@percy/nightwatch 2.2.1-beta.1 → 2.2.1-beta.2

package/commands/percySnapshot.js

@@ -46,10 +46,13 @@ module.exports = class PercySnapshotCommand {
       // Readiness gate — runs before serialize when CLI supports it.
       const readinessDiagnostics = await waitForReady(this.api, options, utils, log);
 
-      // Thread domScript + log through ctx so concurrent percySnapshot calls
+      // Serialize and capture the DOM. Merge .percy.yml config with per-snapshot
+      // options (per-call wins) before handing them to serialize.
+      // domScript + log are threaded through so concurrent percySnapshot calls
       // (parallel workers in the same Node process) don't race on shared
       // module-level state.
-      let { domSnapshot, url } = await captureDOM(this.api, options, utils, domScript, log);
+      const mergedOptions = utils.mergeSnapshotOptions(options);
+      let { domSnapshot, url } = await captureDOM(this.api, mergedOptions, utils, domScript, log);
 
       // Attach readiness diagnostics so the CLI can log timing and pass/fail
       if (readinessDiagnostics && domSnapshot && typeof domSnapshot === 'object' && !Array.isArray(domSnapshot)) {
@@ -63,8 +66,24 @@ module.exports = class PercySnapshotCommand {
         ...snapshotOptions
       } = options;
 
+      // Sanitize caller-supplied options before spreading them into the outbound
+      // POST body (CWE-284/CWE-1321 — PER-8722): drop prototype-pollution keys
+      // and code-bearing fields the SDK must never forward. clientInfo /
+      // environmentInfo are hard-coded AFTER the spread so callers can't override.
+      const BLOCKED_OPTION_KEYS = new Set([
+        '__proto__', 'constructor', 'prototype', 'execute', 'domTransformation'
+      ]);
+      const safeOptions = {};
+      for (const key of Object.keys(snapshotOptions)) {
+        if (BLOCKED_OPTION_KEYS.has(key)) {
+          log.debug?.(`Ignoring disallowed percySnapshot option: ${key}`);
+          continue;
+        }
+        safeOptions[key] = snapshotOptions[key];
+      }
+
       const postData = {
-        ...snapshotOptions,
+        ...safeOptions,
         domSnapshot,
         environmentInfo: ENV_INFO,
         clientInfo: CLIENT_INFO,

package/lib/snapshot.js

@@ -127,6 +127,17 @@ function getCookies(browser) {
   }).catch(() => []);
 }
 
+// Cookie names that commonly hold session/auth secrets. These are stripped from
+// the snapshot payload by default so credentials aren't forwarded to the Percy
+// daemon and on to the cloud (CWE-200). Set PERCY_FORWARD_ALL_COOKIES=true to
+// restore forwarding the full cookie jar.
+const SENSITIVE_COOKIE_PATTERN = /session|token|auth|sid|jwt|bearer|csrf|xsrf/i;
+
+function filterSensitiveCookies(cookies) {
+  if (process.env.PERCY_FORWARD_ALL_COOKIES === 'true' || !Array.isArray(cookies)) return cookies;
+  return cookies.filter(cookie => !SENSITIVE_COOKIE_PATTERN.test(cookie?.name || ''));
+}
+
 function resolveMaxFrameDepth(options = {}, utils) {
   return clampFrameDepth(
     options.maxIframeDepth ??
@@ -398,7 +409,7 @@ async function captureSerializedDOM(browser, options = {}, utils, domScript = nu
   }, [serializeOptions]);
 
   if (!domSnapshot) domSnapshot = {};
-  domSnapshot.cookies = await getCookies(browser);
+  domSnapshot.cookies = filterSensitiveCookies(await getCookies(browser));
 
   // Capture cross-origin iframes. ctx carries the per-call domScript + log so
   // concurrent percySnapshot invocations don't race on shared module state.
@@ -726,6 +737,7 @@ module.exports = {
   slowScrollToBottom,
   ignoreCanvasSerializationErrors,
   ignoreStyleSheetSerializationErrors,
+  filterSensitiveCookies,
   isUnsupportedIframeSrc,
   getOrigin,
   captureCorsIframes,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@percy/nightwatch",
   "description": "Nightwatch client library for visual testing with Percy",
-  "version": "2.2.1-beta.1",
+  "version": "2.2.1-beta.2",
   "license": "MIT",
   "author": "Perceptual Inc.",
   "repository": "https://github.com/percy/percy-nightwatch",