fix(google-analytics): allow ga-audiences regional Google domains through proxy (#729)

Author: harlan-zw

packages/script/src/plugins/transform.ts

@@ -465,7 +465,10 @@ export function NuxtScriptBundleTransformer(options: AssetBundlerTransformerOpti
  ? options.proxyConfigs?.[proxyConfigKey]
  : undefined
 // Derive rewrites from domains: { from: domain, to: proxyPrefix/domain }
-constproxyRewrites=proxyConfig?.domains?.map(domain=>({
+// Skip wildcard patterns — those exist only for runtime allowlist matching of
+// dynamically-constructed URLs (e.g. ga-audiences geo-localized cctlds) and have
+// no literal form to rewrite at build time.
+constproxyRewrites=proxyConfig?.domains?.filter(domain=>!domain.includes('*')).map(domain=>({
 from: domain,
 to: `${options.proxyPrefix}/${domain}`,
 }))

packages/script/src/registry.ts

@@ -734,7 +734,10 @@ export async function registry(resolve?: (path: string) => Promise<string>): Pro
 },
 },
 proxy: {
-domains: ['www.google-analytics.com','analytics.google.com','stats.g.doubleclick.net','pagead2.googlesyndication.com','www.googleadservices.com','googleads.g.doubleclick.net','www.google.com','www.googletagmanager.com'],
+// `www.google.com` covers static URLs (www.google.com/g/collect) rewritten at build time;
+// `www.google.*` covers the geo-localized ga-audiences beacon, which gtag.js dynamically
+// fires to the visitor's local Google cctld (www.google.com.tw, www.google.co.jp, ...).
+domains: ['www.google-analytics.com','analytics.google.com','stats.g.doubleclick.net','pagead2.googlesyndication.com','www.googleadservices.com','googleads.g.doubleclick.net','www.google.com','www.google.*','www.googletagmanager.com'],
 privacy: PRIVACY_HEATMAP,
 },
 partytown: {forwards: ['dataLayer.push','gtag']},

packages/script/src/runtime/server/proxy-handler.ts

@@ -1,6 +1,7 @@
 importtype{ProxyPrivacyInput,ResolvedProxyPrivacy}from'./utils/privacy'
 import{createError,defineEventHandler,getHeaders,getQuery,getRequestIP,getRequestWebStream,readBody,setResponseHeader,setResponseStatus}from'h3'
 import{useNitroApp,useRuntimeConfig}from'nitropack/runtime'
+import{matchDomain}from'./utils/match-domain'
 import{
 anonymizeIP,
 mergePrivacy,
@@ -83,10 +84,10 @@ export default defineEventHandler(async (event) => {
 })
 }
 
-// Find privacy config by matching domain (exact or parent domain match)
+// Find privacy config by matching domain (exact, parent domain, or wildcard pattern)
 letperScriptInput: ProxyPrivacyInput|undefined
 for(const[configDomain,privacyInput]ofObject.entries(domainPrivacy)){
-if(domain===configDomain||domain.endsWith(`.${configDomain}`)){
+if(matchDomain(domain,configDomain)){
 perScriptInput=privacyInput
 break
 }

packages/script/src/runtime/server/utils/match-domain.ts

@@ -0,0 +1,37 @@
+/**
+ * Match a hostname against an allowlist pattern.
+ *
+ * Patterns may include `*` as a TLD wildcard that matches a top-level domain
+ * suffix shaped like a real ccTLD or gTLD:
+ * - `com` (the canonical gTLD we care about)
+ * - any 2-letter ccTLD (`tw`, `jp`, `de`, ...)
+ * - regional `com.<cc>` or `co.<cc>` (e.g. `com.tw`, `co.jp`, `com.hk`)
+ *
+ * Used for geo-localized Google ccTLDs:
+ * `www.google.*` matches `www.google.com`, `www.google.com.tw`, `www.google.co.jp`.
+ *
+ * The pattern is intentionally narrow: it rejects attacker-controlled suffixes
+ * like `www.google.foo.bar` (two arbitrary 3-letter labels) or
+ * `www.google.attacker.com` (long second-level label).
+ *
+ * Bare patterns also match subdomains, e.g. `google.com` matches `mail.google.com`.
+ */
+constTLD_WILDCARD_RE=/^(?:com|[a-z]{2}|(?:com|co)\.[a-z]{2})$/i
+
+exportfunctionmatchDomain(domain: string,pattern: string): boolean{
+if(!pattern.includes('*'))
+returndomain===pattern||domain.endsWith(`.${pattern}`)
+
+// Only support a trailing single `*` wildcard for TLD matching (the only
+// shape we use in practice). Reject any other pattern shape rather than
+// silently allowing it.
+if(!pattern.endsWith('*')||pattern.indexOf('*')!==pattern.length-1)
+returnfalse
+
+constprefix=pattern.slice(0,-1)// includes trailing dot, e.g. "www.google."
+if(!domain.startsWith(prefix))
+returnfalse
+
+consttld=domain.slice(prefix.length)
+returnTLD_WILDCARD_RE.test(tld)
+}

test/unit/proxy-handler-match-domain.test.ts

@@ -0,0 +1,49 @@
+import{describe,expect,it}from'vitest'
+import{matchDomain}from'../../packages/script/src/runtime/server/utils/match-domain'
+
+describe('matchDomain',()=>{
+it('matches exact hostname',()=>{
+expect(matchDomain('www.google-analytics.com','www.google-analytics.com')).toBe(true)
+})
+
+it('matches subdomain via parent pattern',()=>{
+expect(matchDomain('mail.google.com','google.com')).toBe(true)
+expect(matchDomain('google.com','google.com')).toBe(true)
+})
+
+it('rejects non-matching hostname',()=>{
+expect(matchDomain('evil.com','google.com')).toBe(false)
+expect(matchDomain('googleX.com','google.com')).toBe(false)
+})
+
+// Issue #728: ga-audiences fires to www.google.<cctld> based on geo
+it('matches geo-localized Google ccTLDs via wildcard',()=>{
+expect(matchDomain('www.google.com','www.google.*')).toBe(true)
+expect(matchDomain('www.google.com.tw','www.google.*')).toBe(true)
+expect(matchDomain('www.google.co.jp','www.google.*')).toBe(true)
+expect(matchDomain('www.google.com.hk','www.google.*')).toBe(true)
+})
+
+it('wildcard does not match a different host root',()=>{
+expect(matchDomain('evil.google.com','www.google.*')).toBe(false)
+expect(matchDomain('www.googleX.com','www.google.*')).toBe(false)
+})
+
+// Security: the wildcard must not match attacker-controlled subdomains.
+// Without a TLD shape constraint, `*` would match `attacker.com` here.
+it('wildcard rejects attacker-controlled suffixes',()=>{
+expect(matchDomain('www.google.attacker.com','www.google.*')).toBe(false)
+expect(matchDomain('www.google.com.attacker.com','www.google.*')).toBe(false)
+expect(matchDomain('www.google.evil-domain.com','www.google.*')).toBe(false)
+// Three or more labels in the suffix → not a valid ccTLD shape
+expect(matchDomain('www.google.a.b.c','www.google.*')).toBe(false)
+// Two arbitrary 3-letter labels are not a real ccTLD shape; only com.<cc> / co.<cc> allowed
+expect(matchDomain('www.google.foo.bar','www.google.*')).toBe(false)
+expect(matchDomain('www.google.abc.xyz','www.google.*')).toBe(false)
+})
+
+it('escapes regex metachars in the pattern',()=>{
+expect(matchDomain('foo.bar.com','foo+bar.com')).toBe(false)
+expect(matchDomain('foo+bar.com','foo+bar.com')).toBe(true)
+})
+})