add sendPayloadChecksums config option and implement Bugsnag-Integrit…

.buildkite/browser-pipeline.full.yml

@@ -43,4 +43,4 @@ steps:
           queue: "macos"
         timeout_in_minutes: 2
         commands:
-          - BUILD_MODE=CDN buildkite-agent pipeline upload .buildkite/browser-pipeline.yml
+          - BUILD_MODE=CDN buildkite-agent pipeline upload .buildkite/browser-pipeline.yml

.tool-versions

@@ -0,0 +1 @@
+nodejs 20.11.1

jest.config.js

@@ -50,11 +50,15 @@ module.exports = {
     {
       displayName: 'delivery-fetch',
       testMatch: ['<rootDir>/packages/delivery-fetch/**/*.test.ts'],
+      testEnvironment: 'jsdom',
+      setupFilesAfterEnv: ['<rootDir>/jest/setup/crypto.ts'],
       ...defaultModuleConfig
     },
     {
       displayName: 'browser',
       testMatch: ['<rootDir>/packages/platforms/browser/**/*.test.ts'],
+      testEnvironment: 'jsdom',
+      setupFilesAfterEnv: ['<rootDir>/jest/setup/crypto.ts'],
       ...defaultModuleConfig
     },
     {

jest/setup/crypto.ts

@@ -0,0 +1,19 @@
+import { TextDecoder, TextEncoder } from 'node:util'
+import crypto from 'crypto'
+
+Object.defineProperty(window, 'crypto', {
+  get () {
+    return {
+      getRandomValues: crypto.getRandomValues,
+      subtle: crypto.webcrypto.subtle
+    }
+  }
+})
+
+Object.defineProperty(window, 'TextEncoder', {
+  get () { return TextEncoder }
+})
+
+Object.defineProperty(window, 'TextDecoder', {
+  get () { return TextDecoder }
+})

packages/core/lib/config.ts

@@ -8,7 +8,7 @@ import {
 } from './custom-attribute-limits'
 import type { Plugin } from './plugin'
 import type { Span } from './span'
-import { isLogger, isNumber, isObject, isCallbackArray, isPluginArray, isString, isStringArray, isStringWithLength } from './validation'
+import { isBoolean, isLogger, isNumber, isObject, isCallbackArray, isPluginArray, isString, isStringArray, isStringWithLength } from './validation'
 
 type SetTraceCorrelation = (traceId: string, spanId: string) => void
 
@@ -60,6 +60,7 @@ export interface Configuration {
   attributeStringValueLimit?: number
   attributeArrayLengthLimit?: number
   attributeCountLimit?: number
+  sendPayloadChecksums?: boolean
 }
 
 export interface TestConfiguration {
@@ -88,6 +89,7 @@ export interface CoreSchema extends Schema {
   plugins: ConfigOption<Array<Plugin<Configuration>>>
   bugsnag: ConfigOption<BugsnagErrorStatic | undefined>
   samplingProbability: ConfigOption<number | undefined>
+  sendPayloadChecksums: ConfigOption<boolean>
 }
 
 export const schema: CoreSchema = {
@@ -165,6 +167,11 @@ export const schema: CoreSchema = {
     defaultValue: ATTRIBUTE_COUNT_LIMIT_DEFAULT,
     message: `should be a number between 1 and ${ATTRIBUTE_COUNT_LIMIT_MAX}`,
     validate: (value: unknown): value is number => isNumber(value) && value > 0 && value <= ATTRIBUTE_COUNT_LIMIT_MAX
+  },
+  sendPayloadChecksums: {
+    defaultValue: false,
+    message: 'should be true|false',
+    validate: isBoolean
   }
 }
 

packages/core/lib/core.ts

@@ -91,6 +91,11 @@ export function createClient<S extends CoreSchema, C extends Configuration, T> (
     start: (config: C | string) => {
       const configuration = validateConfig<S, C>(config, options.schema, options.isDevelopment)
 
+      // sendPayloadChecksums is false by default unless custom endpoints are not specified
+      if (typeof config !== 'string' && !config.endpoint) {
+        configuration.sendPayloadChecksums = ('sendPayloadChecksums' in config && config.sendPayloadChecksums) || true
+      }
+
       // if using the default endpoint add the API key as a subdomain
       // e.g. convert URL https://otlp.bugsnag.com/v1/traces to URL https://<project_api_key>.otlp.bugsnag.com/v1/traces
       if (configuration.endpoint === schema.endpoint.defaultValue) {
@@ -141,7 +146,7 @@ export function createClient<S extends CoreSchema, C extends Configuration, T> (
 
       spanFactory.configure(configuration)
 
-      const delivery = options.deliveryFactory(configuration.endpoint)
+      const delivery = options.deliveryFactory(configuration.endpoint, configuration.sendPayloadChecksums)
       const probabilityManagerPromise = configuration.samplingProbability === undefined
         ? ProbabilityManager.create(
           options.persistence,

packages/core/lib/delivery.ts

@@ -5,7 +5,7 @@ import type { JsonEvent } from './events'
 import type { Kind, SpanEnded } from './span'
 import { spanToJson } from './span'
 
