fix cookie specific sensitive terms

Author: chargome

packages/core/src/utils/data-collection/filterCookies.ts

@@ -1,6 +1,6 @@
 import type { CollectBehavior } from '../../types/datacollection';
 import { parseCookie } from '../cookie';
-import { FILTERED_VALUE as FILTERED } from './filtering-snippets';
+import { FILTERED_VALUE as FILTERED, SENSITIVE_COOKIE_NAME_SNIPPETS } from './filtering-snippets';
 import { filterKeyValueData } from './filterKeyValueData';
 
 /**
@@ -21,7 +21,7 @@ export function filterCookies(cookieString: string, behavior: CollectBehavior):
       return {};
     }
 
-    return filterKeyValueData(parsed, behavior);
+    return filterKeyValueData(parsed, behavior, SENSITIVE_COOKIE_NAME_SNIPPETS);
   } catch {
     return FILTERED;
   }

packages/core/src/utils/data-collection/filterKeyValueData.ts

@@ -1,27 +1,34 @@
 import type { CollectBehavior } from '../../types/datacollection';
 import { FILTERED_VALUE as FILTERED, SENSITIVE_KEY_SNIPPETS } from './filtering-snippets';
 
-function isSensitiveKey(key: string): boolean {
-  const lower = key.toLowerCase();
-  return SENSITIVE_KEY_SNIPPETS.some(snippet => lower.includes(snippet));
+function isSensitiveKey(lower: string, denySnippets: string[]): boolean {
+  return denySnippets.some(snippet => lower.includes(snippet));
 }
 
 /**
  * Filters a key-value record according to a `CollectBehavior`.
  *
  * Key names are always preserved. Values are either kept, replaced with
  * `[Filtered]`, or the entire record is dropped (off mode).
+ *
+ * @param additionalDenyTerms - Additional sensitive snippets to check beyond the built-in denylist (e.g. cookie-specific terms).
  */
-export function filterKeyValueData(data: Record<string, string>, behavior: CollectBehavior): Record<string, string> {
+export function filterKeyValueData(
+  data: Record<string, string>,
+  behavior: CollectBehavior,
+  additionalDenyTerms?: string[],
+): Record<string, string> {
   if (behavior === false) {
     return {};
   }
 
+  const denySnippets =
+    additionalDenyTerms != null ? [...SENSITIVE_KEY_SNIPPETS, ...additionalDenyTerms] : SENSITIVE_KEY_SNIPPETS;
   const result: Record<string, string> = {};
 
   if (behavior === true) {
     for (const key of Object.keys(data)) {
-      result[key] = isSensitiveKey(key) ? FILTERED : data[key]!;
+      result[key] = isSensitiveKey(key.toLowerCase(), denySnippets) ? FILTERED : data[key]!;
     }
     return result;
   }
@@ -30,7 +37,7 @@ export function filterKeyValueData(data: Record<string, string>, behavior: Colle
     const lowerTerms = behavior.deny.map(t => t.toLowerCase());
     for (const key of Object.keys(data)) {
       const lower = key.toLowerCase();
-      const isDenied = isSensitiveKey(key) || lowerTerms.some(term => lower.includes(term));
+      const isDenied = isSensitiveKey(lower, denySnippets) || lowerTerms.some(term => lower.includes(term));
       result[key] = isDenied ? FILTERED : data[key]!;
     }
     return result;
@@ -39,10 +46,10 @@ export function filterKeyValueData(data: Record<string, string>, behavior: Colle
   // allowList mode
   const lowerTerms = behavior.allow.map(t => t.toLowerCase());
   for (const key of Object.keys(data)) {
-    if (isSensitiveKey(key)) {
+    const lower = key.toLowerCase();
+    if (isSensitiveKey(lower, denySnippets)) {
       result[key] = FILTERED;
     } else {
-      const lower = key.toLowerCase();
       const isAllowed = lowerTerms.some(term => lower.includes(term));
       result[key] = isAllowed ? data[key]! : FILTERED;
     }

packages/core/test/lib/utils/data-collection/filterCookies.test.ts

@@ -27,6 +27,17 @@ describe('filterCookies', () => {
         color: 'blue',
       });
     });
+
+    it('filters cookie-specific sensitive names', () => {
+      const result = filterCookies('theme=dark; connect.sid=abc; remember_me=xyz; __secure-token=secret', true);
+
+      expect(result).toEqual({
+        theme: 'dark',
+        'connect.sid': '[Filtered]', // matches ".sid"
+        remember_me: '[Filtered]', // matches "remember"
+        '__secure-token': '[Filtered]', // matches "__secure-" and "token"
+      });
+    });
   });
 
   describe('denyList mode ({ deny: [...] })', () => {