Skip to content

PII Leak: Stack parsing is broken in scoped npm packages #695

@asklar

Description

@asklar

My package is @react-native-windows/cli . When an exception is thrown from inside of one of our tools, the EnvelopeFactory tries parsing the stack into a parsedStack : StackFrame[]
However the regex used doesn't work for packages (or file paths) that have an @ sign in the name:
https://github.com/microsoft/ApplicationInsights-node.js/blob/develop/Library/EnvelopeFactory.ts#L306-L313

The regex is /^([\s]+at)?(.*?)(\@|\s\(|\s)([^\(\@\n]+):([0-9]+):([0-9]+)(\)?)$/
I'm throwing an exception from a lambda so there is no method name. The stack string looks like:

Error: solutionFile invalid. Error: Too many app solution files found, please specify in react-native.config.
    at E:\rnw\packages\@react-native-windows\cli\lib-commonjs\runWindows\utils\autolink.js:131:23
    at Array.forEach (<anonymous>)
    at Object.updateAutoLink [as func] (E:\rnw\packages\@react-native-windows\cli\lib-commonjs\runWindows\utils\autolink.js:125:24)
    at runWindowsInternal (E:\rnw\packages\@react-native-windows\cli\lib-commonjs\runWindows\runWindows.js:204:42)
    at Object.runWindows [as func] (E:\rnw\packages\@react-native-windows\cli\lib-commonjs\runWindows\runWindows.js:139:15)
    at Command.handleAction (E:\test63\node_modules\@react-native-community\cli\build\index.js:186:23)
    at Command.listener (E:\test63\node_modules\commander\index.js:315:8)
    at Command.emit (events.js:209:13)
    at Command.parseArgs (E:\test63\node_modules\commander\index.js:651:12)
    at Command.parse (E:\test63\node_modules\commander\index.js:474:21)

When parseStack tries the second line, it finds a match:
image

This ends up putting the path as part of the method name.
This causes a potential PII leak since file path information is being exposed through a method name which is not expected to have any PII.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions