From 3368a92cf5d02a84100191fd12b7452ac6d20019 Mon Sep 17 00:00:00 2001 From: Eric Wagoner Date: Sat, 17 Oct 2026 20:14:41 -0400 Subject: [PATCH] A seat link is cut from a report to the end of its string, so a name with a quote, an ampersand or a hash in it cannot end the cut before the token Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_0141G6xqLeNRYEtviLWSB5Up --- packages/web/src/main.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/packages/web/src/main.ts b/packages/web/src/main.ts index 547d916..1f9306f 100644 --- a/packages/web/src/main.ts +++ b/packages/web/src/main.ts @@ -6,7 +6,8 @@ import * as Sentry from "@sentry/browser"; * the history breadcrumb for taking it out of the address bar still names * it, so it is cut from every report before one leaves the browser. */ function scrub(text: string): string { - return text.replace(/(#seat=)[^&#\s"']*/g, "$1…"); + // The cut runs to the end of the JSON string, whatever the name holds. + return text.replace(/(#seat=)(?:[^"\\]|\\.)*/g, "$1…"); } // Errors only — no tracing, no replay. Without a DSN baked at build time