⚗️ Collect click-target attributes as a facetable key-value map

[LFBarreto]

Motivation

_dd.action.target.composed_path_selector identifies the clicked element for auto-collected click actions. It is a single CSS-like string. Customers cannot filter or group RUM click actions by one attribute value, for example href or aria-label.

This change adds a key-value map of click-target attributes. Customers can use it as a facet to filter and group click actions.

Design rationale, prior-art comparison (Heap, PostHog, FullStory, Amplitude, GA4), and customer motivation are written up in RFC: Collecting Click-Target Attributes as a Facetable Key-Value Map.

JIRA: PANA-8907

This field is kept under _dd.* for now. Promoting it to the public action.target schema needs a companion PR in rum-events-format: DataDog/rum-events-format#439 (draft).

Changes

• Add _dd.action.target.attributes, a key-value map collected from a click's composedPath(). The map can contain href, aria-label, name, title, alt, id, role, and data-* attributes.
• Elements are visited target-first. The closest value for each key wins. Farther ancestors are ignored for that key once it is set.
• href is collected only from <a> and <area> elements, and only after the same structural sanitization already used in composed_path_selector (origin plus path, generated segments replaced with ?, query values dropped, query names kept, hash dropped). This sanitization now lives in a shared urlSanitizer.ts, with its own unit tests.
• aria-label, name, title, and alt go through the existing privacy masking pipeline (defaultPrivacyLevel, data-dd-privacy, $DD_ALLOW), independently of the enablePrivacyForActionName option, which only controls masking of the action name.
• data-* attributes go through the same masking pipeline, except for a small allowlist of test-id-style attributes (data-testid, data-cy, ...), which stay unmasked. The SDK's own data-dd-privacy attribute is excluded from this wildcard collection.
• id and role are collected as-is. They are not part of the masked set.
• Every collected value is dropped if it contains an email address, regardless of privacy level or attribute type. aria-label, name, title, and alt values are also dropped if they contain a digit, since that free-form text can carry a raw identifier (e.g. a phone number) when unmasked. href, id, role, and data-* are exempt from the digit check: digits are the common, wanted case there (product ids, SKUs, test ids).
• The map is capped at 20 keys per click action, and each value is truncated to 100 characters.
• The map is gated behind a new composed_path_selector_attributes_map experimental flag.
• href and aria-label are removed from composed_path_selector. They stay in the new attributes map only, so the SDK does not collect the same PII-sensitive data in two fields.

See getComposedPathAttributes.ts for the implementation.

Test instructions

• Unit tests:

  yarn test:unit --spec packages/browser-rum-core/src/domain/getComposedPathAttributes.spec.ts --spec packages/browser-rum-core/src/domain/getComposedPathSelector.spec.ts --spec packages/browser-rum-core/src/domain/urlSanitizer.spec.ts --spec packages/browser-rum-core/src/domain/action/trackClickActions.spec.ts --spec packages/browser-rum-core/src/domain/action/actionCollection.spec.ts
  

• E2E test: yarn test:e2e -g "composed path" covers the attribute map and the selector string, with the correct experimental flag enabled.
• Manual check: run yarn dev, add enableExperimentalFeatures: ['composed_path_selector_attributes_map'] to the sandbox DD_RUM.init() call in sandbox/index.html, click a link with a query string and an icon button with an aria-label, and confirm _dd.action.target.attributes on the intake payload contains the sanitized href and the masked aria-label, with no digits or email addresses in any value.

Checklist

• Tested locally
• Tested on staging
• Added unit tests for this change.
• Added e2e/integration tests for this change.
• Updated documentation and/or relevant AGENTS.md file

[datadog-official]

 

✨ Unblock PR with BitsAI

⚠️ Warnings

❌ Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 1 Pipeline job failed

DataDog/browser-sdk | unit — ❌ 1 test failed · 🔧 Needs a code fix, caused by this PR

View more details · View in GitLab

❌ getComposedPathAttributes when the experimental flag is enabled caps the number of collected keys and keeps collecting nothing further past the cap from Chrome Headless 152.0.0.0 (Linux 0.0.0)

Test has failed

ℹ️ Info

No other issues found (see more)

❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 70.93%
• Overall Coverage: 77.00% (-0.03%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 2ebdcb0 | Docs | View more details | Give us feedback!}

[cit-pr-commenter-54b7da]

Bundles Sizes Evolution

📦 Bundle Name	Base Size	Local Size	𝚫	𝚫%	Status
Rum	181.63 KiB	183.54 KiB	+1.92 KiB	+1.05%	✅
Rum Profiler	8.43 KiB	8.43 KiB	0 B	0.00%	✅
Rum Recorder	25.32 KiB	25.32 KiB	0 B	0.00%	✅
Logs	57.93 KiB	58.01 KiB	+80 B	+0.13%	✅
Rum Salesforce	N/A	141.57 KiB	N/A	N/A	N/A
Rum Slim	139.68 KiB	141.56 KiB	+1.88 KiB	+1.34%	✅
Worker	22.96 KiB	22.96 KiB	0 B	0.00%	✅
Rum Shopify	N/A	207.90 KiB	N/A	N/A	N/A
Rum-shopify Profiler	N/A	8.43 KiB	N/A	N/A	N/A
Rum-shopify Recorder	N/A	3.74 KiB	N/A	N/A	N/A