fix: microsoft clarity identify error handling #1948
Conversation
📝 WalkthroughWalkthroughThe changes in this pull request modify the Changes
Suggested reviewers
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Outside diff range and nitpick comments (1)
packages/analytics-js-integrations/src/integrations/MicrosoftClarity/browser.js (1)
58-68: Consider race conditions in concurrent identify callsThe current implementation might lead to race conditions if multiple identify calls are made in quick succession, as trait setting operations could get interleaved.
Consider implementing a queue mechanism or adding a lock to ensure sequential processing of identify calls. Would you like me to provide an example implementation?
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
📒 Files selected for processing (1)
packages/analytics-js-integrations/src/integrations/MicrosoftClarity/browser.js(1 hunks)
🔇 Additional comments (1)
packages/analytics-js-integrations/src/integrations/MicrosoftClarity/browser.js (1)
58-68: Verify Microsoft Clarity SDK's promise support
The code assumes that window.clarity('identify', ...) returns a Promise, but this should be verified with Microsoft Clarity's documentation.
| if (context?.traits) { | ||
| const { traits } = context; | ||
| const keys = Object.keys(traits); | ||
| keys.forEach(key => { | ||
| window.clarity('set', key, traits[key]); | ||
| }); | ||
| } |
There was a problem hiding this comment.
Add validation for trait values before sending to Clarity
The code directly passes trait values to the third-party SDK without any validation or sanitization, which could potentially expose sensitive data.
Consider:
- Adding a whitelist of allowed trait keys
- Implementing value sanitization
- Filtering out sensitive data patterns (e.g., email, phone numbers)
if (context?.traits) {
const { traits } = context;
const keys = Object.keys(traits);
+ const allowedTraits = ['name', 'company', 'role']; // define allowed traits
keys.forEach(key => {
+ if (!allowedTraits.includes(key)) {
+ logger.debug(`Skipping non-whitelisted trait: ${key}`);
+ return;
+ }
+ const sanitizedValue = sanitizeTraitValue(traits[key]); // implement sanitization
window.clarity('set', key, traits[key]);
});
}Committable suggestion skipped: line range outside the PR's diff.
There was a problem hiding this comment.
Don't see any requirement of allwoedTraits or sanitization of a value in Microsoft Clarity at this point in time.
There was a problem hiding this comment.
@sanpj2292, understood. Thank you for the clarification.
(_/)
( •_• )
✏️ Learnings added
Learnt from: sanpj2292
PR: rudderlabs/rudder-sdk-js#1948
File: packages/analytics-js-integrations/src/integrations/MicrosoftClarity/browser.js:59-65
Timestamp: 2024-11-25T11:33:39.579Z
Learning: In the Microsoft Clarity integration (`packages/analytics-js-integrations/src/integrations/MicrosoftClarity/browser.js`), adding validation or sanitization of trait values before sending them to Microsoft Clarity's SDK is not required at this time.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
packages/analytics-js-integrations/src/integrations/MicrosoftClarity/browser.js
Show resolved
Hide resolved
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## develop #1948 +/- ##
===========================================
- Coverage 58.30% 58.29% -0.01%
===========================================
Files 485 485
Lines 16614 16615 +1
Branches 3351 3349 -2
===========================================
Hits 9686 9686
- Misses 5683 5702 +19
+ Partials 1245 1227 -18 ☔ View full report in Codecov by Sentry. 🚨 Try these New Features:
|
|
|
Basically we need to set traits call after the identify call, right? |
Yes. The previous code was written that way, we are sticking with that approach |
size-limit report 📦
|
PR Description
Adding error handling for microsoft clarity destination
Linear task (optional)
Resolves INT-2937
Cross Browser Tests
Please confirm you have tested for the following browsers:
Sanity Suite
Security
Summary by CodeRabbit
New Features
Bug Fixes