feat(server): Add Reporting API server helpers

dev-packages/node-integration-tests/suites/reporting-api/server.mjs

@@ -0,0 +1,57 @@
+import { loggingTransport, startExpressServerAndSendPortToRunner } from '@sentry-internal/node-integration-tests';
+import { defaultStackParser as browserStackParser } from '@sentry/browser';
+import { handleReportingApi } from '@sentry/core';
+import * as Sentry from '@sentry/node';
+
+Sentry.init({
+  dsn: 'https://[email protected]/1337',
+  release: '1.0',
+  transport: loggingTransport,
+});
+
+import express from 'express';
+
+const app = express();
+
+app.use(express.json({ type: 'application/reports+json' }));
+
+app.post('/reporting-api', async (req, res) => {
+  await handleReportingApi(req.body, browserStackParser);
+  res.sendStatus(200);
+});
+
+startExpressServerAndSendPortToRunner(app);
+
+// Below is to support testing with a browser. We don't test this yet because we don't want to add the overhead of
+// installing playwright to the node-integration-tests. We should consider this in the future.
+
+// const port = 9000;
+
+// app.get('/', (req, res) => {
+//   const file = readFileSync(join(__dirname, 'index.html'), { encoding: 'utf-8' });
+
+//   res.setHeader('Content-Type', 'text/html');
+//   res.setHeader(
+//     'Reporting-Endpoints',
+//     `csp-endpoint="https://localhost:${port}/reporting-api", default="https://localhost:${port}/reporting-api"`,
+//   );
+//   res.setHeader('Content-Security-Policy', "default-src 'self'; report-to csp-endpoint");
+//   res.setHeader('Document-Policy', 'include-js-call-stacks-in-crash-reports');
+//   res.setHeader(
+//     'Origin-Trial',
+//     'ApD+E2izWNtaaRBeZ5BXu46aV0l1MSUzJTPERkU3yf+53pAOHj3rARpjb08itVJklPYx7iNEv5//s2dtXUFIvgMAAABzeyJvcmlnaW4iOiJodHRwczovL2xvY2FsaG9zdDo5MDAwIiwiZmVhdHVyZSI6IkRvY3VtZW50UG9saWN5SW5jbHVkZUpTQ2FsbFN0YWNrc0luQ3Jhc2hSZXBvcnRzIiwiZXhwaXJ5IjoxNzQyMzQyMzk5fQ==',
+//   );
+//   res.send(file);
+// });
+
+// const options = {
+//   key: readFileSync(join(__dirname, 'localhost-key.pem')),
+//   cert: readFileSync(join(__dirname, 'localhost.pem')),
+// };
+
+// const server = https.createServer(options, app);
+
+// server.listen(port, () => {
+//   // eslint-disable-next-line no-console
+//   console.log(`{"port":${port}}`);
+// });

dev-packages/node-integration-tests/suites/reporting-api/test.ts

@@ -0,0 +1,52 @@
+import { cleanupChildProcesses, createRunner } from '../../utils/runner';
+
+describe('Reporting API', () => {
+  afterAll(() => {
+    cleanupChildProcesses();
+  });
+
+  test('should forward Reporting API requests as raw CSP envelopes', done => {
+    const runner = createRunner(__dirname, 'server.mjs')
+      .expect({
+        raw_security: {
+          'csp-report': {
+            'document-uri': 'https://localhost:9000/',
+            referrer: '',
+            'blocked-uri': 'https://example.com/script.js',
+            'effective-directive': 'script-src-elem',
+            'original-policy': "default-src 'self'; report-to csp-endpoint",
+            disposition: 'enforce',
+            'status-code': 200,
+            status: '200',
+            sample: '',
+          },
+        },
+      })
+      .start(done);
+
+    runner.makeRequest(
+      'post',
+      '/reporting-api',
+      { 'Content-Type': 'application/reports+json' },
+      JSON.stringify([
+        {
+          age: 0,
+          body: {
+            blockedURL: 'https://example.com/script.js',
+            disposition: 'enforce',
+            documentURL: 'https://localhost:9000/',
+            effectiveDirective: 'script-src-elem',
+            originalPolicy: "default-src 'self'; report-to csp-endpoint",
+            referrer: '',
+            sample: '',
+            statusCode: 200,
+          },
+          type: 'csp-violation',
+          url: 'https://localhost:9000/',
+          user_agent:
+            'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36',
+        },
+      ]),
+    );
+  });
+});

dev-packages/node-integration-tests/utils/runner.ts

@@ -4,6 +4,7 @@ import { join } from 'path';
 import { SDK_VERSION } from '@sentry/node';
 import type {
   ClientReport,
+  DeprecatedCSPReport,
   Envelope,
   EnvelopeItemType,
   Event,
@@ -165,6 +166,9 @@ type Expected =
     }
   | {
       client_report: Partial<ClientReport> | ((event: ClientReport) => void);
+    }
+  | {
+      raw_security: Partial<DeprecatedCSPReport> | ((event: DeprecatedCSPReport) => void);
     };
 
 type ExpectedEnvelopeHeader =
@@ -265,6 +269,7 @@ export function createRunner(...paths: string[]) {
         }
       }
 
+      // eslint-disable-next-line complexity
       function newEnvelope(envelope: Envelope): void {
         for (const item of envelope[1]) {
           const envelopeItemType = item[0].type;
@@ -360,6 +365,17 @@ export function createRunner(...paths: string[]) {
 
               expectCallbackCalled();
             }
+
+            if ('raw_security' in expected) {
+              const rawSecurity = item[1] as DeprecatedCSPReport;
+              if (typeof expected.raw_security === 'function') {
+                expected.raw_security(rawSecurity);
+              } else {
+                expect(rawSecurity).toMatchObject(expected.raw_security);
+              }
+
+              expectCallbackCalled();
+            }
           } catch (e) {
             complete(e as Error);
           }

packages/core/src/envelope.ts

@@ -1,10 +1,15 @@
 import type {
+  CSPReport,
+  CSPReportPayload,
   Client,
+  DeprecatedCSPReport,
   DsnComponents,
   DynamicSamplingContext,
   Event,
   EventEnvelope,
   EventItem,
+  RawSecurityEnvelope,
+  RawSecurityItem,
   SdkInfo,
   SdkMetadata,
   Session,
@@ -18,8 +23,10 @@ import type {
 import {
   createEnvelope,
   createEventEnvelopeHeaders,
+  dropUndefinedKeys,
   dsnToString,
   getSdkMetadataForEnvelopeHeader,
+  uuid4,
 } from '@sentry/utils';
 import { createSpanEnvelopeItem } from '@sentry/utils';
 import { getDynamicSamplingContextFromSpan } from './tracing/dynamicSamplingContext';
@@ -135,3 +142,44 @@ export function createSpanEnvelope(spans: [SentrySpan, ...SentrySpan[]], client?
 
   return createEnvelope<SpanEnvelope>(headers, items);
 }
+
+function convertToDeprecatedPayload(report: CSPReportPayload): DeprecatedCSPReport {
+  return {
+    'csp-report': {
+      'document-uri': report.documentURI || report.documentURL,
+      referrer: report.referrer,
+      'blocked-uri': report.blockedURI || report.blockedURL,
+      'effective-directive': report.effectiveDirective,
+      'original-policy': report.originalPolicy,
+      disposition: report.disposition,
+      'status-code': report.statusCode,
+      status: report.statusCode.toString(),
+      'script-sample': report.sourceFile,
+      sample: report.sample,
+    },
+  };
+}
+
+/**
+ * Create an Envelope from a CSP report.
+ */
+export function createRawSecurityEnvelope(
+  report: CSPReport,
+  dsn: DsnComponents,
+  tunnel?: string,
+  release?: string,
+  environment?: string,
+): RawSecurityEnvelope {
+  const envelopeHeaders = {
+    event_id: uuid4(),
+    ...(!!tunnel && dsn && { dsn: dsnToString(dsn) }),
+    ...(report.user_agent && { user_agent: report.user_agent }),
+  };
+
+  const eventItem: RawSecurityItem = [
+    { type: 'raw_security', sentry_release: release, sentry_environment: environment },
+    dropUndefinedKeys(convertToDeprecatedPayload(report.body)),
+  ];
+
+  return createEnvelope<RawSecurityEnvelope>(envelopeHeaders, [eventItem]);
+}

packages/core/src/index.ts

@@ -113,3 +113,5 @@ export { captureFeedback } from './feedback';
 export { getCurrentHubShim, getCurrentHub } from './getCurrentHubShim';
 
 export { SDK_VERSION } from '@sentry/utils';
+
+export { handleReportingApi } from './reporting';

packages/core/src/reporting.ts

@@ -0,0 +1,63 @@
+import type { Event, Report, StackParser } from '@sentry/types';
+import { getClient } from './currentScopes';
+import { createRawSecurityEnvelope } from './envelope';
+
+/** Handles Reports from the Reporting API */
+export async function handleReportingApi(
+  reports: Report[],
+  browserStackParser?: StackParser,
+  client = getClient(),
+): Promise<void> {
+  if (!client) {
+    // eslint-disable-next-line no-console
+    console.warn('[Reporting API] No client available');
+    return;
+  }
+
+  const dsn = client.getDsn();
+  if (!dsn) {
+    // eslint-disable-next-line no-console
+    console.warn('[Reporting API] No DSN set');
+    return;
+  }
+
+  for (const report of reports) {
+    if (report.type === 'crash') {
+      const event: Event = {
+        level: 'fatal',
+        message: 'Crashed',
+        request: {
+          url: report.url,
+          ...(report.user_agent && { headers: { 'User-Agent': report.user_agent } }),
+        },
+      };
+
+      if (report.body.reason === 'oom') {
+        event.message = 'Crashed: Out of memory';
+      } else if (report.body.reason === 'unresponsive') {
+        event.message = 'Crashed: Unresponsive';
+      }
+
+      if (report.body.stack && browserStackParser) {
+        event.exception = {
+          values: [
+            {
+              type: 'Crashed',
+              value: event.message,
+              stacktrace: { frames: browserStackParser(report.body.stack) },
+            },
+          ],
+        };
+
+        delete event.message;
+      }
+
+      client.captureEvent(event);
+    } else if (report.type === 'csp-violation') {
+      const options = client.getOptions();
+      const envelope = createRawSecurityEnvelope(report, dsn, options.tunnel, options.release, options.environment);
+
+      await client.sendEnvelope(envelope);
+    }
+  }
+}

