@yuanze_dev/tracker 0.3.1 → 0.4.0

package/dist/autocapture.js

@@ -1,3 +1,4 @@
+import { redactUrl } from "./redact.js";
 const DEFAULT_ALLOW = 'a,button,[role="button"],[role="link"],[role="tab"],input[type="submit"],input[type="button"],summary';
 const DEFAULT_DENY = '[data-no-track],input[type="password"],[type="password"],.yz-no-track';
 const SENSITIVE_TEXT = /(\d[\d\s-]{9,}\d)|([\w.+-]+@[\w-]+\.[\w.]+)|(\d{15,19})/g;
@@ -38,9 +39,9 @@ export function setupAutocapture(tracker, options = {}) {
         return;
     const { captureClicks = true, allow = DEFAULT_ALLOW, deny = DEFAULT_DENY, sampleRate = 1, maxTextLength = 64, } = options;
     const sendPageview = () => tracker.track("$pageview", {
-        url: location.pathname + location.search,
+        url: redactUrl(location.pathname + location.search),
         title: document.title,
-        referrer: document.referrer,
+        referrer: redactUrl(document.referrer),
     });
     sendPageview();
     const patch = (key) => {
@@ -90,7 +91,7 @@ export function setupAutocapture(tracker, options = {}) {
             props.text = text;
         const href = el.getAttribute("href");
         if (href && !href.startsWith("javascript:"))
-            props.href = href;
+            props.href = redactUrl(href);
         tracker.trackUnsafe("$autocapture", props);
     }, true);
 }

package/dist/index.d.ts

@@ -6,6 +6,7 @@ export type { TrackerOptions, Sender } from "./tracker.js";
 export { setupAutocapture, sanitizeText, elementSelector } from "./autocapture.js";
 export type { AutocaptureOptions } from "./autocapture.js";
 export { collectEnvContext } from "./context.js";
+export { redactUrl, CREDENTIAL_PARAMS } from "./redact.js";
 export type { EnvContext } from "./context.js";
 export { SYSTEM_EVENTS, isSystemEvent } from "./events.js";
 export type { EventName, EventProps, SystemEvents, ProjectEvents } from "./events.js";

package/dist/index.js

@@ -4,6 +4,7 @@ import { collectEnvContext } from "./context.js";
 export { Tracker, defaultFetchSender } from "./tracker.js";
 export { setupAutocapture, sanitizeText, elementSelector } from "./autocapture.js";
 export { collectEnvContext } from "./context.js";
+export { redactUrl, CREDENTIAL_PARAMS } from "./redact.js";
 export { SYSTEM_EVENTS, isSystemEvent } from "./events.js";
 let instance = null;
 export function init(opts) {

package/dist/redact.d.ts

@@ -0,0 +1,2 @@
+export declare const CREDENTIAL_PARAMS: readonly ["token", "access_token", "id_token", "refresh_token", "code"];
+export declare function redactUrl(input: string, params?: readonly string[]): string;

package/dist/redact.js

@@ -0,0 +1,51 @@
+export const CREDENTIAL_PARAMS = [
+    "token",
+    "access_token",
+    "id_token",
+    "refresh_token",
+    "code",
+];
+const isCredential = (key, params) => params.includes(key.toLowerCase());
+function redactQuery(query, params) {
+    if (!query)
+        return query;
+    let touched = false;
+    const kept = [];
+    for (const pair of query.split("&")) {
+        if (!pair)
+            continue;
+        const key = pair.split("=")[0];
+        let name = key;
+        try {
+            name = decodeURIComponent(key);
+        }
+        catch {
+        }
+        if (isCredential(name, params)) {
+            touched = true;
+            continue;
+        }
+        kept.push(pair);
+    }
+    return touched ? kept.join("&") : query;
+}
+export function redactUrl(input, params = CREDENTIAL_PARAMS) {
+    if (!input)
+        return input;
+    const cut = (s, sep) => {
+        const i = s.indexOf(sep);
+        return i === -1 ? [s, ""] : [s.slice(0, i), s.slice(i + 1)];
+    };
+    const [beforeHash, hash] = cut(input, "#");
+    const [base, query] = cut(beforeHash, "?");
+    if (/^[a-z][a-z0-9+.-]*:/i.test(base) && !/^https?:/i.test(base))
+        return input;
+    const nextQuery = redactQuery(query, params);
+    const nextHash = hash.includes("=") ? redactQuery(hash, params) : hash;
+    let out = base;
+    if (query)
+        out += nextQuery ? `?${nextQuery}` : "";
+    if (hash)
+        out += nextHash ? `#${nextHash}` : "";
+    return out;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yuanze_dev/tracker",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "原则数据埋点 SDK",
   "license": "UNLICENSED",
   "type": "module",