Marc Mintel
5397309103
Some checks failed
Build & Deploy / 🔍 Prepare (push) Successful in 20s
Build & Deploy / 🧪 QA (push) Failing after 34s
Build & Deploy / 🏗️ Build (push) Has started running
Build & Deploy / 🚀 Deploy (push) Has been cancelled
Build & Deploy / 🧪 Smoke Test (push) Has been cancelled
Build & Deploy / ⚡ Lighthouse (push) Has been cancelled
Build & Deploy / 🔔 Notify (push) Has been cancelled
1 line
14 KiB
Plaintext
1 line
14 KiB
Plaintext
{"version":3,"file":"request.js","sources":["../../../src/utils/request.ts"],"sourcesContent":["import type { PolymorphicRequest } from '../types-hoist/polymorphics';\nimport type { RequestEventData } from '../types-hoist/request';\nimport type { WebFetchHeaders, WebFetchRequest } from '../types-hoist/webfetchapi';\n\n/**\n * Transforms a `Headers` object that implements the `Web Fetch API` (https://developer.mozilla.org/en-US/docs/Web/API/Headers) into a simple key-value dict.\n * The header keys will be lower case: e.g. A \"Content-Type\" header will be stored as \"content-type\".\n */\nexport function winterCGHeadersToDict(winterCGHeaders: WebFetchHeaders): Record<string, string> {\n const headers: Record<string, string> = {};\n try {\n winterCGHeaders.forEach((value, key) => {\n if (typeof value === 'string') {\n // We check that value is a string even though it might be redundant to make sure prototype pollution is not possible.\n headers[key] = value;\n }\n });\n } catch {\n // just return the empty headers\n }\n\n return headers;\n}\n\n/**\n * Convert common request headers to a simple dictionary.\n */\nexport function headersToDict(reqHeaders: Record<string, string | string[] | undefined>): Record<string, string> {\n const headers: Record<string, string> = Object.create(null);\n\n try {\n Object.entries(reqHeaders).forEach(([key, value]) => {\n if (typeof value === 'string') {\n headers[key] = value;\n }\n });\n } catch {\n // just return the empty headers\n }\n\n return headers;\n}\n\n/**\n * Converts a `Request` object that implements the `Web Fetch API` (https://developer.mozilla.org/en-US/docs/Web/API/Headers) into the format that the `RequestData` integration understands.\n */\nexport function winterCGRequestToRequestData(req: WebFetchRequest): RequestEventData {\n const headers = winterCGHeadersToDict(req.headers);\n\n return {\n method: req.method,\n url: req.url,\n query_string: extractQueryParamsFromUrl(req.url),\n headers,\n // TODO: Can we extract body data from the request?\n };\n}\n\n/**\n * Convert a HTTP request object to RequestEventData to be passed as normalizedRequest.\n * Instead of allowing `PolymorphicRequest` to be passed,\n * we want to be more specific and generally require a http.IncomingMessage-like object.\n */\nexport function httpRequestToRequestData(request: {\n method?: string;\n url?: string;\n headers?: {\n [key: string]: string | string[] | undefined;\n };\n protocol?: string;\n socket?: {\n encrypted?: boolean;\n remoteAddress?: string;\n };\n}): RequestEventData {\n const headers = request.headers || {};\n\n // Check for x-forwarded-host first, then fall back to host header\n const forwardedHost = typeof headers['x-forwarded-host'] === 'string' ? headers['x-forwarded-host'] : undefined;\n const host = forwardedHost || (typeof headers.host === 'string' ? headers.host : undefined);\n\n // Check for x-forwarded-proto first, then fall back to existing protocol detection\n const forwardedProto = typeof headers['x-forwarded-proto'] === 'string' ? headers['x-forwarded-proto'] : undefined;\n const protocol = forwardedProto || request.protocol || (request.socket?.encrypted ? 'https' : 'http');\n\n const url = request.url || '';\n\n const absoluteUrl = getAbsoluteUrl({\n url,\n host,\n protocol,\n });\n\n // This is non-standard, but may be sometimes set\n // It may be overwritten later by our own body handling\n const data = (request as PolymorphicRequest).body || undefined;\n\n // This is non-standard, but may be set on e.g. Next.js or Express requests\n const cookies = (request as PolymorphicRequest).cookies;\n\n return {\n url: absoluteUrl,\n method: request.method,\n query_string: extractQueryParamsFromUrl(url),\n headers: headersToDict(headers),\n cookies,\n data,\n };\n}\n\nfunction getAbsoluteUrl({\n url,\n protocol,\n host,\n}: {\n url?: string;\n protocol: string;\n host?: string;\n}): string | undefined {\n if (url?.startsWith('http')) {\n return url;\n }\n\n if (url && host) {\n return `${protocol}://${host}${url}`;\n }\n\n return undefined;\n}\n\nconst SENSITIVE_HEADER_SNIPPETS = [\n 'auth',\n 'token',\n 'secret',\n 'session', // for the user_session cookie\n 'password',\n 'passwd',\n 'pwd',\n 'key',\n 'jwt',\n 'bearer',\n 'sso',\n 'saml',\n 'csrf',\n 'xsrf',\n 'credentials',\n // Always treat cookie headers as sensitive in case individual key-value cookie pairs cannot properly be extracted\n 'set-cookie',\n 'cookie',\n];\n\nconst PII_HEADER_SNIPPETS = ['x-forwarded-', '-user'];\n\n/**\n * Converts incoming HTTP request headers to OpenTelemetry span attributes following semantic conventions.\n * Header names are converted to the format: http.request.header.<key>\n * where <key> is the header name in lowercase with dashes converted to underscores.\n *\n * @see https://opentelemetry.io/docs/specs/semconv/registry/attributes/http/#http-request-header\n */\nexport function httpHeadersToSpanAttributes(\n headers: Record<string, string | string[] | undefined>,\n sendDefaultPii: boolean = false,\n): Record<string, string> {\n const spanAttributes: Record<string, string> = {};\n\n try {\n Object.entries(headers).forEach(([key, value]) => {\n if (value == null) {\n return;\n }\n\n const lowerCasedHeaderKey = key.toLowerCase();\n const isCookieHeader = lowerCasedHeaderKey === 'cookie' || lowerCasedHeaderKey === 'set-cookie';\n\n if (isCookieHeader && typeof value === 'string' && value !== '') {\n // Set-Cookie: single cookie with attributes (\"name=value; HttpOnly; Secure\")\n // Cookie: multiple cookies separated by \"; \" (\"cookie1=value1; cookie2=value2\")\n const isSetCookie = lowerCasedHeaderKey === 'set-cookie';\n const semicolonIndex = value.indexOf(';');\n const cookieString = isSetCookie && semicolonIndex !== -1 ? value.substring(0, semicolonIndex) : value;\n const cookies = isSetCookie ? [cookieString] : cookieString.split('; ');\n\n for (const cookie of cookies) {\n // Split only at the first '=' to preserve '=' characters in cookie values\n const equalSignIndex = cookie.indexOf('=');\n const cookieKey = equalSignIndex !== -1 ? cookie.substring(0, equalSignIndex) : cookie;\n const cookieValue = equalSignIndex !== -1 ? cookie.substring(equalSignIndex + 1) : '';\n\n const lowerCasedCookieKey = cookieKey.toLowerCase();\n\n addSpanAttribute(spanAttributes, lowerCasedHeaderKey, lowerCasedCookieKey, cookieValue, sendDefaultPii);\n }\n } else {\n addSpanAttribute(spanAttributes, lowerCasedHeaderKey, '', value, sendDefaultPii);\n }\n });\n } catch {\n // Return empty object if there's an error\n }\n\n return spanAttributes;\n}\n\nfunction normalizeAttributeKey(key: string): string {\n return key.replace(/-/g, '_');\n}\n\nfunction addSpanAttribute(\n spanAttributes: Record<string, string>,\n headerKey: string,\n cookieKey: string,\n value: string | string[] | undefined,\n sendPii: boolean,\n): void {\n const normalizedKey = cookieKey\n ? `http.request.header.${normalizeAttributeKey(headerKey)}.${normalizeAttributeKey(cookieKey)}`\n : `http.request.header.${normalizeAttributeKey(headerKey)}`;\n\n const headerValue = handleHttpHeader(cookieKey || headerKey, value, sendPii);\n if (headerValue !== undefined) {\n spanAttributes[normalizedKey] = headerValue;\n }\n}\n\nfunction handleHttpHeader(\n lowerCasedKey: string,\n value: string | string[] | undefined,\n sendPii: boolean,\n): string | undefined {\n const isSensitive = sendPii\n ? SENSITIVE_HEADER_SNIPPETS.some(snippet => lowerCasedKey.includes(snippet))\n : [...PII_HEADER_SNIPPETS, ...SENSITIVE_HEADER_SNIPPETS].some(snippet => lowerCasedKey.includes(snippet));\n\n if (isSensitive) {\n return '[Filtered]';\n } else if (Array.isArray(value)) {\n return value.map(v => (v != null ? String(v) : v)).join(';');\n } else if (typeof value === 'string') {\n return value;\n }\n\n return undefined;\n}\n\n/** Extract the query params from an URL. */\nexport function extractQueryParamsFromUrl(url: string): string | undefined {\n // url is path and query string\n if (!url) {\n return;\n }\n\n try {\n // The `URL` constructor can't handle internal URLs of the form `/some/path/here`, so stick a dummy protocol and\n // hostname as the base. Since the point here is just to grab the query string, it doesn't matter what we use.