Ensure iFramed CCP is firing events we listen to, fix KeepAliveManager (

#418) * add check to ensure WindowIOStream is only receiving messages from the output dom element * fix keepalivemanager * bump to 1.6.8
amazon-connect · May 19, 2021 · 98e883d · 98e883d
1 parent f5f78d0
commit 98e883d
Show file tree

Hide file tree

Showing 10 changed files with 6,182 additions and 8 deletions.
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "amazon-connect-streams",
-  "version": "1.6.7",
+  "version": "1.6.8",
   "description": "Amazon Connect Streams Library",
   "engines": {
     "node": ">=12.0.0"
@@ -54,6 +54,6 @@
     "mocha-jsdom": "^2.0.0",
     "pump": "^3.0.0",
     "sinon": "^9.0.0",
-    "typescript": "3.0.1"
+    "typescript": "^4.2.4"
   }
 }
diff --git a/release/connect-streams-min.js b/release/connect-streams-min.js
diff --git a/release/connect-streams.js b/release/connect-streams.js
@@ -21423,7 +21423,18 @@
    * may contain any number of objects.
    */
   LogEntry.prototype.withObject = function (obj) {
-    var copiedObj = connect.deepcopy(obj)
+    var copiedObj = connect.deepcopy(obj);
+    redactSensitiveInfo(copiedObj);
+    this.objects.push(copiedObj);
+    return this;
+  };
+
+  /**
+   * Add a cross origin event object to the log entry.  A log entry
+   * may contain any number of objects.
+   */
+   LogEntry.prototype.withCrossOriginEventObject = function (obj) {
+    var copiedObj = connect.deepcopyCrossOriginEvent(obj);
     redactSensitiveInfo(copiedObj);
     this.objects.push(copiedObj);
     return this;
@@ -21784,6 +21795,7 @@
   var ONE_DAY_MILLIS = 24 * 60 * 60 * 1000;
   var DEFAULT_POPUP_HEIGHT = 578;
   var DEFAULT_POPUP_WIDTH = 433;
+  var COPYABLE_EVENT_FIELDS = ["bubbles", "cancelBubble", "cancelable", "composed", "data", "defaultPrevented", "eventPhase", "isTrusted", "lastEventId", "origin", "returnValue", "timeStamp", "type"];
 
   /**
    * Unpollute sprintf functions from the global namespace.
@@ -22146,6 +22158,20 @@
     return JSON.parse(JSON.stringify(src));
   };
 
+  connect.deepcopyCrossOriginEvent = function(event) {
+    const obj = {};
+    const listOfAcceptableKeys = COPYABLE_EVENT_FIELDS;
+    listOfAcceptableKeys.forEach((key) => {
+      try {
+        obj[key] = event[key];
+      }
+      catch(e) {
+        connect.getLog().info("deepcopyCrossOriginEvent failed on key: ", key).sendInternalLogToServer();
+      }
+    });
+    return connect.deepcopy(obj);
+  }
+
   /**
    * Get the current base url of the open page, e.g. if the page is
    * https://example.com:9494/oranges, this will be "https://example.com:9494".
@@ -22878,7 +22904,14 @@
    };
 
    WindowIOStream.prototype.onMessage = function(f) {
-      this.input.addEventListener("message", f);
+      this.input.addEventListener("message", (message) => {
+         if (message.source === this.output) {
+            f(message);
+         }
+         else {
+            connect.getLog().warn("[Window IO Stream] message event came from somewhere other than the CCP iFrame").withCrossOriginEventObject(message).sendInternalLogToServer();
+         }
+      });
    };
 
    /**---------------------------------------------------------------
@@ -25456,7 +25489,7 @@
 
   connect.core = {};
   connect.core.initialized = false;
-  connect.version = "1.6.6";
+  connect.version = "1.6.8";
   connect.DEFAULT_BATCH_SIZE = 500;
 
   var CCP_SYN_TIMEOUT = 1000; // 1 sec
@@ -26273,11 +26306,13 @@
     this.ackSub = this.conduit.onUpstream(connect.EventType.ACKNOWLEDGE, function () {
       this.unsubscribe();
       global.clearTimeout(self.ackTimer);
+      this.synTimer = null;
       self.deferStart();
     });
     this.ackTimer = global.setTimeout(function () {
       self.ackSub.unsubscribe();
       self.eventBus.trigger(connect.EventType.ACK_TIMEOUT);
+      this.synTimer = null;
       self.deferStart();
     }, this.ackTimeout);
   };

diff --git a/src/core.js b/src/core.js
@@ -828,11 +828,13 @@
     this.ackSub = this.conduit.onUpstream(connect.EventType.ACKNOWLEDGE, function () {
       this.unsubscribe();
       global.clearTimeout(self.ackTimer);
+      this.synTimer = null;
       self.deferStart();
     });
     this.ackTimer = global.setTimeout(function () {
       self.ackSub.unsubscribe();
       self.eventBus.trigger(connect.EventType.ACK_TIMEOUT);
+      this.synTimer = null;
       self.deferStart();
     }, this.ackTimeout);
   };

diff --git a/src/log.js b/src/log.js
@@ -228,7 +228,18 @@
    * may contain any number of objects.
    */
   LogEntry.prototype.withObject = function (obj) {
-    var copiedObj = connect.deepcopy(obj)
+    var copiedObj = connect.deepcopy(obj);
+    redactSensitiveInfo(copiedObj);
+    this.objects.push(copiedObj);
+    return this;
+  };
+
+  /**
+   * Add a cross origin event object to the log entry.  A log entry
+   * may contain any number of objects.
+   */
+   LogEntry.prototype.withCrossOriginEventObject = function (obj) {
+    var copiedObj = connect.deepcopyCrossOriginEvent(obj);
     redactSensitiveInfo(copiedObj);
     this.objects.push(copiedObj);
     return this;

diff --git a/src/streams.js b/src/streams.js
@@ -94,7 +94,14 @@
    };
 
