From 310309d27b901eb9e499400a6119159a3285ffa8 Mon Sep 17 00:00:00 2001
From: Vadim Korolik <vkorolik@gmail.com>
Date: Thu, 8 Dec 2022 15:03:56 -0800
Subject: [PATCH] ensure media elements have their source blocked correctly

---
 packages/rrweb-snapshot/src/snapshot.ts | 19 ++++++++++++-------
 packages/rrweb-snapshot/src/utils.ts    | 11 +++++++++++
 2 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/packages/rrweb-snapshot/src/snapshot.ts b/packages/rrweb-snapshot/src/snapshot.ts
index 95e65eb7..fd089bb3 100644
--- a/packages/rrweb-snapshot/src/snapshot.ts
+++ b/packages/rrweb-snapshot/src/snapshot.ts
@@ -21,6 +21,7 @@ import {
   obfuscateText,
   isNativeShadowDom,
   getCssRulesString,
+  isElementSrcBlocked,
 } from './utils';
 
 let _id = 1;
@@ -815,16 +816,20 @@ function serializeElementNode(
     }
   }
   // block element
-  if (needBlock || needMask || (tagName === 'img' && enableStrictPrivacy)) {
+  if (
+    needBlock ||
+    needMask ||
+    (enableStrictPrivacy && isElementSrcBlocked(tagName))
+  ) {
     const { width, height } = n.getBoundingClientRect();
     attributes = {
       class: attributes.class,
       rr_width: `${width}px`,
       rr_height: `${height}px`,
     };
-    if (enableStrictPrivacy) {
-      needBlock = true;
-    }
+  }
+  if (enableStrictPrivacy && isElementSrcBlocked(tagName)) {
+    needBlock = true;
   }
   // iframe
   if (tagName === 'iframe' && !keepIframeSrcFn(attributes.src as string)) {
@@ -1069,10 +1074,10 @@ export function serializeNodeWithId(
       !!serializedNode.needMask;
 
     /** Highlight Code Begin */
-    // Remove the image's src if enableStrictPrivacy.
-    if (strictPrivacy && serializedNode.tagName === 'img') {
+    // process enableStrictPrivacy obfuscation of non-text elements
+    if (strictPrivacy && isElementSrcBlocked(serializedNode.tagName)) {
       const clone = n.cloneNode();
-      (clone as unknown as HTMLImageElement).src = '';
+      (clone as unknown as { src: string }).src = '';
       mirror.add(clone, serializedNode);
     }
     /** Highlight Code End */
diff --git a/packages/rrweb-snapshot/src/utils.ts b/packages/rrweb-snapshot/src/utils.ts
index f9d3303b..dcb43c3d 100644
--- a/packages/rrweb-snapshot/src/utils.ts
+++ b/packages/rrweb-snapshot/src/utils.ts
@@ -202,4 +202,15 @@ export function obfuscateText(text: string): string {
       .join(' ') || '';
   return text;
 }
+
+// returns true if the tag name is an element type that should have its source blocked
+export function isElementSrcBlocked(tagName: string): boolean {
+  return (
+    tagName === 'img' ||
+    tagName === 'video' ||
+    tagName === 'audio' ||
+    tagName === 'source'
+  );
+}
+
 /* End of Highlight Code */