\n const queryParams = new URL(url, 'http://s.io').search.slice(1);\n return queryParams.length ? queryParams : undefined;\n } catch {\n return undefined;\n }\n}\n"],"names":[],"mappings":"AAIA;AACA;AACA;AACA;AACO,SAAS,qBAAqB,CAAC,eAAe,EAA2C;AAChG,EAAE,MAAM,OAAO,GAA2B,EAAE;AAC5C,EAAE,IAAI;AACN,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,KAAK;AAC5C,MAAM,IAAI,OAAO,KAAA,KAAU,QAAQ,EAAE;AACrC;AACA,QAAQ,OAAO,CAAC,GAAG,CAAA,GAAI,KAAK;AAC5B,MAAM;AACN,IAAI,CAAC,CAAC;AACN,EAAE,EAAE,MAAM;AACV;AACA,EAAE;;AAEF,EAAE,OAAO,OAAO;AAChB;;AAEA;AACA;AACA;AACO,SAAS,aAAa,CAAC,UAAU,EAAyE;AACjH,EAAE,MAAM,OAAO,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;;AAE7D,EAAE,IAAI;AACN,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK;AACzD,MAAM,IAAI,OAAO,KAAA,KAAU,QAAQ,EAAE;AACrC,QAAQ,OAAO,CAAC,GAAG,CAAA,GAAI,KAAK;AAC5B,MAAM;AACN,IAAI,CAAC,CAAC;AACN,EAAE,EAAE,MAAM;AACV;AACA,EAAE;;AAEF,EAAE,OAAO,OAAO;AAChB;;AAEA;AACA;AACA;AACO,SAAS,4BAA4B,CAAC,GAAG,EAAqC;AACrF,EAAE,MAAM,UAAU,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC;;AAEpD,EAAE,OAAO;AACT,IAAI,MAAM,EAAE,GAAG,CAAC,MAAM;AACtB,IAAI,GAAG,EAAE,GAAG,CAAC,GAAG;AAChB,IAAI,YAAY,EAAE,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC;AACpD,IAAI,OAAO;AACX;AACA,GAAG;AACH;;AAEA;AACA;AACA;AACA;AACA;AACO,SAAS,wBAAwB,CAAC;;AAWzC,EAAqB;AACrB,EAAE,MAAM,UAAU,OAAO,CAAC,OAAA,IAAW,EAAE;;AAEvC;AACA,EAAE,MAAM,aAAA,GAAgB,OAAO,OAAO,CAAC,kBAAkB,CAAA,KAAM,QAAA,GAAW,OAAO,CAAC,kBAAkB,CAAA,GAAI,SAAS;AACjH,EAAE,MAAM,IAAA,GAAO,kBAAkB,OAAO,OAAO,CAAC,IAAA,KAAS,WAAW,OAAO,CAAC,IAAA,GAAO,SAAS,CAAC;;AAE7F;AACA,EAAE,MAAM,cAAA,GAAiB,OAAO,OAAO,CAAC,mBAAmB,CAAA,KAAM,QAAA,GAAW,OAAO,CAAC,mBAAmB,CAAA,GAAI,SAAS;AACpH,EAAE,MAAM,QAAA,GAAW,kBAAkB,OAAO,CAAC,QAAA,KAAa,OAAO,CAAC,MAAM,EAAE,SAAA,GAAY,OAAA,GAAU,MAAM,CAAC;;AAEvG,EAAE,MAAM,GAAA,GAAM,OAAO,CAAC,GAAA,IAAO,EAAE;;AAE/B,EAAE,MAAM,WAAA,GAAc,cAAc,CAAC;AACrC,IAAI,GAAG;AACP,IAAI,IAAI;AACR,IAAI,QAAQ;AACZ,GAAG,CAAC;;AAEJ;AACA;AACA,EAAE,MAAM,OAAO,CAAC,UAA+B,IAAA,IAAQ,SAAS;;AAEhE;AACA,EAAE,MAAM,OAAA,GAAU,CAAC,OAAA,GAA+B,OAAO;;AAEzD,EAAE,OAAO;AACT,IAAI,GAAG,EAAE,WAAW;AACpB,IAAI,MAAM,EAAE,OAAO,CAAC,MAAM;AAC1B,IAAI,YAAY,EAAE,yBAAyB,CAAC,GAAG,CAAC;AAChD,IAAI,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC;AACnC,IAAI,OAAO;AACX,IAAI,IAAI;AACR,GAAG;AACH;;AAEA,SAAS,cAAc,CAAC;AACxB,EAAE,GAAG;AACL,EAAE,QAAQ;AACV,EAAE,IAAI;AACN;;AAIA,EAAuB;AACvB,EAAE,IAAI,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE;AAC/B,IAAI,OAAO,GAAG;AACd,EAAE;;AAEF,EAAE,IAAI,GAAA,IAAO,IAAI,EAAE;AACnB,IAAI,OAAO,CAAC,EAAA,QAAA,CAAA,GAAA,EAAA,IAAA,CAAA,EAAA,GAAA,CAAA,CAAA;AACA,EAAA;;AAEA,EAAA,OAAA,SAAA;AACA;;AAEA,MAAA,yBAAA,GAAA;AACA,EAAA,MAAA;AACA,EAAA,OAAA;AACA,EAAA,QAAA;AACA,EAAA,SAAA;AACA,EAAA,UAAA;AACA,EAAA,QAAA;AACA,EAAA,KAAA;AACA,EAAA,KAAA;AACA,EAAA,KAAA;AACA,EAAA,QAAA;AACA,EAAA,KAAA;AACA,EAAA,MAAA;AACA,EAAA,MAAA;AACA,EAAA,MAAA;AACA,EAAA,aAAA;AACA;AACA,EAAA,YAAA;AACA,EAAA,QAAA;AACA,CAAA;;AAEA,MAAA,mBAAA,GAAA,CAAA,cAAA,EAAA,OAAA,CAAA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAA,2BAAA;AACA,EAAA,OAAA;AACA,EAAA,cAAA,GAAA,KAAA;AACA,EAAA;AACA,EAAA,MAAA,cAAA,GAAA,EAAA;;AAEA,EAAA,IAAA;AACA,IAAA,MAAA,CAAA,OAAA,CAAA,OAAA,CAAA,CAAA,OAAA,CAAA,CAAA,CAAA,GAAA,EAAA,KAAA,CAAA,KAAA;AACA,MAAA,IAAA,KAAA,IAAA,IAAA,EAAA;AACA,QAAA;AACA,MAAA;;AAEA,MAAA,MAAA,mBAAA,GAAA,GAAA,CAAA,WAAA,EAAA;AACA,MAAA,MAAA,cAAA,GAAA,mBAAA,KAAA,QAAA,IAAA,mBAAA,KAAA,YAAA;;AAEA,MAAA,IAAA,cAAA,IAAA,OAAA,KAAA,KAAA,QAAA,IAAA,KAAA,KAAA,EAAA,EAAA;AACA;AACA;AACA,QAAA,MAAA,WAAA,GAAA,mBAAA,KAAA,YAAA;AACA,QAAA,MAAA,cAAA,GAAA,KAAA,CAAA,OAAA,CAAA,GAAA,CAAA;AACA,QAAA,MAAA,YAAA,GAAA,WAAA,IAAA,cAAA,KAAA,CAAA,CAAA,GAAA,KAAA,CAAA,SAAA,CAAA,CAAA,EAAA,cAAA,CAAA,GAAA,KAAA;AACA,QAAA,MAAA,OAAA,GAAA,WAAA,GAAA,CAAA,YAAA,CAAA,GAAA,YAAA,CAAA,KAAA,CAAA,IAAA,CAAA;;AAEA,QAAA,KAAA,MAAA,MAAA,IAAA,OAAA,EAAA;AACA;AACA,UAAA,MAAA,cAAA,GAAA,MAAA,CAAA,OAAA,CAAA,GAAA,CAAA;AACA,UAAA,MAAA,SAAA,GAAA,cAAA,KAAA,CAAA,CAAA,GAAA,MAAA,CAAA,SAAA,CAAA,CAAA,EAAA,cAAA,CAAA,GAAA,MAAA;AACA,UAAA,MAAA,WAAA,GAAA,cAAA,KAAA,CAAA,CAAA,GAAA,MAAA,CAAA,SAAA,CAAA,cAAA,GAAA,CAAA,CAAA,GAAA,EAAA;;AAEA,UAAA,MAAA,mBAAA,GAAA,SAAA,CAAA,WAAA,EAAA;;AAEA,UAAA,gBAAA,CAAA,cAAA,EAAA,mBAAA,EAAA,mBAAA,EAAA,WAAA,EAAA,cAAA,CAAA;AACA,QAAA;AACA,MAAA,CAAA,MAAA;AACA,QAAA,gBAAA,CAAA,cAAA,EAAA,mBAAA,EAAA,EAAA,EAAA,KAAA,EAAA,cAAA,CAAA;AACA,MAAA;AACA,IAAA,CAAA,CAAA;AACA,EAAA,CAAA,CAAA,MAAA;AACA;AACA,EAAA;;AAEA,EAAA,OAAA,cAAA;AACA;;AAEA,SAAA,qBAAA,CAAA,GAAA,EAAA;AACA,EAAA,OAAA,GAAA,CAAA,OAAA,CAAA,IAAA,EAAA,GAAA,CAAA;AACA;;AAEA,SAAA,gBAAA;AACA,EAAA,cAAA;AACA,EAAA,SAAA;AACA,EAAA,SAAA;AACA,EAAA,KAAA;AACA,EAAA,OAAA;AACA,EAAA;AACA,EAAA,MAAA,aAAA,GAAA;AACA,MAAA,CAAA,oBAAA,EAAA,qBAAA,CAAA,SAAA,CAAA,CAAA,CAAA,EAAA,qBAAA,CAAA,SAAA,CAAA,CAAA;AACA,MAAA,CAAA,oBAAA,EAAA,qBAAA,CAAA,SAAA,CAAA,CAAA,CAAA;;AAEA,EAAA,MAAA,WAAA,GAAA,gBAAA,CAAA,SAAA,IAAA,SAAA,EAAA,KAAA,EAAA,OAAA,CAAA;AACA,EAAA,IAAA,WAAA,KAAA,SAAA,EAAA;AACA,IAAA,cAAA,CAAA,aAAA,CAAA,GAAA,WAAA;AACA,EAAA;AACA;;AAEA,SAAA,gBAAA;AACA,EAAA,aAAA;AACA,EAAA,KAAA;AACA,EAAA,OAAA;AACA,EAAA;AACA,EAAA,MAAA,WAAA,GAAA;AACA,MAAA,yBAAA,CAAA,IAAA,CAAA,OAAA,IAAA,aAAA,CAAA,QAAA,CAAA,OAAA,CAAA;AACA,MAAA,CAAA,GAAA,mBAAA,EAAA,GAAA,yBAAA,CAAA,CAAA,IAAA,CAAA,OAAA,IAAA,aAAA,CAAA,QAAA,CAAA,OAAA,CAAA,CAAA;;AAEA,EAAA,IAAA,WAAA,EAAA;AACA,IAAA,OAAA,YAAA;AACA,EAAA,CAAA,MAAA,IAAA,KAAA,CAAA,OAAA,CAAA,KAAA,CAAA,EAAA;AACA,IAAA,OAAA,KAAA,CAAA,GAAA,CAAA,CAAA,KAAA,CAAA,IAAA,IAAA,GAAA,MAAA,CAAA,CAAA,CAAA,GAAA,CAAA,CAAA,CAAA,CAAA,IAAA,CAAA,GAAA,CAAA;AACA,EAAA,CAAA,MAAA,IAAA,OAAA,KAAA,KAAA,QAAA,EAAA;AACA,IAAA,OAAA,KAAA;AACA,EAAA;;AAEA,EAAA,OAAA,SAAA;AACA;;AAEA;AACA,SAAA,yBAAA,CAAA,GAAA,EAAA;AACA;AACA,EAAA,IAAA,CAAA,GAAA,EAAA;AACA,IAAA;AACA,EAAA;;AAEA,EAAA,IAAA;AACA;AACA;AACA,IAAA,MAAA,WAAA,GAAA,IAAA,GAAA,CAAA,GAAA,EAAA,aAAA,CAAA,CAAA,MAAA,CAAA,KAAA,CAAA,CAAA,CAAA;AACA,IAAA,OAAA,WAAA,CAAA,MAAA,GAAA,WAAA,GAAA,SAAA;AACA,EAAA,CAAA,CAAA,MAAA;AACA,IAAA,OAAA,SAAA;AACA,EAAA;AACA;;;;"} |