Repository navigation
fix: safe URL handler + origin checks (security), capture log timing and masking - #182
Merged
Merged
Conversation
…of the logs Only gleap.io / gleap.ai were blacklisted, so with Gleap.setApiUrl every SDK call (capture uploads, /logs, session updates) was recorded with the widget session credential and stored on the ticket. The custom api url is now blacklisted like api.gleap.io, and Gleap-Hash is always masked. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ut paused stretches Screenshot logs were posted when the shutter clicked, so a cancelled screenshot still put the customer's console and network logs on the ticket, and a retake kept the first take's logs. They are now held until the Messenger reports the screenshot saved (capture-done sent: true); recording logs go after /complete succeeds (as the native SDKs do). Recording logs also leave out the stretches the customer paused (Pause is for logging in or paying). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…d relative links The default urlHandler set window.location.href to whatever the widget, a banner, a modal, the chatbar or Gleap.openURL handed it, so a javascript: URL ran in the customer's page. It now opens only safe schemes, new tabs with noopener,noreferrer. A custom Gleap.setUrlHandler handler still gets app deep links but never javascript:/vbscript:/data:. Messages to the Messenger frame are pinned to its origin. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…gin for chatbar and agent conversation Banner and modal listeners matched event.origin with bannerUrl.includes(), so https://outboundmedia.gl passed for https://outboundmedia.gleap.io and could trigger open-url, custom actions and tours. Now exact origin equality. Chatbar and <gleap-agent-conversation> (which receives gleapId and gleapHash) post to their frame's origin instead of '*'. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…in/fix-e2e1013-postmessage-security' into fix-e2e-release-20261013
boehlerlukas
changed the title
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
JS SDK fixes from the overnight E2E. One PR for JavaScript-SDK (the earlier #181 is folded in). Needs a release (19.3.1): npm
gleap@19.3.0and the CDN's 19.3.0 are different builds today. Regeneratedbuild/andpublished/bundles are not committed.Security: the default URL handler opens only http(s), mailto, tel and relative links (no
javascript:); new tabs open with noopener; banner/modal listeners check the exact origin; messages to the widget, chatbar and agent conversation are pinned to their frame's origin. Customers withGleap.setUrlHandlerstill get app deep links, never script URLs.Capture: logs go out only once the screenshot/recording is saved (none after cancel), recordings drop paused stretches; the SDK's own calls through a custom API URL stay out of network logs and
Gleap-Hashis always masked.fix(security): exact origin checks for banner/modal, pinned targetOrigin for chatbar and agent conversation (
7de87c9)fix(security): default url handler opens only http(s), mailto, tel and relative links (
dba931b)fix(capture): send capture logs only once the capture is saved, without paused stretches (
1ba664f)fix(network-logs): keep the SDK's calls through a custom api url out of the logs (
93948d5)Checks:
npm test565/565 (32 suites).🤖 Generated with Claude Code