@preprio/toolkit 0.2.0-beta.4 → 0.2.0-beta.6

package/dist/sveltekit/index.js

@@ -1,5 +1,5 @@
 // src/version.ts
-var VERSION = "0.2.0-beta.4";
+var VERSION = "0.2.0-beta.6";
 
 // src/core/constants.ts
 var COOKIE_PREVIEW_MODE = "Prepr-Preview-Mode";
@@ -38,6 +38,11 @@ var UTM_PARAMS = [
   "utm_content",
   "utm_campaign"
 ];
+var MAX_HEADER_VALUE_LENGTH = 2048;
+function sanitizeHeaderValue(value) {
+  const stripped = value.replace(/[\u0000-\u001f\u007f]/g, "");
+  return stripped.length > MAX_HEADER_VALUE_LENGTH ? stripped.slice(0, MAX_HEADER_VALUE_LENGTH) : stripped;
+}
 function serializeCookie(cookie) {
   const parts = [
     `${cookie.name}=${encodeURIComponent(cookie.value)}`,
@@ -69,6 +74,15 @@ function parseCookies(request) {
 function processPreprRequest(request, opts) {
   const requestHeaders = new Headers(request.headers);
   const responseCookies = [];
+  const inboundPreprHeaders = [];
+  requestHeaders.forEach((_value, key) => {
+    if (key.toLowerCase().startsWith("prepr-")) {
+      inboundPreprHeaders.push(key);
+    }
+  });
+  for (const key of inboundPreprHeaders) {
+    requestHeaders.delete(key);
+  }
   const requestCookies = parseCookies(request);
   const url = new URL(request.url);
   const searchParams = url.searchParams;
@@ -78,25 +92,28 @@ function processPreprRequest(request, opts) {
   for (const key of UTM_PARAMS) {
     const value = searchParams.get(key);
     if (value !== null) {
-      requestHeaders.set(`Prepr-Context-${key}`, value);
+      requestHeaders.set(`Prepr-Context-${key}`, sanitizeHeaderValue(value));
     }
   }
   const referer = request.headers.get("referer");
   if (referer) {
-    requestHeaders.set("Prepr-Context-initial_referral", referer);
+    requestHeaders.set(
+      "Prepr-Context-initial_referral",
+      sanitizeHeaderValue(referer)
+    );
   }
   const userAgent = request.headers.get("user-agent");
   if (userAgent) {
-    requestHeaders.set("Prepr-User-Agent", userAgent);
+    requestHeaders.set("Prepr-User-Agent", sanitizeHeaderValue(userAgent));
   }
   requestHeaders.set("Prepr-Package", `@preprio/toolkit@${opts?.version ?? VERSION}`);
   const ip = request.headers.get("Cf-Connecting-Ip") ?? request.headers.get("x-real-ip");
   if (ip) {
-    requestHeaders.set("Prepr-Visitor-IP", ip);
+    requestHeaders.set("Prepr-Visitor-IP", sanitizeHeaderValue(ip));
   }
   const hutkCookie = requestCookies.get(COOKIE_HUBSPOT);
   if (hutkCookie) {
-    requestHeaders.set("Prepr-Hubspot-Id", hutkCookie);
+    requestHeaders.set("Prepr-Hubspot-Id", sanitizeHeaderValue(hutkCookie));
   }
   let uid = requestCookies.get(COOKIE_UID);
   if (!uid) {
@@ -136,16 +153,16 @@ function processPreprRequest(request, opts) {
   if (!isLivePreview) {
     const segmentCookie = features.segments ? requestCookies.get(COOKIE_SEGMENT) : void 0;
     if (segmentCookie) {
-      requestHeaders.set("Prepr-Segments", segmentCookie);
+      requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(segmentCookie));
     }
     const abCookie = features.abTesting ? requestCookies.get(COOKIE_VARIANT) : void 0;
     if (abCookie) {
-      requestHeaders.set("Prepr-ABtesting", abCookie);
+      requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(abCookie));
     }
   }
   const previewAb = features.abTesting ? searchParams.get(PARAM_VARIANT) : null;
   if (previewAb !== null) {
-    requestHeaders.set("Prepr-ABtesting", previewAb);
+    requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(previewAb));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_VARIANT,
@@ -158,7 +175,7 @@ function processPreprRequest(request, opts) {
   }
   const previewSegment = features.segments ? searchParams.get(PARAM_SEGMENT) : null;
   if (previewSegment !== null) {
-    requestHeaders.set("Prepr-Segments", previewSegment);
+    requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(previewSegment));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_SEGMENT,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preprio/toolkit",
-  "version": "0.2.0-beta.4",
+  "version": "0.2.0-beta.6",
   "description": "Prepr personalization, A/B testing and preview toolkit for React, Next.js, Nuxt, Astro, SvelteKit and Express",
   "license": "Apache-2.0",
   "author": "Prepr B.V. (https://prepr.io)",