(t[4]);case 73:return this.uint(t[1])&&this.string(t[2])&&this.uint(t[3])&&this.string(t[4]);case 78:return this.string(t[1])&&this.string(t[2])&&this.string(t[3])&&this.string(t[4]);case 81:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3])&&this.int(t[4])&&this.string(t[5]);case 83:return this.string(t[1])&&this.string(t[2])&&this.string(t[3])&&this.string(t[4])&&this.string(t[5])&&this.uint(t[6])&&this.uint(t[7])&&this.uint(t[8])&&this.uint(t[9]);case 84:return this.string(t[1])&&this.string(t[2])&&this.string(t[3])&&this.uint(t[4])&&this.string(t[5])&&this.string(t[6]);case 112:return this.uint(t[1])&&this.string(t[2])&&this.boolean(t[3])&&this.string(t[4])&&this.int(t[5])&&this.int(t[6]);case 113:return this.uint(t[1])&&this.uint(t[2])&&this.string(t[3]);case 116:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3])&&this.uint(t[4])&&this.uint(t[5])&&this.uint(t[6])&&this.string(t[7])&&this.string(t[8])&&this.uint(t[9])&&this.boolean(t[10]);case 119:return this.string(t[1])&&this.uint(t[2]);case 121:return this.string(t[1])&&this.string(t[2])&&this.uint(t[3])&&this.uint(t[4]);case 122:return this.string(t[1])&&this.string(t[2])&&this.uint(t[3])&&this.string(t[4]);case 123:return this.string(t[1])&&this.string(t[2])&&this.string(t[3])&&this.string(t[4])&&this.uint(t[5])}}}class n{constructor(t,s,i,n,h,r){this.pageNo=t,this.timestamp=s,this.url=i,this.onBatch=n,this.tabId=h,this.onOfflineEnd=r,this.nextIndex=0,this.beaconSize=2e5,this.encoder=new e(this.beaconSize),this.sizeBuffer=new Uint8Array(3),this.isEmpty=!0,this.beaconSizeLimit=1e6,this.prepare()}writeType(t){return this.encoder.uint(t[0])}writeFields(t){return this.encoder.encode(t)}writeSizeAt(t,s){for(let s=0;s<3;s++)this.sizeBuffer[s]=t>>8*s;this.encoder.set(this.sizeBuffer,s)}prepare(){if(!this.encoder.isEmpty)return;const t=[81,1,this.pageNo,this.nextIndex,this.timestamp,this.url],s=[118,this.tabId];this.writeType(t),this.writeFields(t),this.writeWithSize(s),this.isEmpty=!0}writeWithSize(t){const s=this.encoder;if(!this.writeType(t)||!s.skip(3))return!1;const i=s.getCurrentOffset(),e=this.writeFields(t);if(e){const e=s.getCurrentOffset()-i;if(e>16777215)return console.warn(\"OpenReplay: max message size overflow.\"),!1;this.writeSizeAt(e,i-3),s.checkpoint(),this.isEmpty=this.isEmpty&&0===t[0],this.nextIndex++}return e}setBeaconSizeLimit(t){this.beaconSizeLimit=t}writeMessage(t){if(\"q_end\"===t[0])return this.finaliseBatch(),this.onOfflineEnd();0===t[0]&&(this.timestamp=t[1]),122===t[0]&&(this.url=t[1]),this.writeWithSize(t)||(this.finaliseBatch(),this.writeWithSize(t)||(this.encoder=new e(this.beaconSizeLimit),this.prepare(),this.writeWithSize(t)?this.finaliseBatch():console.warn(\"OpenReplay: beacon size overflow. Skipping large message.\",t,this),this.encoder=new e(this.beaconSize),this.prepare()))}finaliseBatch(){if(this.isEmpty)return;const t=this.encoder.flush();this.onBatch(t),this.prepare()}clean(){this.encoder.reset()}}var h;!function(t){t[t.NotActive=0]=\"NotActive\",t[t.Starting=1]=\"Starting\",t[t.Stopping=2]=\"Stopping\",t[t.Active=3]=\"Active\",t[t.Stopped=4]=\"Stopped\"}(h||(h={}));let r=null,a=null,u=h.NotActive;function o(){a&&a.finaliseBatch()}function c(){return new Promise((t=>{u=h.Stopping,null!==p&&(clearInterval(p),p=null),a&&(a.clean(),a=null),r&&(r.clean(),setTimeout((()=>{r=null}),20)),setTimeout((()=>{u=h.NotActive,t(null)}),100)}))}function l(){[h.Stopped,h.Stopping].includes(u)||(postMessage(\"a_stop\"),c().then((()=>{postMessage(\"a_start\")})))}let g,p=null;self.onmessage=({data:s})=>{if(null!=s){if(\"stop\"===s)return o(),void c().then((()=>{u=h.Stopped}));if(\"forceFlushBatch\"!==s){if(!Array.isArray(s)){if(\"compressed\"===s.type){if(!r)return console.debug(\"OR WebWorker: sender not initialised. Compressed batch.\"),void l();s.batch&&r.sendCompressed(s.batch)}if(\"uncompressed\"===s.type){if(!r)return console.debug(\"OR WebWorker: sender not initialised. Uncompressed batch.\"),void l();s.batch&&r.sendUncompressed(s.batch)}return\"start\"===s.type?(u=h.Starting,r=new t(s.ingestPoint,(()=>{l()}),(t=>{!function(t){postMessage({type:\"failure\",reason:t}),c()}(t)}),s.connAttemptCount,s.connAttemptGap,(t=>{postMessage({type:\"compress\",batch:t},[t.buffer])}),s.pageNo),a=new n(s.pageNo,s.timestamp,s.url,(t=>{r&&r.push(t)}),s.tabId,(()=>postMessage({type:\"queue_empty\"}))),null===p&&(p=setInterval(o,1e4)),u=h.Active):\"auth\"===s.type?r?a?(r.authorise(s.token),void(s.beaconSizeLimit&&a.setBeaconSizeLimit(s.beaconSizeLimit))):(console.debug(\"OR WebWorker: writer not initialised. Received auth.\"),void l()):(console.debug(\"OR WebWorker: sender not initialised. Received auth.\"),void l()):void 0}if(a){const t=a;s.forEach((s=>{55===s[0]&&(s[1]?g=setTimeout((()=>l()),18e5):clearTimeout(g)),t.writeMessage(s)}))}else postMessage(\"not_init\"),l()}else o()}else o()}}();\n";
4689
+ const workerBodyFn = "!function(){\"use strict\";class t{constructor(t,s,i,e=10,n=250,h,r){this.onUnauthorised=s,this.onFailure=i,this.MAX_ATTEMPTS_COUNT=e,this.ATTEMPT_TIMEOUT=n,this.onCompress=h,this.pageNo=r,this.attemptsCount=0,this.busy=!1,this.queue=[],this.token=null,this.lastBatchNum=0,this.ingestURL=t+\"/v1/web/i\",this.isCompressing=void 0!==h}getQueueStatus(){return 0===this.queue.length&&!this.busy}authorise(t){this.token=t,this.busy||this.sendNext()}push(t){if(this.busy||!this.token)this.queue.push(t);else if(this.busy=!0,this.isCompressing&&this.onCompress)this.onCompress(t);else{const s=++this.lastBatchNum;this.sendBatch(t,!1,s)}}sendNext(){const t=this.queue.shift();if(t)if(this.busy=!0,this.isCompressing&&this.onCompress)this.onCompress(t);else{const s=++this.lastBatchNum;this.sendBatch(t,!1,s)}else this.busy=!1}retry(t,s,i){this.attemptsCount>=this.MAX_ATTEMPTS_COUNT?this.onFailure(`Failed to send batch after ${this.attemptsCount} attempts.`):(this.attemptsCount++,setTimeout((()=>this.sendBatch(t,s,i)),this.ATTEMPT_TIMEOUT*this.attemptsCount))}sendBatch(t,s,i){var e;const n=null==i?void 0:i.toString().replace(/^([^_]+)_([^_]+).*/,\"$1_$2_$3\");this.busy=!0;const h={Authorization:`Bearer ${this.token}`};s&&(h[\"Content-Encoding\"]=\"gzip\"),null!==this.token?fetch(`${this.ingestURL}?batch=${null!==(e=this.pageNo)&&void 0!==e?e:\"noPageNum\"}_${null!=n?n:\"noBatchNum\"}`,{body:t,method:\"POST\",headers:h,keepalive:t.length<65536}).then((e=>{if(401===e.status)return this.busy=!1,void this.onUnauthorised();e.status>=400?this.retry(t,s,`${null!=i?i:\"noBatchNum\"}_network:${e.status}`):(this.attemptsCount=0,this.sendNext())})).catch((e=>{console.warn(\"OpenReplay:\",e),this.retry(t,s,`${null!=i?i:\"noBatchNum\"}_reject:${e.message}`)})):setTimeout((()=>{this.sendBatch(t,s,`${null!=i?i:\"noBatchNum\"}_newToken`)}),500)}sendCompressed(t){const s=++this.lastBatchNum;this.sendBatch(t,!0,s)}sendUncompressed(t){const s=++this.lastBatchNum;this.sendBatch(t,!1,s)}clean(){this.sendNext(),setTimeout((()=>{this.token=null,this.queue.length=0}),10)}}const s=\"function\"==typeof TextEncoder?new TextEncoder:{encode(t){const s=t.length,i=new Uint8Array(3*s);let e=-1;for(let n=0,h=0,r=0;r!==s;){if(n=t.charCodeAt(r),r+=1,n>=55296&&n<=56319){if(r===s){i[e+=1]=239,i[e+=1]=191,i[e+=1]=189;break}if(h=t.charCodeAt(r),!(h>=56320&&h<=57343)){i[e+=1]=239,i[e+=1]=191,i[e+=1]=189;continue}if(n=1024*(n-55296)+h-56320+65536,r+=1,n>65535){i[e+=1]=240|n>>>18,i[e+=1]=128|n>>>12&63,i[e+=1]=128|n>>>6&63,i[e+=1]=128|63&n;continue}}n<=127?i[e+=1]=0|n:n<=2047?(i[e+=1]=192|n>>>6,i[e+=1]=128|63&n):(i[e+=1]=224|n>>>12,i[e+=1]=128|n>>>6&63,i[e+=1]=128|63&n)}return i.subarray(0,e+1)}};class i{constructor(t){this.size=t,this.offset=0,this.checkpointOffset=0,this.data=new Uint8Array(t)}getCurrentOffset(){return this.offset}checkpoint(){this.checkpointOffset=this.offset}get isEmpty(){return 0===this.offset}skip(t){return this.offset+=t,this.offset<=this.size}set(t,s){this.data.set(t,s)}boolean(t){return this.data[this.offset++]=+t,this.offset<=this.size}uint(t){for((t<0||t>Number.MAX_SAFE_INTEGER)&&(t=0);t>=128;)this.data[this.offset++]=t%256|128,t=Math.floor(t/128);return this.data[this.offset++]=t,this.offset<=this.size}int(t){return t=Math.round(t),this.uint(t>=0?2*t:-2*t-1)}string(t){const i=s.encode(t),e=i.byteLength;return!(!this.uint(e)||this.offset+e>this.size)&&(this.data.set(i,this.offset),this.offset+=e,!0)}reset(){this.offset=0,this.checkpointOffset=0}flush(){const t=this.data.slice(0,this.checkpointOffset);return this.reset(),t}}class e extends i{encode(t){switch(t[0]){case 0:case 11:case 114:case 115:return this.uint(t[1]);case 4:case 44:case 47:return this.string(t[1])&&this.string(t[2])&&this.uint(t[3]);case 5:case 20:case 70:case 75:case 76:case 77:case 82:return this.uint(t[1])&&this.uint(t[2]);case 6:return this.int(t[1])&&this.int(t[2]);case 7:return!0;case 8:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3])&&this.string(t[4])&&this.boolean(t[5]);case 9:case 10:case 24:case 35:case 51:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3]);case 12:case 52:case 61:case 71:return this.uint(t[1])&&this.string(t[2])&&this.string(t[3]);case 13:case 14:case 17:case 34:case 50:case 54:return this.uint(t[1])&&this.string(t[2]);case 16:return this.uint(t[1])&&this.int(t[2])&&this.int(t[3]);case 18:return this.uint(t[1])&&this.string(t[2])&&this.int(t[3]);case 19:return this.uint(t[1])&&this.boolean(t[2]);case 21:return this.string(t[1])&&this.string(t[2])&&this.string(t[3])&&this.string(t[4])&&this.string(t[5])&&this.uint(t[6])&&this.uint(t[7])&&this.uint(t[8]);case 22:case 27:case 30:case 41:case 45:case 46:case 43:case 63:case 64:case 79:case 124:return this.string(t[1])&&this.string(t[2]);case 23:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3])&&this.uint(t[4])&&this.uint(t[5])&&this.uint(t[6])&&this.uint(t[7])&&this.uint(t[8])&&this.uint(t[9]);case 28:case 29:case 42:case 117:case 118:return this.string(t[1]);case 40:return this.string(t[1])&&this.uint(t[2])&&this.string(t[3])&&this.string(t[4]);case 48:return this.string(t[1])&&this.string(t[2])&&this.string(t[3])&&this.string(t[4])&&this.int(t[5]);case 49:return this.int(t[1])&&this.int(t[2])&&this.uint(t[3])&&this.uint(t[4]);case 53:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3])&&this.uint(t[4])&&this.uint(t[5])&&this.uint(t[6])&&this.string(t[7])&&this.string(t[8]);case 55:return this.boolean(t[1]);case 57:case 60:return this.uint(t[1])&&this.string(t[2])&&this.string(t[3])&&this.string(t[4]);case 58:case 120:return this.int(t[1]);case 68:return this.uint(t[1])&&this.uint(t[2])&&this.string(t[3])&&this.string(t[4])&&this.uint(t[5])&&this.uint(t[6]);case 69:return this.uint(t[1])&&this.uint(t[2])&&this.string(t[3])&&this.string(t[4]);case 73:return this.uint(t[1])&&this.string(t[2])&&this.uint(t[3])&&this.string(t[4]);case 78:return this.string(t[1])&&this.string(t[2])&&this.string(t[3])&&this.string(t[4]);case 81:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3])&&this.int(t[4])&&this.string(t[5]);case 83:return this.string(t[1])&&this.string(t[2])&&this.string(t[3])&&this.string(t[4])&&this.string(t[5])&&this.uint(t[6])&&this.uint(t[7])&&this.uint(t[8])&&this.uint(t[9]);case 84:return this.string(t[1])&&this.string(t[2])&&this.string(t[3])&&this.uint(t[4])&&this.string(t[5])&&this.string(t[6]);case 112:return this.uint(t[1])&&this.string(t[2])&&this.boolean(t[3])&&this.string(t[4])&&this.int(t[5])&&this.int(t[6]);case 113:return this.uint(t[1])&&this.uint(t[2])&&this.string(t[3]);case 116:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3])&&this.uint(t[4])&&this.uint(t[5])&&this.uint(t[6])&&this.string(t[7])&&this.string(t[8])&&this.uint(t[9])&&this.boolean(t[10]);case 119:return this.string(t[1])&&this.uint(t[2]);case 121:return this.string(t[1])&&this.string(t[2])&&this.uint(t[3])&&this.uint(t[4]);case 122:return this.string(t[1])&&this.string(t[2])&&this.uint(t[3])&&this.string(t[4]);case 123:return this.string(t[1])&&this.string(t[2])&&this.string(t[3])&&this.string(t[4])&&this.uint(t[5])}}}class n{constructor(t,s,i,n,h,r){this.pageNo=t,this.timestamp=s,this.url=i,this.onBatch=n,this.tabId=h,this.onOfflineEnd=r,this.nextIndex=0,this.beaconSize=2e5,this.encoder=new e(this.beaconSize),this.sizeBuffer=new Uint8Array(3),this.isEmpty=!0,this.beaconSizeLimit=1e6,this.prepare()}writeType(t){return this.encoder.uint(t[0])}writeFields(t){return this.encoder.encode(t)}writeSizeAt(t,s){for(let s=0;s<3;s++)this.sizeBuffer[s]=t>>8*s;this.encoder.set(this.sizeBuffer,s)}prepare(){if(!this.encoder.isEmpty)return;const t=[81,1,this.pageNo,this.nextIndex,this.timestamp,this.url],s=[0,this.timestamp],i=[118,this.tabId];this.writeType(t),this.writeFields(t),this.writeWithSize(s),this.writeWithSize(i),this.isEmpty=!0}writeWithSize(t){const s=this.encoder;if(!this.writeType(t)||!s.skip(3))return!1;const i=s.getCurrentOffset(),e=this.writeFields(t);if(e){const e=s.getCurrentOffset()-i;if(e>16777215)return console.warn(\"OpenReplay: max message size overflow.\"),!1;this.writeSizeAt(e,i-3),s.checkpoint(),this.isEmpty=this.isEmpty&&0===t[0],this.nextIndex++}return e}setBeaconSizeLimit(t){this.beaconSizeLimit=t}writeMessage(t){if(\"q_end\"===t[0])return this.finaliseBatch(),this.onOfflineEnd();0===t[0]&&(this.timestamp=t[1]),122===t[0]&&(this.url=t[1]),this.writeWithSize(t)||(this.finaliseBatch(),this.writeWithSize(t)||(this.encoder=new e(this.beaconSizeLimit),this.prepare(),this.writeWithSize(t)?this.finaliseBatch():console.warn(\"OpenReplay: beacon size overflow. Skipping large message.\",t,this),this.encoder=new e(this.beaconSize),this.prepare()))}finaliseBatch(){if(this.isEmpty)return;const t=this.encoder.flush();this.onBatch(t),this.prepare()}clean(){this.encoder.reset()}}var h;!function(t){t[t.NotActive=0]=\"NotActive\",t[t.Starting=1]=\"Starting\",t[t.Stopping=2]=\"Stopping\",t[t.Active=3]=\"Active\",t[t.Stopped=4]=\"Stopped\"}(h||(h={}));let r=null,a=null,u=h.NotActive;function o(){a&&a.finaliseBatch()}function c(){return new Promise((t=>{u=h.Stopping,null!==p&&(clearInterval(p),p=null),a&&(a.clean(),a=null),r&&(r.clean(),setTimeout((()=>{r=null}),20)),setTimeout((()=>{u=h.NotActive,t(null)}),100)}))}function l(){[h.Stopped,h.Stopping].includes(u)||(postMessage(\"a_stop\"),c().then((()=>{postMessage(\"a_start\")})))}let g,p=null;self.onmessage=({data:s})=>{if(null!=s){if(\"stop\"===s)return o(),void c().then((()=>{u=h.Stopped}));if(\"forceFlushBatch\"!==s){if(!Array.isArray(s)){if(\"compressed\"===s.type){if(!r)return console.debug(\"OR WebWorker: sender not initialised. Compressed batch.\"),void l();s.batch&&r.sendCompressed(s.batch)}if(\"uncompressed\"===s.type){if(!r)return console.debug(\"OR WebWorker: sender not initialised. Uncompressed batch.\"),void l();s.batch&&r.sendUncompressed(s.batch)}return\"start\"===s.type?(u=h.Starting,r=new t(s.ingestPoint,(()=>{l()}),(t=>{!function(t){postMessage({type:\"failure\",reason:t}),c()}(t)}),s.connAttemptCount,s.connAttemptGap,(t=>{postMessage({type:\"compress\",batch:t},[t.buffer])}),s.pageNo),a=new n(s.pageNo,s.timestamp,s.url,(t=>{r&&r.push(t)}),s.tabId,(()=>postMessage({type:\"queue_empty\"}))),null===p&&(p=setInterval(o,1e4)),u=h.Active):\"auth\"===s.type?r?a?(r.authorise(s.token),void(s.beaconSizeLimit&&a.setBeaconSizeLimit(s.beaconSizeLimit))):(console.debug(\"OR WebWorker: writer not initialised. Received auth.\"),void l()):(console.debug(\"OR WebWorker: sender not initialised. Received auth.\"),void l()):void 0}if(a){const t=a;s.forEach((s=>{55===s[0]&&(s[1]?g=setTimeout((()=>l()),18e5):clearTimeout(g)),t.writeMessage(s)}))}else postMessage(\"not_init\"),l()}else o()}else o()}}();\n";
4661
4690
  const CANCELED = 'canceled';
4662
4691
  const uxtStorageKey = 'or_uxt_active';
4663
4692
  const bufferStorageKey = 'or_buffer_1';
@@ -4711,7 +4740,7 @@ class App {
4711
4740
  this.stopCallbacks = [];
4712
4741
  this.commitCallbacks = [];
4713
4742
  this.activityState = ActivityState.NotActive;
4714
- this.version = '16.1.0-beta.9'; // TODO: version compatability check inside each plugin.
4743
+ this.version = '16.1.0'; // TODO: version compatability check inside each plugin.
4715
4744
  this.socketMode = false;
4716
4745
  this.compressionThreshold = 24 * 1000;
4717
4746
  this.bc = null;
@@ -4725,6 +4754,7 @@ class App {
4725
4754
  'feature-flags': true,
4726
4755
  'usability-test': true,
4727
4756
  };
4757
+ this.emptyBatchCounter = 0;
4728
4758
  /** used by child iframes for crossdomain only */
4729
4759
  this.parentActive = false;
4730
4760
  this.checkStatus = () => {
@@ -5324,8 +5354,7 @@ class App {
5324
5354
  * */
5325
5355
  _nCommit() {
5326
5356
  if (this.socketMode) {
5327
- this.messages.unshift(TabData(this.session.getTabId()));
5328
- this.messages.unshift(Timestamp(this.timestamp()));
5357
+ this.messages.unshift(Timestamp(this.timestamp()), TabData(this.session.getTabId()));
5329
5358
  this.commitCallbacks.forEach((cb) => cb(this.messages));
5330
5359
  this.messages.length = 0;
5331
5360
  return;
@@ -5342,26 +5371,19 @@ class App {
5342
5371
  if (this.worker === undefined || !this.messages.length) {
5343
5372
  return;
5344
5373
  }
5374
+ if (!this.messages.length) {
5375
+ // Release empty batches every 30 secs (1000 * 30ms)
5376
+ if (this.emptyBatchCounter < 1000) {
5377
+ this.emptyBatchCounter++;
5378
+ return;
5379
+ }
5380
+ }
5381
+ this.emptyBatchCounter = 0;
5382
+ console.log('messages', this.messages.join(', '));
5345
5383
  try {
5346
5384
  requestIdleCb(() => {
5347
- this.messages.unshift(TabData(this.session.getTabId()));
5348
- this.messages.unshift(Timestamp(this.timestamp()));
5349
- try {
5350
- this.worker?.postMessage(this.messages);
5351
- }
5352
- catch (e) {
5353
- console.log(this.messages.join('$___$'));
5354
- console.log(this.attributeSender.dict);
5355
- console.error(e);
5356
- this.messages.forEach(m => {
5357
- try {
5358
- this.worker?.postMessage([m]);
5359
- }
5360
- catch (e) {
5361
- console.error(m, e);
5362
- }
5363
- });
5364
- }
5385
+ this.messages.unshift(Timestamp(this.timestamp()), TabData(this.session.getTabId()));
5386
+ this.worker?.postMessage(this.messages);
5365
5387
  this.commitCallbacks.forEach((cb) => cb(this.messages));
5366
5388
  this.messages.length = 0;
5367
5389
  });
@@ -5383,10 +5405,9 @@ class App {
5383
5405
  _cStartCommit() {
5384
5406
  this.coldStartCommitN += 1;
5385
5407
  if (this.coldStartCommitN === 2) {
5386
- this.bufferedMessages1.push(Timestamp(this.timestamp()));
5387
- this.bufferedMessages1.push(TabData(this.session.getTabId()));
5388
- this.bufferedMessages2.push(Timestamp(this.timestamp()));
5389
- this.bufferedMessages2.push(TabData(this.session.getTabId()));
5408
+ const payload = [Timestamp(this.timestamp()), TabData(this.session.getTabId())];
5409
+ this.bufferedMessages1.push(...payload);
5410
+ this.bufferedMessages2.push(...payload);
5390
5411
  this.coldStartCommitN = 0;
5391
5412
  }
5392
5413
  }
@@ -6192,7 +6213,13 @@ function Console (app, opts) {
6192
6213
  if (!Array.isArray(options.consoleMethods) || options.consoleMethods.length === 0) {
6193
6214
  return;
6194
6215
  }
6195
- const sendConsoleLog = app.safe((level, args) => app.send(ConsoleLog(level, printf(args))));
6216
+ const sendConsoleLog = app.safe((level, args) => {
6217
+ let logMsg = printf(args);
6218
+ if (app.sanitizer.privateMode) {
6219
+ logMsg = logMsg.replaceAll(/./g, '*');
6220
+ }
6221
+ app.send(ConsoleLog(level, logMsg));
6222
+ });
6196
6223
  let n = 0;
6197
6224
  const reset = () => {
6198
6225
  n = 0;
@@ -6716,7 +6743,10 @@ function Input (app, opts) {
6716
6743
  }, 3);
6717
6744
  function sendInputChange(id, node, hesitationTime, inputTime) {
6718
6745
  const { value, mask } = getInputValue(id, node);
6719
- const label = getInputLabel(node);
6746
+ let label = getInputLabel(node);
6747
+ if (app.sanitizer.privateMode) {
6748
+ label = label.replaceAll(/./g, '*');
6749
+ }
6720
6750
  app.send(InputChange(id, value, mask !== 0, label, hesitationTime, inputTime));
6721
6751
  }
6722
6752
  app.nodes.attachNodeCallback(app.safe((node) => {
@@ -7224,7 +7254,8 @@ function Mouse (app, options) {
7224
7254
  const normalizedX = roundNumber(clickX / contentWidth);
7225
7255
  const normalizedY = roundNumber(clickY / contentHeight);
7226
7256
  sendMouseMove();
7227
- app.send(MouseClick(id, mouseTarget === target ? Math.round(performance.now() - mouseTargetTime) : 0, getTargetLabel(target), isClickable(target) && !disableClickmaps ? getSelector(id, target, options) : '', normalizedX, normalizedY), true);
7257
+ const label = getTargetLabel(target);
7258
+ app.send(MouseClick(id, mouseTarget === target ? Math.round(performance.now() - mouseTargetTime) : 0, app.sanitizer.privateMode ? label.replaceAll(/./g, '*') : label, isClickable(target) && !disableClickmaps ? getSelector(id, target, options) : '', normalizedX, normalizedY), true);
7228
7259
  }
7229
7260
  mouseTarget = null;
7230
7261
  });
@@ -7335,7 +7366,7 @@ function Timing (app, opts) {
7335
7366
  if (failed) {
7336
7367
  app.send(ResourceTiming(entry.startTime + getTimeOrigin(), 0, 0, 0, 0, 0, entry.name, entry.initiatorType, 0, true));
7337
7368
  }
7338
- app.send(ResourceTiming(entry.startTime + getTimeOrigin(), entry.duration, entry.responseStart && entry.startTime ? entry.responseStart - entry.startTime : 0, entry.transferSize > entry.encodedBodySize ? entry.transferSize - entry.encodedBodySize : 0, entry.encodedBodySize || 0, entry.decodedBodySize || 0, entry.name, entry.initiatorType, entry.transferSize,
7369
+ app.send(ResourceTiming(entry.startTime + getTimeOrigin(), entry.duration, entry.responseStart && entry.startTime ? entry.responseStart - entry.startTime : 0, entry.transferSize > entry.encodedBodySize ? entry.transferSize - entry.encodedBodySize : 0, entry.encodedBodySize || 0, entry.decodedBodySize || 0, app.sanitizer.privateMode ? entry.name.replaceAll(/./g, '*') : entry.name, entry.initiatorType, entry.transferSize,
7339
7370
  // @ts-ignore
7340
7371
  (entry.responseStatus && entry.responseStatus === 304) || entry.transferSize === 0));
7341
7372
  }
@@ -7524,7 +7555,10 @@ function Viewport (app) {
7524
7555
  const { URL } = document;
7525
7556
  if (URL !== url) {
7526
7557
  url = URL;
7527
- app.send(SetPageLocation(url, referrer, navigationStart, document.title));
7558
+ const safeTitle = app.sanitizer.privateMode ? stringWiper(document.title) : document.title;
7559
+ const safeUrl = app.sanitizer.privateMode ? stringWiper(url) : url;
7560
+ const safeReferrer = app.sanitizer.privateMode ? stringWiper(referrer) : referrer;
7561
+ app.send(SetPageLocation(safeUrl, safeReferrer, navigationStart, safeTitle));
7528
7562
  navigationStart = 0;
7529
7563
  referrer = url;
7530
7564
  }
@@ -7993,6 +8027,136 @@ function isObject(thing) {
7993
8027
  return thing !== null && typeof thing === 'object';
7994
8028
  }
7995
8029
 
8030
+ const sensitiveParams = new Set([
8031
+ "password",
8032
+ "pass",
8033
+ "pwd",
8034
+ "mdp",
8035
+ "token",
8036
+ "bearer",
8037
+ "jwt",
8038
+ "api_key",
8039
+ "api-key",
8040
+ "apiKey",
8041
+ "secret",
8042
+ "ssn",
8043
+ "zip",
8044
+ "zipcode",
8045
+ "x-api-key",
8046
+ "www-authenticate",
8047
+ "x-csrf-token",
8048
+ "x-requested-with",
8049
+ "x-forwarded-for",
8050
+ "x-real-ip",
8051
+ "cookie",
8052
+ "authorization",
8053
+ "auth",
8054
+ "proxy-authorization",
8055
+ "set-cookie",
8056
+ "account_key",
8057
+ ]);
8058
+ function numDigits(x) {
8059
+ return (Math.log10((x ^ (x >> 31)) - (x >> 31)) | 0) + 1;
8060
+ }
8061
+ function obscure(value) {
8062
+ if (typeof value === "number") {
8063
+ const digits = numDigits(value);
8064
+ return "9".repeat(digits);
8065
+ }
8066
+ return value.replace(/[^\f\n\r\t\v\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff\s]/g, '*');
8067
+ }
8068
+ function filterHeaders(headers) {
8069
+ const filteredHeaders = {};
8070
+ if (Array.isArray(headers)) {
8071
+ headers.forEach(({ name, value }) => {
8072
+ if (sensitiveParams.has(name.toLowerCase())) {
8073
+ filteredHeaders[name] = obscure(value);
8074
+ }
8075
+ else {
8076
+ filteredHeaders[name] = value;
8077
+ }
8078
+ });
8079
+ }
8080
+ else {
8081
+ for (const [key, value] of Object.entries(headers)) {
8082
+ if (sensitiveParams.has(key.toLowerCase())) {
8083
+ filteredHeaders[key] = obscure(value);
8084
+ }
8085
+ else {
8086
+ filteredHeaders[key] = value;
8087
+ }
8088
+ }
8089
+ }
8090
+ return filteredHeaders;
8091
+ }
8092
+ function filterBody(body) {
8093
+ if (!body) {
8094
+ return body;
8095
+ }
8096
+ let parsedBody;
8097
+ let isJSON = false;
8098
+ try {
8099
+ parsedBody = JSON.parse(body);
8100
+ isJSON = true;
8101
+ }
8102
+ catch (e) {
8103
+ // not json
8104
+ }
8105
+ if (isJSON) {
8106
+ obscureSensitiveData(parsedBody);
8107
+ return JSON.stringify(parsedBody);
8108
+ }
8109
+ else {
8110
+ const params = new URLSearchParams(body);
8111
+ for (const key of params.keys()) {
8112
+ if (sensitiveParams.has(key.toLowerCase())) {
8113
+ const value = obscure(params.get(key));
8114
+ params.set(key, value);
8115
+ }
8116
+ }
8117
+ return params.toString();
8118
+ }
8119
+ }
8120
+ function sanitizeObject(obj) {
8121
+ obscureSensitiveData(obj);
8122
+ return obj;
8123
+ }
8124
+ function obscureSensitiveData(obj) {
8125
+ if (Array.isArray(obj)) {
8126
+ obj.forEach(obscureSensitiveData);
8127
+ }
8128
+ else if (obj && typeof obj === "object") {
8129
+ for (const key in obj) {
8130
+ if (Object.hasOwn(obj, key)) {
8131
+ if (sensitiveParams.has(key.toLowerCase())) {
8132
+ obj[key] = obscure(obj[key]);
8133
+ }
8134
+ else if (obj[key] !== null && typeof obj[key] === "object") {
8135
+ obscureSensitiveData(obj[key]);
8136
+ }
8137
+ }
8138
+ }
8139
+ }
8140
+ }
8141
+ function tryFilterUrl(url) {
8142
+ if (!url)
8143
+ return "";
8144
+ try {
8145
+ const urlObj = new URL(url);
8146
+ if (urlObj.searchParams) {
8147
+ for (const key of urlObj.searchParams.keys()) {
8148
+ if (sensitiveParams.has(key.toLowerCase())) {
8149
+ urlObj.searchParams.set(key, "******");
8150
+ }
8151
+ }
8152
+ }
8153
+ return urlObj.toString();
8154
+ }
8155
+ catch (e) {
8156
+ return url;
8157
+ }
8158
+ }
8159
+
7996
8160
  /**
7997
8161
  * I know we're not using most of the information from this class
7998
8162
  * but it can be useful in the future if we will decide to display more stuff in our ui
@@ -8024,13 +8188,18 @@ class NetworkMessage {
8024
8188
  }
8025
8189
  getMessage() {
8026
8190
  const { reqHs, resHs } = this.writeHeaders();
8191
+ const reqBody = this.method === 'GET'
8192
+ ? JSON.stringify(sanitizeObject(this.getData)) : filterBody(this.requestData);
8027
8193
  const request = {
8028
- headers: reqHs,
8029
- body: this.method === 'GET' ? JSON.stringify(this.getData) : this.requestData,
8194
+ headers: filterHeaders(reqHs),
8195
+ body: reqBody,
8196
+ };
8197
+ const response = {
8198
+ headers: filterHeaders(resHs),
8199
+ body: filterBody(this.response)
8030
8200
  };
8031
- const response = { headers: resHs, body: this.response };
8032
8201
  const messageInfo = this.sanitize({
8033
- url: this.url,
8202
+ url: tryFilterUrl(this.url),
8034
8203
  method: this.method,
8035
8204
  status: this.status,
8036
8205
  request,
@@ -8895,7 +9064,7 @@ function Network (app, opts = {}) {
8895
9064
  }
8896
9065
  }
8897
9066
  function sanitize(reqResInfo) {
8898
- if (!options.capturePayload) {
9067
+ if (!options.capturePayload || app.sanitizer.privateMode) {
8899
9068
  // @ts-ignore
8900
9069
  delete reqResInfo.request.body;
8901
9070
  delete reqResInfo.response.body;
@@ -8928,11 +9097,12 @@ function Network (app, opts = {}) {
8928
9097
  const patchWindow = (context) => {
8929
9098
  /* ====== modern way ====== */
8930
9099
  if (options.useProxy) {
8931
- return createNetworkProxy(context, options.ignoreHeaders, setSessionTokenHeader, sanitize, (message) => {
9100
+ return createNetworkProxy(context, app.sanitizer.privateMode ? true : options.ignoreHeaders, setSessionTokenHeader, sanitize, (message) => {
8932
9101
  if (options.failuresOnly && message.status < 400) {
8933
9102
  return;
8934
9103
  }
8935
- app.send(NetworkRequest(message.requestType, message.method, message.url, message.request, message.response, message.status, message.startTime + getTimeOrigin(), message.duration, message.responseSize));
9104
+ const url = app.sanitizer.privateMode ? '************' : message.url;
9105
+ app.send(NetworkRequest(message.requestType, message.method, url, message.request, message.response, message.status, message.startTime + getTimeOrigin(), message.duration, message.responseSize));
8936
9106
  }, (url) => app.isServiceURL(url), { xhr: true, fetch: true, beacon: true }, options.tokenUrlMatcher);
8937
9107
  }
8938
9108
  /* ====== Fetch ====== */
@@ -9189,7 +9359,7 @@ class API {
9189
9359
  this.signalStartIssue = (reason, missingApi) => {
9190
9360
  const doNotTrack = this.checkDoNotTrack();
9191
9361
  console.log("Tracker couldn't start due to:", JSON.stringify({
9192
- trackerVersion: '16.1.0-beta.9',
9362
+ trackerVersion: '16.1.0',
9193
9363
  projectKey: this.options.projectKey,
9194
9364
  doNotTrack,
9195
9365
  reason: missingApi.length ? `missing api: ${missingApi.join(',')}` : reason,