Skip to content

Commit f971dae

Browse files
matus-tomleinclaude
andcommitted
fix(browser-plugin-media-tracking): match the data: scheme as a prefix
dataUrlHandler used a substring check, which was wrong in both directions: it replaced valid URLs that merely contain 'data:' somewhere (a path segment such as 'metadata:9' matches) and it missed an uppercase 'DATA:' scheme, shipping the large base64 payload the function exists to avoid. URI schemes are case-insensitive per RFC 3986. Match /^data:/i instead, and cover both directions with tests. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1 parent 0382a9c commit f971dae

2 files changed

Lines changed: 25 additions & 1 deletion

File tree

plugins/browser-plugin-media-tracking/src/helperFunctions.ts

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,11 @@ export function getDuration(el: HTMLAudioElement | HTMLVideoElement): number | n
4747
export const DATA_URL_PLACEHOLDER = 'data:';
4848

4949
export function dataUrlHandler(url: string): string {
50-
if (url.indexOf('data:') !== -1) {
50+
// Match the `data:` scheme only at the start of the string, case-insensitively as
51+
// RFC 3986 specifies. A substring check would both replace valid URLs that merely
52+
// contain 'data:' (e.g. a path segment 'metadata:9') and miss an uppercase 'DATA:'
53+
// scheme, shipping the large payload this is meant to avoid.
54+
if (/^data:/i.test(url)) {
5155
return DATA_URL_PLACEHOLDER;
5256
}
5357
return url;

plugins/browser-plugin-media-tracking/tests/media.test.ts

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,26 @@ describe('dataUrlHandler', () => {
6464
const output = dataUrlHandler(test_url);
6565
expect(output).toBe('data:');
6666
});
67+
68+
it('matches the data: scheme case-insensitively', () => {
69+
// URI schemes are case-insensitive per RFC 3986, so this is a real data URI and
70+
// its payload must not be sent.
71+
const test_url = 'DATA:image/png;base64,iVBORw0KGgoAA5ErkJggg==';
72+
const output = dataUrlHandler(test_url);
73+
expect(output).toBe('data:');
74+
});
75+
76+
it('keeps urls that merely contain data: outside the scheme', () => {
77+
// 'data:' has to be matched as a scheme, not as a substring, or valid URLs get
78+
// replaced by the placeholder.
79+
for (const test_url of [
80+
'https://example.com/metadata:9/video.mp4',
81+
'https://example.com/data:foo/video.mp4',
82+
'https://example.com/video.mp4?ref=data:x',
83+
]) {
84+
expect(dataUrlHandler(test_url)).toBe(test_url);
85+
}
86+
});
6787
});
6888

6989
describe('getUriFileExtension', () => {

0 commit comments

Comments
 (0)