🐛 honor strictest allowUntrustedEvents policy in XHR observable

packages/core/src/browser/xhrObservable.spec.ts

@@ -1,8 +1,9 @@
 import type { Configuration } from '../domain/configuration'
 import { withXhr, mockXhr } from '../../test'
 import type { Subscription } from '../tools/observable'
+import { noop } from '../tools/utils/functionUtils'
 import type { XhrCompleteContext, XhrContext } from './xhrObservable'
-import { initXhrObservable } from './xhrObservable'
+import { initXhrObservable, resetXhrObservable } from './xhrObservable'
 
 describe('xhr observable', () => {
   let requestsTrackingSubscription: Subscription
@@ -402,4 +403,70 @@ describe('xhr observable', () => {
       },
     })
   })
+
+  describe('with conflicting allowUntrustedEvents policies across callers', () => {
+    // Reproduces the bug where the early bufferedData call to
+    // initXhrObservable({ allowUntrustedEvents: true }) creates the singleton
+    // and a later initXhrObservable(customerConfig) silently reuses it,
+    // discarding the customer's stricter policy.
+    let policySubscription: Subscription
+    let policyContexts: XhrContext[]
+
+    beforeEach(() => {
+      requestsTrackingSubscription.unsubscribe()
+      resetXhrObservable()
+      policyContexts = []
+    })
+
+    afterEach(() => {
+      policySubscription.unsubscribe()
+      resetXhrObservable()
+      // The outer afterEach calls requestsTrackingSubscription.unsubscribe(); we already
+      // unsubscribed it in beforeEach, so give it a no-op stub.
+      requestsTrackingSubscription = { unsubscribe: noop }
+    })
+
+    it('does not emit completion for an untrusted loadend when the customer disallows it', (done) => {
+      // First caller (bufferedData) opts into untrusted events.
+      initXhrObservable({ allowUntrustedEvents: true })
+      // Second caller (customer config) opts out.
+      policySubscription = initXhrObservable({ allowUntrustedEvents: false }).subscribe((context) => {
+        policyContexts.push(context)
+      })
+
+      withXhr({
+        setup(xhr) {
+          xhr.open('GET', '/ok')
+          xhr.send()
+          // Untrusted Event (constructor-built, no __ddIsTrusted marker)
+          xhr.dispatchEvent(new Event('loadend'))
+        },
+        onComplete() {
+          const completions = policyContexts.filter((context) => context.state === 'complete')
+          expect(completions).toEqual([])
+          done()
+        },
+      })
+    })
+
+    it('emits completion for an untrusted loadend when every caller allows it', (done) => {
+      initXhrObservable({ allowUntrustedEvents: true })
+      policySubscription = initXhrObservable({ allowUntrustedEvents: true }).subscribe((context) => {
+        policyContexts.push(context)
+      })
+
+      withXhr({
+        setup(xhr) {
+          xhr.open('GET', '/ok')
+          xhr.send()
+          xhr.dispatchEvent(new Event('loadend'))
+        },
+        onComplete() {
+          const completions = policyContexts.filter((context) => context.state === 'complete')
+          expect(completions.length).toBe(1)
+          done()
+        },
+      })
+    })
+  })
 })

packages/core/src/browser/xhrObservable.ts

@@ -34,14 +34,22 @@ export type XhrContext = XhrOpenContext | XhrStartContext | XhrCompleteContext
 let xhrObservable: Observable<XhrContext> | undefined
 const xhrContexts = new WeakMap<XMLHttpRequest, XhrContext>()
 
-export function initXhrObservable(configuration: { allowUntrustedEvents?: boolean | undefined }) {
+// The singleton XHR observable applies the latest caller's allowUntrustedEvents
+// policy so that the customer's configuration overrides the early call from
+// bufferedData (which always opts in before the customer config is parsed).
+let allowUntrustedEvents: boolean | undefined
+
+export function initXhrObservable(configuration: { allowUntrustedEvents?: boolean | undefined } = {}) {
+  if (configuration.allowUntrustedEvents !== undefined) {
+    allowUntrustedEvents = configuration.allowUntrustedEvents
+  }
   if (!xhrObservable) {
-    xhrObservable = createXhrObservable(configuration)
+    xhrObservable = createXhrObservable()
   }
   return xhrObservable
 }
 
-function createXhrObservable(configuration: { allowUntrustedEvents?: boolean | undefined }) {
+function createXhrObservable() {
   if (!('XMLHttpRequest' in globalObject)) {
     return new Observable<XhrContext>()
   }
@@ -53,7 +61,7 @@ function createXhrObservable(configuration: { allowUntrustedEvents?: boolean | u
       XMLHttpRequest.prototype,
       'send',
       (call) => {
-        sendXhr(call, configuration, observable)
+        sendXhr(call, observable)
       },
       { computeHandlingStack: true }
     )
@@ -78,7 +86,6 @@ function openXhr({ target: xhr, parameters: [method, url] }: InstrumentedMethodC
 
 function sendXhr(
   { target: xhr, parameters: [body], handlingStack }: InstrumentedMethodCall<XMLHttpRequest, 'send'>,
-  configuration: { allowUntrustedEvents?: boolean | undefined },
   observable: Observable<XhrContext>
 ) {
   const context = xhrContexts.get(xhr)
@@ -123,7 +130,7 @@ function sendXhr(
     observable.notify({ ...completeContext, state: 'complete' })
   }
 
-  const { stop: unsubscribeLoadEndListener } = addEventListener(configuration, xhr, 'loadend', onEnd)
+  const { stop: unsubscribeLoadEndListener } = addEventListener({ allowUntrustedEvents }, xhr, 'loadend', onEnd)
 
   observable.notify(startContext)
 }
@@ -142,4 +149,5 @@ function abortXhr({ target: xhr }: InstrumentedMethodCall<XMLHttpRequest, 'abort
  */
 export function resetXhrObservable() {
   xhrObservable = undefined
+  allowUntrustedEvents = undefined
 }