@posthog/core - npm Package Compare versions

Comparing version 1.28.6 to 1.28.7

dist/gzip.d.ts

@@ -7,2 +7,3 @@ /**
 export declare const isNativeAsyncGzipReadError: (error: unknown) => boolean;
+export declare const isNativeAsyncGzipError: (error: unknown) => boolean;
 export type GzipCompressOptions = {
@@ -9,0 +10,0 @@ /**

dist/gzip.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"gzip.d.ts","sourceRoot":"","sources":["../src/gzip.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAOzC;AAED,eAAO,MAAM,0BAA0B,GAAI,OAAO,OAAO,KAAG,OAQ3D,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,CAAA;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,UAAO,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CA8BrH"}
+{"version":3,"file":"gzip.d.ts","sourceRoot":"","sources":["../src/gzip.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAOzC;AAID,eAAO,MAAM,0BAA0B,GAAI,OAAO,OAAO,KAAG,OAQ3D,CAAA;AAED,eAAO,MAAM,sBAAsB,GAAI,OAAO,OAAO,KAAG,OAQvD,CAAA;AA0DD,MAAM,MAAM,mBAAmB,GAAG;IAChC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,CAAA;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,UAAO,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAgCrH"}

dist/gzip.js

@@ -29,2 +29,3 @@ "use strict";
     isGzipSupported: ()=>isGzipSupported,
+    isNativeAsyncGzipError: ()=>isNativeAsyncGzipError,
     isNativeAsyncGzipReadError: ()=>isNativeAsyncGzipReadError
@@ -35,2 +36,3 @@ });
 }
+const NATIVE_GZIP_VALIDATION_ERROR = 'NativeGzipValidationError';
 const isNativeAsyncGzipReadError = (error)=>{
@@ -41,7 +43,44 @@ if (!error || 'object' != typeof error) return false;
 };
+const isNativeAsyncGzipError = (error)=>{
+    if (!error || 'object' != typeof error) return false;
+    const name = 'name' in error ? String(error.name) : '';
+    return isNativeAsyncGzipReadError(error) || name === NATIVE_GZIP_VALIDATION_ERROR;
+};
+let crc32Table;
+const getCrc32Table = ()=>{
+    if (crc32Table) return crc32Table;
+    crc32Table = [];
+    for(let i = 0; i < 256; i++){
+        let crc = i;
+        for(let j = 0; j < 8; j++)crc = 1 & crc ? 0xedb88320 ^ crc >>> 1 : crc >>> 1;
+        crc32Table[i] = crc >>> 0;
+    }
+    return crc32Table;
+};
+const crc32 = (bytes)=>{
+    const table = getCrc32Table();
+    let crc = 0xffffffff;
+    for(let i = 0; i < bytes.length; i++)crc = table[(crc ^ bytes[i]) & 0xff] ^ crc >>> 8;
+    return (0xffffffff ^ crc) >>> 0;
+};
+const throwNativeGzipValidationError = (reason)=>{
+    const error = new Error(`Native gzip produced invalid output: ${reason}`);
+    error.name = NATIVE_GZIP_VALIDATION_ERROR;
+    throw error;
+};
+const validateNativeGzip = async (compressed, inputBytes)=>{
+    if (compressed.size < 18) throwNativeGzipValidationError('too-short');
+    const header = new Uint8Array(await compressed.slice(0, 10).arrayBuffer());
+    if (0x1f !== header[0] || 0x8b !== header[1] || 0x08 !== header[2]) throwNativeGzipValidationError('invalid-header');
+    const trailer = new DataView(await compressed.slice(compressed.size - 8).arrayBuffer());
+    if (trailer.getUint32(0, true) !== crc32(inputBytes)) throwNativeGzipValidationError('invalid-crc');
+    const inputSize = inputBytes.length >>> 0;
+    if (trailer.getUint32(4, true) !== inputSize) throwNativeGzipValidationError('invalid-size');
+};
 async function gzipCompress(input, isDebug = true, options) {
     try {
+        const inputBytes = new TextEncoder().encode(input);
         const compressedStream = new CompressionStream('gzip');
         const writer = compressedStream.writable.getWriter();
-        const writePromise = writer.write(new TextEncoder().encode(input)).then(()=>writer.close()).catch(async (err)=>{
+        const writePromise = writer.write(inputBytes).then(()=>writer.close()).catch(async (err)=>{
             try {
@@ -57,2 +96,3 @@ await writer.abort(err);
         ]);
+        await validateNativeGzip(compressed, inputBytes);
         return compressed;
@@ -67,2 +107,3 @@ } catch (error) {
 exports.isGzipSupported = __webpack_exports__.isGzipSupported;
+exports.isNativeAsyncGzipError = __webpack_exports__.isNativeAsyncGzipError;
 exports.isNativeAsyncGzipReadError = __webpack_exports__.isNativeAsyncGzipReadError;
@@ -72,2 +113,3 @@ for(var __webpack_i__ in __webpack_exports__)if (-1 === [
     "isGzipSupported",
+    "isNativeAsyncGzipError",
     "isNativeAsyncGzipReadError"
@@ -74,0 +116,0 @@ ].indexOf(__webpack_i__)) exports[__webpack_i__] = __webpack_exports__[__webpack_i__];

dist/gzip.mjs

 function isGzipSupported() {
     return 'CompressionStream' in globalThis && 'TextEncoder' in globalThis && 'Response' in globalThis && 'function' == typeof Response.prototype.blob;
 }
+const NATIVE_GZIP_VALIDATION_ERROR = 'NativeGzipValidationError';
 const isNativeAsyncGzipReadError = (error)=>{
@@ -9,7 +10,44 @@ if (!error || 'object' != typeof error) return false;
 };
+const isNativeAsyncGzipError = (error)=>{
+    if (!error || 'object' != typeof error) return false;
+    const name = 'name' in error ? String(error.name) : '';
+    return isNativeAsyncGzipReadError(error) || name === NATIVE_GZIP_VALIDATION_ERROR;
+};
+let crc32Table;
+const getCrc32Table = ()=>{
+    if (crc32Table) return crc32Table;
+    crc32Table = [];
+    for(let i = 0; i < 256; i++){
+        let crc = i;
+        for(let j = 0; j < 8; j++)crc = 1 & crc ? 0xedb88320 ^ crc >>> 1 : crc >>> 1;
+        crc32Table[i] = crc >>> 0;
+    }
+    return crc32Table;
+};
+const crc32 = (bytes)=>{
+    const table = getCrc32Table();
+    let crc = 0xffffffff;
+    for(let i = 0; i < bytes.length; i++)crc = table[(crc ^ bytes[i]) & 0xff] ^ crc >>> 8;
+    return (0xffffffff ^ crc) >>> 0;
+};
+const throwNativeGzipValidationError = (reason)=>{
+    const error = new Error(`Native gzip produced invalid output: ${reason}`);
+    error.name = NATIVE_GZIP_VALIDATION_ERROR;
+    throw error;
+};
+const validateNativeGzip = async (compressed, inputBytes)=>{
+    if (compressed.size < 18) throwNativeGzipValidationError('too-short');
+    const header = new Uint8Array(await compressed.slice(0, 10).arrayBuffer());
+    if (0x1f !== header[0] || 0x8b !== header[1] || 0x08 !== header[2]) throwNativeGzipValidationError('invalid-header');
+    const trailer = new DataView(await compressed.slice(compressed.size - 8).arrayBuffer());
+    if (trailer.getUint32(0, true) !== crc32(inputBytes)) throwNativeGzipValidationError('invalid-crc');
+    const inputSize = inputBytes.length >>> 0;
+    if (trailer.getUint32(4, true) !== inputSize) throwNativeGzipValidationError('invalid-size');
+};
 async function gzipCompress(input, isDebug = true, options) {
     try {
+        const inputBytes = new TextEncoder().encode(input);
         const compressedStream = new CompressionStream('gzip');
         const writer = compressedStream.writable.getWriter();
-        const writePromise = writer.write(new TextEncoder().encode(input)).then(()=>writer.close()).catch(async (err)=>{
+        const writePromise = writer.write(inputBytes).then(()=>writer.close()).catch(async (err)=>{
             try {
@@ -25,2 +63,3 @@ await writer.abort(err);
         ]);
+        await validateNativeGzip(compressed, inputBytes);
         return compressed;
@@ -33,2 +72,2 @@ } catch (error) {
 }
-export { gzipCompress, isGzipSupported, isNativeAsyncGzipReadError };
+export { gzipCompress, isGzipSupported, isNativeAsyncGzipError, isNativeAsyncGzipReadError };

dist/index.d.ts

 export { getFeatureFlagValue } from './featureFlagUtils';
-export { gzipCompress, isNativeAsyncGzipReadError } from './gzip';
+export { gzipCompress, isNativeAsyncGzipError, isNativeAsyncGzipReadError } from './gzip';
 export * from './utils';
@@ -4,0 +4,0 @@ export * as ErrorTracking from './error-tracking';

