feat: Mask page URLs in session recordings

[dzsibi]

Changes

• Meta events generated by rrweb have a href attribute that is now masked by maskNetworkRequestFn
• Virtual $pageview events have a href attribute that is now masked by maskNetworkRequestFn

Notes

Right now, properties on events can be filtered using sanitize_properties to redact any sensitive information in URLs, and maskNetworkRequestFn does the same for captured network events. But rrweb has a Meta event that leaks the full page URL, and there is also a mechanism that translates $pageview events into rrweb custom events, that captures window.location.href directly. I passed these through maskNetworkRequestFn to redact sensitive information as necessary. Without this patch, neither of these values can be sanitized by the currently available options.

To be honest, I don't know why window.location.href is used directly when $pageview events are translated into rrweb custom events - there is a perfectly good $current_url property that has already passed through sanitize_properties on the event object. As an alternative to passing that through maskNetworkRequestFn one could also just use that value (it might also be more "correct" in the sense that I don't know if there is a guarantee that window.location.href would always have the desired value when it is used here). But that still leaves the Meta event, which captures window.location.href mercilessly.

I couldn't find any test infrastructure for events coming from / forwarded to rrweb, so I don't really know how to add tests for this without doing a lot of groundwork first.

Checklist

• Tests for new code (see advice on the tests we use)
• Accounted for the impact of any changes across different browsers

[benjackwhite]

This totally makes sense.

We use this value because we aren't guaranteed to have pageview events (some people turn them off for whatever reason) so we do need it in the payload. Re-using the maskNetworkRequestFn makes total sense.

We're likely to be extending this network code later to be able to track more things so we will take care of proper tests at that point 👍