packages/types/src/datacategory.ts

@@ -30,5 +30,7 @@ export type DataCategory =
   | 'metric_bucket'
   // Span
   | 'span'
+  // Security report
+  | 'security'
   // Unknown data category
   | 'unknown';

packages/types/src/envelope.ts

@@ -6,6 +6,7 @@ import type { Event } from './event';
 import type { FeedbackEvent, UserFeedback } from './feedback';
 import type { Profile, ProfileChunk } from './profiling';
 import type { ReplayEvent, ReplayRecordingData } from './replay';
+import type { DeprecatedCSPReport } from './reporting';
 import type { SdkInfo } from './sdkinfo';
 import type { SerializedSession, SessionAggregates } from './session';
 import type { SpanJSON } from './span';
@@ -41,7 +42,8 @@ export type EnvelopeItemType =
   | 'replay_recording'
   | 'check_in'
   | 'statsd'
-  | 'span';
+  | 'span'
+  | 'raw_security';
 
 export type BaseEnvelopeHeaders = {
   [key: string]: unknown;
@@ -84,6 +86,7 @@ type ProfileItemHeaders = { type: 'profile' };
 type ProfileChunkItemHeaders = { type: 'profile_chunk' };
 type StatsdItemHeaders = { type: 'statsd'; length: number };
 type SpanItemHeaders = { type: 'span' };
+type RawSecurityHeaders = { type: 'raw_security'; sentry_release?: string; sentry_environment?: string };
 
 export type EventItem = BaseEnvelopeItem<EventItemHeaders, Event>;
 export type AttachmentItem = BaseEnvelopeItem<AttachmentItemHeaders, string | Uint8Array>;
@@ -100,6 +103,7 @@ export type FeedbackItem = BaseEnvelopeItem<FeedbackItemHeaders, FeedbackEvent>;
 export type ProfileItem = BaseEnvelopeItem<ProfileItemHeaders, Profile>;
 export type ProfileChunkItem = BaseEnvelopeItem<ProfileChunkItemHeaders, ProfileChunk>;
 export type SpanItem = BaseEnvelopeItem<SpanItemHeaders, Partial<SpanJSON>>;
+export type RawSecurityItem = BaseEnvelopeItem<RawSecurityHeaders, DeprecatedCSPReport>;
 
 export type EventEnvelopeHeaders = { event_id: string; sent_at: string; trace?: DynamicSamplingContext };
 type SessionEnvelopeHeaders = { sent_at: string };
@@ -120,6 +124,7 @@ export type CheckInEnvelope = BaseEnvelope<CheckInEnvelopeHeaders, CheckInItem>;
 export type StatsdEnvelope = BaseEnvelope<StatsdEnvelopeHeaders, StatsdItem>;
 export type SpanEnvelope = BaseEnvelope<SpanEnvelopeHeaders, SpanItem>;
 export type ProfileChunkEnvelope = BaseEnvelope<BaseEnvelopeHeaders, ProfileChunkItem>;
+export type RawSecurityEnvelope = BaseEnvelope<BaseEnvelopeHeaders, RawSecurityItem>;
 
 export type Envelope =
   | EventEnvelope
@@ -129,6 +134,7 @@ export type Envelope =
   | ReplayEnvelope
   | CheckInEnvelope
   | StatsdEnvelope
-  | SpanEnvelope;
+  | SpanEnvelope
+  | RawSecurityEnvelope;
 
 export type EnvelopeItem = Envelope[1][number];

packages/types/src/index.ts

@@ -48,6 +48,8 @@ export type {
   ProfileItem,
   ProfileChunkEnvelope,
   ProfileChunkItem,
+  RawSecurityEnvelope,
+  RawSecurityItem,
   SpanEnvelope,
   SpanItem,
 } from './envelope';
@@ -173,3 +175,4 @@ export type {
 export type { ParameterizedString } from './parameterize';
 export type { ContinuousProfiler, ProfilingIntegration, Profiler } from './profiling';
 export type { ViewHierarchyData, ViewHierarchyWindow } from './view-hierarchy';
+export type { Report, CSPReport, CSPReportPayload, DeprecatedCSPReport } from './reporting';