Merge pull request #786 from bugsnag/v7-user-config

fix(core): Stricter validation on user, copying over to prevent mutations

packages/core/client.js

@@ -132,8 +132,8 @@ class Client {
     }
 
     // update and elevate some options
-    this._metadata = config.metadata
-    this._user = config.user
+    this._metadata = assign({}, config.metadata)
+    this._user = assign({}, config.user)
     this._context = config.context
     if (config.logger) this._logger = config.logger
 

packages/core/config.js

@@ -113,8 +113,14 @@ module.exports.schema = {
   },
   user: {
     defaultValue: () => ({}),
-    message: 'should be an object',
-    validate: (value) => typeof value === 'object' && value !== null
+    message: 'should be an object with { id, email, name } properties',
+    validate: value =>
+      (value === null) ||
+      (value && reduce(
+        keys(value),
+        (accum, key) => accum && includes(['id', 'email', 'name'], key),
+        true
+      ))
   },
   metadata: {
     defaultValue: () => ({}),

packages/core/test/config.test.ts

@@ -17,6 +17,17 @@ describe('@bugsnag/core/config', () => {
     })
   })
 
+  describe('user', () => {
+    it('should only allow id, name and email', () => {
+      const userValidator = config.schema.user.validate
+      expect(userValidator(null)).toBe(true)
+      expect(userValidator({ id: '123', email: 'bug@sn.ag', name: 'Bugsnag' })).toBe(true)
+      expect(userValidator({ id: '123', email: 'bug@sn.ag', name: 'Bugsnag', extra: 'aaa' })).toBe(false)
+      expect(userValidator({ id: '123' })).toBe(true)
+      expect(userValidator('123')).toBe(false)
+    })
+  })
+
   describe('enabledBreadcrumbTypes', () => {
     it('fails when a supplied value is not a valid breadcrumb type', () => {
       const enabledBreadcrumbTypesValidator = config.schema.enabledBreadcrumbTypes.validate