Skip to content

fix(collect): Fix the issue where referer might be null#4043

Open
God-2077 wants to merge 2 commits into
umami-software:devfrom
God-2077:umami-v3-dev-3
Open

fix(collect): Fix the issue where referer might be null#4043
God-2077 wants to merge 2 commits into
umami-software:devfrom
God-2077:umami-v3-dev-3

Conversation

@God-2077
Copy link
Copy Markdown
Contributor

Handle the case where the referer header could be null, and uniformly use the value from either the referer or referrer header.

#4038

Handle the case where the referer header could be null, and uniformly use the value from either the referer or referrer header.
@vercel
Copy link
Copy Markdown

vercel Bot commented Feb 18, 2026

@God-2077 is attempting to deploy a commit to the umami-software Team on Vercel.

A member of the Team first needs to authorize it.

@greptile-apps
Copy link
Copy Markdown
Contributor

greptile-apps Bot commented Feb 18, 2026

Greptile Summary

This PR fixes a null-safety issue where request.headers.get('referer') could return null, which would then be passed as the referrer field in the payload — causing downstream issues since the Zod schema expects a string. The fix also adds a fallback to the referrer header name (both spellings).

  • Critical bug introduced: Both changed files use JavaScript shorthand { referer } which creates a property named referer, but the Zod schema in src/app/api/send/route.ts expects referrer. Zod's default behavior strips unknown keys, so the referer value will be silently lost for all pixel and link events. The fix should use { referrer: referer } instead.
  • The conditional spread ...(referer && { ... }) is a good approach to avoid sending null values.

Confidence Score: 1/5

  • This PR introduces a data loss regression — referer data will be silently dropped for all pixel and link collection events.
  • While the intent of fixing the null referer is correct, the implementation renames the payload property from referrer to referer, which doesn't match the Zod schema in the API handler. This will cause all referer data to be silently stripped, effectively breaking referrer tracking for pixel and link events.
  • Both src/app/(collect)/p/[slug]/route.ts and src/app/(collect)/q/[slug]/route.ts need the field name corrected from referer to referrer.

Important Files Changed

Filename Overview
src/app/(collect)/p/[slug]/route.ts Null handling for referer is correct, but the payload field was renamed from referrer to referer, which breaks the Zod schema contract in send/route.ts — referer data will be silently dropped.
src/app/(collect)/q/[slug]/route.ts Same field name mismatch as the pixel route — referer instead of referrer breaks the API schema, causing referer data to be silently lost for link events.

Sequence Diagram

sequenceDiagram
    participant Browser
    participant CollectRoute as /p or /q Route
    participant SendAPI as POST /api/send
    participant Zod as Zod Schema
    participant DB as Database

    Browser->>CollectRoute: GET /p/:slug or /q/:slug
    Note over CollectRoute: Gets referer header (may be null)
    CollectRoute->>CollectRoute: Build payload with { referer } ❌
    Note over CollectRoute: Field named "referer" instead of "referrer"
    CollectRoute->>SendAPI: POST with payload
    SendAPI->>Zod: safeParse(body)
    Note over Zod: Schema expects "referrer" field<br/>Unknown key "referer" is stripped
    Zod-->>SendAPI: Parsed data (referrer = undefined)
    SendAPI->>DB: saveEvent (referrerPath = undefined)
    Note over DB: Referer data lost silently
Loading

Last reviewed commit: 920b81d

Copy link
Copy Markdown
Contributor

@greptile-apps greptile-apps Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

2 files reviewed, 2 comments

Edit Code Review Agent Settings | Greptile

Comment thread src/app/(collect)/p/[slug]/route.ts Outdated
Comment thread src/app/(collect)/q/[slug]/route.ts Outdated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant