fix: send only the referrer origin with page views

README.md

@@ -54,6 +54,10 @@ pas.alias({ id: "42", hash: "signed-user-hash" });
 pas.pageView();
 ```
 
+`pageView` sends the page's origin and path, its `utm_source`, `utm_medium`,
+and `utm_campaign` values, and only the origin of the referrer. Nothing else
+from either URL is sent, so search terms in them stay out of PAS.
+
 Requests queued for retry are stored in a cookie and replayed on the next
 initialization. The queue keeps at most the 20 most recent requests within
 3000 bytes of percent-encoded JSON: a request too large on its own is

src/client.spec.ts

@@ -159,6 +159,30 @@ describe("Client", () => {
     });
   });
 
+  it.each([
+    ["https://www.google.com/search?q=secret+movie#top", "https://www.google.com"],
+    ["https://torrents.example/search/secret-movie/1/", "https://torrents.example"],
+    ["https://app.put.io/search?phrase=secret%20movie", "https://app.put.io"],
+    ["https://app.put.io/files?search=secret+movie", "https://app.put.io"],
+    [
+      "android-app://com.google.android.googlequicksearchbox/https/www.google.com",
+      "android-app://com.google.android.googlequicksearchbox",
+    ],
+    ["", ""],
+  ])("sends only the referrer origin for pageView: %s", (referrer, expected) => {
+    vi.spyOn(document, "referrer", "get").mockReturnValueOnce(referrer);
+    client.pageView();
+
+    expect(mockAPI.post).toHaveBeenCalledWith("/events", {
+      events: [
+        expect.objectContaining({
+          properties: expect.objectContaining({ referrer: expected }),
+        }),
+      ],
+    });
+    expect(JSON.stringify(vi.mocked(mockAPI.post).mock.calls)).not.toContain("secret");
+  });
+
   it("clears cached user state", () => {
     client.alias({ id: 7, hash: "user_hash" });
     client.clear();

src/client.ts

@@ -13,6 +13,18 @@ const defaultConfig = {
 
 export type Config = typeof defaultConfig;
 
+// A referrer's path, query, and fragment can carry search terms, so PAS only
+// gets where the visit came from, never which page. `URL#origin` is "null" for
+// app referrers such as android-app://, so build it from protocol and host.
+const referrerOrigin = (referrer: string) => {
+  try {
+    const { host, protocol } = new URL(referrer);
+    return `${protocol}//${host}`;
+  } catch {
+    return "";
+  }
+};
+
 export const createClientFactoryWithDependencies =
   (
     cacheFactory: typeof createCache,
@@ -71,7 +83,7 @@ export const createClientFactoryWithDependencies =
       return track("page_viewed", {
         domain: origin,
         path: pathname,
-        referrer: document.referrer,
+        referrer: referrerOrigin(document.referrer),
         utm_source,
         utm_medium,
         utm_campaign,