dist/index.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EAAE,YAAY,EAAE,0BAA0B,EAAE,MAAM,QAAQ,CAAA;AACjE,cAAc,SAAS,CAAA;AACvB,OAAO,KAAK,aAAa,MAAM,kBAAkB,CAAA;AACjD,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,EACd,kBAAkB,GACnB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AACpC,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,cAAc,CAAA;AAIrB,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACzG,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AACxC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,SAAS,CAAA;AACvB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,QAAQ,CAAA;AACzF,cAAc,SAAS,CAAA;AACvB,OAAO,KAAK,aAAa,MAAM,kBAAkB,CAAA;AACjD,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,EACd,kBAAkB,GACnB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AACpC,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,cAAc,CAAA;AAIrB,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACzG,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AACxC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,SAAS,CAAA;AACvB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA"}

dist/index.js

@@ -95,2 +95,3 @@ "use strict";
         gzipCompress: ()=>_gzip__WEBPACK_IMPORTED_MODULE_1__.gzipCompress,
+        isNativeAsyncGzipError: ()=>_gzip__WEBPACK_IMPORTED_MODULE_1__.isNativeAsyncGzipError,
         isNativeAsyncGzipReadError: ()=>_gzip__WEBPACK_IMPORTED_MODULE_1__.isNativeAsyncGzipReadError,
@@ -108,2 +109,3 @@ toOtlpAnyValue: ()=>_logs_logs_utils__WEBPACK_IMPORTED_MODULE_4__.toOtlpAnyValue,
         "PostHogLogs",
+        "isNativeAsyncGzipError",
         "getOtlpSeverityText",
@@ -136,2 +138,3 @@ "isNativeAsyncGzipReadError",
         "PostHogLogs",
+        "isNativeAsyncGzipError",
         "getOtlpSeverityText",
@@ -160,2 +163,3 @@ "isNativeAsyncGzipReadError",
         "PostHogLogs",
+        "isNativeAsyncGzipError",
         "getOtlpSeverityText",
@@ -184,2 +188,3 @@ "isNativeAsyncGzipReadError",
         "PostHogLogs",
+        "isNativeAsyncGzipError",
         "getOtlpSeverityText",
@@ -208,2 +213,3 @@ "isNativeAsyncGzipReadError",
         "PostHogLogs",
+        "isNativeAsyncGzipError",
         "getOtlpSeverityText",
@@ -240,2 +246,3 @@ "isNativeAsyncGzipReadError",
 exports.gzipCompress = __webpack_exports__.gzipCompress;
+exports.isNativeAsyncGzipError = __webpack_exports__.isNativeAsyncGzipError;
 exports.isNativeAsyncGzipReadError = __webpack_exports__.isNativeAsyncGzipReadError;
@@ -257,2 +264,3 @@ exports.toOtlpAnyValue = __webpack_exports__.toOtlpAnyValue;
     "gzipCompress",
+    "isNativeAsyncGzipError",
     "isNativeAsyncGzipReadError",
@@ -259,0 +267,0 @@ "toOtlpAnyValue",

dist/index.mjs

 import { getFeatureFlagValue } from "./featureFlagUtils.mjs";
-import { gzipCompress, isNativeAsyncGzipReadError } from "./gzip.mjs";
+import { gzipCompress, isNativeAsyncGzipError, isNativeAsyncGzipReadError } from "./gzip.mjs";
 import { buildOtlpLogRecord, buildOtlpLogsPayload, getOtlpSeverityNumber, getOtlpSeverityText, toOtlpAnyValue, toOtlpKeyValueList } from "./logs/logs-utils.mjs";
@@ -13,2 +13,2 @@ import { PostHogLogs } from "./logs/index.mjs";
 import * as __WEBPACK_EXTERNAL_MODULE__error_tracking_index_mjs_b3406d6f__ from "./error-tracking/index.mjs";
-export { __WEBPACK_EXTERNAL_MODULE__error_tracking_index_mjs_b3406d6f__ as ErrorTracking, PostHogLogs, buildOtlpLogRecord, buildOtlpLogsPayload, getFeatureFlagValue, getLengthFromRules, getOtlpSeverityNumber, getOtlpSeverityText, getRequirementsHint, getValidationError, gzipCompress, isNativeAsyncGzipReadError, toOtlpAnyValue, toOtlpKeyValueList, uuidv7 };
+export { __WEBPACK_EXTERNAL_MODULE__error_tracking_index_mjs_b3406d6f__ as ErrorTracking, PostHogLogs, buildOtlpLogRecord, buildOtlpLogsPayload, getFeatureFlagValue, getLengthFromRules, getOtlpSeverityNumber, getOtlpSeverityText, getRequirementsHint, getValidationError, gzipCompress, isNativeAsyncGzipError, isNativeAsyncGzipReadError, toOtlpAnyValue, toOtlpKeyValueList, uuidv7 };

