@preprio/toolkit 0.2.0-beta.5 → 0.2.0-beta.7

package/dist/react/components.cjs

@@ -334,7 +334,10 @@ function createIframeBridge(store, options = {}) {
   };
   return {
     start() {
-      sendPreprEvent("loaded", void 0, { allowUntrustedTarget: true });
+      const features = store?.get().features;
+      sendPreprEvent("loaded", features ? { features } : void 0, {
+        allowUntrustedTarget: true
+      });
       window.addEventListener("keydown", onKeyDown);
       window.addEventListener("message", onMessage);
     },
@@ -436,6 +439,8 @@ function createStegaAutoClean() {
   function scanAndClean() {
     processing = true;
     walkTextNodes(document.body, cleanTextNode);
+    const title = (0, import_stega2.vercelStegaSplit)(document.title);
+    if (title.encoded) document.title = title.cleaned;
     processing = false;
   }
   function collectAffected(mutations) {
@@ -481,15 +486,8 @@ function createStegaAutoClean() {
   }
   function start() {
     if (observer || typeof window === "undefined") return;
-    const run = () => {
-      scanAndClean();
-      setupObserver();
-    };
-    if ("requestIdleCallback" in window) {
-      window.requestIdleCallback(run);
-    } else {
-      setTimeout(run, 0);
-    }
+    scanAndClean();
+    setupObserver();
     debug2.log("stega auto-clean started");
   }
   function stop() {
@@ -982,7 +980,7 @@ function cookieOpts() {
   };
 }
 function createChangeHandler(deps) {
-  const { store, stega, syncAutoClean, features, editingEnabled } = deps;
+  const { store, stega, features, editingEnabled } = deps;
   function updateParams(patch) {
     const [path, existing] = splitPath(deps.currentPath());
     const params = new URLSearchParams(existing);
@@ -1045,16 +1043,17 @@ function createChangeHandler(deps) {
       setCookie(COOKIE_PREVIEW_MODE, String(after.previewMode), cookieOpts());
       setCookie(COOKIE_TOOLBAR_OPEN, "false", cookieOpts());
       sendPreprEvent("preview_mode_toggled", { previewMode: after.previewMode });
-      syncAutoClean(after.previewMode);
-      const [path, existing] = splitPath(deps.currentPath());
-      const params = new URLSearchParams(existing);
-      if (params.has(PARAM_SEGMENT) || params.has(PARAM_VARIANT)) {
-        params.delete(PARAM_SEGMENT);
-        params.delete(PARAM_VARIANT);
-        const query = params.toString();
-        deps.navigate(query ? `${path}?${query}` : path);
-      } else {
-        deps.reload();
+      if (!after.isIframe) {
+        const [path, existing] = splitPath(deps.currentPath());
+        const params = new URLSearchParams(existing);
+        if (params.has(PARAM_SEGMENT) || params.has(PARAM_VARIANT)) {
+          params.delete(PARAM_SEGMENT);
+          params.delete(PARAM_VARIANT);
+          const query = params.toString();
+          deps.navigate(query ? `${path}?${query}` : path);
+        } else {
+          deps.reload();
+        }
       }
     }
     if (before.toolbarOpen !== after.toolbarOpen) {
@@ -2049,6 +2048,14 @@ function defaultNavigation() {
     currentPath: () => window.location.pathname + window.location.search
   };
 }
+function safeEditUrl(href) {
+  try {
+    const url = new URL(href, window.location.href);
+    return url.protocol === "https:" || url.protocol === "http:" ? url.href : null;
+  } catch {
+    return null;
+  }
+}
 function buildSegments(data) {
   return [{ _id: "all_other_users", name: "All other users" }, ...data];
 }
@@ -2112,24 +2119,25 @@ function createPreprPreview(opts = {}) {
     // In the editor, ask the parent to focus the field instead of opening a new
     // tab. Standalone previews keep the window.open behaviour.
     onEdit: ({ href, origin, id, field }) => {
+      const safeHref = href ? safeEditUrl(href) : null;
+      if (href && !safeHref) {
+        debug7.warn("ignored edit request with unsupported href scheme");
+        return;
+      }
       if (isIframe) {
-        sendPreprEvent("field_edit_requested", { href, origin, id, field });
-      } else if (href) {
-        window.open(href);
+        sendPreprEvent("field_edit_requested", {
+          href: safeHref ?? void 0,
+          origin,
+          id,
+          field
+        });
+      } else if (safeHref) {
+        window.open(safeHref, "_blank", "noopener,noreferrer");
       }
     }
   });
   const autoClean = createStegaAutoClean();
-  let autoCleanActive = false;
-  function syncAutoClean(active) {
-    if (active && !autoCleanActive) {
-      autoClean.start();
-      autoCleanActive = true;
-    } else if (!active && autoCleanActive) {
-      autoClean.stop();
-      autoCleanActive = false;
-    }
-  }
+  autoClean.start();
   const handleChange = createChangeHandler({
     store,
     features,
@@ -2137,8 +2145,7 @@ function createPreprPreview(opts = {}) {
     navigate: (url) => navigation.navigate(url),
     currentPath: () => navigation.currentPath(),
     reload: navigation.reload ?? (() => window.location.reload()),
-    stega,
-    syncAutoClean
+    stega
   });
   let prev = store.get();
   const unsubscribe = store.subscribe((state) => {
@@ -2146,7 +2153,6 @@ function createPreprPreview(opts = {}) {
     prev = state;
     handleChange(before, state);
   });
-  syncAutoClean(store.get().previewMode);
   const bridge = createIframeBridge(store, {
     allowedEditorOrigins: options?.allowedEditorOrigins
   });
@@ -2159,7 +2165,7 @@ function createPreprPreview(opts = {}) {
   function destroy() {
     unsubscribe();
     stega.stop();
-    syncAutoClean(false);
+    autoClean.stop();
     if (isIframe) {
       bridge.stop();
     }

package/dist/react/components.js

@@ -310,7 +310,10 @@ function createIframeBridge(store, options = {}) {
   };
   return {
     start() {
-      sendPreprEvent("loaded", void 0, { allowUntrustedTarget: true });
+      const features = store?.get().features;
+      sendPreprEvent("loaded", features ? { features } : void 0, {
+        allowUntrustedTarget: true
+      });
       window.addEventListener("keydown", onKeyDown);
       window.addEventListener("message", onMessage);
     },
@@ -412,6 +415,8 @@ function createStegaAutoClean() {
   function scanAndClean() {
     processing = true;
     walkTextNodes(document.body, cleanTextNode);
+    const title = vercelStegaSplit(document.title);
+    if (title.encoded) document.title = title.cleaned;
     processing = false;
   }
   function collectAffected(mutations) {
@@ -457,15 +462,8 @@ function createStegaAutoClean() {
   }
   function start() {
     if (observer || typeof window === "undefined") return;
-    const run = () => {
-      scanAndClean();
-      setupObserver();
-    };
-    if ("requestIdleCallback" in window) {
-      window.requestIdleCallback(run);
-    } else {
-      setTimeout(run, 0);
-    }
+    scanAndClean();
+    setupObserver();
     debug2.log("stega auto-clean started");
   }
   function stop() {
@@ -958,7 +956,7 @@ function cookieOpts() {
   };
 }
 function createChangeHandler(deps) {
-  const { store, stega, syncAutoClean, features, editingEnabled } = deps;
+  const { store, stega, features, editingEnabled } = deps;
   function updateParams(patch) {
     const [path, existing] = splitPath(deps.currentPath());
     const params = new URLSearchParams(existing);
@@ -1021,16 +1019,17 @@ function createChangeHandler(deps) {
       setCookie(COOKIE_PREVIEW_MODE, String(after.previewMode), cookieOpts());
       setCookie(COOKIE_TOOLBAR_OPEN, "false", cookieOpts());
       sendPreprEvent("preview_mode_toggled", { previewMode: after.previewMode });
-      syncAutoClean(after.previewMode);
-      const [path, existing] = splitPath(deps.currentPath());
-      const params = new URLSearchParams(existing);
-      if (params.has(PARAM_SEGMENT) || params.has(PARAM_VARIANT)) {
-        params.delete(PARAM_SEGMENT);
-        params.delete(PARAM_VARIANT);
-        const query = params.toString();
-        deps.navigate(query ? `${path}?${query}` : path);
-      } else {
-        deps.reload();
+      if (!after.isIframe) {
+        const [path, existing] = splitPath(deps.currentPath());
+        const params = new URLSearchParams(existing);
+        if (params.has(PARAM_SEGMENT) || params.has(PARAM_VARIANT)) {
+          params.delete(PARAM_SEGMENT);
+          params.delete(PARAM_VARIANT);
+          const query = params.toString();
+          deps.navigate(query ? `${path}?${query}` : path);
+        } else {
+          deps.reload();
+        }
       }
     }
     if (before.toolbarOpen !== after.toolbarOpen) {
@@ -2025,6 +2024,14 @@ function defaultNavigation() {
     currentPath: () => window.location.pathname + window.location.search
   };
 }
+function safeEditUrl(href) {
+  try {
+    const url = new URL(href, window.location.href);
+    return url.protocol === "https:" || url.protocol === "http:" ? url.href : null;
+  } catch {
+    return null;
+  }
+}
 function buildSegments(data) {
   return [{ _id: "all_other_users", name: "All other users" }, ...data];
 }
@@ -2088,24 +2095,25 @@ function createPreprPreview(opts = {}) {
     // In the editor, ask the parent to focus the field instead of opening a new
     // tab. Standalone previews keep the window.open behaviour.
     onEdit: ({ href, origin, id, field }) => {
+      const safeHref = href ? safeEditUrl(href) : null;
+      if (href && !safeHref) {
+        debug7.warn("ignored edit request with unsupported href scheme");
+        return;
+      }
       if (isIframe) {
-        sendPreprEvent("field_edit_requested", { href, origin, id, field });
-      } else if (href) {
-        window.open(href);
+        sendPreprEvent("field_edit_requested", {
+          href: safeHref ?? void 0,
+          origin,
+          id,
+          field
+        });
+      } else if (safeHref) {
+        window.open(safeHref, "_blank", "noopener,noreferrer");
       }
     }
   });
   const autoClean = createStegaAutoClean();
-  let autoCleanActive = false;
-  function syncAutoClean(active) {
-    if (active && !autoCleanActive) {
-      autoClean.start();
-      autoCleanActive = true;
-    } else if (!active && autoCleanActive) {
-      autoClean.stop();
-      autoCleanActive = false;
-    }
-  }
+  autoClean.start();
   const handleChange = createChangeHandler({
     store,
     features,
@@ -2113,8 +2121,7 @@ function createPreprPreview(opts = {}) {
     navigate: (url) => navigation.navigate(url),
     currentPath: () => navigation.currentPath(),
     reload: navigation.reload ?? (() => window.location.reload()),
-    stega,
-    syncAutoClean
+    stega
   });
   let prev = store.get();
   const unsubscribe = store.subscribe((state) => {
@@ -2122,7 +2129,6 @@ function createPreprPreview(opts = {}) {
     prev = state;
     handleChange(before, state);
   });
-  syncAutoClean(store.get().previewMode);
   const bridge = createIframeBridge(store, {
     allowedEditorOrigins: options?.allowedEditorOrigins
   });
@@ -2135,7 +2141,7 @@ function createPreprPreview(opts = {}) {
   function destroy() {
     unsubscribe();
     stega.stop();
-    syncAutoClean(false);
+    autoClean.stop();
     if (isIframe) {
       bridge.stop();
     }

