posthog-js 1.391.6 → 1.391.7

package/lib/package.json

@@ -1,6 +1,6 @@
 {
     "name": "posthog-js",
-    "version": "1.391.6",
+    "version": "1.391.7",
     "bugs": {
         "url": "https://github.com/PostHog/posthog-js/issues"
     },

package/lib/src/extensions/replay/external/config.js

@@ -137,16 +137,41 @@ var PAYLOAD_CONTENT_DENY_LIST = [
     'private_key',
     'token',
 ];
-// we always remove headers on the deny list because we never want to capture this sensitive data
-var removeAuthorizationHeader = function (data) {
-    var headers = data.requestHeaders;
+// substrings that mark a header as credential-bearing - catches custom names
+// (e.g. x-gist-encoded-user-token) that aren't in the exact deny list above
+var HEADER_DENY_SUBSTRINGS = [
+    'auth',
+    'token',
+    'secret',
+    'session',
+    'api-key',
+    'apikey',
+    'api_key',
+    'credential',
+    'password',
+    'passwd',
+    'cookie',
+    'csrf',
+    'xsrf',
+];
+var isDeniedHeader = function (header) {
+    var lower = header.toLowerCase();
+    return HEADER_DENY_LIST.includes(lower) || HEADER_DENY_SUBSTRINGS.some(function (s) { return lower.includes(s); });
+};
+var redactDeniedHeaders = function (headers) {
     if (!(0, core_1.isNullish)(headers)) {
-        (0, utils_1.each)(Object.keys(headers !== null && headers !== void 0 ? headers : {}), function (header) {
-            if (HEADER_DENY_LIST.includes(header.toLowerCase())) {
+        (0, utils_1.each)(Object.keys(headers), function (header) {
+            if (isDeniedHeader(header)) {
                 headers[header] = REDACTED;
             }
         });
     }
+};
+// we always remove headers on the deny list because we never want to capture this sensitive data.
+// applies to both request and response headers (e.g. set-cookie is a response header)
+var removeAuthorizationHeader = function (data) {
+    redactDeniedHeaders(data.requestHeaders);
+    redactDeniedHeaders(data.responseHeaders);
     return data;
 };
 var POSTHOG_PATHS_TO_IGNORE = ['/s/', '/e/', '/i/'];

package/lib/src/extensions/replay/external/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../../src/extensions/replay/external/config.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,sCAA4E;AAC5E,8DAA2D;AAC3D,gDAA8C;AAC9C,gEAA+D;AAC/D,wCAAqC;AAErC,IAAM,aAAa,GAAG,oBAAoB,CAAA;AAE1C,IAAM,QAAQ,GAAG,UAAU,CAAA;AAEd,QAAA,qBAAqB,GAAmC;IACjE,cAAc,EAAE;QACZ,OAAO;QACP,QAAQ;QACR,MAAM;QACN,KAAK;QACL,YAAY;QACZ,OAAO;QACP,OAAO;QACP,OAAO;QACP,QAAQ;QACR,MAAM;QACN,OAAO;QACP,KAAK;QACL,OAAO;QACP,MAAM;QACN,YAAY;QACZ,QAAQ;QACR,MAAM;QACN,QAAQ;QACR,OAAO;QACP,OAAO;QACP,gBAAgB;KACnB;IACD,aAAa,EAAE,UAAC,IAA4B,IAAK,OAAA,IAAI,EAAJ,CAAI;IACrD,aAAa,EAAE,KAAK;IACpB,UAAU,EAAE,KAAK;IACjB,qBAAqB,EAAE,KAAK;IAC5B,iBAAiB,EAAE,KAAK;IACxB,6BAA6B,EAAE;QAC3B,gEAAgE;QAChE,aAAa;QACb,oFAAoF;QACpF,6FAA6F;QAC7F,YAAY;QACZ,OAAO;QACP,UAAU;KACb;IACD,qBAAqB,EAAE,OAAO;IAC9B,mBAAmB,EAAE;QACjB,eAAe;QACf,mBAAmB;QACnB,aAAa;QACb,yBAAyB;QACzB,sFAAsF;QACtF,8EAA8E;QAC9E,sBAAsB;QACtB,sBAAsB;QACtB,2CAA2C;QAC3C,aAAa;QACb,6BAA6B;QAC7B,eAAe;QACf,cAAc;QACd,cAAc;QACd,2FAA2F;QAC3F,YAAY;QACZ,iBAAiB;QACjB,eAAe;QACf,cAAc;QACd,oDAAoD;QACpD,YAAY;QACZ,WAAW;QACX,eAAe;KAClB;CACJ,CAAA;AAED,IAAM,gBAAgB,GAAG;IACrB,eAAe;IACf,iBAAiB;IACjB,eAAe;IACf,QAAQ;IACR,YAAY;IACZ,WAAW;IACX,WAAW;IACX,aAAa;IACb,WAAW;IACX,qBAAqB;IACrB,cAAc;IACd,aAAa;IACb,cAAc;CACjB,CAAA;AAED,IAAM,yBAAyB,GAAG;IAC9B,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,MAAM;IACN,aAAa;IACb,WAAW;IACX,YAAY;IACZ,aAAa;IACb,OAAO;CACV,CAAA;AAED,iGAAiG;AACjG,IAAM,yBAAyB,GAAG,UAAC,IAA4B;IAC3D,IAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAA;IACnC,IAAI,CAAC,IAAA,gBAAS,EAAC,OAAO,CAAC,EAAE,CAAC;QACtB,IAAA,YAAI,EAAC,MAAM,CAAC,IAAI,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC,EAAE,UAAC,MAAM;YACpC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAClD,OAAO,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAA;YAC9B,CAAC;QACL,CAAC,CAAC,CAAA;IACN,CAAC;IACD,OAAO,IAAI,CAAA;AACf,CAAC,CAAA;AAED,IAAM,uBAAuB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;AACrD,wFAAwF;AACxF,iGAAiG;AACjG,IAAM,kBAAkB,GAAG,UACvB,IAA4B,EAC5B,aAAwC;;IAExC,IAAM,GAAG,GAAG,IAAA,4BAAY,EAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEnC,yGAAyG;IACzG,IAAI,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAA,IAAA,4BAAY,EAAC,aAAa,CAAC,0CAAE,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAA;IAC9G,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;QACvB,YAAY,GAAG,EAAE,CAAA;IACrB,CAAC;IACD,IAAM,QAAQ,GAAG,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,QAAQ,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;IAE9D,IAAI,GAAG,IAAI,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,UAAC,IAAI,IAAK,OAAA,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAA5B,CAA4B,CAAC,EAAE,CAAC;QAC1F