Repository navigation
feat: add capture sanitization controls - #468
Merged
Merged
Conversation
Co-authored-by: Codex <noreply@openai.com>
sam-cook
requested review from
AHB,
Billlynch,
andreas-karlsson,
fabriziodemaria,
mfranberg,
nicklasl,
umberto-sonnino and
vahidlazio
as code owners
September 17, 2026 15:48
`Recorder.stop()` cleared the network sanitizer, but `restoreNetwork()`
cannot cancel in-flight requests — their patched handlers still emit
afterwards. Those emits took the no-sanitizer branch and shipped raw
URLs, and `uploader.close()` does not reject later frames, so they
uploaded. Stop often coincides with unload, which is exactly when
requests are in flight. The fields are reassigned on every `start()`,
so the clearing had no other purpose. Adds a regression test.
Simplifications, no behavior change:
- Collapse `sanitizeCapturedValue`, `sanitizeCapturedValues`,
`createOnceCaptureLogger`, `logSanitizerFailure` and
`applyBuiltInSanitizer` into one `createValueSanitizer` factory.
Call sites no longer thread `(value, sanitizer, source, logger)`,
and the duplicated try/catch around the diagnostic logger is gone.
- Drop `emitNetworkRequestEvent` and one `Recorder` field.
- Drop `isConsoleLogData`/`isConsoleLogLevel`/`isStringArray`. rrweb's
`LogData` is always `{ level, payload: string[], trace: string[] }`,
and the only levels it emits are the ones we pass plus error/warn,
so the guard could never reject real data. Malformed fields still
fail closed.
- Stop routing debug messages by sniffing a `[CSR] SECURITY:` prefix.
The message text lived in csr-recorder and the match lived in
session-recording with no shared constant, so a reworded message
would have silently degraded the routing.
- Fix the README paragraph order — a sentence ended in `:` followed by
an unrelated paragraph — and stop duplicating the detail in both.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Replaces the one `createValueSanitizer` factory with four small pieces, each with one job and each testable on its own: - `stripUrlsInText` — the console built-in policy - `getValueSanitizer` — policy selection plus string-return enforcement - `createOnceLogger` — log at most once, never throw at the host app - `dropOnFailure` — fail closed while building one captured event The real reduction is in how failure travels. `ValueSanitizer` now throws instead of returning `string | undefined`, so callers no longer propagate `undefined` by hand. That deletes `sanitizeField` and its `.every` type-predicate narrowing, and collapses the console observer's two undefined checks into one. Malformed plugin data now fails closed through the same path, because mapping over a non-array throws. That restores the SECURITY warning the previous commit had dropped, with no dedicated branch for it. Measured with eslint's `complexity` rule, complexity added over main: as submitted 53 first pass 31 this commit 28 capture-sanitizer.ts peak 5 -> 3 console-capture-plugin.ts 27 -> 10 total, 8 functions -> 4 `recorder.ts` goes up 2, the cost of the extra closure on its single emit site. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The existing failure tests use a sanitizer that throws for every value, so they proved per-event retry but never that a later good event still gets captured. These cover the selective case on both channels: the event whose value the sanitizer cannot handle is skipped, and the next one is captured normally. Recording and the host application continue either way. Both passed on the first run — this documents existing behavior rather than changing it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
AHB
approved these changes
Sep 18, 2026
Collaborator
Author
|
Local browser integration test completed:
|
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi There, I just made a Pull Request!
Adds opt-in sanitization controls for captured network URLs and console output while preserving the existing raw-capture behavior.
sanitize: truestrips query strings and fragments.CSR_DEBUGis enabled.✔️ Checklist
Validation
yarn prettier --check .yarn run -T eslint --no-eslintrc --config .eslintrc 'csr/*/src/**/*.{tsx,ts}'yarn test:csr— 17 files, 244 tests passedyarn build:csrgit diff --checkGenerated with Codex.