package/dist/sveltekit/index.cjs

@@ -35,7 +35,7 @@ __export(sveltekit_exports, {
 module.exports = __toCommonJS(sveltekit_exports);
 
 // src/version.ts
-var VERSION = "0.2.0-beta.5";
+var VERSION = "0.2.0-beta.7";
 
 // src/core/constants.ts
 var COOKIE_PREVIEW_MODE = "Prepr-Preview-Mode";
@@ -74,6 +74,11 @@ var UTM_PARAMS = [
   "utm_content",
   "utm_campaign"
 ];
+var MAX_HEADER_VALUE_LENGTH = 2048;
+function sanitizeHeaderValue(value) {
+  const stripped = value.replace(/[\u0000-\u001f\u007f]/g, "");
+  return stripped.length > MAX_HEADER_VALUE_LENGTH ? stripped.slice(0, MAX_HEADER_VALUE_LENGTH) : stripped;
+}
 function serializeCookie(cookie) {
   const parts = [
     `${cookie.name}=${encodeURIComponent(cookie.value)}`,
@@ -105,6 +110,15 @@ function parseCookies(request) {
 function processPreprRequest(request, opts) {
   const requestHeaders = new Headers(request.headers);
   const responseCookies = [];
+  const inboundPreprHeaders = [];
+  requestHeaders.forEach((_value, key) => {
+    if (key.toLowerCase().startsWith("prepr-")) {
+      inboundPreprHeaders.push(key);
+    }
+  });
+  for (const key of inboundPreprHeaders) {
+    requestHeaders.delete(key);
+  }
   const requestCookies = parseCookies(request);
   const url = new URL(request.url);
   const searchParams = url.searchParams;
@@ -114,25 +128,28 @@ function processPreprRequest(request, opts) {
   for (const key of UTM_PARAMS) {
     const value = searchParams.get(key);
     if (value !== null) {
-      requestHeaders.set(`Prepr-Context-${key}`, value);
+      requestHeaders.set(`Prepr-Context-${key}`, sanitizeHeaderValue(value));
     }
   }
   const referer = request.headers.get("referer");
   if (referer) {
-    requestHeaders.set("Prepr-Context-initial_referral", referer);
+    requestHeaders.set(
+      "Prepr-Context-initial_referral",
+      sanitizeHeaderValue(referer)
+    );
   }
   const userAgent = request.headers.get("user-agent");
   if (userAgent) {
-    requestHeaders.set("Prepr-User-Agent", userAgent);
+    requestHeaders.set("Prepr-User-Agent", sanitizeHeaderValue(userAgent));
   }
   requestHeaders.set("Prepr-Package", `@preprio/toolkit@${opts?.version ?? VERSION}`);
   const ip = request.headers.get("Cf-Connecting-Ip") ?? request.headers.get("x-real-ip");
   if (ip) {
-    requestHeaders.set("Prepr-Visitor-IP", ip);
+    requestHeaders.set("Prepr-Visitor-IP", sanitizeHeaderValue(ip));
   }
   const hutkCookie = requestCookies.get(COOKIE_HUBSPOT);
   if (hutkCookie) {
-    requestHeaders.set("Prepr-Hubspot-Id", hutkCookie);
+    requestHeaders.set("Prepr-Hubspot-Id", sanitizeHeaderValue(hutkCookie));
   }
   let uid = requestCookies.get(COOKIE_UID);
   if (!uid) {
@@ -172,16 +189,16 @@ function processPreprRequest(request, opts) {
   if (!isLivePreview) {
     const segmentCookie = features.segments ? requestCookies.get(COOKIE_SEGMENT) : void 0;
     if (segmentCookie) {
-      requestHeaders.set("Prepr-Segments", segmentCookie);
+      requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(segmentCookie));
     }
     const abCookie = features.abTesting ? requestCookies.get(COOKIE_VARIANT) : void 0;
     if (abCookie) {
-      requestHeaders.set("Prepr-ABtesting", abCookie);
+      requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(abCookie));
     }
   }
   const previewAb = features.abTesting ? searchParams.get(PARAM_VARIANT) : null;
   if (previewAb !== null) {
-    requestHeaders.set("Prepr-ABtesting", previewAb);
+    requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(previewAb));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_VARIANT,
@@ -194,7 +211,7 @@ function processPreprRequest(request, opts) {
   }
   const previewSegment = features.segments ? searchParams.get(PARAM_SEGMENT) : null;
   if (previewSegment !== null) {
-    requestHeaders.set("Prepr-Segments", previewSegment);
+    requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(previewSegment));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_SEGMENT,

package/dist/sveltekit/index.js

@@ -1,5 +1,5 @@
 // src/version.ts
-var VERSION = "0.2.0-beta.5";
+var VERSION = "0.2.0-beta.7";
 
 // src/core/constants.ts
 var COOKIE_PREVIEW_MODE = "Prepr-Preview-Mode";
@@ -38,6 +38,11 @@ var UTM_PARAMS = [
   "utm_content",
   "utm_campaign"
 ];
+var MAX_HEADER_VALUE_LENGTH = 2048;
+function sanitizeHeaderValue(value) {
+  const stripped = value.replace(/[\u0000-\u001f\u007f]/g, "");
+  return stripped.length > MAX_HEADER_VALUE_LENGTH ? stripped.slice(0, MAX_HEADER_VALUE_LENGTH) : stripped;
+}
 function serializeCookie(cookie) {
   const parts = [
     `${cookie.name}=${encodeURIComponent(cookie.value)}`,
@@ -69,6 +74,15 @@ function parseCookies(request) {
 function processPreprRequest(request, opts) {
   const requestHeaders = new Headers(request.headers);
   const responseCookies = [];
+  const inboundPreprHeaders = [];
+  requestHeaders.forEach((_value, key) => {
+    if (key.toLowerCase().startsWith("prepr-")) {
+      inboundPreprHeaders.push(key);
+    }
+  });
+  for (const key of inboundPreprHeaders) {
+    requestHeaders.delete(key);
+  }
   const requestCookies = parseCookies(request);
   const url = new URL(request.url);
   const searchParams = url.searchParams;
@@ -78,25 +92,28 @@ function processPreprRequest(request, opts) {
   for (const key of UTM_PARAMS) {
     const value = searchParams.get(key);
     if (value !== null) {
-      requestHeaders.set(`Prepr-Context-${key}`, value);
+      requestHeaders.set(`Prepr-Context-${key}`, sanitizeHeaderValue(value));
     }
   }
   const referer = request.headers.get("referer");
   if (referer) {
-    requestHeaders.set("Prepr-Context-initial_referral", referer);
+    requestHeaders.set(
+      "Prepr-Context-initial_referral",
+      sanitizeHeaderValue(referer)
+    );
   }
   const userAgent = request.headers.get("user-agent");
   if (userAgent) {
-    requestHeaders.set("Prepr-User-Agent", userAgent);
+    requestHeaders.set("Prepr-User-Agent", sanitizeHeaderValue(userAgent));
   }
   requestHeaders.set("Prepr-Package", `@preprio/toolkit@${opts?.version ?? VERSION}`);
   const ip = request.headers.get("Cf-Connecting-Ip") ?? request.headers.get("x-real-ip");
   if (ip) {
-    requestHeaders.set("Prepr-Visitor-IP", ip);
+    requestHeaders.set("Prepr-Visitor-IP", sanitizeHeaderValue(ip));
   }
   const hutkCookie = requestCookies.get(COOKIE_HUBSPOT);
   if (hutkCookie) {
-    requestHeaders.set("Prepr-Hubspot-Id", hutkCookie);
+    requestHeaders.set("Prepr-Hubspot-Id", sanitizeHeaderValue(hutkCookie));
   }
   let uid = requestCookies.get(COOKIE_UID);
   if (!uid) {
@@ -136,16 +153,16 @@ function processPreprRequest(request, opts) {
   if (!isLivePreview) {
     const segmentCookie = features.segments ? requestCookies.get(COOKIE_SEGMENT) : void 0;
     if (segmentCookie) {
-      requestHeaders.set("Prepr-Segments", segmentCookie);
+      requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(segmentCookie));
     }
     const abCookie = features.abTesting ? requestCookies.get(COOKIE_VARIANT) : void 0;
     if (abCookie) {
-      requestHeaders.set("Prepr-ABtesting", abCookie);
+      requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(abCookie));
     }
   }
   const previewAb = features.abTesting ? searchParams.get(PARAM_VARIANT) : null;
   if (previewAb !== null) {
-    requestHeaders.set("Prepr-ABtesting", previewAb);
+    requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(previewAb));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_VARIANT,
@@ -158,7 +175,7 @@ function processPreprRequest(request, opts) {
   }
   const previewSegment = features.segments ? searchParams.get(PARAM_SEGMENT) : null;
   if (previewSegment !== null) {
-    requestHeaders.set("Prepr-Segments", previewSegment);
+    requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(previewSegment));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_SEGMENT,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preprio/toolkit",
-  "version": "0.2.0-beta.5",
+  "version": "0.2.0-beta.7",
   "description": "Prepr personalization, A/B testing and preview toolkit for React, Next.js, Nuxt, Astro, SvelteKit and Express",
   "license": "Apache-2.0",
   "author": "Prepr B.V. (https://prepr.io)",
@@ -94,6 +94,16 @@
     "src/sveltekit/*.svelte",
     "src/nuxt/*.vue"
   ],
+  "scripts": {
+    "gen:css": "node scripts/compile-css.mjs",
+    "prebuild": "rm -rf dist && pnpm gen:css && node scripts/check-version.mjs",
+    "pretest": "pnpm gen:css",
+    "pretypecheck": "pnpm gen:css",
+    "build": "tsup",
+    "postbuild": "node scripts/check-exports.mjs",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  },
   "dependencies": {
     "@vercel/stega": "^1.1.0",
     "preact": "^10.29.7"
@@ -135,15 +145,5 @@
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
     "vitest": "^4.1.10"
-  },
-  "scripts": {
-    "gen:css": "node scripts/compile-css.mjs",
-    "prebuild": "rm -rf dist && pnpm gen:css && node scripts/check-version.mjs",
-    "pretest": "pnpm gen:css",
-    "pretypecheck": "pnpm gen:css",
-    "build": "tsup",
-    "postbuild": "node scripts/check-exports.mjs",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit"
   }
-}
+}