{"action":"created","issue":{"url":"https://api.github.com/repos/segment-integrations/analytics.js-integration-intercom/issues/9","labels_url":"https://api.github.com/repos/segment-integrations/analytics.js-integration-intercom/issues/9/labels{/name}","comments_url":"https://api.github.com/repos/segment-integrations/analytics.js-integration-intercom/issues/9/comments","events_url":"https://api.github.com/repos/segment-integrations/analytics.js-integration-intercom/issues/9/events","html_url":"https://github.com/segment-integrations/analytics.js-integration-intercom/issues/9","id":128997708,"number":9,"title":"Type-check the type of traits before formatting it","user":{"login":"bbeaird","id":1836395,"avatar_url":"https://avatars.githubusercontent.com/u/1836395?v=3","gravatar_id":"","url":"https://api.github.com/users/bbeaird","html_url":"https://github.com/bbeaird","followers_url":"https://api.github.com/users/bbeaird/followers","following_url":"https://api.github.com/users/bbeaird/following{/other_user}","gists_url":"https://api.github.com/users/bbeaird/gists{/gist_id}","starred_url":"https://api.github.com/users/bbeaird/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bbeaird/subscriptions","organizations_url":"https://api.github.com/users/bbeaird/orgs","repos_url":"https://api.github.com/users/bbeaird/repos","events_url":"https://api.github.com/users/bbeaird/events{/privacy}","received_events_url":"https://api.github.com/users/bbeaird/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-01-27T01:29:50Z","updated_at":"2016-01-27T06:20:30Z","closed_at":null,"body":"Moved from here - https://github.com/segmentio/integration-intercom/issues/12\r\n\r\nWe've seen a nasty bug where somehow our `traits` was not a JS object, but some HTML string. This was coming from our API endpoint that at one point—due to a bug—returned some HTML and we passed it through as the traits.\r\n\r\n***This repo below is wrong as it's server-side.\r\nThis led to the following block of code being executed: https://github.com/segmentio/integration-intercom/blob/b522c0c5a4d7bed8c12c340c913402c790e83ce2/lib/index.js#L126-L140\r\n\r\nSince `traits` here isn't type-checked, the string was iterated over as a list of chars, leading to the \"formatted\" result objects that looked like this:\r\n\r\n```js\r\n{\r\n  \"0\": \"<\",\r\n  \"1\": \"h\",\r\n  \"2\": \"t\",\r\n  \"3\": \"m\",\r\n  \"4\": \"l\",\r\n  \"5\": \">\",\r\n  ...\r\n}\r\n```\r\n\r\nSince this is a perfectly valid object, Intercom happily accepted it. The resulting object had almost 12K keys like this, and it crippled our Intercom dashboard (all users now has to load over 12,000 properties).\r\n\r\nThis could have been prevented by adding a type check to the input param here to be an object. I'm not sure if this is a more generic problem, or only exists in the Intercom integration."},"comment":{"url":"https://api.github.com/repos/segment-integrations/analytics.js-integration-intercom/issues/comments/175425202","html_url":"https://github.com/segment-integrations/analytics.js-integration-intercom/issues/9#issuecomment-175425202","issue_url":"https://api.github.com/repos/segment-integrations/analytics.js-integration-intercom/issues/9","id":175425202,"user":{"login":"f2prateek","id":843979,"avatar_url":"https://avatars.githubusercontent.com/u/843979?v=3","gravatar_id":"","url":"https://api.github.com/users/f2prateek","html_url":"https://github.com/f2prateek","followers_url":"https://api.github.com/users/f2prateek/followers","following_url":"https://api.github.com/users/f2prateek/following{/other_user}","gists_url":"https://api.github.com/users/f2prateek/gists{/gist_id}","starred_url":"https://api.github.com/users/f2prateek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/f2prateek/subscriptions","organizations_url":"https://api.github.com/users/f2prateek/orgs","repos_url":"https://api.github.com/users/f2prateek/repos","events_url":"https://api.github.com/users/f2prateek/events{/privacy}","received_events_url":"https://api.github.com/users/f2prateek/received_events","type":"User","site_admin":false},"created_at":"2016-01-27T06:20:30Z","updated_at":"2016-01-27T06:20:30Z","body":"This likely affects other integrations (but not all).\r\n\r\nThis should be fixed in facade which is the right place to do validations like this.\r\n\r\nThe other obvious solution is to send bad data like this - that's why we have a spec documented with what we expect certain properties to be.\r\n"}}