Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socketโs threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
coveo.analytics
Advanced tools
The Coveo analytics javascript client, also called coveo.analytics.js or coveoua for short, is responsible for logging analytics events to the Coveo platform. Analytics events may include basic Coveo web events such as clicks or searches. For specific usecases, such as commerce and service, dedicated events may be defined and logged.
The analytics library is bundled with all Coveo provided UI components. Integrations which exclusively rely on these components, generally don't have to interact with coveoua directly. For Coveo integrations which integrate with an already existing UI and do not use headless, coveoua will be required to ensure events are logged correctly.
In order to ensure the tracking code is available on your webpage, the following code snippet needs to be added to the top of each page on which analytics are required. This will load the latest major version of coveo.analytics.js from a Coveo CDN. As of writing, the current major version is 2.
<script>
(function (c, o, v, e, O, u, a) {
a = 'coveoua';
c[a] =
c[a] ||
function () {
(c[a].q = c[a].q || []).push(arguments);
};
c[a].t = Date.now();
u = o.createElement(v);
u.async = 1;
u.src = e;
O = o.getElementsByTagName(v)[0];
O.parentNode.insertBefore(u, O);
})(window, document, 'script', 'https://static.cloud.coveo.com/coveo.analytics.js/2/coveoua.js');
</script>
coveoua('init', #COVEO_API_KEY); // Replace #COVEO_API_KEY with your api key
Since calls to the coveo analytics service need to be authenticated, the library needs to be initialized with a Coveo api key which has push access to the Analytics Data Domain. You can create an API key from the administration console selecting the Push option box for the Analytics Data domain (see Adding and Managing API Keys).
After the library has loaded sucessfully, you can interact with coveoua through the global coveoua
function. Any interaction with the library happens through this function by supplying both a action name, followed by an optional series of action arguments. The following actions are available:
coveoua('version')
: Returns the current version of the tracking library.coveoua('init', <COVEO_API_KEY>, <ENDPOINT>)
: Initializes the library with the given api key and endpoint. The following parameters are accepted
coveoua('init', <COVEO_API_KEY>, {endpoint: <ENDPOINT>, isCustomEndpoint: <IS_CUSTOM_ENDPOINT>, plugins: <PLUGINS>})
: Initializes the library with the given api key, endpoint, isCustomEndpoint option and plugins. The following parameters are accepted
coveoua('set', <NAME>, <VALUE>)
: Attempts to inject an attribute with given name and value on every logged event, overriding any existing value. Some payloads may reject attributes they do not support.coveoua('set', <OBJECT>)
: Attempts to inject all attributes and values of the given object on every logged event, overriding any existing value. Some payloads may reject attributes they do not support.coveoua('set', 'custom', <OBJECT>)
: Attempts to inject all attributes and values of the given object in the custom section of an object, overriding any existing value. Use this call to pass customer specific parameters on the payload.coveoua('onLoad', <CALLBACK>)
: Calls the specified function immediately, library initialization is not required.coveoua('reset')
: Resets the state of the logger to the state before initialization.coveoua('send', <EVENT_NAME>, <EVENT_PAYLOAD>)
: Sends an event with a given name and payload to the analytics endpoint.coveoua('provide', <PLUGIN_NAME>, <PLUGINCLASS>)
: Registers a given pluginClass with the analytics library under the provided name.coveoua('require', <PLUGIN_NAME>)
: Explicitly loads the plugin with the given name.coveoua('callPlugin', <PLUGIN_NAME>, <FUNCTION>, <PARAMS>)
: Executes the specified function with given arguments on the given plugin name. Can be shorthanded using a plugin action prefix coveoua(<PLUGINNAME>:<FUNCTION>, <PARAMS>)
.Coveoua is set up in a modular way with different plugins providing functionality that may be specific to a given usecase. This allows you to customize some of its behavior dynamically. By default, the following plugins are loaded at library initialization:
ec
: eCommerce plugin which takes care of sending eCommerce specific events.svc
: Service plugin which takes care of sending customer service specific events.Plugin actions extend the set of available actions. They can be executed either via the callPlugin
action above, or via the shorthand. For example, to call the function addImpression
on the ec
plugin, you'd specify coveoua('ec:addImpression', ...)
.
It is possible to disable loading of any plugins by explicitly initializing the library with an empty list of plugins using coveoua('init', <API_KEY>, {plugins:[]})
.
In most common integration usecases, you will be using Coveo pre-wired components (e.g. jsui, headless or atomic) to handle communication with the Coveo backend. These components have their own specific apis to handle event logging.
When you are not using any specific Coveo web component, you need to send these events payloads explicitly, use the send
action to transmit an assembled payload to the usage analytics backend. See the Usage Analytics Events documentation for description of the payload contents. The following event types are supported in coveoua:
search
: sends a client side search event.click
: sends a click event.view
: sends a view event.custom
: sends a custom event.collect
: sends a collect event payload. We strongly recommend you use the simplified api in the ecommerce plugin to send these events instead.For example, in order to send a click event after a user has interacted with a Coveo provided result, first initialize the library with an api key and then send a click event with the appropriate payload. Refer to the click event documentation for up to date information on event payloads.
coveoua('send', 'click', {...});
You should be able to observe the click event being transmitted to the Coveo backend at https://analytics.cloud.coveo.com/rest/ua/click
in the Developer tool's Network tab of your browser of choice.
Commerce specific events such as product selections, shopping cart modifications and transactions are sent to Coveo in the compact collect protocol. Rather than explicitly assembling these payloads by hand, the eCommerce plugin provides APIs to assemble and transmit the payloads. The event
is specific to the eCommerce plugin:
event
: An event, which has been assembled through different plugin actions.The eCommerce plugin supports adding product data (ec:addProduct
) as well as setting the appropriate event action through ec:setAction
. These calls can be used in series to assemble different types of payloads:
As a sample, here is how a cart modification event is assembled:
ec:addProduct
action to include the relevant product data in the event youโre about to send
coveoua('ec:addProduct', <PRODUCT_DATA>);
ec:setAction
action to specify that the action done on this data is an addition to the cart.
coveoua('ec:setAction', 'add');
send
action to send the generic event to Coveo Usage Analytics. The payload is implicit in this case, and has been generated by the plugin.
coveoua('send', 'event');
To help track a visitor across different domains, the library offers functionality to initialize a clientId from a URL query parameter. The query parameter is named cvo_cid
with value <clientid>.<timestamp>
. The clientId is encoded without dashes and the timestamp is encoded in seconds since epoch, both to save space in the url. Both are separated by a period. A sample parameter could be cvo_cid=c0b48880743e484f8044d7c37910c55b.1676298678
. This query parameter will be picked up by the target page if the following conditions hold:
cvo_cid
query parametercoveoua('link:acceptFrom', [<referrers>])
.Given that you want to ensure the clientId remains consistent when you navigate from a source page on http://foo.com/index.html to a target page http://bar.com/index.html, the following steps are needed.
href
is replaced by coveoua('link:decorate', 'http://bar.com/index.html')
. For example, by creating an onClick event listener on the element or on the page. It's important that the decorated link is generated at the moment the link is clicked, as it will be valid only for a short time after generation.<script>
async function decorate(element) {
element.href = await coveoua('link:decorate', element.href);
}
</script>
<a onclick="decorate(this)" href="http://bar.com/index.html">Navigate</a>>
coveoua('link:acceptFrom', ['foo.com']);
immediately after script load.Information for contributors or Coveo developers developing or integrating coveoua.
git clone
npm install
npm run build
There are two ways to run your code locally:
Run npm run start
and open your browser on http://localhost:9001
Debugging through VSCode debugger with the Debug: Start Debugging
command, using the Launch Chrome
configuration.
To test out your changes, add coveoua
function calls in the public/index.html
file and check the payload in the Developer Console
section of your browser.
npm run test
.Debug: Start Debugging
command, using the Jest All
configuration.Coveo.analytics.js tracks interactions from the same browser client, through a client side provided uuid called a clientId
. This clientId is initialized on first use and there are multiple options for persisting it's value:
By default, coveoua will use both local storage and cookie storage to persist its clientId. If your environment does not support local persistence, it's possible to write your own storage abstraction.
Since React Native does not run inside a browser, it cannot use cookies or the local/session storage that modern browsers provide. You must provide your own Storage implementation. Thankfully, there exist multiple packages to store data:
A sample React native storage class implementation could look as follows
import {CoveoAnalyticsClient, ReactNativeRuntime} from 'coveo.analytics/react-native';
// Use any React native storage library or implement your own.
import AsyncStorage from '@react-native-async-storage/async-storage';
// Sample storage class
class ReactNativeStorage implements WebStorage {
async getItem(key: string) {
return AsyncStorage.getItem(key);
}
async setItem(key: string, data: string) {
return AsyncStorage.setItem(key, data);
}
async removeItem(key: string) {
AsyncStorage.removeItem(key);
}
}
// Create an API client with a specific runtime
const client = new CoveoAnalyticsClient({
token: 'YOUR_API_KEY',
runtimeEnvironment: new ReactNativeRuntime({
token: 'YOUR_API_KEY',
storage: new ReactNativeStorage(),
}),
});
// Send your event
client.sendCustomEvent({
eventType: 'dog',
eventValue: 'Hello! Yes! This is Dog!',
language: 'en',
});
Chrome, Firefox, Safari, Edge. IE11 support on a reasonable-effort basis.
See CONTRIBUTING.md
MIT license (see LICENSE).
FAQs
๐ Coveo analytics client (node and browser compatible)
The npm package coveo.analytics receives a total of 20,386 weekly downloads. As such, coveo.analytics popularity was classified as popular.
We found that coveo.analytics demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.ย It has 16 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socketโs threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.