package.json

 {
   "name": "@posthog/core",
-  "version": "1.28.6",
+  "version": "1.28.7",
   "license": "MIT",
@@ -70,3 +70,3 @@ "main": "dist/index.js",
   "dependencies": {
-    "@posthog/types": "1.373.1"
+    "@posthog/types": "1.373.2"
   },
@@ -73,0 +73,0 @@ "devDependencies": {

src/gzip.ts

@@ -14,2 +14,4 @@ /**
 
+const NATIVE_GZIP_VALIDATION_ERROR = 'NativeGzipValidationError'
+
 export const isNativeAsyncGzipReadError = (error: unknown): boolean => {
@@ -25,2 +27,68 @@ if (!error || typeof error !== 'object') {
 
+export const isNativeAsyncGzipError = (error: unknown): boolean => {
+  if (!error || typeof error !== 'object') {
+    return false
+  }
+
+  const name = 'name' in error ? String(error.name) : ''
+
+  return isNativeAsyncGzipReadError(error) || name === NATIVE_GZIP_VALIDATION_ERROR
+}
+
+type NativeGzipValidationReason = 'too-short' | 'invalid-header' | 'invalid-crc' | 'invalid-size'
+
+let crc32Table: number[] | undefined
+
+const getCrc32Table = (): number[] => {
+  if (crc32Table) {
+    return crc32Table
+  }
+
+  crc32Table = []
+  for (let i = 0; i < 256; i++) {
+    let crc = i
+    for (let j = 0; j < 8; j++) {
+      crc = crc & 1 ? 0xedb88320 ^ (crc >>> 1) : crc >>> 1
+    }
+    crc32Table[i] = crc >>> 0
+  }
+  return crc32Table
+}
+
+const crc32 = (bytes: Uint8Array): number => {
+  const table = getCrc32Table()
+  let crc = 0xffffffff
+  for (let i = 0; i < bytes.length; i++) {
+    crc = table[(crc ^ bytes[i]) & 0xff] ^ (crc >>> 8)
+  }
+  return (crc ^ 0xffffffff) >>> 0
+}
+
+const throwNativeGzipValidationError = (reason: NativeGzipValidationReason): never => {
+  const error = new Error(`Native gzip produced invalid output: ${reason}`)
+  error.name = NATIVE_GZIP_VALIDATION_ERROR
+  throw error
+}
+
+const validateNativeGzip = async (compressed: Blob, inputBytes: Uint8Array): Promise<void> => {
+  if (compressed.size < 18) {
+    throwNativeGzipValidationError('too-short')
+  }
+
+  const header = new Uint8Array(await compressed.slice(0, 10).arrayBuffer())
+  if (header[0] !== 0x1f || header[1] !== 0x8b || header[2] !== 0x08) {
+    throwNativeGzipValidationError('invalid-header')
+  }
+
+  const trailer = new DataView(await compressed.slice(compressed.size - 8).arrayBuffer())
+  if (trailer.getUint32(0, true) !== crc32(inputBytes)) {
+    throwNativeGzipValidationError('invalid-crc')
+  }
+
+  const inputSize = inputBytes.length >>> 0
+  if (trailer.getUint32(4, true) !== inputSize) {
+    throwNativeGzipValidationError('invalid-size')
+  }
+}
+
 export type GzipCompressOptions = {
@@ -41,2 +109,3 @@ /**
   try {
+    const inputBytes = new TextEncoder().encode(input)
     const compressedStream = new CompressionStream('gzip')
@@ -46,3 +115,3 @@ const writer = compressedStream.writable.getWriter()
     const writePromise = writer
-      .write(new TextEncoder().encode(input))
+      .write(inputBytes)
       .then(() => writer.close())
@@ -60,2 +129,3 @@ .catch(async (err) => {
     const [compressed] = await Promise.all([responsePromise, writePromise])
+    await validateNativeGzip(compressed, inputBytes)
     return compressed
@@ -62,0 +132,0 @@ } catch (error) {

src/index.ts

 export { getFeatureFlagValue } from './featureFlagUtils'
-export { gzipCompress, isNativeAsyncGzipReadError } from './gzip'
+export { gzipCompress, isNativeAsyncGzipError, isNativeAsyncGzipReadError } from './gzip'
 export * from './utils'
@@ -4,0 +4,0 @@ export * as ErrorTracking from './error-tracking'

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1018667

0.65%

Lines of code

23973

0.61%

Dependency changes

• + Added

  @posthog/types@1.373.2
  (transitive)

• - Removed

  @posthog/types@1.373.1
  (transitive)

• Updated

  @posthog/types@1.373.2