,OAAO,SAAS,CAAA;IACpB,CAAC;IACD,OAAO,IAAI,CAAA;AACf,CAAC,CAAA;AAED,SAAS,aAAa,CAAC,OAAe;IAClC,OAAO,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;AACnC,CAAC;AAED,SAAS,uBAAuB,CAC5B,OAAkC,EAClC,OAAwC,EACxC,KAAa,EACb,WAAmB;IAEnB,IAAI,IAAA,gBAAS,EAAC,OAAO,CAAC,EAAE,CAAC;QACrB,OAAO,OAAO,CAAA;IAClB,CAAC;IAED,IAAI,oBAAoB,GAAoB,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAG,gBAAgB,CAAC,KAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IACjG,IAAI,IAAA,eAAQ,EAAC,oBAAoB,CAAC,EAAE,CAAC;QACjC,oBAAoB,GAAG,QAAQ,CAAC,oBAAoB,CAAC,CAAA;IACzD,CAAC;IAED,IAAI,oBAAoB,GAAG,KAAK,EAAE,CAAC;QAC/B,OAAO,aAAa,GAAG,WAAI,WAAW,wCAA8B,oBAAoB,YAAS,CAAA;IACrG,CAAC;IAED,OAAO,OAAO,CAAA;AAClB,CAAC;AAED,6FAA6F;AAC7F,IAAM,gBAAgB,GAAG,UACrB,OAA6B;;IAE7B,6DAA6D;IAC7D,IAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAA,OAAO,CAAC,qBAAqB,mCAAI,OAAO,CAAC,CAAA;IAEzE,OAAO,UAAC,IAAI;QACR,IAAI,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,WAAW,EAAE,CAAC;YACpB,IAAI,CAAC,WAAW,GAAG,uBAAuB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;QACvG,CAAC;QAED,IAAI,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,YAAY,EAAE,CAAC;YACrB,IAAI,CAAC,YAAY,GAAG,uBAAuB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;QAC3G,CAAC;QAED,OAAO,IAAI,CAAA;IACf,CAAC,CAAA;AACL,CAAC,CAAA;AAED,SAAS,YAAY,CAAC,OAAkC,EAAE,KAA6B;IACnF,IAAI,IAAA,gBAAS,EAAC,OAAO,CAAC,EAAE,CAAC;QACrB,OAAO,OAAO,CAAA;IAClB,CAAC;IACD,IAAI,QAAQ,GAAG,OAAO,CAAA;IAEtB,IAAI,CAAC,IAAA,sCAAkB,EAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;QACvC,QAAQ,GAAG,aAAa,GAAG,GAAG,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,CAAA;IAChE,CAAC;IACD,IAAA,YAAI,EAAC,yBAAyB,EAAE,UAAC,IAAI;QACjC,IAAI,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,KAAI,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,OAAO,CAAC,IAAI,CAAC,MAAK,CAAC,CAAC,EAAE,CAAC;YACrD,QAAQ,GAAG,aAAa,GAAG,GAAG,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,qBAAqB,GAAG,IAAI,CAAA;QAC/F,CAAC;IACL,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,eAAmD;IACtE,IAAI,IAAA,kBAAW,EAAC,eAAe,CAAC,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAA;IACpB,CAAC;IAED,eAAe,CAAC,WAAW,GAAG,YAAY,CAAC,eAAe,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;IAClF,eAAe,CAAC,YAAY,GAAG,YAAY,CAAC,eAAe,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;IAErF,OAAO,eAAe,CAAA;AAC1B,CAAC;AAED;;;;;GAKG;AACI,IAAM,0BAA0B,GAAG,UACtC,cAA6B,EAC7B,oBAGC;IAED,IAAM,MAAM,GAAyB;QACjC,qBAAqB,EAAE,6BAAqB,CAAC,qBAAqB;QAClE,6BAA6B,2BAAM,6BAAqB,CAAC,6BAA6B,SAAC;QACvF,mBAAmB,yCACZ,CAAC,oBAAoB,CAAC,mBAAmB,IAAI,EAAE,CAAC,kBAChD,6BAAqB,CAAC,mBAAmB,SAC/C;KACJ,CAAA;IACD,mDAAmD;IACnD,IAAM,gBAAgB,GAClB,cAAc,CAAC,iBAAiB,CAAC,aAAa,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAA;IACzG,IAAM,aAAa,GACf,cAAc,CAAC,iBAAiB,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAA;IACnG,IAAM,oBAAoB,GACtB,cAAc,CAAC,mBAAmB,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,iBAAiB,CAAA;IAEjG,IAAM,cAAc,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAA;IAE/C,IAAM,kBAAkB,GAA0C,UAAC,CAAyB;QACxF,OAAA,cAAc,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAAzF,CAAyF,CAAA;IAE7F,IAAM,yBAAyB,GAAG,IAAA,iBAAU,EAAC,cAAc,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,CAAA;IAEnG,IAAI,yBAAyB,IAAI,IAAA,iBAAU,EAAC,cAAc,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,EAAE,CAAC;QACzG,eAAM,CAAC,IAAI,CACP,qHAAqH,CACxH,CAAA;IACL,CAAC;IAED,IAAI,yBAAyB,EAAE,CAAC;QAC5B,cAAc,CAAC,iBAAiB,CAAC,4BAA4B,GAAG,UAAC,IAA4B;YACzF,IAAM,UAAU,GAAG,cAAc,CAAC,iBAAiB,CAAC,oBAAqB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;YAC7F,OAAO,sBACA,IAAI,KACP,IAAI,EAAE,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,GAAG,GACE,CAAA;QAC/B,CAAC,CAAA;IACL,CAAC;IAED,MAAM,CAAC,aAAa,GAAG,IAAA,iBAAU,EAAC,cAAc,CAAC,iBAAiB,CAAC,4BAA4B,CAAC;QAC5F,CAAC,CAAC,UAAC,IAAI;;YACD,IAAM,cAAc,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;YAC/C,OAAO,cAAc;gBACjB,CAAC,CAAC,CAAC,MAAA,MAAA,MAAA,cAAc,CAAC,iBAAiB,EAAC,4BAA4B,mDAAG,cAAc,CAAC,mCAAI,SAAS,CAAC;gBAChG,CAAC,CAAC,SAAS,CAAA;QACnB,CAAC;QACH,CAAC,CAAC,UAAC,IAAI,IAAK,OAAA,aAAa,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,EAAvC,CAAuC,CAAA;IAEvD,sCACO,6BAAqB,GACrB,MAAM,KACT,aAAa,EAAE,gBAAgB,EAC/B,UAAU,EAAE,aAAa,EACzB,iBAAiB,EAAE,oBAAoB,EACvC,qBAAqB,EAAE,oBAAoB,IAC9C;AACL,CAAC,CAAA;AA/DY,QAAA,0BAA0B,8BA+DtC","sourcesContent":["import { CapturedNetworkRequest, NetworkRecordOptions, PostHogConfig } from '../../../types'\nimport { isFunction, isNullish, isString, isUndefined } from '@posthog/core'\nimport { convertToURL } from '../../../utils/request-utils'\nimport { logger } from '../../../utils/logger'\nimport { shouldCaptureValue } from '../../../autocapture-utils'\nimport { each } from '../../../utils'\n\nconst LOGGER_PREFIX = '[SessionRecording]'\n\nconst REDACTED = 'redacted'\n\nexport const defaultNetworkOptions: Required<NetworkRecordOptions> = {\n    initiatorTypes: [\n        'audio',\n        'beacon',\n        'body',\n        'css',\n        'early-hint',\n        'embed',\n        'fetch',\n        'frame',\n        'iframe',\n        'icon',\n        'image',\n        'img',\n        'input',\n        'link',\n        'navigation',\n        'object',\n        'ping',\n        'script',\n        'track',\n        'video',\n        'xmlhttprequest',\n    ],\n    maskRequestFn: (data: CapturedNetworkRequest) => data,\n    recordHeaders: false,\n    recordBody: false,\n    recordInitialRequests: false,\n    recordPerformance: false,\n    performanceEntryTypeToObserve: [\n        // 'event', // This is too noisy as it covers all browser events\n        'first-input',\n        // 'mark', // Mark is used too liberally. We would need to filter for specific marks\n        // 'measure', // Measure is used too liberally. We would need to filter for specific measures\n        'navigation',\n        'paint',\n        'resource',\n    ],\n    payloadSizeLimitBytes: 1000000,\n    payloadHostDenyList: [\n        '.lr-ingest.io',\n        '.ingest.sentry.io',\n        '.clarity.ms',\n        // NB no leading dot here\n        // GA4/gtag beacons go to *.google-analytics.com; with Google Signals on they also hit\n        // analytics.google.com (region1.analytics.google.com/g/collect), so deny both\n        'google-analytics.com',\n        'analytics.google.com',\n        // New Relic browser agent (bam + bam-cell)\n        'nr-data.net',\n        // Datadog browser RUM intake\n        'datadoghq.com',\n        'datadoghq.eu',\n        'ddog-gov.com',\n        // other third-party analytics / session-replay vendors whose telemetry has no replay value\n        'segment.io',\n        'rudderstack.com',\n        'amplitude.com',\n        'mixpanel.com',\n        // Hotjar uses both .com and .io for data collection\n        'hotjar.com',\n        'hotjar.io',\n        'fullstory.com',\n    ],\n}\n\nconst HEADER_DENY_LIST = [\n    'authorization',\n    'x-forwarded-for',\n    'authorization',\n    'cookie',\n    'set-cookie',\n    'x-api-key',\n    'x-real-ip',\n    'remote-addr',\n    'forwarded',\n    'proxy-authorization',\n    'x-csrf-token',\n    'x-csrftoken',\n    'x-xsrf-token',\n]\n\nconst PAYLOAD_CONTENT_DENY_LIST = [\n    'password',\n    'secret',\n    'passwd',\n    'api_key',\n    'apikey',\n    'auth',\n    'credentials',\n    'mysql_pwd',\n    'privatekey',\n    'private_key',\n    'token',\n]\n\n// we always remove headers on the deny list because we never want to capture this sensitive data\nconst removeAuthorizationHeader = (data: CapturedNetworkRequest): CapturedNetworkRequest => {\n    const headers = data.requestHeaders\n    if (!isNullish(headers)) {\n        each(Object.keys(headers ?? {}), (header) => {\n            if (HEADER_DENY_LIST.includes(header.toLowerCase())) {\n                headers[header] = REDACTED\n            }\n        })\n    }\n    return data\n}\n\nconst POSTHOG_PATHS_TO_IGNORE = ['/s/', '/e/', '/i/']\n// want to ignore posthog paths when capturing requests, or we can get trapped in a loop\n// because calls to PostHog would be reported using a call to PostHog which would be reported....\nconst ignorePostHogPaths = (\n    data: CapturedNetworkRequest,\n    apiHostConfig: PostHogConfig['api_host']\n): CapturedNetworkRequest | undefined => {\n    const url = convertToURL(data.name)\n\n    // we need to account for api host config as e.g. pathname could be /ingest/s/ and we want to ignore that\n    let replaceValue = apiHostConfig.indexOf('http') === 0 ? convertToURL(apiHostConfig)?.pathname : apiHostConfig\n    if (replaceValue === '/') {\n        replaceValue = ''\n    }\n    const pathname = url?.pathname.replace(replaceValue || '', '')\n\n    if (url && pathname && POSTHOG_PATHS_TO_IGNORE.some((path) => pathname.indexOf(path) === 0)) {\n        return undefined\n    }\n    return data\n}\n\nfunction estimateBytes(payload: string): number {\n    return new Blob([payload]).size\n}\n\nfunction enforcePayloadSizeLimit(\n    payload: string | null | undefined,\n    headers: Record<string, any> | undefined,\n    limit: number,\n    description: string\n): string | null | undefined {\n    if (isNullish(payload)) {\n        return payload\n    }\n\n    let requestContentLength: string | number = headers?.['content-length'] || estimateBytes(payload)\n    if (isString(requestContentLength)) {\n        requestContentLength = parseInt(requestContentLength)\n    }\n\n    if (requestContentLength > limit) {\n        return LOGGER_PREFIX + ` ${description} body too large to record (${requestContentLength} bytes)`\n    }\n\n    return payload\n}\n\n// people can have arbitrarily large payloads on their site, but we don't want to ingest them\nconst limitPayloadSize = (\n    options: NetworkRecordOptions\n): ((data: CapturedNetworkRequest | undefined) => CapturedNetworkRequest | undefined) => {\n    // the smallest of 1MB or the specified limit if there is one\n    const limit = Math.min(1000000, options.payloadSizeLimitBytes ?? 1000000)\n\n    return (data) => {\n        if (data?.requestBody) {\n            data.requestBody = enforcePayloadSizeLimit(data.requestBody, data.requestHeaders, limit, 'Request')\n        }\n\n        if (data?.responseBody) {\n            data.responseBody = enforcePayloadSizeLimit(data.responseBody, data.responseHeaders, limit, 'Response')\n        }\n\n        return data\n    }\n}\n\nfunction scrubPayload(payload: string | null | undefined, label: 'Request' | 'Response'): string | null | undefined {\n    if (isNullish(payload)) {\n        return payload\n    }\n    let scrubbed = payload\n\n    if (!shouldCaptureValue(scrubbed, false)) {\n        scrubbed = LOGGER_PREFIX + ' ' + label + ' body ' + REDACTED\n    }\n    each(PAYLOAD_CONTENT_DENY_LIST, (text) => {\n        if (scrubbed?.length && scrubbed?.indexOf(text) !== -1) {\n            scrubbed = LOGGER_PREFIX + ' ' + label + ' body ' + REDACTED + ' as might contain: ' + text\n        }\n    })\n\n    return scrubbed\n}\n\nfunction scrubPayloads(capturedRequest: CapturedNetworkRequest | undefined): CapturedNetworkRequest | undefined {\n    if (isUndefined(capturedRequest)) {\n        return undefined\n    }\n\n    capturedRequest.requestBody = scrubPayload(capturedRequest.requestBody, 'Request')\n    capturedRequest.responseBody = scrubPayload(capturedRequest.responseBody, 'Response')\n\n    return capturedRequest\n}\n\n/**\n *  whether a maskRequestFn is provided or not,\n *  we ensure that we remove the denied header from requests\n *  we _never_ want to record that header by accident\n *  if someone complains then we'll add an opt-in to let them override it\n */\nexport const buildNetworkRequestOptions = (\n    instanceConfig: PostHogConfig,\n    remoteNetworkOptions: Pick<\n        NetworkRecordOptions,\n        'recordHeaders' | 'recordBody' | 'recordPerformance' | 'payloadHostDenyList'\n    >\n): NetworkRecordOptions => {\n    const config: NetworkRecordOptions = {\n        payloadSizeLimitBytes: defaultNetworkOptions.payloadSizeLimitBytes,\n        performanceEntryTypeToObserve: [...defaultNetworkOptions.performanceEntryTypeToObserve],\n        payloadHostDenyList: [\n            ...(remoteNetworkOptions.payloadHostDenyList || []),\n            ...defaultNetworkOptions.payloadHostDenyList,\n        ],\n    }\n    // client can always disable despite remote options\n    const canRecordHeaders =\n        instanceConfig.session_recording.recordHeaders === false ? false : remoteNetworkOptions.recordHeaders\n    const canRecordBody =\n        instanceConfig.session_recording.recordBody === false ? false : remoteNetworkOptions.recordBody\n    const canRecordPerformance =\n        instanceConfig.capture_performance === false ? false : remoteNetworkOptions.recordPerformance\n\n    const payloadLimiter = limitPayloadSize(config)\n\n    const enforcedCleaningFn: NetworkRecordOptions['maskRequestFn'] = (d: CapturedNetworkRequest) =>\n        payloadLimiter(ignorePostHogPaths(removeAuthorizationHeader(d), instanceConfig.api_host))\n\n    const hasDeprecatedMaskFunction = isFunction(instanceConfig.session_recording.maskNetworkRequestFn)\n\n    if (hasDeprecatedMaskFunction && isFunction(instanceConfig.session_recording.maskCapturedNetworkRequestFn)) {\n        logger.warn(\n            'Both `maskNetworkRequestFn` and `maskCapturedNetworkRequestFn` are defined. `maskNetworkRequestFn` will be ignored.'\n        )\n    }\n\n    if (hasDeprecatedMaskFunction) {\n        instanceConfig.session_recording.maskCapturedNetworkRequestFn = (data: CapturedNetworkRequest) => {\n            const cleanedURL = instanceConfig.session_recording.maskNetworkRequestFn!({ url: data.name })\n            return {\n                ...data,\n                name: cleanedURL?.url,\n            } as CapturedNetworkRequest\n        }\n    }\n\n    config.maskRequestFn = isFunction(instanceConfig.session_recording.maskCapturedNetworkRequestFn)\n        ? (data) => {\n              const cleanedRequest = enforcedCleaningFn(data)\n              return cleanedRequest\n                  ? (instanceConfig.session_recording.maskCapturedNetworkRequestFn?.(cleanedRequest) ?? undefined)\n                  : undefined\n          }\n        : (data) => scrubPayloads(enforcedCleaningFn(data))\n\n    return {\n        ...defaultNetworkOptions,\n        ...config,\n        recordHeaders: canRecordHeaders,\n        recordBody: canRecordBody,\n        recordPerformance: canRecordPerformance,\n        recordInitialRequests: canRecordPerformance,\n    }\n}\n"]}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../../src/extensions/replay/external/config.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,sCAA4E;AAC5E,8DAA2D;AAC3D,gDAA8C;AAC9C,gEAA+D;AAC/D,wCAAqC;AAErC,IAAM,aAAa,GAAG,oBAAoB,CAAA;AAE1C,IAAM,QAAQ,GAAG,UAAU,CAAA;AAEd,QAAA,qBAAqB,GAAmC;IACjE,cAAc,EAAE;QACZ,OAAO;QACP,QAAQ;QACR,MAAM;QACN,KAAK;QACL,YAAY;QACZ,OAAO;QACP,OAAO;QACP,OAAO;QACP,QAAQ;QACR,MAAM;QACN,OAAO;QACP,KAAK;QACL,OAAO;QACP,MAAM;QACN,YAAY;QACZ,QAAQ;QACR,MAAM;QACN,QAAQ;QACR,OAAO;QACP,OAAO;QACP,gBAAgB;KACnB;IACD,aAAa,EAAE,UAAC,IAA4B,IAAK,OAAA,IAAI,EAAJ,CAAI;IACrD,aAAa,EAAE,KAAK;IACpB,UAAU,EAAE,KAAK;IACjB,qBAAqB,EAAE,KAAK;IAC5B,iBAAiB,EAAE,KAAK;IACxB,6BAA6B,EAAE;QAC3B,gEAAgE;QAChE,aAAa;QACb,oFAAoF;QACpF,6FAA6F;QAC7F,YAAY;QACZ,OAAO;QACP,UAAU;KACb;IACD,qBAAqB,EAAE,OAAO;IAC9B,mBAAmB,EAAE;QACjB,eAAe;QACf,mBAAmB;QACnB,aAAa;QACb,yBAAyB;QACzB,sFAAsF;QACtF,8EAA8E;QAC9E,sBAAsB;QACtB,sBAAsB;QACtB,2CAA2C;QAC3C,aAAa;QACb,6BAA6B;QAC7B,eAAe;QACf,cAAc;QACd,cAAc;QACd,2FAA2F;QAC3F,YAAY;QACZ,iBAAiB;QACjB,eAAe;QACf,cAAc;QACd,oDAAoD;QACpD,YAAY;QACZ,WAAW;QACX,eAAe;KAClB;CACJ,CAAA;AAED,IAAM,gBAAgB,GAAG;IACrB,eAAe;IACf,iBAAiB;IACjB,eAAe;IACf,QAAQ;IACR,YAAY;IACZ,WAAW;IACX,WAAW;IACX,aAAa;IACb,WAAW;IACX,qBAAqB;IACrB,cAAc;IACd,aAAa;IACb,cAAc;CACjB,CAAA;AAED,IAAM,yBAAyB,GAAG;IAC9B,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,MAAM;IACN,aAAa;IACb,WAAW;IACX,YAAY;IACZ,aAAa;IACb,OAAO;CACV,CAAA;AAED,6EAA6E;AAC7E,4EAA4E;AAC5E,IAAM,sBAAsB,GAAG;IAC3B,MAAM;IACN,OAAO;IACP,QAAQ;IACR,SAAS;IACT,SAAS;IACT,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,MAAM;CACT,CAAA;AAED,IAAM,cAAc,GAAG,UAAC,MAAc;IAClC,IAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;IAClC,OAAO,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,UAAC,CAAC,IAAK,OAAA,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAjB,CAAiB,CAAC,CAAA;AACpG,CAAC,CAAA;AAED,IAAM,mBAAmB,GAAG,UAAC,OAAiD;IAC1E,IAAI,CAAC,IAAA,gBAAS,EAAC,OAAO,CAAC,EAAE,CAAC;QACtB,IAAA,YAAI,EAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,UAAC,MAAM;YAC9B,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAA;YAC9B,CAAC;QACL,CAAC,CAAC,CAAA;IACN,CAAC;AACL,CAAC,CAAA;AAED,kGAAkG;AAClG,sFAAsF;AACtF,IAAM,yBAAyB,GAAG,UAAC,IAA4B;IAC3D,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IACxC,mBAAmB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACzC,OAAO,IAAI,CAAA;AACf,CAAC,CAAA;AAED,IAAM,uBAAuB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;AACrD,wFAAwF;AACxF,iGAAiG;AACjG,IAAM,kBAAkB,GAAG,UACvB,IAA4B,EAC5B,aAAwC;;IAExC,IAAM,GAAG,GAAG,IAAA,4BAAY,EAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEnC,yGAAyG;IACzG,IAAI,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAA,IAAA,4BAAY,EAAC,aAAa,CAAC,0CAAE,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAA;IAC9G,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;QACvB,YAAY,GAAG,EAAE,CAAA;IACrB,CAAC;IACD,IAAM,QAAQ,GAAG,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,QAAQ,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;IAE9D,IAAI,GAAG,IAAI,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,UAAC,IAAI,IAAK,OAAA,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAA5B,CAA4B,CAAC,EAAE,CAAC;QAC1F,OAAO,SAAS,CAAA;IACpB,CAAC;IACD,OAAO,IAAI,CAAA;AACf,CAAC,CAAA;AAED,SAAS,aAAa,CAAC,OAAe;IAClC,OAAO,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;AACnC,CAAC;AAED,SAAS,uBAAuB,CAC5B,OAAkC,EAClC,OAAwC,EACxC,KAAa,EACb,WAAmB;IAEnB,IAAI,IAAA,gBAAS,EAAC,OAAO,CAAC,EAAE,CAAC;QACrB,OAAO,OAAO,CAAA;IAClB,CAAC;IAED,IAAI,oBAAoB,GAAoB,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAG,gBAAgB,CAAC,KAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IACjG,IAAI,IAAA,eAAQ,EAAC,oBAAoB,CAAC,EAAE,CAAC;QACjC,oBAAoB,GAAG,QAAQ,CAAC,oBAAoB,CAAC,CAAA;IACzD,CAAC;IAED,IAAI,oBAAoB,GAAG,KAAK,EAAE,CAAC;QAC/B,OAAO,aAAa,GAAG,WAAI,WAAW,wCAA8B,oBAAoB,YAAS,CAAA;IACrG,CAAC;IAED,OAAO,OAAO,CAAA;AAClB,CAAC;AAED,6FAA6F;AAC7F,IAAM,gBAAgB,GAAG,UACrB,OAA6B;;IAE7B,6DAA6D;IAC7D,IAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAA,OAAO,CAAC,qBAAqB,mCAAI,OAAO,CAAC,CAAA;IAEzE,OAAO,UAAC,IAAI;QACR,IAAI,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,WAAW,EAAE,CAAC;YACpB,IAAI,CAAC,WAAW,GAAG,uBAAuB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;QACvG,CAAC;QAED,IAAI,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,YAAY,EAAE,CAAC;YACrB,IAAI,CAAC,YAAY,GAAG,uBAAuB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;QAC3G,CAAC;QAED,OAAO,IAAI,CAAA;IACf,CAAC,CAAA;AACL,CAAC,CAAA;AAED,SAAS,YAAY,CAAC,OAAkC,EAAE,KAA6B;IACnF,IAAI,IAAA,gBAAS,EAAC,OAAO,CAAC,EAAE,CAAC;QACrB,OAAO,OAAO,CAAA;IAClB,CAAC;IACD,IAAI,QAAQ,GAAG,OAAO,CAAA;IAEtB,IAAI,CAAC,IAAA,sCAAkB,EAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;QACvC,QAAQ,GAAG,aAAa,GAAG,GAAG,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,CAAA;IAChE,CAAC;IACD,IAAA,YAAI,EAAC,yBAAyB,EAAE,UAAC,IAAI;QACjC,IAAI,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,KAAI,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,OAAO,CAAC,IAAI,CAAC,MAAK,CAAC,CAAC,EAAE,CAAC;YACrD,QAAQ,GAAG,aAAa,GAAG,GAAG,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,qBAAqB,GAAG,IAAI,CAAA;QAC/F,CAAC;IACL,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,eAAmD;IACtE,IAAI,IAAA,kBAAW,EAAC,eAAe,CAAC,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAA;IACpB,CAAC;IAED,eAAe,CAAC,WAAW,GAAG,YAAY,CAAC,eAAe,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;IAClF,eAAe,CAAC,YAAY,GAAG,YAAY,CAAC,eAAe,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;IAErF,OAAO,eAAe,CAAA;AAC1B,CAAC;AAED;;;;;GAKG;AACI,IAAM,0BAA0B,GAAG,UACtC,cAA6B,EAC7B,oBAGC;IAED,IAAM,MAAM,GAAyB;QACjC,qBAAqB,EAAE,6BAAqB,CAAC,qBAAqB;QAClE,6BAA6B,2BAAM,6BAAqB,CAAC,6BAA6B,SAAC;QACvF,mBAAmB,yCACZ,CAAC,oBAAoB,CAAC,mBAAmB,IAAI,EAAE,CAAC,kBAChD,6BAAqB,CAAC,mBAAmB,SAC/C;KACJ,CAAA;IACD,mDAAmD;IACnD,IAAM,gBAAgB,GAClB,cAAc,CAAC,iBAAiB,CAAC,aAAa,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAA;IACzG,IAAM,aAAa,GACf,cAAc,CAAC,iBAAiB,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAA;IACnG,IAAM,oBAAoB,GACtB,cAAc,CAAC,mBAAmB,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,iBAAiB,CAAA;IAEjG,IAAM,cAAc,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAA;IAE/C,IAAM,kBAAkB,GAA0C,UAAC,CAAyB;QACxF,OAAA,cAAc,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAAzF,CAAyF,CAAA;IAE7F,IAAM,yBAAyB,GAAG,IAAA,iBAAU,EAAC,cAAc,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,CAAA;IAEnG,IAAI,yBAAyB,IAAI,IAAA,iBAAU,EAAC,cAAc,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,EAAE,CAAC;QACzG,eAAM,CAAC,IAAI,CACP,qHAAqH,CACxH,CAAA;IACL,CAAC;IAED,IAAI,yBAAyB,EAAE,CAAC;QAC5B,cAAc,CAAC,iBAAiB,CAAC,4BAA4B,GAAG,UAAC,IAA4B;YACzF,IAAM,UAAU,GAAG,cAAc,CAAC,iBAAiB,CAAC,oBAAqB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;YAC7F,OAAO,sBACA,IAAI,KACP,IAAI,EAAE,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,GAAG,GACE,CAAA;QAC/B,CAAC,CAAA;IACL,CAAC;IAED,MAAM,CAAC,aAAa,GAAG,IAAA,iBAAU,EAAC,cAAc,CAAC,iBAAiB,CAAC,4BAA4B,CAAC;QAC5F,CAAC,CAAC,UAAC,IAAI;;YACD,IAAM,cAAc,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;YAC/C,OAAO,cAAc;gBACjB,CAAC,CAAC,CAAC,MAAA,MAAA,MAAA,cAAc,CAAC,iBAAiB,EAAC,4BAA4B,mDAAG,cAAc,CAAC,mCAAI,SAAS,CAAC;gBAChG,CAAC,CAAC,SAAS,CAAA;QACnB,CAAC;QACH,CAAC,CAAC,UAAC,IAAI,IAAK,OAAA,aAAa,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,EAAvC,CAAuC,CAAA;IAEvD,sCACO,6BAAqB,GACrB,MAAM,KACT,aAAa,EAAE,gBAAgB,EAC/B,UAAU,EAAE,aAAa,EACzB,iBAAiB,EAAE,oBAAoB,EACvC,qBAAqB,EAAE,oBAAoB,IAC9C;AACL,CAAC,CAAA;AA/DY,QAAA,0BAA0B,8BA+DtC","sourcesContent":["import { CapturedNetworkRequest, NetworkRecordOptions, PostHogConfig } from '../../../types'\nimport { isFunction, isNullish, isString, isUndefined } from '@posthog/core'\nimport { convertToURL } from '../../../utils/request-utils'\nimport { logger } from '../../../utils/logger'\nimport { shouldCaptureValue } from '../../../autocapture-utils'\nimport { each } from '../../../utils'\n\nconst LOGGER_PREFIX = '[SessionRecording]'\n\nconst REDACTED = 'redacted'\n\nexport const defaultNetworkOptions: Required<NetworkRecordOptions> = {\n    initiatorTypes: [\n        'audio',\n        'beacon',\n        'body',\n        'css',\n        'early-hint',\n        'embed',\n        'fetch',\n        'frame',\n        'iframe',\n        'icon',\n        'image',\n        'img',\n        'input',\n        'link',\n        'navigation',\n        'object',\n        'ping',\n        'script',\n        'track',\n        'video',\n        'xmlhttprequest',\n    ],\n    maskRequestFn: (data: CapturedNetworkRequest) => data,\n    recordHeaders: false,\n    recordBody: false,\n    recordInitialRequests: false,\n    recordPerformance: false,\n    performanceEntryTypeToObserve: [\n        // 'event', // This is too noisy as it covers all browser events\n        'first-input',\n        // 'mark', // Mark is used too liberally. We would need to filter for specific marks\n        // 'measure', // Measure is used too liberally. We would need to filter for specific measures\n        'navigation',\n        'paint',\n        'resource',\n    ],\n    payloadSizeLimitBytes: 1000000,\n    payloadHostDenyList: [\n        '.lr-ingest.io',\n        '.ingest.sentry.io',\n        '.clarity.ms',\n        // NB no leading dot here\n        // GA4/gtag beacons go to *.google-analytics.com; with Google Signals on they also hit\n        // analytics.google.com (region1.analytics.google.com/g/collect), so deny both\n        'google-analytics.com',\n        'analytics.google.com',\n        // New Relic browser agent (bam + bam-cell)\n        'nr-data.net',\n        // Datadog browser RUM intake\n        'datadoghq.com',\n        'datadoghq.eu',\n        'ddog-gov.com',\n        // other third-party analytics / session-replay vendors whose telemetry has no replay value\n        'segment.io',\n        'rudderstack.com',\n        'amplitude.com',\n        'mixpanel.com',\n        // Hotjar uses both .com and .io for data collection\n        'hotjar.com',\n        'hotjar.io',\n        'fullstory.com',\n    ],\n}\n\nconst HEADER_DENY_LIST = [\n    'authorization',\n    'x-forwarded-for',\n    'authorization',\n    'cookie',\n    'set-cookie',\n    'x-api-key',\n    'x-real-ip',\n    'remote-addr',\n    'forwarded',\n    'proxy-authorization',\n    'x-csrf-token',\n    'x-csrftoken',\n    'x-xsrf-token',\n]\n\nconst PAYLOAD_CONTENT_DENY_LIST = [\n    'password',\n    'secret',\n    'passwd',\n    'api_key',\n    'apikey',\n    'auth',\n    'credentials',\n    'mysql_pwd',\n    'privatekey',\n    'private_key',\n    'token',\n]\n\n// substrings that mark a header as credential-bearing - catches custom names\n// (e.g. x-gist-encoded-user-token) that aren't in the exact deny list above\nconst HEADER_DENY_SUBSTRINGS = [\n    'auth',\n    'token',\n    'secret',\n    'session',\n    'api-key',\n    'apikey',\n    'api_key',\n    'credential',\n    'password',\n    'passwd',\n    'cookie',\n    'csrf',\n    'xsrf',\n]\n\nconst isDeniedHeader = (header: string): boolean => {\n    const lower = header.toLowerCase()\n    return HEADER_DENY_LIST.includes(lower) || HEADER_DENY_SUBSTRINGS.some((s) => lower.includes(s))\n}\n\nconst redactDeniedHeaders = (headers: CapturedNetworkRequest['requestHeaders']): void => {\n    if (!isNullish(headers)) {\n        each(Object.keys(headers), (header) => {\n            if (isDeniedHeader(header)) {\n                headers[header] = REDACTED\n            }\n        })\n    }\n}\n\n// we always remove headers on the deny list because we never want to capture this sensitive data.\n// applies to both request and response headers (e.g. set-cookie is a response header)\nconst removeAuthorizationHeader = (data: CapturedNetworkRequest): CapturedNetworkRequest => {\n    redactDeniedHeaders(data.requestHeaders)\n    redactDeniedHeaders(data.responseHeaders)\n    return data\n}\n\nconst POSTHOG_PATHS_TO_IGNORE = ['/s/', '/e/', '/i/']\n// want to ignore posthog paths when capturing requests, or we can get trapped in a loop\n// because calls to PostHog would be reported using a call to PostHog which would be reported....\nconst ignorePostHogPaths = (\n    data: CapturedNetworkRequest,\n    apiHostConfig: PostHogConfig['api_host']\n): CapturedNetworkRequest | undefined => {\n    const url = convertToURL(data.name)\n\n    // we need to account for api host config as e.g. pathname could be /ingest/s/ and we want to ignore that\n    let replaceValue = apiHostConfig.indexOf('http') === 0 ? convertToURL(apiHostConfig)?.pathname : apiHostConfig\n    if (replaceValue === '/') {\n        replaceValue = ''\n    }\n    const pathname = url?.pathname.replace(replaceValue || '', '')\n\n    if (url && pathname && POSTHOG_PATHS_TO_IGNORE.some((path) => pathname.indexOf(path) === 0)) {\n        return undefined\n    }\n    return data\n}\n\nfunction estimateBytes(payload: string): number {\n    return new Blob([payload]).size\n}\n\nfunction enforcePayloadSizeLimit(\n    payload: string | null | undefined,\n    headers: Record<string, any> | undefined,\n    limit: number,\n    description: string\n): string | null | undefined {\n    if (isNullish(payload)) {\n        return payload\n    }\n\n    let requestContentLength: string | number = headers?.['content-length'] || estimateBytes(payload)\n    if (isString(requestContentLength)) {\n        requestContentLength = parseInt(requestContentLength)\n    }\n\n    if (requestContentLength > limit) {\n        return LOGGER_PREFIX + ` ${description} body too large to record (${requestContentLength} bytes)`\n    }\n\n    return payload\n}\n\n// people can have arbitrarily large payloads on their site, but we don't want to ingest them\nconst limitPayloadSize = (\n    options: NetworkRecordOptions\n): ((data: CapturedNetworkRequest | undefined) => CapturedNetworkRequest | undefined) => {\n    // the smallest of 1MB or the specified limit if there is one\n    const limit = Math.min(1000000, options.payloadSizeLimitBytes ?? 1000000)\n\n    return (data) => {\n        if (data?.requestBody) {\n            data.requestBody = enforcePayloadSizeLimit(data.requestBody, data.requestHeaders, limit, 'Request')\n        }\n\n        if (data?.responseBody) {\n            data.responseBody = enforcePayloadSizeLimit(data.responseBody, data.responseHeaders, limit, 'Response')\n        }\n\n        return data\n    }\n}\n\nfunction scrubPayload(payload: string | null | undefined, label: 'Request' | 'Response'): string | null | undefined {\n    if (isNullish(payload)) {\n        return payload\n    }\n    let scrubbed = payload\n\n    if (!shouldCaptureValue(scrubbed, false)) {\n        scrubbed = LOGGER_PREFIX + ' ' + label + ' body ' + REDACTED\n    }\n    each(PAYLOAD_CONTENT_DENY_LIST, (text) => {\n        if (scrubbed?.length && scrubbed?.indexOf(text) !== -1) {\n            scrubbed = LOGGER_PREFIX + ' ' + label + ' body ' + REDACTED + ' as might contain: ' + text\n        }\n    })\n\n    return scrubbed\n}\n\nfunction scrubPayloads(capturedRequest: CapturedNetworkRequest | undefined): CapturedNetworkRequest | undefined {\n    if (isUndefined(capturedRequest)) {\n        return undefined\n    }\n\n    capturedRequest.requestBody = scrubPayload(capturedRequest.requestBody, 'Request')\n    capturedRequest.responseBody = scrubPayload(capturedRequest.responseBody, 'Response')\n\n    return capturedRequest\n}\n\n/**\n *  whether a maskRequestFn is provided or not,\n *  we ensure that we remove the denied header from requests\n *  we _never_ want to record that header by accident\n *  if someone complains then we'll add an opt-in to let them override it\n */\nexport const buildNetworkRequestOptions = (\n    instanceConfig: PostHogConfig,\n    remoteNetworkOptions: Pick<\n        NetworkRecordOptions,\n        'recordHeaders' | 'recordBody' | 'recordPerformance' | 'payloadHostDenyList'\n    >\n): NetworkRecordOptions => {\n    const config: NetworkRecordOptions = {\n        payloadSizeLimitBytes: defaultNetworkOptions.payloadSizeLimitBytes,\n        performanceEntryTypeToObserve: [...defaultNetworkOptions.performanceEntryTypeToObserve],\n        payloadHostDenyList: [\n            ...(remoteNetworkOptions.payloadHostDenyList || []),\n            ...defaultNetworkOptions.payloadHostDenyList,\n        ],\n    }\n    // client can always disable despite remote options\n    const canRecordHeaders =\n        instanceConfig.session_recording.recordHeaders === false ? false : remoteNetworkOptions.recordHeaders\n    const canRecordBody =\n        instanceConfig.session_recording.recordBody === false ? false : remoteNetworkOptions.recordBody\n    const canRecordPerformance =\n        instanceConfig.capture_performance === false ? false : remoteNetworkOptions.recordPerformance\n\n    const payloadLimiter = limitPayloadSize(config)\n\n    const enforcedCleaningFn: NetworkRecordOptions['maskRequestFn'] = (d: CapturedNetworkRequest) =>\n        payloadLimiter(ignorePostHogPaths(removeAuthorizationHeader(d), instanceConfig.api_host))\n\n    const hasDeprecatedMaskFunction = isFunction(instanceConfig.session_recording.maskNetworkRequestFn)\n\n    if (hasDeprecatedMaskFunction && isFunction(instanceConfig.session_recording.maskCapturedNetworkRequestFn)) {\n        logger.warn(\n            'Both `maskNetworkRequestFn` and `maskCapturedNetworkRequestFn` are defined. `maskNetworkRequestFn` will be ignored.'\n        )\n    }\n\n    if (hasDeprecatedMaskFunction) {\n        instanceConfig.session_recording.maskCapturedNetworkRequestFn = (data: CapturedNetworkRequest) => {\n            const cleanedURL = instanceConfig.session_recording.maskNetworkRequestFn!({ url: data.name })\n            return {\n                ...data,\n                name: cleanedURL?.url,\n            } as CapturedNetworkRequest\n        }\n    }\n\n    config.maskRequestFn = isFunction(instanceConfig.session_recording.maskCapturedNetworkRequestFn)\n        ? (data) => {\n              const cleanedRequest = enforcedCleaningFn(data)\n              return cleanedRequest\n                  ? (instanceConfig.session_recording.maskCapturedNetworkRequestFn?.(cleanedRequest) ?? undefined)\n                  : undefined\n          }\n        : (data) => scrubPayloads(enforcedCleaningFn(data))\n\n    return {\n        ...defaultNetworkOptions,\n        ...config,\n        recordHeaders: canRecordHeaders,\n        recordBody: canRecordBody,\n        recordPerformance: canRecordPerformance,\n        recordInitialRequests: canRecordPerformance,\n    }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "posthog-js",
-  "version": "1.391.6",
+  "version": "1.391.7",
   "bugs": {
     "url": "https://github.com/PostHog/posthog-js/issues"
   },
@@ -103,8 +103,8 @@
     "@posthog-tooling/rollup-utils": "1.1.1",
     "@posthog/rrweb-record": "0.0.74",
     "@posthog/rrweb-plugin-console-record": "0.0.74",
-    "@posthog/rrweb": "0.0.74",
-    "@posthog/rrweb-types": "0.0.62"
+    "@posthog/rrweb-types": "0.0.62",
+    "@posthog/rrweb": "0.0.74"
   },
   "browserslist": [
     "> 0.5%, last 2 versions, Firefox ESR, not dead"