posthog-js 1.76.0 → 1.77.1

package/lib/package.json

@@ -1,6 +1,6 @@
 {
     "name": "posthog-js",
-    "version": "1.76.0",
+    "version": "1.77.1",
     "description": "Posthog-js allows you to automatically capture usage and send events to PostHog.",
     "repository": "https://github.com/PostHog/posthog-js",
     "author": "hey@posthog.com",
@@ -46,14 +46,15 @@
         "@types/jest": "^29.5.1",
         "@types/react-dom": "^18.0.10",
         "@types/uuid": "^9.0.1",
-        "@typescript-eslint/eslint-plugin": "^5.30.7",
-        "@typescript-eslint/parser": "^5.30.7",
+        "@typescript-eslint/eslint-plugin": "^6.4.0",
+        "@typescript-eslint/parser": "^6.4.0",
         "babel-eslint": "10.1.0",
         "babel-jest": "^26.6.3",
         "cypress": "10.3.1",
         "eslint": "8.20.0",
         "eslint-config-prettier": "^8.5.0",
         "eslint-plugin-compat": "^4.1.4",
+        "eslint-plugin-jest": "^27.2.3",
         "eslint-plugin-prettier": "^4.2.1",
         "eslint-plugin-react": "^7.30.1",
         "eslint-plugin-react-hooks": "^4.6.0",
@@ -77,10 +78,11 @@
         "rrweb-snapshot": "2.0.0-alpha.8",
         "rrweb-v1": "npm:rrweb@1.1.3",
         "sinon": "9.0.2",
-        "testcafe": "^1.19.0",
-        "testcafe-browser-provider-browserstack": "^1.14.0",
+        "testcafe": "1.19.0",
+        "testcafe-browser-provider-browserstack": "1.14.0",
         "tslib": "^2.4.0",
-        "typescript": "^4.7.4"
+        "typescript": "^4.7.4",
+        "yargs": "^17.7.2"
     },
     "lint-staged": {
         "*.{ts,tsx,js,json}": "prettier --write",

package/lib/src/autocapture-utils.d.ts

@@ -0,0 +1,15 @@
+import { AutocaptureConfig } from 'types';
+export declare function getClassName(el: Element): string;
+export declare function getSafeText(el: Element): string;
+export declare function isElementNode(el: Element | undefined | null): el is HTMLElement;
+export declare function isTag(el: Element | undefined | null, tag: string): el is HTMLElement;
+export declare function isTextNode(el: Element | undefined | null): el is HTMLElement;
+export declare function isDocumentFragment(el: Element | ParentNode | undefined | null): el is DocumentFragment;
+export declare const autocaptureCompatibleElements: string[];
+export declare function shouldCaptureDomEvent(el: Element, event: Event, autocaptureConfig?: AutocaptureConfig | undefined): boolean;
+export declare function shouldCaptureElement(el: Element): boolean;
+export declare function isSensitiveElement(el: Element): boolean;
+export declare function shouldCaptureValue(value: string): boolean;
+export declare function isAngularStyleAttr(attributeName: string): boolean;
+export declare function getDirectAndNestedSpanText(target: Element): string;
+export declare function getNestedSpanText(target: Element): string;

package/lib/src/autocapture-utils.js

@@ -0,0 +1,303 @@
+import { _each, _includes, _isUndefined, _trim } from './utils';
+export function getClassName(el) {
+    switch (typeof el.className) {
+        case 'string':
+            return el.className;
+        // TODO: when is this ever used?
+        case 'object': // handle cases where className might be SVGAnimatedString or some other type
+            return ('baseVal' in el.className ? el.className.baseVal : null) || el.getAttribute('class') || '';
+        default:
+            // future proof
+            return '';
+    }
+}
+/*
+ * Get the direct text content of an element, protecting against sensitive data collection.
+ * Concats textContent of each of the element's text node children; this avoids potential
+ * collection of sensitive data that could happen if we used element.textContent and the
+ * element had sensitive child elements, since element.textContent includes child content.
+ * Scrubs values that look like they could be sensitive (i.e. cc or ssn number).
+ * @param {Element} el - element to get the text of
+ * @returns {string} the element's direct text content
+ */
+export function getSafeText(el) {
+    var elText = '';
+    if (shouldCaptureElement(el) && !isSensitiveElement(el) && el.childNodes && el.childNodes.length) {
+        _each(el.childNodes, function (child) {
+            if (isTextNode(child) && child.textContent) {
+                elText += _trim(child.textContent)
+                    // scrub potentially sensitive values
+                    .split(/(\s+)/)
+                    .filter(shouldCaptureValue)
+                    .join('')
+                    // normalize whitespace
+                    .replace(/[\r\n]/g, ' ')
+                    .replace(/[ ]+/g, ' ')
+                    // truncate
+                    .substring(0, 255);
+            }
+        });
+    }
+    return _trim(elText);
+}
+/*
+ * Check whether an element has nodeType Node.ELEMENT_NODE
+ * @param {Element} el - element to check
+ * @returns {boolean} whether el is of the correct nodeType
+ */
+export function isElementNode(el) {
+    return !!el && el.nodeType === 1; // Node.ELEMENT_NODE - use integer constant for browser portability
+}
+/*
+ * Check whether an element is of a given tag type.
+ * Due to potential reference discrepancies (such as the webcomponents.js polyfill),
+ * we want to match tagNames instead of specific references because something like
+ * element === document.body won't always work because element might not be a native
+ * element.
+ * @param {Element} el - element to check
+ * @param {string} tag - tag name (e.g., "div")
+ * @returns {boolean} whether el is of the given tag type
+ */
+export function isTag(el, tag) {
+    return !!el && !!el.tagName && el.tagName.toLowerCase() === tag.toLowerCase();
+}
+/*
+ * Check whether an element has nodeType Node.TEXT_NODE
+ * @param {Element} el - element to check
+ * @returns {boolean} whether el is of the correct nodeType
+ */
+export function isTextNode(el) {
+    return !!el && el.nodeType === 3; // Node.TEXT_NODE - use integer constant for browser portability
+}
+/*
+ * Check whether an element has nodeType Node.DOCUMENT_FRAGMENT_NODE
+ * @param {Element} el - element to check
+ * @returns {boolean} whether el is of the correct nodeType
+ */
+export function isDocumentFragment(el) {
+    return !!el && el.nodeType === 11; // Node.DOCUMENT_FRAGMENT_NODE - use integer constant for browser portability
+}
+export var autocaptureCompatibleElements = ['a', 'button', 'form', 'input', 'select', 'textarea', 'label'];
+/*
+ * Check whether a DOM event should be "captured" or if it may contain sentitive data
+ * using a variety of heuristics.
+ * @param {Element} el - element to check
+ * @param {Event} event - event to check
+ * @param {Object} autocaptureConfig - autocapture config
+ * @returns {boolean} whether the event should be captured
+ */
+export function shouldCaptureDomEvent(el, event, autocaptureConfig) {
+    if (autocaptureConfig === void 0) { autocaptureConfig = undefined; }
+    if (!el || isTag(el, 'html') || !isElementNode(el)) {
+        return false;
+    }
+    if (autocaptureConfig === null || autocaptureConfig === void 0 ? void 0 : autocaptureConfig.url_allowlist) {
+        var url_1 = window.location.href;
+        var allowlist = autocaptureConfig.url_allowlist;
+        if (allowlist && !allowlist.some(function (regex) { return url_1.match(regex); })) {
+            return false;
+        }
+    }
+    if (autocaptureConfig === null || autocaptureConfig === void 0 ? void 0 : autocaptureConfig.dom_event_allowlist) {
+        var allowlist = autocaptureConfig.dom_event_allowlist;
+        if (allowlist && !allowlist.some(function (eventType) { return event.type === eventType; })) {
+            return false;
+        }
+    }
+    if (autocaptureConfig === null || autocaptureConfig === void 0 ? void 0 : autocaptureConfig.element_allowlist) {
+        var allowlist = autocaptureConfig.element_allowlist;
+        if (allowlist && !allowlist.some(function (elementType) { return el.tagName.toLowerCase() === elementType; })) {
+            return false;
+        }
+    }
+    if (autocaptureConfig === null || autocaptureConfig === void 0 ? void 0 : autocaptureConfig.css_selector_allowlist) {
+        var allowlist = autocaptureConfig.css_selector_allowlist;
+        if (allowlist && !allowlist.some(function (selector) { return el.matches(selector); })) {
+            return false;
+        }
+    }
+    var parentIsUsefulElement = false;
+    var targetElementList = [el]; // TODO: remove this var, it's never queried
+    var parentNode = true;
+    var curEl = el;
+    while (curEl.parentNode && !isTag(curEl, 'body')) {
+        // If element is a shadow root, we skip it
+        if (isDocumentFragment(curEl.parentNode)) {
+            targetElementList.push(curEl.parentNode.host);
+            curEl = curEl.parentNode.host;
+            continue;
+        }
+        parentNode = curEl.parentNode || false;
+        if (!parentNode)
+            break;
+        if (autocaptureCompatibleElements.indexOf(parentNode.tagName.toLowerCase()) > -1) {
+            parentIsUsefulElement = true;
+        }
+        else {
+            var compStyles_1 = window.getComputedStyle(parentNode);
+            if (compStyles_1 && compStyles_1.getPropertyValue('cursor') === 'pointer') {
+                parentIsUsefulElement = true;
+            }
+        }
+        targetElementList.push(parentNode);
+        curEl = parentNode;
+    }
+    var compStyles = window.getComputedStyle(el);
+    if (compStyles && compStyles.getPropertyValue('cursor') === 'pointer' && event.type === 'click') {
+        return true;
+    }
+    var tag = el.tagName.toLowerCase();
+    switch (tag) {
+        case 'html':
+            return false;
+        case 'form':
+            return event.type === 'submit';
+        case 'input':
+            return event.type === 'change' || event.type === 'click';
+        case 'select':
+        case 'textarea':
+            return event.type === 'change' || event.type === 'click';
+        default:
+            if (parentIsUsefulElement)
+                return event.type === 'click';
+            return (event.type === 'click' &&
+                (autocaptureCompatibleElements.indexOf(tag) > -1 || el.getAttribute('contenteditable') === 'true'));
+    }
+}
+/*
+ * Check whether a DOM element should be "captured" or if it may contain sentitive data
+ * using a variety of heuristics.
+ * @param {Element} el - element to check
+ * @returns {boolean} whether the element should be captured
+ */
+export function shouldCaptureElement(el) {
+    for (var curEl = el; curEl.parentNode && !isTag(curEl, 'body'); curEl = curEl.parentNode) {
+        var classes = getClassName(curEl).split(' ');
+        if (_includes(classes, 'ph-sensitive') || _includes(classes, 'ph-no-capture')) {
+            return false;
+        }
+    }
+    if (_includes(getClassName(el).split(' '), 'ph-include')) {
+        return true;
+    }
+    // don't include hidden or password fields
+    var type = el.type || '';
+    if (typeof type === 'string') {
+        // it's possible for el.type to be a DOM element if el is a form with a child input[name="type"]
+        switch (type.toLowerCase()) {
+            case 'hidden':
+                return false;
+            case 'password':
+                return false;
+        }
+    }
+    // filter out data from fields that look like sensitive fields
+    var name = el.name || el.id || '';
+    // See https://github.com/posthog/posthog-js/issues/165
+    // Under specific circumstances a bug caused .replace to be called on a DOM element
+    // instead of a string, removing the element from the page. Ensure this issue is mitigated.
+    if (typeof name === 'string') {
+        // it's possible for el.name or el.id to be a DOM element if el is a form with a child input[name="name"]
+        var sensitiveNameRegex = /^cc|cardnum|ccnum|creditcard|csc|cvc|cvv|exp|pass|pwd|routing|seccode|securitycode|securitynum|socialsec|socsec|ssn/i;
+        if (sensitiveNameRegex.test(name.replace(/[^a-zA-Z0-9]/g, ''))) {
+            return false;
+        }
+    }
+    return true;
+}
+/*
+ * Check whether a DOM element is 'sensitive' and we should only capture limited data
+ * @param {Element} el - element to check
+ * @returns {boolean} whether the element should be captured
+ */
+export function isSensitiveElement(el) {
+    // don't send data from inputs or similar elements since there will always be
+    // a risk of clientside javascript placing sensitive data in attributes
+    var allowedInputTypes = ['button', 'checkbox', 'submit', 'reset'];
+    if ((isTag(el, 'input') && !allowedInputTypes.includes(el.type)) ||
+        isTag(el, 'select') ||
+        isTag(el, 'textarea') ||
+        el.getAttribute('contenteditable') === 'true') {
+        return true;
+    }
+    return false;
+}
+/*
+ * Check whether a string value should be "captured" or if it may contain sentitive data
+ * using a variety of heuristics.
+ * @param {string} value - string value to check
+ * @returns {boolean} whether the element should be captured
+ */
+export function shouldCaptureValue(value) {
+    if (value === null || _isUndefined(value)) {
+        return false;
+    }
+    if (typeof value === 'string') {
+        value = _trim(value);
+        // check to see if input value looks like a credit card number
+        // see: https://www.safaribooksonline.com/library/view/regular-expressions-cookbook/9781449327453/ch04s20.html
+        var ccRegex = /^(?:(4[0-9]{12}(?:[0-9]{3})?)|(5[1-5][0-9]{14})|(6(?:011|5[0-9]{2})[0-9]{12})|(3[47][0-9]{13})|(3(?:0[0-5]|[68][0-9])[0-9]{11})|((?:2131|1800|35[0-9]{3})[0-9]{11}))$/;
+        if (ccRegex.test((value || '').replace(/[- ]/g, ''))) {
+            return false;
+        }
+        // check to see if input value looks like a social security number
+        var ssnRegex = /(^\d{3}-?\d{2}-?\d{4}$)/;
+        if (ssnRegex.test(value)) {
+            return false;
+        }
+    }
+    return true;
+}
+/*
+ * Check whether an attribute name is an Angular style attr (either _ngcontent or _nghost)
+ * These update on each build and lead to noise in the element chain
+ * More details on the attributes here: https://angular.io/guide/view-encapsulation
+ * @param {string} attributeName - string value to check
+ * @returns {boolean} whether the element is an angular tag
+ */
+export function isAngularStyleAttr(attributeName) {
+    if (typeof attributeName === 'string') {
+        return attributeName.substring(0, 10) === '_ngcontent' || attributeName.substring(0, 7) === '_nghost';
+    }
+    return false;
+}
+/*
+ * Iterate through children of a target element looking for span tags
+ * and return the text content of the span tags, separated by spaces,
+ * along with the direct text content of the target element
+ * @param {Element} target - element to check
+ * @returns {string} text content of the target element and its child span tags
+ */
+export function getDirectAndNestedSpanText(target) {
+    var text = getSafeText(target);
+    text = "".concat(text, " ").concat(getNestedSpanText(target)).trim();
+    return shouldCaptureValue(text) ? text : '';
+}
+/*
+ * Iterate through children of a target element looking for span tags
+ * and return the text content of the span tags, separated by spaces
+ * @param {Element} target - element to check
+ * @returns {string} text content of span tags
+ */
+export function getNestedSpanText(target) {
+    var text = '';
+    if (target && target.childNodes && target.childNodes.length) {
+        _each(target.childNodes, function (child) {
+            var _a;
+            if (child && ((_a = child.tagName) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === 'span') {
+                try {
+                    var spanText = getSafeText(child);
+                    text = "".concat(text, " ").concat(spanText).trim();
+                    if (child.childNodes && child.childNodes.length) {
+                        text = "".concat(text, " ").concat(getNestedSpanText(child)).trim();
+                    }
+                }
+                catch (e) {
+                    console.error(e);
+                }
+            }
+        });
+    }
+    return text;
+}
+//# sourceMappingURL=autocapture-utils.js.map

package/lib/src/autocapture-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"autocapture-utils.js","sourceRoot":"","sources":["../../src/autocapture-utils.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAE/D,MAAM,UAAU,YAAY,CAAC,EAAW;IACpC,QAAQ,OAAO,EAAE,CAAC,SAAS,EAAE;QACzB,KAAK,QAAQ;YACT,OAAO,EAAE,CAAC,SAAS,CAAA;QACvB,gCAAgC;QAChC,KAAK,QAAQ,EAAE,6EAA6E;YACxF,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAE,EAAE,CAAC,SAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;QAC/G;YACI,eAAe;YACf,OAAO,EAAE,CAAA;KAChB;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,EAAW;IACnC,IAAI,MAAM,GAAG,EAAE,CAAA;IAEf,IAAI,oBAAoB,CAAC,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE;QAC9F,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,KAAK;YAChC,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE;gBACxC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC;oBAC9B,qCAAqC;qBACpC,KAAK,CAAC,OAAO,CAAC;qBACd,MAAM,CAAC,kBAAkB,CAAC;qBAC1B,IAAI,CAAC,EAAE,CAAC;oBACT,uBAAuB;qBACtB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;qBACvB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;oBACtB,WAAW;qBACV,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;aACzB;QACL,CAAC,CAAC,CAAA;KACL;IAED,OAAO,KAAK,CAAC,MAAM,CAAC,CAAA;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,EAA8B;IACxD,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,KAAK,CAAC,CAAA,CAAC,mEAAmE;AACxG,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,KAAK,CAAC,EAA8B,EAAE,GAAW;IAC7D,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CAAA;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,EAA8B;IACrD,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,KAAK,CAAC,CAAA,CAAC,gEAAgE;AACrG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAA2C;IAC1E,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,KAAK,EAAE,CAAA,CAAC,6EAA6E;AACnH,CAAC;AAED,MAAM,CAAC,IAAM,6BAA6B,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;AAC5G;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACjC,EAAW,EACX,KAAY,EACZ,iBAA4D;IAA5D,kCAAA,EAAA,6BAA4D;IAE5D,IAAI,CAAC,EAAE,IAAI,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE;QAChD,OAAO,KAAK,CAAA;KACf;IAED,IAAI,iBAAiB,aAAjB,iBAAiB,uBAAjB,iBAAiB,CAAE,aAAa,EAAE;QAClC,IAAM,KAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAA;QAChC,IAAM,SAAS,GAAG,iBAAiB,CAAC,aAAa,CAAA;QACjD,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAC,KAAK,IAAK,OAAA,KAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAhB,CAAgB,CAAC,EAAE;YAC3D,OAAO,KAAK,CAAA;SACf;KACJ;IAED,IAAI,iBAAiB,aAAjB,iBAAiB,uBAAjB,iBAAiB,CAAE,mBAAmB,EAAE;QACxC,IAAM,SAAS,GAAG,iBAAiB,CAAC,mBAAmB,CAAA;QACvD,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAC,SAAS,IAAK,OAAA,KAAK,CAAC,IAAI,KAAK,SAAS,EAAxB,CAAwB,CAAC,EAAE;YACvE,OAAO,KAAK,CAAA;SACf;KACJ;IAED,IAAI,iBAAiB,aAAjB,iBAAiB,uBAAjB,iBAAiB,CAAE,iBAAiB,EAAE;QACtC,IAAM,SAAS,GAAG,iBAAiB,CAAC,iBAAiB,CAAA;QACrD,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAC,WAAW,IAAK,OAAA,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,WAAW,EAAxC,CAAwC,CAAC,EAAE;YACzF,OAAO,KAAK,CAAA;SACf;KACJ;IAED,IAAI,iBAAiB,aAAjB,iBAAiB,uBAAjB,iBAAiB,CAAE,sBAAsB,EAAE;QAC3C,IAAM,SAAS,GAAG,iBAAiB,CAAC,sBAAsB,CAAA;QAC1D,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAC,QAAQ,IAAK,OAAA,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAApB,CAAoB,CAAC,EAAE;YAClE,OAAO,KAAK,CAAA;SACf;KACJ;IAED,IAAI,qBAAqB,GAAG,KAAK,CAAA;IACjC,IAAM,iBAAiB,GAAc,CAAC,EAAE,CAAC,CAAA,CAAC,4CAA4C;IACtF,IAAI,UAAU,GAAsB,IAAI,CAAA;IACxC,IAAI,KAAK,GAAY,EAAE,CAAA;IACvB,OAAO,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;QAC9C,0CAA0C;QAC1C,IAAI,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE;YACtC,iBAAiB,CAAC,IAAI,CAAE,KAAK,CAAC,UAAkB,CAAC,IAAI,CAAC,CAAA;YACtD,KAAK,GAAI,KAAK,CAAC,UAAkB,CAAC,IAAI,CAAA;YACtC,SAAQ;SACX;QACD,UAAU,GAAI,KAAK,CAAC,UAAsB,IAAI,KAAK,CAAA;QACnD,IAAI,CAAC,UAAU;YAAE,MAAK;QACtB,IAAI,6BAA6B,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE;YAC9E,qBAAqB,GAAG,IAAI,CAAA;SAC/B;aAAM;YACH,IAAM,YAAU,GAAG,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAA;YACtD,IAAI,YAAU,IAAI,YAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE;gBACnE,qBAAqB,GAAG,IAAI,CAAA;aAC/B;SACJ;QAED,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAClC,KAAK,GAAG,UAAU,CAAA;KACrB;IAED,IAAM,UAAU,GAAG,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;IAC9C,IAAI,UAAU,IAAI,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE;QAC7F,OAAO,IAAI,CAAA;KACd;IAED,IAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAA;IACpC,QAAQ,GAAG,EAAE;QACT,KAAK,MAAM;YACP,OAAO,KAAK,CAAA;QAChB,KAAK,MAAM;YACP,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAA;QAClC,KAAK,OAAO;YACR,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAA;QAC5D,KAAK,QAAQ,CAAC;QACd,KAAK,UAAU;YACX,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAA;QAC5D;YACI,IAAI,qBAAqB;gBAAE,OAAO,KAAK,CAAC,IAAI,KAAK,OAAO,CAAA;YACxD,OAAO,CACH,KAAK,CAAC,IAAI,KAAK,OAAO;gBACtB,CAAC,6BAA6B,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,iBAAiB,CAAC,KAAK,MAAM,CAAC,CACrG,CAAA;KACR;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAAW;IAC5C,KAAK,IAAI,KAAK,GAAG,EAAE,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,UAAqB,EAAE;QACjG,IAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9C,IAAI,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE;YAC3E,OAAO,KAAK,CAAA;SACf;KACJ;IAED,IAAI,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,EAAE;QACtD,OAAO,IAAI,CAAA;KACd;IAED,0CAA0C;IAC1C,IAAM,IAAI,GAAI,EAAuB,CAAC,IAAI,IAAI,EAAE,CAAA;IAChD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;QAC1B,gGAAgG;QAChG,QAAQ,IAAI,CAAC,WAAW,EAAE,EAAE;YACxB,KAAK,QAAQ;gBACT,OAAO,KAAK,CAAA;YAChB,KAAK,UAAU;gBACX,OAAO,KAAK,CAAA;SACnB;KACJ;IAED,8DAA8D;IAC9D,IAAM,IAAI,GAAI,EAAuB,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAA;IACzD,uDAAuD;IACvD,mFAAmF;IACnF,2FAA2F;IAC3F,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;QAC1B,yGAAyG;QACzG,IAAM,kBAAkB,GACpB,sHAAsH,CAAA;QAC1H,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,EAAE;YAC5D,OAAO,KAAK,CAAA;SACf;KACJ;IAED,OAAO,IAAI,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAW;IAC1C,6EAA6E;IAC7E,uEAAuE;IACvE,IAAM,iBAAiB,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;IACnE,IACI,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAE,EAAuB,CAAC,IAAI,CAAC,CAAC;QAClF,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC;QACnB,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC;QACrB,EAAE,CAAC,YAAY,CAAC,iBAAiB,CAAC,KAAK,MAAM,EAC/C;QACE,OAAO,IAAI,CAAA;KACd;IACD,OAAO,KAAK,CAAA;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC5C,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE;QACvC,OAAO,KAAK,CAAA;KACf;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;QAC3B,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;QAEpB,8DAA8D;QAC9D,8GAA8G;QAC9G,IAAM,OAAO,GACT,uKAAuK,CAAA;QAC3K,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE;YAClD,OAAO,KAAK,CAAA;SACf;QAED,kEAAkE;QAClE,IAAM,QAAQ,GAAG,yBAAyB,CAAA;QAC1C,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YACtB,OAAO,KAAK,CAAA;SACf;KACJ;IAED,OAAO,IAAI,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,aAAqB;IACpD,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE;QACnC,OAAO,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,YAAY,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,CAAA;KACxG;IACD,OAAO,KAAK,CAAA;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAe;IACtD,IAAI,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAC9B,IAAI,GAAG,UAAG,IAAI,cAAI,iBAAiB,CAAC,MAAM,CAAC,CAAE,CAAC,IAAI,EAAE,CAAA;IACpD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAe;IAC7C,IAAI,IAAI,GAAG,EAAE,CAAA;IACb,IAAI,MAAM,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE;QACzD,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,KAAK;;YACpC,IAAI,KAAK,IAAI,CAAA,MAAA,KAAK,CAAC,OAAO,0CAAE,WAAW,EAAE,MAAK,MAAM,EAAE;gBAClD,IAAI;oBACA,IAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;oBACnC,IAAI,GAAG,UAAG,IAAI,cAAI,QAAQ,CAAE,CAAC,IAAI,EAAE,CAAA;oBAEnC,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE;wBAC7C,IAAI,GAAG,UAAG,IAAI,cAAI,iBAAiB,CAAC,KAAK,CAAC,CAAE,CAAC,IAAI,EAAE,CAAA;qBACtD;iBACJ;gBAAC,OAAO,CAAC,EAAE;oBACR,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;iBACnB;aACJ;QACL,CAAC,CAAC,CAAA;KACL;IACD,OAAO,IAAI,CAAA;AACf,CAAC","sourcesContent":["/*\n * Get the className of an element, accounting for edge cases where element.className is an object\n * @param {Element} el - element to get the className of\n * @returns {string} the element's class\n */\nimport { AutocaptureConfig } from 'types'\nimport { _each, _includes, _isUndefined, _trim } from './utils'\n\nexport function getClassName(el: Element): string {\n    switch (typeof el.className) {\n        case 'string':\n            return el.className\n        // TODO: when is this ever used?\n        case 'object': // handle cases where className might be SVGAnimatedString or some other type\n            return ('baseVal' in el.className ? (el.className as any).baseVal : null) || el.getAttribute('class') || ''\n        default:\n            // future proof\n            return ''\n    }\n}\n\n/*\n * Get the direct text content of an element, protecting against sensitive data collection.\n * Concats textContent of each of the element's text node children; this avoids potential\n * collection of sensitive data that could happen if we used element.textContent and the\n * element had sensitive child elements, since element.textContent includes child content.\n * Scrubs values that look like they could be sensitive (i.e. cc or ssn number).\n * @param {Element} el - element to get the text of\n * @returns {string} the element's direct text content\n */\nexport function getSafeText(el: Element): string {\n    let elText = ''\n\n    if (shouldCaptureElement(el) && !isSensitiveElement(el) && el.childNodes && el.childNodes.length) {\n        _each(el.childNodes, function (child) {\n            if (isTextNode(child) && child.textContent) {\n                elText += _trim(child.textContent)\n                    // scrub potentially sensitive values\n                    .split(/(\\s+)/)\n                    .filter(shouldCaptureValue)\n                    .join('')\n                    // normalize whitespace\n                    .replace(/[\\r\\n]/g, ' ')\n                    .replace(/[ ]+/g, ' ')\n                    // truncate\n                    .substring(0, 255)\n            }\n        })\n    }\n\n    return _trim(elText)\n}\n\n/*\n * Check whether an element has nodeType Node.ELEMENT_NODE\n * @param {Element} el - element to check\n * @returns {boolean} whether el is of the correct nodeType\n */\nexport function isElementNode(el: Element | undefined | null): el is HTMLElement {\n    return !!el && el.nodeType === 1 // Node.ELEMENT_NODE - use integer constant for browser portability\n}\n\n/*\n * Check whether an element is of a given tag type.\n * Due to potential reference discrepancies (such as the webcomponents.js polyfill),\n * we want to match tagNames instead of specific references because something like\n * element === document.body won't always work because element might not be a native\n * element.\n * @param {Element} el - element to check\n * @param {string} tag - tag name (e.g., \"div\")\n * @returns {boolean} whether el is of the given tag type\n */\nexport function isTag(el: Element | undefined | null, tag: string): el is HTMLElement {\n    return !!el && !!el.tagName && el.tagName.toLowerCase() === tag.toLowerCase()\n}\n\n/*\n * Check whether an element has nodeType Node.TEXT_NODE\n * @param {Element} el - element to check\n * @returns {boolean} whether el is of the correct nodeType\n */\nexport function isTextNode(el: Element | undefined | null): el is HTMLElement {\n    return !!el && el.nodeType === 3 // Node.TEXT_NODE - use integer constant for browser portability\n}\n\n/*\n * Check whether an element has nodeType Node.DOCUMENT_FRAGMENT_NODE\n * @param {Element} el - element to check\n * @returns {boolean} whether el is of the correct nodeType\n */\nexport function isDocumentFragment(el: Element | ParentNode | undefined | null): el is DocumentFragment {\n    return !!el && el.nodeType === 11 // Node.DOCUMENT_FRAGMENT_NODE - use integer constant for browser portability\n}\n\nexport const autocaptureCompatibleElements = ['a', 'button', 'form', 'input', 'select', 'textarea', 'label']\n/*\n * Check whether a DOM event should be \"captured\" or if it may contain sentitive data\n * using a variety of heuristics.\n * @param {Element} el - element to check\n * @param {Event} event - event to check\n * @param {Object} autocaptureConfig - autocapture config\n * @returns {boolean} whether the event should be captured\n */\nexport function shouldCaptureDomEvent(\n    el: Element,\n    event: Event,\n    autocaptureConfig: AutocaptureConfig | undefined = undefined\n): boolean {\n    if (!el || isTag(el, 'html') || !isElementNode(el)) {\n        return false\n    }\n\n    if (autocaptureConfig?.url_allowlist) {\n        const url = window.location.href\n        const allowlist = autocaptureConfig.url_allowlist\n        if (allowlist && !allowlist.some((regex) => url.match(regex))) {\n            return false\n        }\n    }\n\n    if (autocaptureConfig?.dom_event_allowlist) {\n        const allowlist = autocaptureConfig.dom_event_allowlist\n        if (allowlist && !allowlist.some((eventType) => event.type === eventType)) {\n            return false\n        }\n    }\n\n    if (autocaptureConfig?.element_allowlist) {\n        const allowlist = autocaptureConfig.element_allowlist\n        if (allowlist && !allowlist.some((elementType) => el.tagName.toLowerCase() === elementType)) {\n            return false\n        }\n    }\n\n    if (autocaptureConfig?.css_selector_allowlist) {\n        const allowlist = autocaptureConfig.css_selector_allowlist\n        if (allowlist && !allowlist.some((selector) => el.matches(selector))) {\n            return false\n        }\n    }\n\n    let parentIsUsefulElement = false\n    const targetElementList: Element[] = [el] // TODO: remove this var, it's never queried\n    let parentNode: Element | boolean = true\n    let curEl: Element = el\n    while (curEl.parentNode && !isTag(curEl, 'body')) {\n        // If element is a shadow root, we skip it\n        if (isDocumentFragment(curEl.parentNode)) {\n            targetElementList.push((curEl.parentNode as any).host)\n            curEl = (curEl.parentNode as any).host\n            continue\n        }\n        parentNode = (curEl.parentNode as Element) || false\n        if (!parentNode) break\n        if (autocaptureCompatibleElements.indexOf(parentNode.tagName.toLowerCase()) > -1) {\n            parentIsUsefulElement = true\n        } else {\n            const compStyles = window.getComputedStyle(parentNode)\n            if (compStyles && compStyles.getPropertyValue('cursor') === 'pointer') {\n                parentIsUsefulElement = true\n            }\n        }\n\n        targetElementList.push(parentNode)\n        curEl = parentNode\n    }\n\n    const compStyles = window.getComputedStyle(el)\n    if (compStyles && compStyles.getPropertyValue('cursor') === 'pointer' && event.type === 'click') {\n        return true\n    }\n\n    const tag = el.tagName.toLowerCase()\n    switch (tag) {\n        case 'html':\n            return false\n        case 'form':\n            return event.type === 'submit'\n        case 'input':\n            return event.type === 'change' || event.type === 'click'\n        case 'select':\n        case 'textarea':\n            return event.type === 'change' || event.type === 'click'\n        default:\n            if (parentIsUsefulElement) return event.type === 'click'\n            return (\n                event.type === 'click' &&\n                (autocaptureCompatibleElements.indexOf(tag) > -1 || el.getAttribute('contenteditable') === 'true')\n            )\n    }\n}\n\n/*\n * Check whether a DOM element should be \"captured\" or if it may contain sentitive data\n * using a variety of heuristics.\n * @param {Element} el - element to check\n * @returns {boolean} whether the element should be captured\n */\nexport function shouldCaptureElement(el: Element): boolean {\n    for (let curEl = el; curEl.parentNode && !isTag(curEl, 'body'); curEl = curEl.parentNode as Element) {\n        const classes = getClassName(curEl).split(' ')\n        if (_includes(classes, 'ph-sensitive') || _includes(classes, 'ph-no-capture')) {\n            return false\n        }\n    }\n\n    if (_includes(getClassName(el).split(' '), 'ph-include')) {\n        return true\n    }\n\n    // don't include hidden or password fields\n    const type = (el as HTMLInputElement).type || ''\n    if (typeof type === 'string') {\n        // it's possible for el.type to be a DOM element if el is a form with a child input[name=\"type\"]\n        switch (type.toLowerCase()) {\n            case 'hidden':\n                return false\n            case 'password':\n                return false\n        }\n    }\n\n    // filter out data from fields that look like sensitive fields\n    const name = (el as HTMLInputElement).name || el.id || ''\n    // See https://github.com/posthog/posthog-js/issues/165\n    // Under specific circumstances a bug caused .replace to be called on a DOM element\n    // instead of a string, removing the element from the page. Ensure this issue is mitigated.\n    if (typeof name === 'string') {\n        // it's possible for el.name or el.id to be a DOM element if el is a form with a child input[name=\"name\"]\n        const sensitiveNameRegex =\n            /^cc|cardnum|ccnum|creditcard|csc|cvc|cvv|exp|pass|pwd|routing|seccode|securitycode|securitynum|socialsec|socsec|ssn/i\n        if (sensitiveNameRegex.test(name.replace(/[^a-zA-Z0-9]/g, ''))) {\n            return false\n        }\n    }\n\n    return true\n}\n\n/*\n * Check whether a DOM element is 'sensitive' and we should only capture limited data\n * @param {Element} el - element to check\n * @returns {boolean} whether the element should be captured\n */\nexport function isSensitiveElement(el: Element): boolean {\n    // don't send data from inputs or similar elements since there will always be\n    // a risk of clientside javascript placing sensitive data in attributes\n    const allowedInputTypes = ['button', 'checkbox', 'submit', 'reset']\n    if (\n        (isTag(el, 'input') && !allowedInputTypes.includes((el as HTMLInputElement).type)) ||\n        isTag(el, 'select') ||\n        isTag(el, 'textarea') ||\n        el.getAttribute('contenteditable') === 'true'\n    ) {\n        return true\n    }\n    return false\n}\n\n/*\n * Check whether a string value should be \"captured\" or if it may contain sentitive data\n * using a variety of heuristics.\n * @param {string} value - string value to check\n * @returns {boolean} whether the element should be captured\n */\nexport function shouldCaptureValue(value: string): boolean {\n    if (value === null || _isUndefined(value)) {\n        return false\n    }\n\n    if (typeof value === 'string') {\n        value = _trim(value)\n\n        // check to see if input value looks like a credit card number\n        // see: https://www.safaribooksonline.com/library/view/regular-expressions-cookbook/9781449327453/ch04s20.html\n        const ccRegex =\n            /^(?:(4[0-9]{12}(?:[0-9]{3})?)|(5[1-5][0-9]{14})|(6(?:011|5[0-9]{2})[0-9]{12})|(3[47][0-9]{13})|(3(?:0[0-5]|[68][0-9])[0-9]{11})|((?:2131|1800|35[0-9]{3})[0-9]{11}))$/\n        if (ccRegex.test((value || '').replace(/[- ]/g, ''))) {\n            return false\n        }\n\n        // check to see if input value looks like a social security number\n        const ssnRegex = /(^\\d{3}-?\\d{2}-?\\d{4}$)/\n        if (ssnRegex.test(value)) {\n            return false\n        }\n    }\n\n    return true\n}\n\n/*\n * Check whether an attribute name is an Angular style attr (either _ngcontent or _nghost)\n * These update on each build and lead to noise in the element chain\n * More details on the attributes here: https://angular.io/guide/view-encapsulation\n * @param {string} attributeName - string value to check\n * @returns {boolean} whether the element is an angular tag\n */\nexport function isAngularStyleAttr(attributeName: string): boolean {\n    if (typeof attributeName === 'string') {\n        return attributeName.substring(0, 10) === '_ngcontent' || attributeName.substring(0, 7) === '_nghost'\n    }\n    return false\n}\n\n/*\n * Iterate through children of a target element looking for span tags\n * and return the text content of the span tags, separated by spaces,\n * along with the direct text content of the target element\n * @param {Element} target - element to check\n * @returns {string} text content of the target element and its child span tags\n */\nexport function getDirectAndNestedSpanText(target: Element): string {\n    let text = getSafeText(target)\n    text = `${text} ${getNestedSpanText(target)}`.trim()\n    return shouldCaptureValue(text) ? text : ''\n}\n\n/*\n * Iterate through children of a target element looking for span tags\n * and return the text content of the span tags, separated by spaces\n * @param {Element} target - element to check\n * @returns {string} text content of span tags\n */\nexport function getNestedSpanText(target: Element): string {\n    let text = ''\n    if (target && target.childNodes && target.childNodes.length) {\n        _each(target.childNodes, function (child) {\n            if (child && child.tagName?.toLowerCase() === 'span') {\n                try {\n                    const spanText = getSafeText(child)\n                    text = `${text} ${spanText}`.trim()\n\n                    if (child.childNodes && child.childNodes.length) {\n                        text = `${text} ${getNestedSpanText(child)}`.trim()\n                    }\n                } catch (e) {\n                    console.error(e)\n                }\n            }\n        })\n    }\n    return text\n}\n"]}

package/lib/src/autocapture.d.ts

@@ -0,0 +1,27 @@
+import RageClick from './extensions/rageclick';
+import { AutocaptureConfig, AutoCaptureCustomProperty, DecideResponse, Properties } from './types';
+import { PostHog } from './posthog-core';
+declare const autocapture: {
+    _initializedTokens: string[];
+    _isDisabledServerSide: boolean | null;
+    _isAutocaptureEnabled: boolean;
+    _setIsAutocaptureEnabled: (instance: PostHog) => void;
+    _previousElementSibling: (el: Element) => Element | null;
+    _getAugmentPropertiesFromElement: (elem: Element) => Properties;
+    _getPropertiesFromElement: (elem: Element, maskInputs: boolean, maskText: boolean) => Properties;
+    _getDefaultProperties: (eventType: string) => Properties;
+    _extractCustomPropertyValue: (customProperty: AutoCaptureCustomProperty) => string;
+    _getCustomProperties: (targetElementList: Element[]) => Properties;
+    _getEventTarget: (e: Event) => Element | null;
+    _captureEvent: (e: Event, instance: PostHog, eventName?: string) => boolean | void;
+    _navigate: (href: string) => void;
+    _addDomEventHandlers: (instance: PostHog) => void;
+    _customProperties: AutoCaptureCustomProperty[];
+    rageclicks: RageClick | null;
+    config: AutocaptureConfig | undefined;
+    init: (instance: PostHog) => void;
+    afterDecideResponse: (response: DecideResponse, instance: PostHog) => void;
+    enabledForProject: (token: string | null | undefined, numBuckets: number, numEnabledBuckets: number) => boolean;
+    isBrowserSupported: () => boolean;
+};
+export { autocapture };