Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add csp-violation-event-plugin #590

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

anthony-ism
Copy link

This change adds a new plugin, CspViolationPlugin that is responsible for attaching its custom eventHandler to the securitypolicyviolation event. https://developer.mozilla.org/en-US/docs/Web/API/Element/securitypolicyviolation_event


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

}

private addEventHandler(): void {
window.addEventListener('securitypolicyviolation', this.eventHandler);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for bringing attention to this new category of RUM events. This CR looks really good and I don't see any bugs at first glance.

However, I would like this plugin to be extensible for other security issues, and to use the best reporting tool available. From some quick research, I suspect that we should be monitoring security related issues using the ReportingObserver API. https://developer.mozilla.org/en-US/docs/Web/API/ReportingObserver

  1. Could you refactor from EventListeners to ReportingObserver?
  2. I suspect we should refactor this to a generic SecurityPlugin, but add a configuration option if rum users want to record CSP Violations (by default disabled). This way, we can easily extend your plugin to capture other security events as necessary.
  3. Last, for knowledge share, please let me know what other security telemetries you are interested in recording, so I can try to get priority.

Thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants