diff --git a/CHANGELOG.md b/CHANGELOG.md index 6ddca87f8b..f366b115b3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,10 @@ useful summary for people upgrading their application, not a replication of the commit log. +## Unreleased + +* Add some GOV.UK Accounts specific PII redacts ([PR #1807](https://github.com/alphagov/govuk_publishing_components/pull/1807)) + ## 23.7.6 * Amend share links columns spacing ([PR #1800](https://github.com/alphagov/govuk_publishing_components/pull/1800)) diff --git a/app/assets/javascripts/govuk_publishing_components/analytics/pii.js b/app/assets/javascripts/govuk_publishing_components/analytics/pii.js index 5698e4de2c..da55367ab0 100644 --- a/app/assets/javascripts/govuk_publishing_components/analytics/pii.js +++ b/app/assets/javascripts/govuk_publishing_components/analytics/pii.js @@ -8,6 +8,11 @@ var POSTCODE_PATTERN = /[A-PR-UWYZ][A-HJ-Z]?[0-9][0-9A-HJKMNPR-Y]?(?:[\s+]|%20)*[0-9][ABD-HJLNPQ-Z]{2}/gi var DATE_PATTERN = /\d{4}(-?)\d{2}(-?)\d{2}/g + // specific URL parameters to be redacted from accounts URLs + var RESET_PASSWORD_TOKEN_PATTERN = /reset_password_token=[a-zA-Z0-9-]+/g + var UNLOCK_TOKEN_PATTERN = /unlock_token=[a-zA-Z0-9-]+/g + var STATE_PATTERN = /state=.[^&]+/g + function shouldStripDates () { return ($('meta[name="govuk:static-analytics:strip-dates"]').length > 0) } @@ -35,6 +40,10 @@ pii.prototype.stripPIIFromString = function (string) { var stripped = string.replace(EMAIL_PATTERN, '[email]') + stripped = stripped.replace(RESET_PASSWORD_TOKEN_PATTERN, 'reset_password_token=[reset_password_token]') + stripped = stripped.replace(UNLOCK_TOKEN_PATTERN, 'unlock_token=[unlock_token]') + stripped = stripped.replace(STATE_PATTERN, 'state=[state]') + if (this.stripDatePII === true) { stripped = stripped.replace(DATE_PATTERN, '[date]') } diff --git a/spec/javascripts/govuk_publishing_components/analytics/pii.spec.js b/spec/javascripts/govuk_publishing_components/analytics/pii.spec.js index 0da8f3b59c..d5d588d743 100644 --- a/spec/javascripts/govuk_publishing_components/analytics/pii.spec.js +++ b/spec/javascripts/govuk_publishing_components/analytics/pii.spec.js @@ -54,6 +54,19 @@ describe('GOVUK.PII', function () { }) }) + describe('by default for account specific PII', function () { + it('redacts the expected list of URL parameters', function () { + var resetPasswordToken = pii.stripPII('https://www.account.publishing.service.gov.uk/new-account?reset_password_token=4be6f4db-f32a-4d75-b0c7-3b3533ff31c4&somethingelse=24342fdjfskf') + expect(resetPasswordToken).toEqual('https://www.account.publishing.service.gov.uk/new-account?reset_password_token=[reset_password_token]&somethingelse=24342fdjfskf') + + var unlockToken = pii.stripPII('https://www.account.publishing.service.gov.uk/new-account?unlock_token=4be6f4db-f32a-4d75-b0c7-3b3533ff31c4&somethingelse=24342fdjfskf') + expect(unlockToken).toEqual('https://www.account.publishing.service.gov.uk/new-account?unlock_token=[unlock_token]&somethingelse=24342fdjfskf') + + var state = pii.stripPII('https://www.account.publishing.service.gov.uk/new-account?state=4be6f4db-f32a-4d75-b0c7-3b3533ff31c4&somethingelse=24342fdjfskf') + expect(state).toEqual('https://www.account.publishing.service.gov.uk/new-account?state=[state]&somethingelse=24342fdjfskf') + }) + }) + describe('when configured to remove all PII', function () { beforeEach(function () { pageWantsDatesStripped()