Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

🐛 allow untrusted event for httpRequest xhr event listeners #3123

Merged
merged 5 commits into from
Nov 12, 2024

Conversation

thomas-lebeau
Copy link
Collaborator

@thomas-lebeau thomas-lebeau commented Nov 12, 2024

Motivation

Fixes an issue where a non native XMLHttpRequest override is dispatching synthetic events (i.e. non-trusted) result in the callback not being executed, and breaking session replay ingestion.

Changes

allow untrusted event in that particular use-case. This is safe as we're not using any properties from the event.

Testing

  • Local
  • Staging
  • Unit
  • End to end

I have gone over the contributing documentation.

@thomas-lebeau
Copy link
Collaborator Author

/to-staging

@dd-devflow
Copy link
Contributor

dd-devflow bot commented Nov 12, 2024

Devflow running: /to-staging

View all feedbacks in Devflow UI.


2024-11-12 12:58:39 UTC ℹ️ Branch Integration: starting soon, median merge time is 0s

Commit 5f3f019075 will soon be integrated into staging-46.


2024-11-12 13:11:40 UTC ℹ️ Branch Integration: This commit was successfully integrated

Commit 5f3f019075 has been merged into staging-46 in merge commit 6f3a76bc8c.

Check out the triggered pipeline on Gitlab 🦊

dd-mergequeue bot added a commit that referenced this pull request Nov 12, 2024
…ng-46

Integrated commit sha: 5f3f019

Co-authored-by: Thomas Lebeau <thomas.lebeau@datadoghq.com>
@thomas-lebeau thomas-lebeau marked this pull request as ready for review November 12, 2024 13:48
@thomas-lebeau thomas-lebeau requested a review from a team as a code owner November 12, 2024 13:48
@codecov-commenter
Copy link

codecov-commenter commented Nov 12, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 93.17%. Comparing base (08b2ab4) to head (9d3552e).

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #3123      +/-   ##
==========================================
- Coverage   93.63%   93.17%   -0.47%     
==========================================
  Files         276      276              
  Lines        7616     7615       -1     
  Branches     1709     1708       -1     
==========================================
- Hits         7131     7095      -36     
- Misses        485      520      +35     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@@ -49,11 +49,12 @@ class MockEventEmitter {
this.listeners[name] = this.listeners[name].filter((listener) => listener !== callback)
}

protected dispatchEvent(name: string) {
if (!this.listeners[name]) {
dispatchEvent(evt: Event) {
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

dispatchEvent is normally exposed on the native xhr, so I see no reason to not expose it for mockXHR, especially as I a change the signature to be more standard.

It's just a tiny bit more verbose where dispatchEvent is called

Co-authored-by: Benoît <benoit.zugmeyer@datadoghq.com>
Copy link

cit-pr-commenter bot commented Nov 12, 2024

Bundles Sizes Evolution

📦 Bundle Name Base Size Local Size 𝚫 𝚫% Status
Rum 161.03 KiB 161.01 KiB -14 B -0.01%
Logs 55.76 KiB 55.75 KiB -12 B -0.02%
Rum Slim 109.60 KiB 109.59 KiB -12 B -0.01%
Worker 25.21 KiB 25.21 KiB 0 B 0.00%
🚀 CPU Performance
Action Name Base Average Cpu Time (ms) Local Average Cpu Time (ms) 𝚫
addglobalcontext 0.002 0.002 -0.000
addaction 0.049 0.054 0.004
addtiming 0.001 0.001 0.000
adderror 0.052 0.055 0.004
startstopsessionreplayrecording 1.384 1.119 -0.265
startview 1.602 1.751 0.149
logmessage 0.025 0.023 -0.003
🧠 Memory Performance
Action Name Base Consumption Memory (bytes) Local Consumption Memory (bytes) 𝚫 (bytes)
addglobalcontext 8.19 KiB 7.83 KiB -372 B
addaction 40.97 KiB 39.91 KiB -1078 B
addtiming 7.00 KiB 7.36 KiB 376 B
adderror 46.07 KiB 43.34 KiB -2796 B
startstopsessionreplayrecording 6.40 KiB 7.05 KiB 668 B
startview 427.27 KiB 431.20 KiB 3.93 KiB
logmessage 41.12 KiB 39.91 KiB -1229 B

🔗 RealWorld

@@ -187,7 +187,7 @@ describe('httpRequest', () => {
const onResponseSpy = jasmine.createSpy('xhrOnResponse')

interceptor.withMockXhr((xhr) => {
const syntheticEvent = new Event('loadend')
const syntheticEvent = createNewEvent('loadend', {}, false)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💬 suggestion: maybe leveraging the properties argument like ‏createNewEvent('loadend', { __ddIsTrusted: false }) could be simpler/more explicit...

@thomas-lebeau thomas-lebeau force-pushed the thomas.lebeau/xhr-allow-untrested-events branch from 71cfaae to 9d3552e Compare November 12, 2024 15:44
Copy link
Contributor

@sethfowler-datadog sethfowler-datadog left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice!

@thomas-lebeau thomas-lebeau merged commit fa08217 into main Nov 12, 2024
19 checks passed
@thomas-lebeau thomas-lebeau deleted the thomas.lebeau/xhr-allow-untrested-events branch November 12, 2024 16:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants