💥[RUMF-1152] sanitize resource method names (#2288)

DataDog · Jun 7, 2023 · fad84dd · fad84dd
1 parent c928b60
commit fad84dd
Show file tree

Hide file tree

Showing 4 changed files with 21 additions and 3 deletions.
diff --git a/packages/core/src/browser/fetchObservable.spec.ts b/packages/core/src/browser/fetchObservable.spec.ts
@@ -113,6 +113,7 @@ describe('fetch proxy', () => {
     fetchStub(new Request(FAKE_URL, { method: 'PUT' }), { method: 'POST' }).resolveWith({ status: 500 })
     fetchStub(new Request(FAKE_URL), { method: 'POST' }).resolveWith({ status: 500 })
     fetchStub(FAKE_URL, { method: 'POST' }).resolveWith({ status: 500 })
+    fetchStub(FAKE_URL, { method: 'post' }).resolveWith({ status: 500 })
     fetchStub(null as any).resolveWith({ status: 500 })
     fetchStub({ method: 'POST' } as any).resolveWith({ status: 500 })
 
@@ -123,8 +124,9 @@ describe('fetch proxy', () => {
       expect(requests[3].method).toEqual('POST')
       expect(requests[4].method).toEqual('POST')
       expect(requests[5].method).toEqual('POST')
-      expect(requests[6].method).toEqual('GET')
+      expect(requests[6].method).toEqual('POST')
       expect(requests[7].method).toEqual('GET')
+      expect(requests[8].method).toEqual('GET')
       done()
     })
   })

diff --git a/packages/core/src/browser/fetchObservable.ts b/packages/core/src/browser/fetchObservable.ts
@@ -69,7 +69,8 @@ function createFetchObservable() {
 }
 
 function beforeSend(observable: Observable<FetchContext>, input: unknown, init?: RequestInit) {
-  const method = (init && init.method) || (input instanceof Request && input.method) || 'GET'
+  const methodFromParams = (init && init.method) || (input instanceof Request && input.method)
+  const method = methodFromParams ? methodFromParams.toUpperCase() : 'GET'
   const url = input instanceof Request ? input.url : normalizeUrl(String(input))
   const startClocks = clocksNow()
 

diff --git a/packages/core/src/browser/xhrObservable.spec.ts b/packages/core/src/browser/xhrObservable.spec.ts
@@ -53,6 +53,21 @@ describe('xhr observable', () => {
     })
   })
 
+  it('should sanitize request method', (done) => {
+    withXhr({
+      setup(xhr) {
+        xhr.open('get', '/ok')
+        xhr.send()
+        xhr.complete(200, 'ok')
+      },
+      onComplete() {
+        const request = requests[0]
+        expect(request.method).toBe('GET')
+        done()
+      },
+    })
+  })
+
   it('should track client error', (done) => {
     withXhr({
       setup(xhr) {

diff --git a/packages/core/src/browser/xhrObservable.ts b/packages/core/src/browser/xhrObservable.ts
@@ -65,7 +65,7 @@ function createXhrObservable() {
 function openXhr(this: XMLHttpRequest, method: string, url: string | URL | undefined | null) {
   xhrContexts.set(this, {
     state: 'open',
-    method,
+    method: method.toUpperCase(),
     url: normalizeUrl(String(url)),
   })
 }