    WindowIOStream.prototype.onMessage = function(f) {
-      this.input.addEventListener("message", f);
+      this.input.addEventListener("message", (message) => {
+         if (message.source === this.output) {
+            f(message);
+         }
+         else {
+            connect.getLog().warn("[Window IO Stream] message event came from somewhere other than the CCP iFrame").withCrossOriginEventObject(message).sendInternalLogToServer();
+         }
+      });
    };
 
    /**---------------------------------------------------------------

diff --git a/src/util.js b/src/util.js
@@ -13,6 +13,7 @@
   var ONE_DAY_MILLIS = 24 * 60 * 60 * 1000;
   var DEFAULT_POPUP_HEIGHT = 578;
   var DEFAULT_POPUP_WIDTH = 433;
+  var COPYABLE_EVENT_FIELDS = ["bubbles", "cancelBubble", "cancelable", "composed", "data", "defaultPrevented", "eventPhase", "isTrusted", "lastEventId", "origin", "returnValue", "timeStamp", "type"];
 
   /**
    * Unpollute sprintf functions from the global namespace.
@@ -375,6 +376,20 @@
     return JSON.parse(JSON.stringify(src));
   };
 
+  connect.deepcopyCrossOriginEvent = function(event) {
+    const obj = {};
+    const listOfAcceptableKeys = COPYABLE_EVENT_FIELDS;
+    listOfAcceptableKeys.forEach((key) => {
+      try {
+        obj[key] = event[key];
+      }
+      catch(e) {
+        connect.getLog().info("deepcopyCrossOriginEvent failed on key: ", key).sendInternalLogToServer();
+      }
+    });
+    return connect.deepcopy(obj);
+  }
+
   /**
    * Get the current base url of the open page, e.g. if the page is
    * https://example.com:9494/oranges, this will be "https://example.com:9494".

diff --git a/test/unit/log.spec.js b/test/unit/log.spec.js
@@ -71,4 +71,35 @@ describe('Logger', function() {
             assert.deepEqual(loggedObject.objects, expectedObj);
         })
     });
+    describe('Logger.withCrossOriginEventObject()', function(){
+        it('Log should be empty as none of these are the right fields.', function(){
+            var obj =  {
+                "webSocketTransport": {
+                    "url": "wss://15isv8flsl.execute-api.us-west-2.amazonaws.com/gamma/?AuthToken=QVFJREFIa==",
+                    "transportLifeTimeInSeconds": 3869,
+                    "expiry": "2021-03-09T20:03:34.625Z"
+                }
+            };
+            var expectedObj = [{
+                "webSocketTransport": {
+                    "url": "wss://15isv8flsl.execute-api.us-west-2.amazonaws.com/gamma/?[redacted]",
+                    "transportLifeTimeInSeconds": 3869,
+                    "expiry": "2021-03-09T20:03:34.625Z"
+                }
+            }];
+            var loggedObject = connect.getLog().trace("AWSClient: <-- Operation '%s' succeeded.").withCrossOriginEventObject(obj);
+            assert.notDeepEqual(loggedObject.objects, expectedObj);
+            assert.deepEqual([{}], loggedObject.objects);
+        });
+        it('Log should not break if the value of url or text is not a string', function(){
+            var obj =  {
+                "bubbles": true
+            };
+            var expectedObj = [{
+                "bubbles": true
+            }];
+            var loggedObject = connect.getLog().trace("AWSClient: <-- Operation '%s' succeeded.").withObject(obj);
+            assert.deepEqual(loggedObject.objects, expectedObj);
+        })
+    });
 });
diff --git a/test/unit/util.spec.js b/test/unit/util.spec.js
@@ -1,5 +1,7 @@
 require("../unit/test-setup.js");
 
+var COPYABLE_EVENT_FIELDS = ["bubbles", "cancelBubble", "cancelable", "composed", "data", "defaultPrevented", "eventPhase", "isTrusted", "lastEventId", "origin", "returnValue", "timeStamp", "type"];
+
 describe('Utils', function () {
 
     describe('#connect.hitch', function () {
@@ -92,6 +94,20 @@ describe('Utils', function () {
         });
     });
 
+    describe('#connect.deepcopyCrossOriginEvent', () => {
+        it('should ignore all fields but those hardcoded in the method.', () => {
+            let obj = {"heyo": "hi"};
+            let obj2 = {};
+            COPYABLE_EVENT_FIELDS.forEach((key) => {
+                obj[key] = "hello";
+                obj2[key] = "hello";
+            });
+            assert.notDeepEqual(connect.deepcopyCrossOriginEvent(obj), obj);
+            assert.deepEqual(connect.deepcopyCrossOriginEvent(obj), obj2);
+            assert.deepEqual(connect.deepcopyCrossOriginEvent(obj2), obj2);
+        });
+    });
+
     describe('TODO', function () {
         it("include test cases for all the remaining methods");
     });