fix(proxy): cover dynamic third-party domains for Clarity and PostHog (#732)

Author: harlan-zw

packages/script/src/registry.ts

@@ -334,6 +334,10 @@ export async function registry(resolve?: (path: string) => Promise<string>): Pro
 return`${proxyPrefix}/${host}`
 },
 },
+// PostHog supports `apiHost` for self-hosted instances and custom
+// reverse proxies. Without this, custom-host users are 403'd through
+// the proxy because only the SaaS US/EU hosts are allowlisted.
+configDomainFields: ['apiHost'],
 },
 }),
 def('fathomAnalytics',{
@@ -575,7 +579,13 @@ export async function registry(resolve?: (path: string) => Promise<string>): Pro
 },
 },
 proxy: {
-domains: ['www.clarity.ms','scripts.clarity.ms','d.clarity.ms','e.clarity.ms','k.clarity.ms','c.clarity.ms','a.clarity.ms','b.clarity.ms'],
+// Clarity buckets visitors across letter/hash-prefixed shards (a/b/c/d/e/k/...).
+// Microsoft adds shards over time, so an enumerated list silently 403s
+// through the proxy when an unlisted letter is rolled out (#728-class bug).
+// `*.clarity.ms` covers the full surface at runtime; `www.clarity.ms` is
+// kept literal so the build-time URL rewrite (which filters wildcards)
+// can still rewrite `https://www.clarity.ms/tag/<id>` in bundled SDKs.
+domains: ['www.clarity.ms','*.clarity.ms'],
 privacy: PRIVACY_HEATMAP,
 },
 partytown: {forwards: ['clarity']},

packages/script/src/runtime/server/utils/match-domain.ts

@@ -1,30 +1,49 @@
 /**
  * Match a hostname against an allowlist pattern.
  *
- * Patterns may include `*` as a TLD wildcard that matches a top-level domain
- * suffix shaped like a real ccTLD or gTLD:
- * - `com` (the canonical gTLD we care about)
- * - any 2-letter ccTLD (`tw`, `jp`, `de`, ...)
- * - regional `com.<cc>` or `co.<cc>` (e.g. `com.tw`, `co.jp`, `com.hk`)
+ * Two wildcard shapes are supported:
  *
- * Used for geo-localized Google ccTLDs:
- * `www.google.*` matches `www.google.com`, `www.google.com.tw`, `www.google.co.jp`.
+ * 1. Trailing TLD wildcard `host.<tld>.*` — matches a top-level domain suffix
+ * shaped like a real ccTLD or gTLD:
+ * - `com` (the canonical gTLD we care about)
+ * - any 2-letter ccTLD (`tw`, `jp`, `de`, ...)
+ * - regional `com.<cc>` or `co.<cc>` (e.g. `com.tw`, `co.jp`, `com.hk`)
  *
- * The pattern is intentionally narrow: it rejects attacker-controlled suffixes
- * like `www.google.foo.bar` (two arbitrary 3-letter labels) or
- * `www.google.attacker.com` (long second-level label).
+ * Used for geo-localized Google ccTLDs:
+ * `www.google.*` matches `www.google.com`, `www.google.com.tw`, `www.google.co.jp`.
+ *
+ * The pattern is intentionally narrow: it rejects attacker-controlled
+ * suffixes like `www.google.foo.bar` (two arbitrary 3-letter labels) or
+ * `www.google.attacker.com` (long second-level label).
+ *
+ * 2. Leading subdomain wildcard `*.host.tld` — matches exactly one DNS label
+ * in front of the suffix. The wildcard label must be one or more non-dot
+ * chars; it does not match the bare suffix or multi-label prefixes.
+ *
+ * Used for vendors that bucket clients across letter/hash-prefixed shards:
+ * `*.clarity.ms` matches `a.clarity.ms`, `www.clarity.ms`, `scripts.clarity.ms`.
+ * It does NOT match `clarity.ms` (no prefix) or `a.b.clarity.ms` (multi-label).
  *
  * Bare patterns also match subdomains, e.g. `google.com` matches `mail.google.com`.
  */
 constTLD_WILDCARD_RE=/^(?:com|[a-z]{2}|(?:com|co)\.[a-z]{2})$/i
+constSUBDOMAIN_LABEL_RE=/^[^.]+$/
 
 exportfunctionmatchDomain(domain: string,pattern: string): boolean{
 if(!pattern.includes('*'))
 returndomain===pattern||domain.endsWith(`.${pattern}`)
 
-// Only support a trailing single `*` wildcard for TLD matching (the only
-// shape we use in practice). Reject any other pattern shape rather than
-// silently allowing it.
+// Leading subdomain wildcard: `*.host.tld` matches exactly one non-dot label.
+if(pattern.startsWith('*.')&&pattern.indexOf('*')===0){
+constsuffix=pattern.slice(2)// drop leading "*."
+if(!domain.endsWith(`.${suffix}`))
+returnfalse
+constlabel=domain.slice(0,-(suffix.length+1))
+returnSUBDOMAIN_LABEL_RE.test(label)
+}
+
+// Trailing TLD wildcard: only support a single trailing `*`. Any other
+// wildcard shape is rejected rather than silently allowed.
 if(!pattern.endsWith('*')||pattern.indexOf('*')!==pattern.length-1)
 returnfalse
 

test/unit/first-party.test.ts

@@ -198,6 +198,13 @@ describe('first-party mode', () => {
 apiUrl: 'https://events.analytics.example.com',
 },configs.databuddyAnalytics)).toEqual(['cdn.analytics.example.com','events.analytics.example.com'])
 })
+
+it('derives extra allowlist domains for self-hosted PostHog apiHost',async()=>{
+constconfigs=awaitgetProxyConfigs()
+expect(resolveConfiguredProxyDomains({
+apiHost: 'https://posthog.example.com',
+},configs.posthog)).toEqual(['posthog.example.com'])
+})
 })
 
 describe('full chain: capabilities → proxy config → domains',()=>{

test/unit/proxy-handler-match-domain.test.ts

@@ -46,4 +46,25 @@ describe('matchDomain', () => {
 expect(matchDomain('foo.bar.com','foo+bar.com')).toBe(false)
 expect(matchDomain('foo+bar.com','foo+bar.com')).toBe(true)
 })
+
+// Microsoft Clarity buckets visitors across letter-prefixed shards
+// (a/b/c/d/e/k/scripts/www/...); enumerating them silently 403s through
+// the proxy when a new shard is rolled out.
+it('matches single-label subdomain via leading wildcard',()=>{
+expect(matchDomain('a.clarity.ms','*.clarity.ms')).toBe(true)
+expect(matchDomain('z.clarity.ms','*.clarity.ms')).toBe(true)
+expect(matchDomain('whatever.clarity.ms','*.clarity.ms')).toBe(true)
+expect(matchDomain('www.clarity.ms','*.clarity.ms')).toBe(true)
+expect(matchDomain('scripts.clarity.ms','*.clarity.ms')).toBe(true)
+})
+
+it('leading wildcard requires exactly one non-dot label',()=>{
+// bare suffix has no prefix label
+expect(matchDomain('clarity.ms','*.clarity.ms')).toBe(false)
+// multi-label prefix would be too permissive (attacker.clarity.ms.evil.com)
+expect(matchDomain('a.b.clarity.ms','*.clarity.ms')).toBe(false)
+// different host root must not match
+expect(matchDomain('a.evil.ms','*.clarity.ms')).toBe(false)
+expect(matchDomain('clarity.ms.attacker.com','*.clarity.ms')).toBe(false)
+})
 })