diff --git a/.eslintrc b/.eslintrc index 8e8ecee7e1b6ce19e5bd183dbd3f7fcc17ab27e2..602bd6469668500f166537e84693d3b9ae044656 100644 --- a/.eslintrc +++ b/.eslintrc @@ -8,6 +8,7 @@ "globals": { "Address": true, "files": true, + "Header": true, "helpers": true, "interceptor": true, "mappings": true, diff --git a/core/constants.js b/core/constants.js index 1d4de9e129d9b11356d7651791e8b28f4237835f..86e5754e75c1fd406badd69bd1ae5c384346dc87 100644 --- a/core/constants.js +++ b/core/constants.js @@ -27,6 +27,12 @@ const Address = { 'WWW_PREFIX': 'www.' }; +const Header = { + 'COOKIE': 'Cookie', + 'ORIGIN': 'Origin', + 'REFERER': 'Referer' +}; + const Resource = { 'MAPPING_EXPRESSION': /\.map$/i, 'VERSION_EXPRESSION': /(?:\d{1,2}\.){1,3}\d{1,2}/, @@ -46,9 +52,7 @@ const Setting = { const WebRequest = { 'GET': 'GET', 'BLOCKING': 'blocking', - 'HEADERS': 'requestHeaders', - 'ORIGIN_HEADER': 'Origin', - 'REFERER_HEADER': 'Referer' + 'HEADERS': 'requestHeaders' }; const Whitelist = { diff --git a/core/request-sanitizer.js b/core/request-sanitizer.js index a28799f085a2df86b7dc5a12eddeeb3b9d442d46..8a76e6759e69b916707d0d0ee8260d38a241f5ff 100644 --- a/core/request-sanitizer.js +++ b/core/request-sanitizer.js @@ -47,11 +47,11 @@ requestSanitizer.disable = function () { requestSanitizer._stripMetadata = function (requestDetails) { + let sensitiveHeaders = [Header.COOKIE, Header.ORIGIN, Header.REFERER]; + for (let i = 0; i < requestDetails.requestHeaders.length; ++i) { - if (requestDetails.requestHeaders[i].name === WebRequest.ORIGIN_HEADER) { - requestDetails.requestHeaders.splice(i--, 1); - } else if (requestDetails.requestHeaders[i].name === WebRequest.REFERER_HEADER) { + if (sensitiveHeaders.indexOf(requestDetails.requestHeaders[i].name) > -1) { requestDetails.requestHeaders.splice(i--, 1); } }