@preprio/toolkit 0.2.0-beta.5 → 0.2.0-beta.7

package/dist/index.js

@@ -17,10 +17,10 @@ import {
   setTrackingParam,
   stegaClean,
   trackEvent
-} from "./chunk-BYJ2JBGX.js";
+} from "./chunk-P6VTLWM4.js";
 
 // src/version.ts
-var VERSION = "0.2.0-beta.5";
+var VERSION = "0.2.0-beta.7";
 
 // src/core/server.ts
 var PreprError = class extends Error {
@@ -184,6 +184,11 @@ var UTM_PARAMS = [
   "utm_content",
   "utm_campaign"
 ];
+var MAX_HEADER_VALUE_LENGTH = 2048;
+function sanitizeHeaderValue(value) {
+  const stripped = value.replace(/[\u0000-\u001f\u007f]/g, "");
+  return stripped.length > MAX_HEADER_VALUE_LENGTH ? stripped.slice(0, MAX_HEADER_VALUE_LENGTH) : stripped;
+}
 function parseCookies(request) {
   const cookies = /* @__PURE__ */ new Map();
   const header = request.headers.get("cookie");
@@ -201,6 +206,15 @@ function parseCookies(request) {
 function processPreprRequest(request, opts) {
   const requestHeaders = new Headers(request.headers);
   const responseCookies = [];
+  const inboundPreprHeaders = [];
+  requestHeaders.forEach((_value, key) => {
+    if (key.toLowerCase().startsWith("prepr-")) {
+      inboundPreprHeaders.push(key);
+    }
+  });
+  for (const key of inboundPreprHeaders) {
+    requestHeaders.delete(key);
+  }
   const requestCookies = parseCookies(request);
   const url = new URL(request.url);
   const searchParams = url.searchParams;
@@ -210,25 +224,28 @@ function processPreprRequest(request, opts) {
   for (const key of UTM_PARAMS) {
     const value = searchParams.get(key);
     if (value !== null) {
-      requestHeaders.set(`Prepr-Context-${key}`, value);
+      requestHeaders.set(`Prepr-Context-${key}`, sanitizeHeaderValue(value));
     }
   }
   const referer = request.headers.get("referer");
   if (referer) {
-    requestHeaders.set("Prepr-Context-initial_referral", referer);
+    requestHeaders.set(
+      "Prepr-Context-initial_referral",
+      sanitizeHeaderValue(referer)
+    );
   }
   const userAgent = request.headers.get("user-agent");
   if (userAgent) {
-    requestHeaders.set("Prepr-User-Agent", userAgent);
+    requestHeaders.set("Prepr-User-Agent", sanitizeHeaderValue(userAgent));
   }
   requestHeaders.set("Prepr-Package", `@preprio/toolkit@${opts?.version ?? VERSION}`);
   const ip = request.headers.get("Cf-Connecting-Ip") ?? request.headers.get("x-real-ip");
   if (ip) {
-    requestHeaders.set("Prepr-Visitor-IP", ip);
+    requestHeaders.set("Prepr-Visitor-IP", sanitizeHeaderValue(ip));
   }
   const hutkCookie = requestCookies.get(COOKIE_HUBSPOT);
   if (hutkCookie) {
-    requestHeaders.set("Prepr-Hubspot-Id", hutkCookie);
+    requestHeaders.set("Prepr-Hubspot-Id", sanitizeHeaderValue(hutkCookie));
   }
   let uid = requestCookies.get(COOKIE_UID);
   if (!uid) {
@@ -268,16 +285,16 @@ function processPreprRequest(request, opts) {
   if (!isLivePreview) {
     const segmentCookie = features.segments ? requestCookies.get(COOKIE_SEGMENT) : void 0;
     if (segmentCookie) {
-      requestHeaders.set("Prepr-Segments", segmentCookie);
+      requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(segmentCookie));
     }
     const abCookie = features.abTesting ? requestCookies.get(COOKIE_VARIANT) : void 0;
     if (abCookie) {
-      requestHeaders.set("Prepr-ABtesting", abCookie);
+      requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(abCookie));
     }
   }
   const previewAb = features.abTesting ? searchParams.get(PARAM_VARIANT) : null;
   if (previewAb !== null) {
-    requestHeaders.set("Prepr-ABtesting", previewAb);
+    requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(previewAb));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_VARIANT,
@@ -290,7 +307,7 @@ function processPreprRequest(request, opts) {
   }
   const previewSegment = features.segments ? searchParams.get(PARAM_SEGMENT) : null;
   if (previewSegment !== null) {
-    requestHeaders.set("Prepr-Segments", previewSegment);
+    requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(previewSegment));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_SEGMENT,

package/dist/nextjs/components.cjs

@@ -335,7 +335,10 @@ function createIframeBridge(store, options = {}) {
   };
   return {
     start() {
-      sendPreprEvent("loaded", void 0, { allowUntrustedTarget: true });
+      const features = store?.get().features;
+      sendPreprEvent("loaded", features ? { features } : void 0, {
+        allowUntrustedTarget: true
+      });
       window.addEventListener("keydown", onKeyDown);
       window.addEventListener("message", onMessage);
     },
@@ -437,6 +440,8 @@ function createStegaAutoClean() {
   function scanAndClean() {
     processing = true;
     walkTextNodes(document.body, cleanTextNode);
+    const title = (0, import_stega2.vercelStegaSplit)(document.title);
+    if (title.encoded) document.title = title.cleaned;
     processing = false;
   }
   function collectAffected(mutations) {
@@ -482,15 +487,8 @@ function createStegaAutoClean() {
   }
   function start() {
     if (observer || typeof window === "undefined") return;
-    const run = () => {
-      scanAndClean();
-      setupObserver();
-    };
-    if ("requestIdleCallback" in window) {
-      window.requestIdleCallback(run);
-    } else {
-      setTimeout(run, 0);
-    }
+    scanAndClean();
+    setupObserver();
     debug2.log("stega auto-clean started");
   }
   function stop() {
@@ -983,7 +981,7 @@ function cookieOpts() {
   };
 }
 function createChangeHandler(deps) {
-  const { store, stega, syncAutoClean, features, editingEnabled } = deps;
+  const { store, stega, features, editingEnabled } = deps;
   function updateParams(patch) {
     const [path, existing] = splitPath(deps.currentPath());
     const params = new URLSearchParams(existing);
@@ -1046,16 +1044,17 @@ function createChangeHandler(deps) {
       setCookie(COOKIE_PREVIEW_MODE, String(after.previewMode), cookieOpts());
       setCookie(COOKIE_TOOLBAR_OPEN, "false", cookieOpts());
       sendPreprEvent("preview_mode_toggled", { previewMode: after.previewMode });
-      syncAutoClean(after.previewMode);
-      const [path, existing] = splitPath(deps.currentPath());
-      const params = new URLSearchParams(existing);
-      if (params.has(PARAM_SEGMENT) || params.has(PARAM_VARIANT)) {
-        params.delete(PARAM_SEGMENT);
-        params.delete(PARAM_VARIANT);
-        const query = params.toString();
-        deps.navigate(query ? `${path}?${query}` : path);
-      } else {
-        deps.reload();
+      if (!after.isIframe) {
+        const [path, existing] = splitPath(deps.currentPath());
+        const params = new URLSearchParams(existing);
+        if (params.has(PARAM_SEGMENT) || params.has(PARAM_VARIANT)) {
+          params.delete(PARAM_SEGMENT);
+          params.delete(PARAM_VARIANT);
+          const query = params.toString();
+          deps.navigate(query ? `${path}?${query}` : path);
+        } else {
+          deps.reload();
+        }
       }
     }
     if (before.toolbarOpen !== after.toolbarOpen) {
@@ -2050,6 +2049,14 @@ function defaultNavigation() {
     currentPath: () => window.location.pathname + window.location.search
   };
 }
+function safeEditUrl(href) {
+  try {
+    const url = new URL(href, window.location.href);
+    return url.protocol === "https:" || url.protocol === "http:" ? url.href : null;
+  } catch {
+    return null;
+  }
+}
 function buildSegments(data) {
   return [{ _id: "all_other_users", name: "All other users" }, ...data];
 }
@@ -2113,24 +2120,25 @@ function createPreprPreview(opts = {}) {
     // In the editor, ask the parent to focus the field instead of opening a new
     // tab. Standalone previews keep the window.open behaviour.
     onEdit: ({ href, origin, id, field }) => {
+      const safeHref = href ? safeEditUrl(href) : null;
+      if (href && !safeHref) {
+        debug7.warn("ignored edit request with unsupported href scheme");
+        return;
+      }
       if (isIframe) {
-        sendPreprEvent("field_edit_requested", { href, origin, id, field });
-      } else if (href) {
-        window.open(href);
+        sendPreprEvent("field_edit_requested", {
+          href: safeHref ?? void 0,
+          origin,
+          id,
+          field
+        });
+      } else if (safeHref) {
+        window.open(safeHref, "_blank", "noopener,noreferrer");
       }
     }
   });
   const autoClean = createStegaAutoClean();
-  let autoCleanActive = false;
-  function syncAutoClean(active) {
-    if (active && !autoCleanActive) {
-      autoClean.start();
-      autoCleanActive = true;
-    } else if (!active && autoCleanActive) {
-      autoClean.stop();
-      autoCleanActive = false;
-    }
-  }
+  autoClean.start();
   const handleChange = createChangeHandler({
     store,
     features,
@@ -2138,8 +2146,7 @@ function createPreprPreview(opts = {}) {
     navigate: (url) => navigation.navigate(url),
     currentPath: () => navigation.currentPath(),
     reload: navigation.reload ?? (() => window.location.reload()),
-    stega,
-    syncAutoClean
+    stega
   });
   let prev = store.get();
   const unsubscribe = store.subscribe((state) => {
@@ -2147,7 +2154,6 @@ function createPreprPreview(opts = {}) {
     prev = state;
     handleChange(before, state);
   });
-  syncAutoClean(store.get().previewMode);
   const bridge = createIframeBridge(store, {
     allowedEditorOrigins: options?.allowedEditorOrigins
   });
@@ -2160,7 +2166,7 @@ function createPreprPreview(opts = {}) {
   function destroy() {
     unsubscribe();
     stega.stop();
-    syncAutoClean(false);
+    autoClean.stop();
     if (isIframe) {
       bridge.stop();
     }

package/dist/nextjs/components.js

@@ -2,7 +2,7 @@
 import {
   createPreprPreview,
   loadTrackingPixel
-} from "../chunk-BYJ2JBGX.js";
+} from "../chunk-P6VTLWM4.js";
 
 // src/nextjs/components.ts
 import { usePathname, useRouter } from "next/navigation";

package/dist/nextjs/index.cjs

@@ -38,7 +38,7 @@ module.exports = __toCommonJS(nextjs_exports);
 var import_server = require("next/server");
 
 // src/version.ts
-var VERSION = "0.2.0-beta.5";
+var VERSION = "0.2.0-beta.7";
 
 // src/core/constants.ts
 var COOKIE_PREVIEW_MODE = "Prepr-Preview-Mode";
@@ -77,6 +77,11 @@ var UTM_PARAMS = [
   "utm_content",
   "utm_campaign"
 ];
+var MAX_HEADER_VALUE_LENGTH = 2048;
+function sanitizeHeaderValue(value) {
+  const stripped = value.replace(/[\u0000-\u001f\u007f]/g, "");
+  return stripped.length > MAX_HEADER_VALUE_LENGTH ? stripped.slice(0, MAX_HEADER_VALUE_LENGTH) : stripped;
+}
 function parseCookies(request) {
   const cookies = /* @__PURE__ */ new Map();
   const header = request.headers.get("cookie");
@@ -94,6 +99,15 @@ function parseCookies(request) {
 function processPreprRequest(request, opts) {
   const requestHeaders = new Headers(request.headers);
   const responseCookies = [];
+  const inboundPreprHeaders = [];
+  requestHeaders.forEach((_value, key) => {
+    if (key.toLowerCase().startsWith("prepr-")) {
+      inboundPreprHeaders.push(key);
+    }
+  });
+  for (const key of inboundPreprHeaders) {
+    requestHeaders.delete(key);
+  }
   const requestCookies = parseCookies(request);
   const url = new URL(request.url);
   const searchParams = url.searchParams;
@@ -103,25 +117,28 @@ function processPreprRequest(request, opts) {
   for (const key of UTM_PARAMS) {
     const value = searchParams.get(key);
     if (value !== null) {
-      requestHeaders.set(`Prepr-Context-${key}`, value);
+      requestHeaders.set(`Prepr-Context-${key}`, sanitizeHeaderValue(value));
     }
   }
   const referer = request.headers.get("referer");
   if (referer) {
-    requestHeaders.set("Prepr-Context-initial_referral", referer);
+    requestHeaders.set(
+      "Prepr-Context-initial_referral",
+      sanitizeHeaderValue(referer)
+    );
   }
   const userAgent = request.headers.get("user-agent");
   if (userAgent) {
-    requestHeaders.set("Prepr-User-Agent", userAgent);
+    requestHeaders.set("Prepr-User-Agent", sanitizeHeaderValue(userAgent));
   }
   requestHeaders.set("Prepr-Package", `@preprio/toolkit@${opts?.version ?? VERSION}`);
   const ip = request.headers.get("Cf-Connecting-Ip") ?? request.headers.get("x-real-ip");
   if (ip) {
-    requestHeaders.set("Prepr-Visitor-IP", ip);
+    requestHeaders.set("Prepr-Visitor-IP", sanitizeHeaderValue(ip));
   }
   const hutkCookie = requestCookies.get(COOKIE_HUBSPOT);
   if (hutkCookie) {
-    requestHeaders.set("Prepr-Hubspot-Id", hutkCookie);
+    requestHeaders.set("Prepr-Hubspot-Id", sanitizeHeaderValue(hutkCookie));
   }
   let uid = requestCookies.get(COOKIE_UID);
   if (!uid) {
@@ -161,16 +178,16 @@ function processPreprRequest(request, opts) {
   if (!isLivePreview) {
     const segmentCookie = features.segments ? requestCookies.get(COOKIE_SEGMENT) : void 0;
     if (segmentCookie) {
-      requestHeaders.set("Prepr-Segments", segmentCookie);
+      requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(segmentCookie));
     }
     const abCookie = features.abTesting ? requestCookies.get(COOKIE_VARIANT) : void 0;
     if (abCookie) {
-      requestHeaders.set("Prepr-ABtesting", abCookie);
+      requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(abCookie));
     }
   }
   const previewAb = features.abTesting ? searchParams.get(PARAM_VARIANT) : null;
   if (previewAb !== null) {
-    requestHeaders.set("Prepr-ABtesting", previewAb);
+    requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(previewAb));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_VARIANT,
@@ -183,7 +200,7 @@ function processPreprRequest(request, opts) {
   }
   const previewSegment = features.segments ? searchParams.get(PARAM_SEGMENT) : null;
   if (previewSegment !== null) {
-    requestHeaders.set("Prepr-Segments", previewSegment);
+    requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(previewSegment));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_SEGMENT,

package/dist/nextjs/index.js

@@ -2,7 +2,7 @@
 import { NextResponse } from "next/server";
 
 // src/version.ts
-var VERSION = "0.2.0-beta.5";
+var VERSION = "0.2.0-beta.7";
 
 // src/core/constants.ts
 var COOKIE_PREVIEW_MODE = "Prepr-Preview-Mode";
@@ -41,6 +41,11 @@ var UTM_PARAMS = [
   "utm_content",
   "utm_campaign"
 ];
+var MAX_HEADER_VALUE_LENGTH = 2048;
+function sanitizeHeaderValue(value) {
+  const stripped = value.replace(/[\u0000-\u001f\u007f]/g, "");
+  return stripped.length > MAX_HEADER_VALUE_LENGTH ? stripped.slice(0, MAX_HEADER_VALUE_LENGTH) : stripped;
+}
 function parseCookies(request) {
   const cookies = /* @__PURE__ */ new Map();
   const header = request.headers.get("cookie");
@@ -58,6 +63,15 @@ function parseCookies(request) {
 function processPreprRequest(request, opts) {
   const requestHeaders = new Headers(request.headers);
   const responseCookies = [];
+  const inboundPreprHeaders = [];
+  requestHeaders.forEach((_value, key) => {
+    if (key.toLowerCase().startsWith("prepr-")) {
+      inboundPreprHeaders.push(key);
+    }
+  });
+  for (const key of inboundPreprHeaders) {
+    requestHeaders.delete(key);
+  }
   const requestCookies = parseCookies(request);
   const url = new URL(request.url);
   const searchParams = url.searchParams;
@@ -67,25 +81,28 @@ function processPreprRequest(request, opts) {
   for (const key of UTM_PARAMS) {
     const value = searchParams.get(key);
     if (value !== null) {
-      requestHeaders.set(`Prepr-Context-${key}`, value);
+      requestHeaders.set(`Prepr-Context-${key}`, sanitizeHeaderValue(value));
     }
   }
   const referer = request.headers.get("referer");
   if (referer) {
-    requestHeaders.set("Prepr-Context-initial_referral", referer);
+    requestHeaders.set(
+      "Prepr-Context-initial_referral",
+      sanitizeHeaderValue(referer)
+    );
   }
   const userAgent = request.headers.get("user-agent");
   if (userAgent) {
-    requestHeaders.set("Prepr-User-Agent", userAgent);
+    requestHeaders.set("Prepr-User-Agent", sanitizeHeaderValue(userAgent));
   }
   requestHeaders.set("Prepr-Package", `@preprio/toolkit@${opts?.version ?? VERSION}`);
   const ip = request.headers.get("Cf-Connecting-Ip") ?? request.headers.get("x-real-ip");
   if (ip) {
-    requestHeaders.set("Prepr-Visitor-IP", ip);
+    requestHeaders.set("Prepr-Visitor-IP", sanitizeHeaderValue(ip));
   }
   const hutkCookie = requestCookies.get(COOKIE_HUBSPOT);
   if (hutkCookie) {
-    requestHeaders.set("Prepr-Hubspot-Id", hutkCookie);
+    requestHeaders.set("Prepr-Hubspot-Id", sanitizeHeaderValue(hutkCookie));
   }
   let uid = requestCookies.get(COOKIE_UID);
   if (!uid) {
@@ -125,16 +142,16 @@ function processPreprRequest(request, opts) {
   if (!isLivePreview) {
     const segmentCookie = features.segments ? requestCookies.get(COOKIE_SEGMENT) : void 0;
     if (segmentCookie) {
-      requestHeaders.set("Prepr-Segments", segmentCookie);
+      requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(segmentCookie));
     }
     const abCookie = features.abTesting ? requestCookies.get(COOKIE_VARIANT) : void 0;
     if (abCookie) {
-      requestHeaders.set("Prepr-ABtesting", abCookie);
+      requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(abCookie));
     }
   }
   const previewAb = features.abTesting ? searchParams.get(PARAM_VARIANT) : null;
   if (previewAb !== null) {
-    requestHeaders.set("Prepr-ABtesting", previewAb);
+    requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(previewAb));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_VARIANT,
@@ -147,7 +164,7 @@ function processPreprRequest(request, opts) {
   }
   const previewSegment = features.segments ? searchParams.get(PARAM_SEGMENT) : null;
   if (previewSegment !== null) {
-    requestHeaders.set("Prepr-Segments", previewSegment);
+    requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(previewSegment));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_SEGMENT,

package/dist/nuxt/index.cjs

@@ -35,7 +35,7 @@ __export(nuxt_exports, {
 module.exports = __toCommonJS(nuxt_exports);
 
 // src/version.ts
-var VERSION = "0.2.0-beta.5";
+var VERSION = "0.2.0-beta.7";
 
 // src/core/constants.ts
 var COOKIE_PREVIEW_MODE = "Prepr-Preview-Mode";
@@ -74,6 +74,11 @@ var UTM_PARAMS = [
   "utm_content",
   "utm_campaign"
 ];
+var MAX_HEADER_VALUE_LENGTH = 2048;
+function sanitizeHeaderValue(value) {
+  const stripped = value.replace(/[\u0000-\u001f\u007f]/g, "");
+  return stripped.length > MAX_HEADER_VALUE_LENGTH ? stripped.slice(0, MAX_HEADER_VALUE_LENGTH) : stripped;
+}
 function serializeCookie(cookie) {
   const parts = [
     `${cookie.name}=${encodeURIComponent(cookie.value)}`,
@@ -105,6 +110,15 @@ function parseCookies(request) {
 function processPreprRequest(request, opts) {
   const requestHeaders = new Headers(request.headers);
   const responseCookies = [];
+  const inboundPreprHeaders = [];
+  requestHeaders.forEach((_value, key) => {
+    if (key.toLowerCase().startsWith("prepr-")) {
+      inboundPreprHeaders.push(key);
+    }
+  });
+  for (const key of inboundPreprHeaders) {
+    requestHeaders.delete(key);
+  }
   const requestCookies = parseCookies(request);
   const url = new URL(request.url);
   const searchParams = url.searchParams;
@@ -114,25 +128,28 @@ function processPreprRequest(request, opts) {
   for (const key of UTM_PARAMS) {
     const value = searchParams.get(key);
     if (value !== null) {
-      requestHeaders.set(`Prepr-Context-${key}`, value);
+      requestHeaders.set(`Prepr-Context-${key}`, sanitizeHeaderValue(value));
     }
   }
   const referer = request.headers.get("referer");
   if (referer) {
-    requestHeaders.set("Prepr-Context-initial_referral", referer);
+    requestHeaders.set(
+      "Prepr-Context-initial_referral",
+      sanitizeHeaderValue(referer)
+    );
   }
   const userAgent = request.headers.get("user-agent");
   if (userAgent) {
-    requestHeaders.set("Prepr-User-Agent", userAgent);
+    requestHeaders.set("Prepr-User-Agent", sanitizeHeaderValue(userAgent));
   }
   requestHeaders.set("Prepr-Package", `@preprio/toolkit@${opts?.version ?? VERSION}`);
   const ip = request.headers.get("Cf-Connecting-Ip") ?? request.headers.get("x-real-ip");
   if (ip) {
-    requestHeaders.set("Prepr-Visitor-IP", ip);
+    requestHeaders.set("Prepr-Visitor-IP", sanitizeHeaderValue(ip));
   }
   const hutkCookie = requestCookies.get(COOKIE_HUBSPOT);
   if (hutkCookie) {
-    requestHeaders.set("Prepr-Hubspot-Id", hutkCookie);
+    requestHeaders.set("Prepr-Hubspot-Id", sanitizeHeaderValue(hutkCookie));
   }
   let uid = requestCookies.get(COOKIE_UID);
   if (!uid) {
@@ -172,16 +189,16 @@ function processPreprRequest(request, opts) {
   if (!isLivePreview) {
     const segmentCookie = features.segments ? requestCookies.get(COOKIE_SEGMENT) : void 0;
     if (segmentCookie) {
-      requestHeaders.set("Prepr-Segments", segmentCookie);
+      requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(segmentCookie));
     }
     const abCookie = features.abTesting ? requestCookies.get(COOKIE_VARIANT) : void 0;
     if (abCookie) {
-      requestHeaders.set("Prepr-ABtesting", abCookie);
+      requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(abCookie));
     }
   }
   const previewAb = features.abTesting ? searchParams.get(PARAM_VARIANT) : null;
   if (previewAb !== null) {
-    requestHeaders.set("Prepr-ABtesting", previewAb);
+    requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(previewAb));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_VARIANT,
@@ -194,7 +211,7 @@ function processPreprRequest(request, opts) {
   }
   const previewSegment = features.segments ? searchParams.get(PARAM_SEGMENT) : null;
   if (previewSegment !== null) {
-    requestHeaders.set("Prepr-Segments", previewSegment);
+    requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(previewSegment));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_SEGMENT,

package/dist/nuxt/index.js

@@ -1,5 +1,5 @@
 // src/version.ts
-var VERSION = "0.2.0-beta.5";
+var VERSION = "0.2.0-beta.7";
 