-export type DeliveryFactory = (endpoint: string) => Delivery
+export type DeliveryFactory = (endpoint: string, sendPayloadChecksums: boolean) => Delivery
 
 export type ResponseState = 'success' | 'failure-discard' | 'failure-retryable'
 
@@ -60,6 +60,8 @@ export interface TracePayload {
     // therefore it's 'undefined' when passed to delivery, which adds a value
     // immediately before initiating the request
     'Bugsnag-Sent-At'?: string
+    // 'undefined' when passed to delivery, which adds a value before initiating the request
+    'Bugsnag-Integrity'?: string
   }
 }
 

packages/core/tests/core.test.ts

@@ -344,7 +344,7 @@ describe('Core', () => {
 
               await jest.runOnlyPendingTimersAsync()
 
-              expect(deliveryFactory).toHaveBeenCalledWith('https://a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6.otlp.bugsnag.com/v1/traces')
+              expect(deliveryFactory).toHaveBeenCalledWith('https://a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6.otlp.bugsnag.com/v1/traces', false)
             })
           })
 
@@ -358,7 +358,7 @@ describe('Core', () => {
 
               await jest.runOnlyPendingTimersAsync()
 
-              expect(deliveryFactory).toHaveBeenCalledWith('https://my-custom-otel-repeater.com')
+              expect(deliveryFactory).toHaveBeenCalledWith('https://my-custom-otel-repeater.com', false)
             })
           })
         })
@@ -530,7 +530,7 @@ describe('Core', () => {
         // allow async configuration to complete
         await jest.runOnlyPendingTimersAsync()
 
-        expect(deliveryFactory).toHaveBeenCalledWith(SECONDARY_ENDPOINT)
+        expect(deliveryFactory).toHaveBeenCalledWith(SECONDARY_ENDPOINT, false)
       })
 
       it('keeps Bugsnag host + apiKey sub-domain for a normal key', async () => {
@@ -543,7 +543,8 @@ describe('Core', () => {
         await jest.runOnlyPendingTimersAsync()
 
         expect(deliveryFactory).toHaveBeenCalledWith(
-          `https://${BS_KEY}.${PRIMARY_ENDPOINT.slice('https://'.length)}`
+          `https://${BS_KEY}.${PRIMARY_ENDPOINT.slice('https://'.length)}`,
+          false
         )
       })
 
@@ -557,7 +558,7 @@ describe('Core', () => {
 
         await jest.runOnlyPendingTimersAsync()
 
-        expect(deliveryFactory).toHaveBeenCalledWith(CUSTOM_ENDPOINT)
+        expect(deliveryFactory).toHaveBeenCalledWith(CUSTOM_ENDPOINT, false)
       })
     })
   })

packages/delivery-fetch/lib/delivery.ts

@@ -1,7 +1,4 @@
-import {
-
-  responseStateFromStatusCode
-} from '@bugsnag/core-performance'
+import { responseStateFromStatusCode } from '@bugsnag/core-performance'
 import type { BackgroundingListener, Clock, Delivery, DeliveryFactory, TracePayload } from '@bugsnag/core-performance'
 
 export type Fetch = typeof fetch
@@ -40,14 +37,20 @@ function createFetchDeliveryFactory (
     })
   }
 
-  return function fetchDeliveryFactory (endpoint: string): Delivery {
+  return function fetchDeliveryFactory (endpoint: string, sendPayloadChecksums?: boolean): Delivery {
     return {
       async send (payload: TracePayload) {
         const body = JSON.stringify(payload.body)
 
         payload.headers['Bugsnag-Sent-At'] = clock.date().toISOString()
 
         try {
+          const integrityHeaderValue = await getIntegrityHeaderValue(sendPayloadChecksums ?? false, window, body)
+
+          if (integrityHeaderValue) {
+            payload.headers['Bugsnag-Integrity'] = integrityHeaderValue
+          }
+
           const response = await fetch(endpoint, {
             method: 'POST',
             keepalive,
@@ -72,3 +75,19 @@ function createFetchDeliveryFactory (
 }
 
 export default createFetchDeliveryFactory
+
+function getIntegrityHeaderValue (sendPayloadChecksums: boolean, windowOrWorkerGlobalScope: Window, requestBody: string) {
+  if (sendPayloadChecksums && windowOrWorkerGlobalScope.isSecureContext && windowOrWorkerGlobalScope.crypto && windowOrWorkerGlobalScope.crypto.subtle && windowOrWorkerGlobalScope.crypto.subtle.digest && typeof TextEncoder === 'function') {
+    const msgUint8 = new TextEncoder().encode(requestBody)
+    return windowOrWorkerGlobalScope.crypto.subtle.digest('SHA-1', msgUint8).then((hashBuffer) => {
+      const hashArray = Array.from(new Uint8Array(hashBuffer))
+      const hashHex = hashArray
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('')
+
+      return 'sha1 ' + hashHex
+    })
+  }
+
+  return Promise.resolve()
+}