@sailfish-ai/recorder 1.7.41 → 1.7.42

package/dist/index.js

@@ -422,22 +422,46 @@ function storeCredentialsAndConnection({ apiKey, backendApi, }) {
     sessionStorage.setItem("sailfishBackendApi", backendApi);
 }
 // Utility function to match domains or paths with wildcard support
-export function matchUrlWithWildcard(url, patterns) {
-    if (!url || typeof url !== "string") {
-        throw new Error("Invalid URL input");
-    }
-    // Ensure the URL has a protocol. If not, prepend "http://"
-    const formattedUrl = url.match(/^[a-zA-Z]+:\/\//) ? url : `http://${url}`;
-    const strippedUrl = formattedUrl.replace(/^[a-zA-Z]+:\/\//, "");
-    const parsedUrl = new URL("http://" + strippedUrl); // Add a dummy protocol for URL parsing
-    const { hostname, pathname, port } = parsedUrl;
+export function matchUrlWithWildcard(input, patterns) {
+    // Tolerate non-string inputs (Request, URL, etc.); coerce to string when possible.
+    let urlStr;
+    if (typeof input === "string") {
+        urlStr = input;
+    }
+    else if (typeof URL !== "undefined" && input instanceof URL) {
+        urlStr = input.href;
+    }
+    else if (typeof Request !== "undefined" && input instanceof Request) {
+        urlStr = input.url;
+    }
+    else if (input != null && typeof input.toString === "function") {
+        // As per web APIs, fetch/open may accept any object with a stringifier.
+        urlStr = input.toString();
+    }
+    if (!urlStr)
+        return false;
+    // Use WHATWG URL parsing with a base for relative URLs.
+    let parsed;
+    try {
+        const base = typeof window !== "undefined"
+            ? window.location.href
+            : "http://localhost/";
+        parsed = new URL(urlStr, base);
+    }
+    catch {
+        return false; // If we can't parse, just say "no match" instead of throwing.
+    }
+    const { hostname, pathname, port, protocol } = parsed;
+    // Only match http(s) hosts/paths; ignore others like data:, blob:, about:.
+    if (!/^https?:$/.test(protocol))
+        return false;
     // Handle stripping 'www.' and port
     const domain = hostname.startsWith("www.")
         ? hostname.slice(4).toLowerCase()
         : hostname.toLowerCase();
     return patterns.some((pattern) => {
         // Strip any protocol and handle port in the pattern if present
-        const strippedPattern = pattern.replace(/^[a-zA-Z]+:\/\//, "");
+        const strippedPattern = String(pattern || "").replace(/^[a-zA-Z]+:\/\//, "");
         let [patternDomain, patternPath] = strippedPattern.split("/", 2);
         // Handle port in pattern
         let patternPort = "";
@@ -453,14 +477,16 @@ export function matchUrlWithWildcard(url, patterns) {
         // Strip 'www.' from both the input domain and the pattern domain for comparison
         const strippedDomain = domain.startsWith("www.") ? domain.slice(4) : domain;
         // If pattern specifies a port, match the exact port
-        if (patternPort && port !== patternPort) {
+        if (patternPort && port !== patternPort)
             return false;
-        }
-        // Handle subdomain wildcard (*.) to match both base and subdomains
-        if (patternDomain.startsWith("*.") &&
-            (domain === patternDomain.slice(2) ||
-                strippedDomain === patternDomain.slice(2))) {
-            // Check for path match if the pattern includes a path
+        // handle patterns like "*.example.com"
+        if (patternDomain.startsWith("*.")) {
+            const base = patternDomain.slice(2).toLowerCase();
+            const isDomainMatch = domain === base ||
+                strippedDomain === base ||
+                domain.endsWith("." + base);
+            if (!isDomainMatch)
+                return false;
             if (patternPath) {
                 const normalizedPatternPath = patternPath
                     .replace(/\*/g, ".*") // Replace '*' with regex to match any characters
@@ -471,9 +497,8 @@ export function matchUrlWithWildcard(url, patterns) {
             return true; // Domain matched, no path required
         }
         // Check if the domain matches (include check for base domain without www)
-        if (!domainRegex.test(strippedDomain) && !domainRegex.test(domain)) {
+        if (!domainRegex.test(strippedDomain) && !domainRegex.test(domain))
             return false;
-        }
         // If there's a path in the pattern, match the path
         if (patternPath) {
             const normalizedPatternPath = patternPath
@@ -487,7 +512,14 @@ export function matchUrlWithWildcard(url, patterns) {
     });
 }
 function shouldSkipHeadersPropagation(url, domainsToNotPropagateHeaderTo = []) {
-    const urlObj = new URL(url, window.location.href);
+    let urlObj;
+    try {
+        urlObj = new URL(typeof url === "string" ? url : String(url?.url ?? url), window.location.href);
+    }
+    catch {
+        // If we cannot parse, play it safe and do NOT inject headers.
+        return true;
+    }
     // 1️⃣ STATIC ASSET EXCLUSIONS (by comprehensive file extension list)
     for (const ext of STATIC_EXTENSIONS) {
         if (urlObj.pathname.toLowerCase().endsWith(ext)) {