 // src/core/constants.ts
 var COOKIE_PREVIEW_MODE = "Prepr-Preview-Mode";
@@ -38,6 +38,11 @@ var UTM_PARAMS = [
   "utm_content",
   "utm_campaign"
 ];
+var MAX_HEADER_VALUE_LENGTH = 2048;
+function sanitizeHeaderValue(value) {
+  const stripped = value.replace(/[\u0000-\u001f\u007f]/g, "");
+  return stripped.length > MAX_HEADER_VALUE_LENGTH ? stripped.slice(0, MAX_HEADER_VALUE_LENGTH) : stripped;
+}
 function serializeCookie(cookie) {
   const parts = [
     `${cookie.name}=${encodeURIComponent(cookie.value)}`,
@@ -69,6 +74,15 @@ function parseCookies(request) {
 function processPreprRequest(request, opts) {
   const requestHeaders = new Headers(request.headers);
   const responseCookies = [];
+  const inboundPreprHeaders = [];
+  requestHeaders.forEach((_value, key) => {
+    if (key.toLowerCase().startsWith("prepr-")) {
+      inboundPreprHeaders.push(key);
+    }
+  });
+  for (const key of inboundPreprHeaders) {
+    requestHeaders.delete(key);
+  }
   const requestCookies = parseCookies(request);
   const url = new URL(request.url);
   const searchParams = url.searchParams;
@@ -78,25 +92,28 @@ function processPreprRequest(request, opts) {
   for (const key of UTM_PARAMS) {
     const value = searchParams.get(key);
     if (value !== null) {
-      requestHeaders.set(`Prepr-Context-${key}`, value);
+      requestHeaders.set(`Prepr-Context-${key}`, sanitizeHeaderValue(value));
     }
   }
   const referer = request.headers.get("referer");
   if (referer) {
-    requestHeaders.set("Prepr-Context-initial_referral", referer);
+    requestHeaders.set(
+      "Prepr-Context-initial_referral",
+      sanitizeHeaderValue(referer)
+    );
   }
   const userAgent = request.headers.get("user-agent");
   if (userAgent) {
-    requestHeaders.set("Prepr-User-Agent", userAgent);
+    requestHeaders.set("Prepr-User-Agent", sanitizeHeaderValue(userAgent));
   }
   requestHeaders.set("Prepr-Package", `@preprio/toolkit@${opts?.version ?? VERSION}`);
   const ip = request.headers.get("Cf-Connecting-Ip") ?? request.headers.get("x-real-ip");
   if (ip) {
-    requestHeaders.set("Prepr-Visitor-IP", ip);
+    requestHeaders.set("Prepr-Visitor-IP", sanitizeHeaderValue(ip));
   }
   const hutkCookie = requestCookies.get(COOKIE_HUBSPOT);
   if (hutkCookie) {
-    requestHeaders.set("Prepr-Hubspot-Id", hutkCookie);
+    requestHeaders.set("Prepr-Hubspot-Id", sanitizeHeaderValue(hutkCookie));
   }
   let uid = requestCookies.get(COOKIE_UID);
   if (!uid) {
@@ -136,16 +153,16 @@ function processPreprRequest(request, opts) {
   if (!isLivePreview) {
     const segmentCookie = features.segments ? requestCookies.get(COOKIE_SEGMENT) : void 0;
     if (segmentCookie) {
-      requestHeaders.set("Prepr-Segments", segmentCookie);
+      requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(segmentCookie));
     }
     const abCookie = features.abTesting ? requestCookies.get(COOKIE_VARIANT) : void 0;
     if (abCookie) {
-      requestHeaders.set("Prepr-ABtesting", abCookie);
+      requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(abCookie));
     }
   }
   const previewAb = features.abTesting ? searchParams.get(PARAM_VARIANT) : null;
   if (previewAb !== null) {
-    requestHeaders.set("Prepr-ABtesting", previewAb);
+    requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(previewAb));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_VARIANT,
@@ -158,7 +175,7 @@ function processPreprRequest(request, opts) {
   }
   const previewSegment = features.segments ? searchParams.get(PARAM_SEGMENT) : null;
   if (previewSegment !== null) {
-    requestHeaders.set("Prepr-Segments", previewSegment);
+    requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(previewSegment));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_SEGMENT,