Files
overleaf-cep/services/web/app/src/Features/Analytics/AnalyticsUTMTrackingMiddleware.mjs
T
Jakob Ackermann 03cbfbe90f [web] fix open redirect via utm tags (#36019)
GitOrigin-RevId: 1304c1578adf1d3248abcaa01902467422e8d8f6
2026-09-17 11:41:34 +00:00

72 lines
2.0 KiB
JavaScript

import RequestHelper from './RequestHelper.mjs'
import AnalyticsManager from './AnalyticsManager.mjs'
import { URL } from 'node:url'
import Settings from '@overleaf/settings'
import logger from '@overleaf/logger'
import UrlHelper from '../Helpers/UrlHelper.mjs'
function recordUTMTags() {
return function (req, res, next) {
const rawQuery = req.query
try {
const utmValues = RequestHelper.parseUtm(rawQuery)
if (utmValues) {
const path = new URL(req.url, Settings.siteUrl).pathname
const host = req.headers.host
const domain = host?.split('.')[0]
AnalyticsManager.recordEventForSession(req.session, 'page-view', {
path,
...utmValues,
domain,
})
const propertyValue = `${utmValues.utm_source || 'N/A'};${
utmValues.utm_medium || 'N/A'
};${utmValues.utm_campaign || 'N/A'};${
utmValues.utm_content || utmValues.utm_term || 'N/A'
}`
AnalyticsManager.setUserPropertyForSessionInBackground(
req.session,
'utm-tags',
propertyValue
)
}
} catch (error) {
// log errors and fail silently
logger.warn({ error, rawQuery, req }, 'failed to track UTM tags')
}
try {
const strippedQuery = RequestHelper.stripUTMKeys(rawQuery)
const allFields = Object.keys(rawQuery).length
const withoutUTM = Object.keys(strippedQuery).length
if (allFields !== withoutUTM) {
let redirect =
UrlHelper.getSafeRedirectPath(
// Drop the query from URL, we will add our own below.
new URL(req.url, Settings.siteUrl).pathname
) || '/'
if (withoutUTM > 0) redirect += `?${new URLSearchParams(strippedQuery)}`
res.redirect(redirect)
return
}
} catch (err) {
// log errors and fail silently
logger.warn(
{ err, rawQuery, req },
'failed to remove UTM tags from query'
)
}
next()
}
}
export default {
recordUTMTags,
}