Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add payload host denylist #1282

Merged
merged 2 commits into from
Jul 3, 2024
Merged

Conversation

pauldambra
Copy link
Member

@pauldambra pauldambra commented Jul 3, 2024

We've seen replay message be rejected for being too large
And on inspection they contain many megabytes of replay data for other vendors
There's no point capturing those payloads 🙈

  • adds a default deny list
  • adds a hook that we could use to start extending it via decide response
  • ...

Verified

This commit was signed with the committer’s verified signature.
pradyunsg Pradyun Gedam
Copy link

vercel bot commented Jul 3, 2024

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Updated (UTC)
posthog-js ✅ Ready (Inspect) Visit Preview Jul 3, 2024 2:03pm

@pauldambra pauldambra requested a review from daibhin July 3, 2024 13:47
@pauldambra pauldambra added the bump minor Bump minor version when this PR gets merged label Jul 3, 2024
import { NetworkRecordOptions } from '../../../../types'
import { isHostOnDenyList } from '../../../../extensions/replay/external/denylist'

describe('network host denylist', () => {
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

made me sad "we" weren't testing any network recorder code

Copy link

github-actions bot commented Jul 3, 2024

Size Change: +4.67 kB (+0.41%)

Total Size: 1.15 MB

Filename Size Change
dist/array.full.js 317 kB +1.47 kB (+0.47%)
dist/array.js 154 kB +144 B (+0.09%)
dist/main.js 155 kB +144 B (+0.09%)
dist/module.js 154 kB +144 B (+0.09%)
dist/recorder-v2.js 110 kB +1.38 kB (+1.27%)
dist/recorder.js 110 kB +1.38 kB (+1.27%)
ℹ️ View Unchanged
Filename Size
dist/exception-autocapture.js 10.4 kB
dist/surveys-preview.js 60.3 kB
dist/surveys.js 65.4 kB
dist/tracing-headers.js 8.26 kB
dist/web-vitals.js 5.79 kB

compressed-size-action

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

giving us a place we can start moving code out of the entrypoint file
as we do we should add a lint rule restricting what can import it

Comment on lines +19 to +23
const defaultNotDenied = { hostname, isHostDenied: false }

if (!options.payloadHostDenyList?.length || !hostname?.trim().length) {
return defaultNotDenied
}
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fail open

}

for (const deny of options.payloadHostDenyList) {
if (hostname.endsWith(deny)) {
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

went with endsWith over regex or something...

so that we can say e.g. .lr-ingest.io and not get any of their payloads

Verified

This commit was signed with the committer’s verified signature.
pradyunsg Pradyun Gedam
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bump minor Bump minor version when this PR gets merged
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants