@workleap/logrocket 4.0.6 → 4.1.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @workleap/logrocket
 
+## 4.1.0
+
+### Minor Changes
+
+- [#289](https://github.com/workleap/wl-telemetry/pull/289) [`a233944`](https://github.com/workleap/wl-telemetry/commit/a233944db31a52c20cfbe2d086dfa698e2a685b3) Thanks [@patricklafrance](https://github.com/patricklafrance)! - A name provided with the `privateQueryParameterNames` option is now matched literally, and is also matched in its percent-encoded form. Previously, a name was used as a regular expression without being escaped: a name such as `user[email]` was not redacted, and a name that is not a valid regular expression made the sanitizer throw. A name that relied on the regular expression syntax, such as `(sid|key)`, no longer matches and must be replaced by the actual names.
+
+### Patch Changes
+
+- Updated dependencies [[`a233944`](https://github.com/workleap/wl-telemetry/commit/a233944db31a52c20cfbe2d086dfa698e2a685b3)]:
+  - @workleap-telemetry/core@2.1.0
+
+## 4.0.7
+
+### Patch Changes
+
+- [#278](https://github.com/workleap/wl-telemetry/pull/278) [`c75b3cf`](https://github.com/workleap/wl-telemetry/commit/c75b3cfc89799f2cc76170066cfc512e1db7055a) Thanks [@patricklafrance](https://github.com/patricklafrance)! - Redact the private query parameters from the URL of the network requests recorded in LogRocket session replays. Previously, the private query parameters were only redacted from the page URLs. Every occurrence of a private query parameter is now redacted, previously only the first occurrence was.
+
 ## 4.0.6
 
 ### Patch Changes

package/dist/js/createRequestSanitizer.d.ts

@@ -1,3 +1,4 @@
+import type { UrlSanitizerFunction } from "./createUrlSanitizer.js";
 import type { LogRocketRequest } from "./logRocketTypes.js";
 export type RequestSanitizerFunction = (req: LogRocketRequest) => any;
-export declare function createRequestSanitizer(fuzzyRequestSanitizer: RequestSanitizerFunction): (req: LogRocketRequest) => any;
+export declare function createRequestSanitizer(fuzzyRequestSanitizer: RequestSanitizerFunction, urlSanitizer: UrlSanitizerFunction): (req: LogRocketRequest) => any;

package/dist/js/createRequestSanitizer.js

@@ -2,8 +2,9 @@ import { sanitizeHeaders } from "./sanitizeHeaders.js";
 
 
 
-function createRequestSanitizer(fuzzyRequestSanitizer) {
+function createRequestSanitizer(fuzzyRequestSanitizer, urlSanitizer) {
     return (req)=>{
+        req.url = urlSanitizer(req.url);
         req.headers = sanitizeHeaders(req.headers);
         if (req.body) {
             // Do not return the request body, which could contain sensitive information.

package/dist/js/createRequestSanitizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"js/createRequestSanitizer.js","sources":["../../src/js/createRequestSanitizer.ts"],"sourcesContent":["import type { LogRocketRequest } from \"./logRocketTypes.ts\";\nimport { sanitizeHeaders } from \"./sanitizeHeaders.ts\";\n\n// oxlint-disable-next-line typescript/no-explicit-any\nexport type RequestSanitizerFunction = (req: LogRocketRequest) => any;\n\nexport function createRequestSanitizer(fuzzyRequestSanitizer: RequestSanitizerFunction) {\n    return (req: LogRocketRequest) => {\n        req.headers = sanitizeHeaders(req.headers);\n\n        if (req.body) {\n            // Do not return the request body, which could contain sensitive information.\n            req.body = \"**redacted**\";\n        }\n\n        return fuzzyRequestSanitizer(req);\n    };\n}\n"],"names":["sanitizeHeaders","createRequestSanitizer","fuzzyRequestSanitizer","req"],"mappings":";;;AACuD;AAKhD,SAASC,uBAAuBC,qBAA+C;IAClF,OAAO,CAACC;QACJA,IAAI,OAAO,GAAGH,eAAeA,CAACG,IAAI,OAAO;QAEzC,IAAIA,IAAI,IAAI,EAAE;YACV,6EAA6E;YAC7EA,IAAI,IAAI,GAAG;QACf;QAEA,OAAOD,sBAAsBC;IACjC;AACJ"}
+{"version":3,"file":"js/createRequestSanitizer.js","sources":["../../src/js/createRequestSanitizer.ts"],"sourcesContent":["import type { UrlSanitizerFunction } from \"./createUrlSanitizer.ts\";\nimport type { LogRocketRequest } from \"./logRocketTypes.ts\";\nimport { sanitizeHeaders } from \"./sanitizeHeaders.ts\";\n\n// oxlint-disable-next-line typescript/no-explicit-any\nexport type RequestSanitizerFunction = (req: LogRocketRequest) => any;\n\nexport function createRequestSanitizer(fuzzyRequestSanitizer: RequestSanitizerFunction, urlSanitizer: UrlSanitizerFunction) {\n    return (req: LogRocketRequest) => {\n        req.url = urlSanitizer(req.url);\n        req.headers = sanitizeHeaders(req.headers);\n\n        if (req.body) {\n            // Do not return the request body, which could contain sensitive information.\n            req.body = \"**redacted**\";\n        }\n\n        return fuzzyRequestSanitizer(req);\n    };\n}\n"],"names":["sanitizeHeaders","createRequestSanitizer","fuzzyRequestSanitizer","urlSanitizer","req"],"mappings":";;;AAEuD;AAKhD,SAASC,uBAAuBC,qBAA+C,EAAEC,YAAkC;IACtH,OAAO,CAACC;QACJA,IAAI,GAAG,GAAGD,aAAaC,IAAI,GAAG;QAC9BA,IAAI,OAAO,GAAGJ,eAAeA,CAACI,IAAI,OAAO;QAEzC,IAAIA,IAAI,IAAI,EAAE;YACV,6EAA6E;YAC7EA,IAAI,IAAI,GAAG;QACf;QAEA,OAAOF,sBAAsBE;IACjC;AACJ"}

package/dist/js/createResponseSanitizer.d.ts

@@ -1,3 +1,4 @@
+import type { UrlSanitizerFunction } from "./createUrlSanitizer.js";
 import type { LogRocketResponse } from "./logRocketTypes.js";
 export type ResponseSanitizerFunction = (res: LogRocketResponse) => any;
-export declare function createResponseSanitizer(fuzzyResponseSanitizer: ResponseSanitizerFunction): (res: LogRocketResponse) => any;
+export declare function createResponseSanitizer(fuzzyResponseSanitizer: ResponseSanitizerFunction, urlSanitizer: UrlSanitizerFunction): (res: LogRocketResponse) => any;

package/dist/js/createResponseSanitizer.js

@@ -2,8 +2,11 @@ import { sanitizeHeaders } from "./sanitizeHeaders.js";
 
 
 
-function createResponseSanitizer(fuzzyResponseSanitizer) {
+function createResponseSanitizer(fuzzyResponseSanitizer, urlSanitizer) {
     return (res)=>{
+        if (res.url) {
+            res.url = urlSanitizer(res.url);
+        }
         res.headers = sanitizeHeaders(res.headers);
         if (res.body) {
             // Do not return the response body, which could contain sensitive information.

package/dist/js/createResponseSanitizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"js/createResponseSanitizer.js","sources":["../../src/js/createResponseSanitizer.ts"],"sourcesContent":["import type { LogRocketResponse } from \"./logRocketTypes.ts\";\nimport { sanitizeHeaders } from \"./sanitizeHeaders.ts\";\n\n// oxlint-disable-next-line typescript/no-explicit-any\nexport type ResponseSanitizerFunction = (res: LogRocketResponse) => any;\n\nexport function createResponseSanitizer(fuzzyResponseSanitizer: ResponseSanitizerFunction) {\n    return (res: LogRocketResponse) => {\n        res.headers = sanitizeHeaders(res.headers);\n\n        if (res.body) {\n            // Do not return the response body, which could contain sensitive information.\n            res.body = \"**redacted**\";\n        }\n\n        return fuzzyResponseSanitizer(res);\n    };\n}\n"],"names":["sanitizeHeaders","createResponseSanitizer","fuzzyResponseSanitizer","res"],"mappings":";;;AACuD;AAKhD,SAASC,wBAAwBC,sBAAiD;IACrF,OAAO,CAACC;QACJA,IAAI,OAAO,GAAGH,eAAeA,CAACG,IAAI,OAAO;QAEzC,IAAIA,IAAI,IAAI,EAAE;YACV,8EAA8E;YAC9EA,IAAI,IAAI,GAAG;QACf;QAEA,OAAOD,uBAAuBC;IAClC;AACJ"}
+{"version":3,"file":"js/createResponseSanitizer.js","sources":["../../src/js/createResponseSanitizer.ts"],"sourcesContent":["import type { UrlSanitizerFunction } from \"./createUrlSanitizer.ts\";\nimport type { LogRocketResponse } from \"./logRocketTypes.ts\";\nimport { sanitizeHeaders } from \"./sanitizeHeaders.ts\";\n\n// oxlint-disable-next-line typescript/no-explicit-any\nexport type ResponseSanitizerFunction = (res: LogRocketResponse) => any;\n\nexport function createResponseSanitizer(fuzzyResponseSanitizer: ResponseSanitizerFunction, urlSanitizer: UrlSanitizerFunction) {\n    return (res: LogRocketResponse) => {\n        if (res.url) {\n            res.url = urlSanitizer(res.url);\n        }\n\n        res.headers = sanitizeHeaders(res.headers);\n\n        if (res.body) {\n            // Do not return the response body, which could contain sensitive information.\n            res.body = \"**redacted**\";\n        }\n\n        return fuzzyResponseSanitizer(res);\n    };\n}\n"],"names":["sanitizeHeaders","createResponseSanitizer","fuzzyResponseSanitizer","urlSanitizer","res"],"mappings":";;;AAEuD;AAKhD,SAASC,wBAAwBC,sBAAiD,EAAEC,YAAkC;IACzH,OAAO,CAACC;QACJ,IAAIA,IAAI,GAAG,EAAE;YACTA,IAAI,GAAG,GAAGD,aAAaC,IAAI,GAAG;QAClC;QAEAA,IAAI,OAAO,GAAGJ,eAAeA,CAACI,IAAI,OAAO;QAEzC,IAAIA,IAAI,IAAI,EAAE;YACV,8EAA8E;YAC9EA,IAAI,IAAI,GAAG;QACf;QAEA,OAAOF,uBAAuBE;IAClC;AACJ"}

package/dist/js/createUrlSanitizer.d.ts

@@ -1 +1,2 @@
-export declare function createUrlSanitizer(queryParametersToRemove: string[]): (url: string) => string;
+export type UrlSanitizerFunction = (url: string) => string;
+export declare function createUrlSanitizer(queryParametersToRemove: string[]): (url: string | URL) => string;

package/dist/js/createUrlSanitizer.js

@@ -1,10 +1,11 @@
+import { redactQueryParameters } from "@workleap-telemetry/core";
+
+
+
 function createUrlSanitizer(queryParametersToRemove) {
     return (url)=>{
-        let sanitizedUrl = url;
-        for (const x of queryParametersToRemove){
-            sanitizedUrl = sanitizedUrl.replace(new RegExp(`${x}=([^&]*)`, "i"), `${x}=**redacted**`);
-        }
-        return sanitizedUrl;
+        // A network request made with XMLHttpRequest can provide a URL object rather than a string.
+        return redactQueryParameters(String(url), queryParametersToRemove);
     };
 }
 

package/dist/js/createUrlSanitizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"js/createUrlSanitizer.js","sources":["../../src/js/createUrlSanitizer.ts"],"sourcesContent":["export function createUrlSanitizer(queryParametersToRemove: string[]) {\n    return (url: string) => {\n        let sanitizedUrl = url;\n\n        for (const x of queryParametersToRemove) {\n            sanitizedUrl = sanitizedUrl.replace(new RegExp(`${x}=([^&]*)`, \"i\"), `${x}=**redacted**`);\n        }\n\n        return sanitizedUrl;\n    };\n}\n"],"names":["createUrlSanitizer","queryParametersToRemove","url","sanitizedUrl","x","RegExp"],"mappings":"AAAO,SAASA,mBAAmBC,uBAAiC;IAChE,OAAO,CAACC;QACJ,IAAIC,eAAeD;QAEnB,KAAK,MAAME,KAAKH,wBAAyB;YACrCE,eAAeA,aAAa,OAAO,CAAC,IAAIE,OAAO,GAAGD,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAGA,EAAE,aAAa,CAAC;QAC5F;QAEA,OAAOD;IACX;AACJ"}
+{"version":3,"file":"js/createUrlSanitizer.js","sources":["../../src/js/createUrlSanitizer.ts"],"sourcesContent":["import { redactQueryParameters } from \"@workleap-telemetry/core\";\n\nexport type UrlSanitizerFunction = (url: string) => string;\n\nexport function createUrlSanitizer(queryParametersToRemove: string[]) {\n    return (url: string | URL) => {\n        // A network request made with XMLHttpRequest can provide a URL object rather than a string.\n        return redactQueryParameters(String(url), queryParametersToRemove);\n    };\n}\n"],"names":["redactQueryParameters","createUrlSanitizer","queryParametersToRemove","url","String"],"mappings":";;;AAAiE;AAI1D,SAASC,mBAAmBC,uBAAiC;IAChE,OAAO,CAACC;QACJ,4FAA4F;QAC5F,OAAOH,qBAAqBA,CAACI,OAAOD,MAAMD;IAC9C;AACJ"}

package/dist/js/registerLogRocketInstrumentation.js

@@ -1,4 +1,4 @@
-import { HasExecutedGuard } from "@workleap-telemetry/core";
+import { DefaultPrivateQueryParameterNames, HasExecutedGuard } from "@workleap-telemetry/core";
 import { createCompositeLogger } from "@workleap/logging";
 import logrocket from "logrocket";
 import logrocket_fuzzy_search_sanitizer from "logrocket-fuzzy-search-sanitizer";
@@ -39,11 +39,6 @@ const DefaultPrivateFieldNames = [
     "timeZone",
     "birthday"
 ];
-const DefaultPrivateQueryParameterNames = [
-    "token",
-    "email",
-    "password"
-];
 // The function return type is mandatory, otherwise we got an error TS4058.
 function getLogRocketSdkOptions(userOptions, logger) {
     const { rootHostname = "workleap.com", privateFieldNames = [], privateQueryParameterNames = [], verbose = false, transformers = [] } = userOptions;
@@ -54,6 +49,7 @@ function getLogRocketSdkOptions(userOptions, logger) {
     // No clue why the "setup" method is not available. This package is shady.
     // @ts-ignore
     const { requestSanitizer: fuzzyRequestSanitizer, responseSanitizer: fuzzyResponseSanitizer } = logrocket_fuzzy_search_sanitizer.setup(mergedPrivateFieldNames);
+    const urlSanitizer = createUrlSanitizer(mergedPrivateQueryParameterNames);
     const sdkOptions = {
         console: {
             // Prevent console logs from being visible in LogRocket session replays and leaking PII.
@@ -66,11 +62,11 @@ function getLogRocketSdkOptions(userOptions, logger) {
             inputSanitizer: true
         },
         network: {
-            requestSanitizer: createRequestSanitizer(fuzzyRequestSanitizer),
-            responseSanitizer: createResponseSanitizer(fuzzyResponseSanitizer)
+            requestSanitizer: createRequestSanitizer(fuzzyRequestSanitizer, urlSanitizer),
+            responseSanitizer: createResponseSanitizer(fuzzyResponseSanitizer, urlSanitizer)
         },
         browser: {
-            urlSanitizer: createUrlSanitizer(mergedPrivateQueryParameterNames)
+            urlSanitizer
         },
         shouldDebugLog: verbose
     };

package/dist/js/registerLogRocketInstrumentation.js.map

@@ -1 +1 @@
-{"version":3,"file":"js/registerLogRocketInstrumentation.js","sources":["../../src/js/registerLogRocketInstrumentation.ts"],"sourcesContent":["import { HasExecutedGuard, type TelemetryContext } from \"@workleap-telemetry/core\";\nimport { createCompositeLogger, type RootLogger } from \"@workleap/logging\";\nimport LogRocket from \"logrocket\";\nimport LogrocketFuzzySanitizer from \"logrocket-fuzzy-search-sanitizer\";\nimport { applyTransformers, type LogRocketSdkOptionsTransformer } from \"./applyTransformers.ts\";\nimport { createRequestSanitizer } from \"./createRequestSanitizer.ts\";\nimport { createResponseSanitizer } from \"./createResponseSanitizer.ts\";\nimport { createUrlSanitizer } from \"./createUrlSanitizer.ts\";\nimport { DeviceIdTrait, type LogRocketInstrumentationClient, LogRocketInstrumentationClientImpl, TelemetryIdTrait } from \"./LogRocketInstrumentationClient.ts\";\nimport type { LogRocketSdkOptions } from \"./logRocketTypes.ts\";\n\nconst DefaultPrivateFieldNames = [\"email\", \"personalEmail\", \"phoneNumber\", \"password\", \"firstName\", \"lastName\", \"givenName\", \"fullName\", \"gender\", \"timeZone\", \"birthday\"];\n\nconst DefaultPrivateQueryParameterNames = [\"token\", \"email\", \"password\"];\n\n///////////////////////////\n\n/**\n * @see {@link https://workleap.github.io/wl-telemetry}\n */\nexport interface RegisterLogRocketInstrumentationOptions {\n    /**\n     * A root hostname to track sessions across subdomains. Set this option to capture traffic from all subdomains under one session: https://docs.logrocket.com/reference/roothostname.\n     * @see {@link https://workleap.github.io/wl-telemetry}\n     */\n    rootHostname?: LogRocketSdkOptions[\"rootHostname\"];\n    /**\n     * Names of additional fields to exclude from session replays. These fields will be removed from network requests, responses using a fuzzy-matching algorithm.\n     * @see {@link https://workleap.github.io/wl-telemetry}\n     */\n    privateFieldNames?: string[];\n    /**\n     * Names of additional fields to exclude from session replays. These fields will be removed from query parameters using a fuzzy-matching algorithm.\n     * @see {@link https://workleap.github.io/wl-telemetry}\n     */\n    privateQueryParameterNames?: string[];\n    /**\n     * Context including telemetry correlation ids.\n     * @see {@link https://workleap.github.io/wl-telemetry}\n     */\n    telemetryContext?: TelemetryContext;\n    /**\n     * Hooks to transform the resulting LogRocket SDK options.\n     * @see {@link https://workleap.github.io/wl-telemetry}\n     */\n    transformers?: LogRocketSdkOptionsTransformer[];\n    /**\n     * Indicates whether or not debug information should be logged to the console.\n     * @see {@link https://workleap.github.io/wl-telemetry}\n     */\n    verbose?: boolean;\n    /**\n     * The logger instances that will output messages.\n     * @see {@link https://workleap.github.io/wl-telemetry}\n     */\n    loggers?: RootLogger[];\n}\n\n// The function return type is mandatory, otherwise we got an error TS4058.\nexport function getLogRocketSdkOptions(userOptions: RegisterLogRocketInstrumentationOptions, logger: RootLogger): LogRocketSdkOptions {\n    const { rootHostname = \"workleap.com\", privateFieldNames = [], privateQueryParameterNames = [], verbose = false, transformers = [] } = userOptions;\n\n    const mergedPrivateFieldNames = DefaultPrivateFieldNames.concat(privateFieldNames);\n    const mergedPrivateQueryParameterNames = DefaultPrivateQueryParameterNames.concat(privateQueryParameterNames);\n\n    // The \"LogrocketFuzzySearch.setup\" code is awkward. For now, we prefer to play it safe and call it once here, then forward the sanitize functions\n    // to the appropriate factories.\n    // No clue why the \"setup\" method is not available. This package is shady.\n    // @ts-ignore\n    const { requestSanitizer: fuzzyRequestSanitizer, responseSanitizer: fuzzyResponseSanitizer } = LogrocketFuzzySanitizer.setup(mergedPrivateFieldNames);\n\n    const sdkOptions = {\n        console: {\n            // Prevent console logs from being visible in LogRocket session replays and leaking PII.\n            // To capture logs in a session replay, use the LogRocketLogger class.\n            isEnabled: false\n        },\n        rootHostname,\n        dom: {\n            textSanitizer: true,\n            inputSanitizer: true\n        },\n        network: {\n            requestSanitizer: createRequestSanitizer(fuzzyRequestSanitizer),\n            responseSanitizer: createResponseSanitizer(fuzzyResponseSanitizer)\n        },\n        browser: {\n            urlSanitizer: createUrlSanitizer(mergedPrivateQueryParameterNames)\n        },\n        shouldDebugLog: verbose\n    } satisfies LogRocketSdkOptions;\n\n    return applyTransformers(sdkOptions, transformers, {\n        verbose,\n        logger\n    });\n}\n\n///////////////////////////\n\nlet registrationGuardInstance: HasExecutedGuard | undefined;\n\n// It's important to use a lazy singleton instead of a singleton to avoid\n// any future probleme related to HMR, tree-shaking, SSR, etc..\nfunction getRegistrationGuard() {\n    if (!registrationGuardInstance) {\n        registrationGuardInstance = new HasExecutedGuard();\n    }\n\n    return registrationGuardInstance;\n}\n\n// This function should only be used by tests.\nexport function __resetRegistrationGuard() {\n    if (registrationGuardInstance) {\n        registrationGuardInstance.reset();\n    }\n}\n\n///////////////////////////\n\nexport class LogRocketInstrumentationRegistrator {\n    register(appId: string, options: RegisterLogRocketInstrumentationOptions = {}) {\n        const { telemetryContext, verbose = false, loggers = [] } = options;\n\n        const logger = createCompositeLogger(verbose, loggers);\n        const sdkOptions = getLogRocketSdkOptions(options, logger);\n\n        // Session starts anonymously when LogRocket.init() is called.\n        LogRocket.init(appId, sdkOptions);\n\n        // Identify the user with the correlation ids.\n        if (telemetryContext) {\n            // LogRocket maintains the same session even if the user starts as anonymous and later becomes identified via LogRocket.identify().\n            // If LogRocket.identify is called multiple times during a recording, you can search for any of the identified users in the session.\n            LogRocket.identify(telemetryContext.deviceId, {\n                [DeviceIdTrait]: telemetryContext.deviceId,\n                [TelemetryIdTrait]: telemetryContext.telemetryId\n            });\n        }\n\n        LogRocket.getSessionURL(url => {\n            logger.withText(\"[logrocket] Session replay URL is now available:\").withText(url).debug();\n        });\n\n        logger.information(\"[logrocket] LogRocket instrumentation is registered.\");\n\n        const client = new LogRocketInstrumentationClientImpl(telemetryContext);\n\n        // The cast is to normalize the inferred return type to the \"LogRocketInstrumentationClient\" type.\n        return client as LogRocketInstrumentationClient;\n    }\n}\n\n/**\n * Register the LogRocket instrumentation.\n * @param appId LogRocket application id.\n * @param options LogRocket instrumentation options.\n * @returns {LogRocketInstrumentationClient} A LogRocket instrumentation client instance.\n * @see {@link https://workleap.github.io/wl-telemetry}\n */\nexport function registerLogRocketInstrumentation(appId: string, options?: RegisterLogRocketInstrumentationOptions) {\n    getRegistrationGuard().throw('[logrocket] The LogRocket instrumentation has already been registered. Did you call the \"registerLogRocketInstrumentation\" function twice?');\n\n    return new LogRocketInstrumentationRegistrator().register(appId, options);\n}\n"],"names":["HasExecutedGuard","createCompositeLogger","LogRocket","LogrocketFuzzySanitizer","applyTransformers","createRequestSanitizer","createResponseSanitizer","createUrlSanitizer","DeviceIdTrait","LogRocketInstrumentationClientImpl","TelemetryIdTrait","DefaultPrivateFieldNames","DefaultPrivateQueryParameterNames","getLogRocketSdkOptions","userOptions","logger","rootHostname","privateFieldNames","privateQueryParameterNames","verbose","transformers","mergedPrivateFieldNames","mergedPrivateQueryParameterNames","fuzzyRequestSanitizer","fuzzyResponseSanitizer","sdkOptions","registrationGuardInstance","getRegistrationGuard","__resetRegistrationGuard","LogRocketInstrumentationRegistrator","appId","options","telemetryContext","loggers","url","client","registerLogRocketInstrumentation"],"mappings":";;;;;;;;;;;;;;;;;;;AAAmF;AACR;AACzC;AACqC;AACyB;AAC3B;AACE;AACV;AACkG;AAG/J,MAAMW,2BAA2B;IAAC;IAAS;IAAiB;IAAe;IAAY;IAAa;IAAY;IAAa;IAAY;IAAU;IAAY;CAAW;AAE1K,MAAMC,oCAAoC;IAAC;IAAS;IAAS;CAAW;AA6CxE,2EAA2E;AACpE,SAASC,uBAAuBC,WAAoD,EAAEC,MAAkB;IAC3G,MAAM,EAAEC,eAAe,cAAc,EAAEC,oBAAoB,EAAE,EAAEC,6BAA6B,EAAE,EAAEC,UAAU,KAAK,EAAEC,eAAe,EAAE,EAAE,GAAGN;IAEvI,MAAMO,0BAA0BV,yBAAyB,MAAM,CAACM;IAChE,MAAMK,mCAAmCV,kCAAkC,MAAM,CAACM;IAElF,kJAAkJ;IAClJ,gCAAgC;IAChC,0EAA0E;IAC1E,aAAa;IACb,MAAM,EAAE,kBAAkBK,qBAAqB,EAAE,mBAAmBC,sBAAsB,EAAE,GAAGrB,sCAA6B,CAACkB;IAE7H,MAAMI,aAAa;QACf,SAAS;YACL,wFAAwF;YACxF,sEAAsE;YACtE,WAAW;QACf;QACAT;QACA,KAAK;YACD,eAAe;YACf,gBAAgB;QACpB;QACA,SAAS;YACL,kBAAkBX,sBAAsBA,CAACkB;YACzC,mBAAmBjB,uBAAuBA,CAACkB;QAC/C;QACA,SAAS;YACL,cAAcjB,kBAAkBA,CAACe;QACrC;QACA,gBAAgBH;IACpB;IAEA,OAAOf,iBAAiBA,CAACqB,YAAYL,cAAc;QAC/CD;QACAJ;IACJ;AACJ;AAEA,2BAA2B;AAE3B,IAAIW;AAEJ,yEAAyE;AACzE,+DAA+D;AAC/D,SAASC;IACL,IAAI,CAACD,2BAA2B;QAC5BA,4BAA4B,IAAI1B,gBAAgBA;IACpD;IAEA,OAAO0B;AACX;AAEA,8CAA8C;AACvC,SAASE;IACZ,IAAIF,2BAA2B;QAC3BA,0BAA0B,KAAK;IACnC;AACJ;AAEA,2BAA2B;AAEpB,MAAMG;IACT,SAASC,KAAa,EAAEC,UAAmD,CAAC,CAAC,EAAE;QAC3E,MAAM,EAAEC,gBAAgB,EAAEb,UAAU,KAAK,EAAEc,UAAU,EAAE,EAAE,GAAGF;QAE5D,MAAMhB,SAASd,qBAAqBA,CAACkB,SAASc;QAC9C,MAAMR,aAAaZ,uBAAuBkB,SAAShB;QAEnD,8DAA8D;QAC9Db,cAAc,CAAC4B,OAAOL;QAEtB,8CAA8C;QAC9C,IAAIO,kBAAkB;YAClB,mIAAmI;YACnI,oIAAoI;YACpI9B,kBAAkB,CAAC8B,iBAAiB,QAAQ,EAAE;gBAC1C,CAACxB,aAAaA,CAAC,EAAEwB,iBAAiB,QAAQ;gBAC1C,CAACtB,gBAAgBA,CAAC,EAAEsB,iBAAiB,WAAW;YACpD;QACJ;QAEA9B,uBAAuB,CAACgC,CAAAA;YACpBnB,OAAO,QAAQ,CAAC,oDAAoD,QAAQ,CAACmB,KAAK,KAAK;QAC3F;QAEAnB,OAAO,WAAW,CAAC;QAEnB,MAAMoB,SAAS,IAAI1B,kCAAkCA,CAACuB;QAEtD,kGAAkG;QAClG,OAAOG;IACX;AACJ;AAEA;;;;;;CAMC,GACM,SAASC,iCAAiCN,KAAa,EAAEC,OAAiD;IAC7GJ,uBAAuB,KAAK,CAAC;IAE7B,OAAO,IAAIE,sCAAsC,QAAQ,CAACC,OAAOC;AACrE"}
+{"version":3,"file":"js/registerLogRocketInstrumentation.js","sources":["../../src/js/registerLogRocketInstrumentation.ts"],"sourcesContent":["import { DefaultPrivateQueryParameterNames, HasExecutedGuard, type TelemetryContext } from \"@workleap-telemetry/core\";\nimport { createCompositeLogger, type RootLogger } from \"@workleap/logging\";\nimport LogRocket from \"logrocket\";\nimport LogrocketFuzzySanitizer from \"logrocket-fuzzy-search-sanitizer\";\nimport { applyTransformers, type LogRocketSdkOptionsTransformer } from \"./applyTransformers.ts\";\nimport { createRequestSanitizer } from \"./createRequestSanitizer.ts\";\nimport { createResponseSanitizer } from \"./createResponseSanitizer.ts\";\nimport { createUrlSanitizer } from \"./createUrlSanitizer.ts\";\nimport { DeviceIdTrait, type LogRocketInstrumentationClient, LogRocketInstrumentationClientImpl, TelemetryIdTrait } from \"./LogRocketInstrumentationClient.ts\";\nimport type { LogRocketSdkOptions } from \"./logRocketTypes.ts\";\n\nconst DefaultPrivateFieldNames = [\"email\", \"personalEmail\", \"phoneNumber\", \"password\", \"firstName\", \"lastName\", \"givenName\", \"fullName\", \"gender\", \"timeZone\", \"birthday\"];\n\n///////////////////////////\n\n/**\n * @see {@link https://workleap.github.io/wl-telemetry}\n */\nexport interface RegisterLogRocketInstrumentationOptions {\n    /**\n     * A root hostname to track sessions across subdomains. Set this option to capture traffic from all subdomains under one session: https://docs.logrocket.com/reference/roothostname.\n     * @see {@link https://workleap.github.io/wl-telemetry}\n     */\n    rootHostname?: LogRocketSdkOptions[\"rootHostname\"];\n    /**\n     * Names of additional fields to exclude from session replays. These fields will be removed from network requests, responses using a fuzzy-matching algorithm.\n     * @see {@link https://workleap.github.io/wl-telemetry}\n     */\n    privateFieldNames?: string[];\n    /**\n     * Names of additional fields to exclude from session replays. These fields will be removed from query parameters using a fuzzy-matching algorithm.\n     * @see {@link https://workleap.github.io/wl-telemetry}\n     */\n    privateQueryParameterNames?: string[];\n    /**\n     * Context including telemetry correlation ids.\n     * @see {@link https://workleap.github.io/wl-telemetry}\n     */\n    telemetryContext?: TelemetryContext;\n    /**\n     * Hooks to transform the resulting LogRocket SDK options.\n     * @see {@link https://workleap.github.io/wl-telemetry}\n     */\n    transformers?: LogRocketSdkOptionsTransformer[];\n    /**\n     * Indicates whether or not debug information should be logged to the console.\n     * @see {@link https://workleap.github.io/wl-telemetry}\n     */\n    verbose?: boolean;\n    /**\n     * The logger instances that will output messages.\n     * @see {@link https://workleap.github.io/wl-telemetry}\n     */\n    loggers?: RootLogger[];\n}\n\n// The function return type is mandatory, otherwise we got an error TS4058.\nexport function getLogRocketSdkOptions(userOptions: RegisterLogRocketInstrumentationOptions, logger: RootLogger): LogRocketSdkOptions {\n    const { rootHostname = \"workleap.com\", privateFieldNames = [], privateQueryParameterNames = [], verbose = false, transformers = [] } = userOptions;\n\n    const mergedPrivateFieldNames = DefaultPrivateFieldNames.concat(privateFieldNames);\n    const mergedPrivateQueryParameterNames = DefaultPrivateQueryParameterNames.concat(privateQueryParameterNames);\n\n    // The \"LogrocketFuzzySearch.setup\" code is awkward. For now, we prefer to play it safe and call it once here, then forward the sanitize functions\n    // to the appropriate factories.\n    // No clue why the \"setup\" method is not available. This package is shady.\n    // @ts-ignore\n    const { requestSanitizer: fuzzyRequestSanitizer, responseSanitizer: fuzzyResponseSanitizer } = LogrocketFuzzySanitizer.setup(mergedPrivateFieldNames);\n\n    const urlSanitizer = createUrlSanitizer(mergedPrivateQueryParameterNames);\n\n    const sdkOptions = {\n        console: {\n            // Prevent console logs from being visible in LogRocket session replays and leaking PII.\n            // To capture logs in a session replay, use the LogRocketLogger class.\n            isEnabled: false\n        },\n        rootHostname,\n        dom: {\n            textSanitizer: true,\n            inputSanitizer: true\n        },\n        network: {\n            requestSanitizer: createRequestSanitizer(fuzzyRequestSanitizer, urlSanitizer),\n            responseSanitizer: createResponseSanitizer(fuzzyResponseSanitizer, urlSanitizer)\n        },\n        browser: {\n            urlSanitizer\n        },\n        shouldDebugLog: verbose\n    } satisfies LogRocketSdkOptions;\n\n    return applyTransformers(sdkOptions, transformers, {\n        verbose,\n        logger\n    });\n}\n\n///////////////////////////\n\nlet registrationGuardInstance: HasExecutedGuard | undefined;\n\n// It's important to use a lazy singleton instead of a singleton to avoid\n// any future probleme related to HMR, tree-shaking, SSR, etc..\nfunction getRegistrationGuard() {\n    if (!registrationGuardInstance) {\n        registrationGuardInstance = new HasExecutedGuard();\n    }\n\n    return registrationGuardInstance;\n}\n\n// This function should only be used by tests.\nexport function __resetRegistrationGuard() {\n    if (registrationGuardInstance) {\n        registrationGuardInstance.reset();\n    }\n}\n\n///////////////////////////\n\nexport class LogRocketInstrumentationRegistrator {\n    register(appId: string, options: RegisterLogRocketInstrumentationOptions = {}) {\n        const { telemetryContext, verbose = false, loggers = [] } = options;\n\n        const logger = createCompositeLogger(verbose, loggers);\n        const sdkOptions = getLogRocketSdkOptions(options, logger);\n\n        // Session starts anonymously when LogRocket.init() is called.\n        LogRocket.init(appId, sdkOptions);\n\n        // Identify the user with the correlation ids.\n        if (telemetryContext) {\n            // LogRocket maintains the same session even if the user starts as anonymous and later becomes identified via LogRocket.identify().\n            // If LogRocket.identify is called multiple times during a recording, you can search for any of the identified users in the session.\n            LogRocket.identify(telemetryContext.deviceId, {\n                [DeviceIdTrait]: telemetryContext.deviceId,\n                [TelemetryIdTrait]: telemetryContext.telemetryId\n            });\n        }\n\n        LogRocket.getSessionURL(url => {\n            logger.withText(\"[logrocket] Session replay URL is now available:\").withText(url).debug();\n        });\n\n        logger.information(\"[logrocket] LogRocket instrumentation is registered.\");\n\n        const client = new LogRocketInstrumentationClientImpl(telemetryContext);\n\n        // The cast is to normalize the inferred return type to the \"LogRocketInstrumentationClient\" type.\n        return client as LogRocketInstrumentationClient;\n    }\n}\n\n/**\n * Register the LogRocket instrumentation.\n * @param appId LogRocket application id.\n * @param options LogRocket instrumentation options.\n * @returns {LogRocketInstrumentationClient} A LogRocket instrumentation client instance.\n * @see {@link https://workleap.github.io/wl-telemetry}\n */\nexport function registerLogRocketInstrumentation(appId: string, options?: RegisterLogRocketInstrumentationOptions) {\n    getRegistrationGuard().throw('[logrocket] The LogRocket instrumentation has already been registered. Did you call the \"registerLogRocketInstrumentation\" function twice?');\n\n    return new LogRocketInstrumentationRegistrator().register(appId, options);\n}\n"],"names":["DefaultPrivateQueryParameterNames","HasExecutedGuard","createCompositeLogger","LogRocket","LogrocketFuzzySanitizer","applyTransformers","createRequestSanitizer","createResponseSanitizer","createUrlSanitizer","DeviceIdTrait","LogRocketInstrumentationClientImpl","TelemetryIdTrait","DefaultPrivateFieldNames","getLogRocketSdkOptions","userOptions","logger","rootHostname","privateFieldNames","privateQueryParameterNames","verbose","transformers","mergedPrivateFieldNames","mergedPrivateQueryParameterNames","fuzzyRequestSanitizer","fuzzyResponseSanitizer","urlSanitizer","sdkOptions","registrationGuardInstance","getRegistrationGuard","__resetRegistrationGuard","LogRocketInstrumentationRegistrator","appId","options","telemetryContext","loggers","url","client","registerLogRocketInstrumentation"],"mappings":";;;;;;;;;;;;;;;;;;;AAAsH;AAC3C;AACzC;AACqC;AACyB;AAC3B;AACE;AACV;AACkG;AAG/J,MAAMY,2BAA2B;IAAC;IAAS;IAAiB;IAAe;IAAY;IAAa;IAAY;IAAa;IAAY;IAAU;IAAY;CAAW;AA6C1K,2EAA2E;AACpE,SAASC,uBAAuBC,WAAoD,EAAEC,MAAkB;IAC3G,MAAM,EAAEC,eAAe,cAAc,EAAEC,oBAAoB,EAAE,EAAEC,6BAA6B,EAAE,EAAEC,UAAU,KAAK,EAAEC,eAAe,EAAE,EAAE,GAAGN;IAEvI,MAAMO,0BAA0BT,yBAAyB,MAAM,CAACK;IAChE,MAAMK,mCAAmCtB,wCAAwC,CAACkB;IAElF,kJAAkJ;IAClJ,gCAAgC;IAChC,0EAA0E;IAC1E,aAAa;IACb,MAAM,EAAE,kBAAkBK,qBAAqB,EAAE,mBAAmBC,sBAAsB,EAAE,GAAGpB,sCAA6B,CAACiB;IAE7H,MAAMI,eAAejB,kBAAkBA,CAACc;IAExC,MAAMI,aAAa;QACf,SAAS;YACL,wFAAwF;YACxF,sEAAsE;YACtE,WAAW;QACf;QACAV;QACA,KAAK;YACD,eAAe;YACf,gBAAgB;QACpB;QACA,SAAS;YACL,kBAAkBV,sBAAsBA,CAACiB,uBAAuBE;YAChE,mBAAmBlB,uBAAuBA,CAACiB,wBAAwBC;QACvE;QACA,SAAS;YACLA;QACJ;QACA,gBAAgBN;IACpB;IAEA,OAAOd,iBAAiBA,CAACqB,YAAYN,cAAc;QAC/CD;QACAJ;IACJ;AACJ;AAEA,2BAA2B;AAE3B,IAAIY;AAEJ,yEAAyE;AACzE,+DAA+D;AAC/D,SAASC;IACL,IAAI,CAACD,2BAA2B;QAC5BA,4BAA4B,IAAI1B,gBAAgBA;IACpD;IAEA,OAAO0B;AACX;AAEA,8CAA8C;AACvC,SAASE;IACZ,IAAIF,2BAA2B;QAC3BA,0BAA0B,KAAK;IACnC;AACJ;AAEA,2BAA2B;AAEpB,MAAMG;IACT,SAASC,KAAa,EAAEC,UAAmD,CAAC,CAAC,EAAE;QAC3E,MAAM,EAAEC,gBAAgB,EAAEd,UAAU,KAAK,EAAEe,UAAU,EAAE,EAAE,GAAGF;QAE5D,MAAMjB,SAASb,qBAAqBA,CAACiB,SAASe;QAC9C,MAAMR,aAAab,uBAAuBmB,SAASjB;QAEnD,8DAA8D;QAC9DZ,cAAc,CAAC4B,OAAOL;QAEtB,8CAA8C;QAC9C,IAAIO,kBAAkB;YAClB,mIAAmI;YACnI,oIAAoI;YACpI9B,kBAAkB,CAAC8B,iBAAiB,QAAQ,EAAE;gBAC1C,CAACxB,aAAaA,CAAC,EAAEwB,iBAAiB,QAAQ;gBAC1C,CAACtB,gBAAgBA,CAAC,EAAEsB,iBAAiB,WAAW;YACpD;QACJ;QAEA9B,uBAAuB,CAACgC,CAAAA;YACpBpB,OAAO,QAAQ,CAAC,oDAAoD,QAAQ,CAACoB,KAAK,KAAK;QAC3F;QAEApB,OAAO,WAAW,CAAC;QAEnB,MAAMqB,SAAS,IAAI1B,kCAAkCA,CAACuB;QAEtD,kGAAkG;QAClG,OAAOG;IACX;AACJ;AAEA;;;;;;CAMC,GACM,SAASC,iCAAiCN,KAAa,EAAEC,OAAiD;IAC7GJ,uBAAuB,KAAK,CAAC;IAE7B,OAAO,IAAIE,sCAAsC,QAAQ,CAACC,OAAOC;AACrE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workleap/logrocket",
-  "version": "4.0.6",
+  "version": "4.1.0",
   "description": "A package containing utilities for LogRocket.",
   "license": "Apache-2.0",
   "author": "Workleap",
@@ -33,7 +33,7 @@
     "provenance": true
   },
   "dependencies": {
-    "@workleap-telemetry/core": "^2.0.7",
+    "@workleap-telemetry/core": "^2.1.0",
     "@workleap/logging": "^2.1.0",
     "logrocket-fuzzy-search-sanitizer": "0.0.2"
   },

package/src/js/createRequestSanitizer.ts

@@ -1,11 +1,13 @@
+import type { UrlSanitizerFunction } from "./createUrlSanitizer.ts";
 import type { LogRocketRequest } from "./logRocketTypes.ts";
 import { sanitizeHeaders } from "./sanitizeHeaders.ts";
 
 // oxlint-disable-next-line typescript/no-explicit-any
 export type RequestSanitizerFunction = (req: LogRocketRequest) => any;
 
-export function createRequestSanitizer(fuzzyRequestSanitizer: RequestSanitizerFunction) {
+export function createRequestSanitizer(fuzzyRequestSanitizer: RequestSanitizerFunction, urlSanitizer: UrlSanitizerFunction) {
     return (req: LogRocketRequest) => {
+        req.url = urlSanitizer(req.url);
         req.headers = sanitizeHeaders(req.headers);
 
         if (req.body) {

package/src/js/createResponseSanitizer.ts

@@ -1,11 +1,16 @@
+import type { UrlSanitizerFunction } from "./createUrlSanitizer.ts";
 import type { LogRocketResponse } from "./logRocketTypes.ts";
 import { sanitizeHeaders } from "./sanitizeHeaders.ts";
 
 // oxlint-disable-next-line typescript/no-explicit-any
 export type ResponseSanitizerFunction = (res: LogRocketResponse) => any;
 
-export function createResponseSanitizer(fuzzyResponseSanitizer: ResponseSanitizerFunction) {
+export function createResponseSanitizer(fuzzyResponseSanitizer: ResponseSanitizerFunction, urlSanitizer: UrlSanitizerFunction) {
     return (res: LogRocketResponse) => {
+        if (res.url) {
+            res.url = urlSanitizer(res.url);
+        }
+
         res.headers = sanitizeHeaders(res.headers);
 
         if (res.body) {

package/src/js/createUrlSanitizer.ts

@@ -1,11 +1,10 @@
-export function createUrlSanitizer(queryParametersToRemove: string[]) {
-    return (url: string) => {
-        let sanitizedUrl = url;
+import { redactQueryParameters } from "@workleap-telemetry/core";
 
-        for (const x of queryParametersToRemove) {
-            sanitizedUrl = sanitizedUrl.replace(new RegExp(`${x}=([^&]*)`, "i"), `${x}=**redacted**`);
-        }
+export type UrlSanitizerFunction = (url: string) => string;
 
-        return sanitizedUrl;
+export function createUrlSanitizer(queryParametersToRemove: string[]) {
+    return (url: string | URL) => {
+        // A network request made with XMLHttpRequest can provide a URL object rather than a string.
+        return redactQueryParameters(String(url), queryParametersToRemove);
     };
 }

package/src/js/registerLogRocketInstrumentation.ts

@@ -1,4 +1,4 @@
-import { HasExecutedGuard, type TelemetryContext } from "@workleap-telemetry/core";
+import { DefaultPrivateQueryParameterNames, HasExecutedGuard, type TelemetryContext } from "@workleap-telemetry/core";
 import { createCompositeLogger, type RootLogger } from "@workleap/logging";
 import LogRocket from "logrocket";
 import LogrocketFuzzySanitizer from "logrocket-fuzzy-search-sanitizer";
@@ -11,8 +11,6 @@ import type { LogRocketSdkOptions } from "./logRocketTypes.ts";
 
 const DefaultPrivateFieldNames = ["email", "personalEmail", "phoneNumber", "password", "firstName", "lastName", "givenName", "fullName", "gender", "timeZone", "birthday"];
 
-const DefaultPrivateQueryParameterNames = ["token", "email", "password"];
-
 ///////////////////////////
 
 /**
@@ -69,6 +67,8 @@ export function getLogRocketSdkOptions(userOptions: RegisterLogRocketInstrumenta
     // @ts-ignore
     const { requestSanitizer: fuzzyRequestSanitizer, responseSanitizer: fuzzyResponseSanitizer } = LogrocketFuzzySanitizer.setup(mergedPrivateFieldNames);
 
+    const urlSanitizer = createUrlSanitizer(mergedPrivateQueryParameterNames);
+
     const sdkOptions = {
         console: {
             // Prevent console logs from being visible in LogRocket session replays and leaking PII.
@@ -81,11 +81,11 @@ export function getLogRocketSdkOptions(userOptions: RegisterLogRocketInstrumenta
             inputSanitizer: true
         },
         network: {
-            requestSanitizer: createRequestSanitizer(fuzzyRequestSanitizer),
-            responseSanitizer: createResponseSanitizer(fuzzyResponseSanitizer)
+            requestSanitizer: createRequestSanitizer(fuzzyRequestSanitizer, urlSanitizer),
+            responseSanitizer: createResponseSanitizer(fuzzyResponseSanitizer, urlSanitizer)
         },
         browser: {
-            urlSanitizer: createUrlSanitizer(mergedPrivateQueryParameterNames)
+            urlSanitizer
         },
         shouldDebugLog: verbose
     } satisfies LogRocketSdkOptions;