From bab074eae3fb91f37cb66cf8f364c7b4607ae507 Mon Sep 17 00:00:00 2001
From: Marius Andra <marius.andra@gmail.com>
Date: Mon, 14 Oct 2024 15:12:04 +0200
Subject: [PATCH] fix: sanitize set_once properties (#1462)

---
 src/__tests__/posthog-core.ts | 18 ++++++++++++++++++
 src/posthog-core.ts           |  6 +++++-
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/src/__tests__/posthog-core.ts b/src/__tests__/posthog-core.ts
index a0dea04e0..91fa5a800 100644
--- a/src/__tests__/posthog-core.ts
+++ b/src/__tests__/posthog-core.ts
@@ -500,6 +500,24 @@ describe('posthog core', () => {
             })
         })
 
+        it('calls sanitize_properties for $set_once', () => {
+            posthog = posthogWith(
+                {
+                    api_host: 'https://custom.posthog.com',
+                    sanitize_properties: (props, event_name) => ({ token: props.token, event_name, ...props }),
+                },
+                overrides
+            )
+
+            posthog.persistence.get_initial_props = () => ({ initial: 'prop' })
+            expect(posthog._calculate_set_once_properties({ key: 'prop' })).toEqual({
+                event_name: '$set_once',
+                token: undefined,
+                initial: 'prop',
+                key: 'prop',
+            })
+        })
+
         it('saves $snapshot data and token for $snapshot events', () => {
             posthog = posthogWith({}, overrides)
 
diff --git a/src/posthog-core.ts b/src/posthog-core.ts
index 3dee01b08..6e06c2e43 100644
--- a/src/posthog-core.ts
+++ b/src/posthog-core.ts
@@ -988,7 +988,11 @@ export class PostHog {
             return dataSetOnce
         }
         // if we're an identified person, send initial params with every event
-        const setOnceProperties = extend({}, this.persistence.get_initial_props(), dataSetOnce || {})
+        let setOnceProperties = extend({}, this.persistence.get_initial_props(), dataSetOnce || {})
+        const sanitize_properties = this.config.sanitize_properties
+        if (sanitize_properties) {
+            setOnceProperties = sanitize_properties(setOnceProperties, '$set_once')
+        }
         if (isEmptyObject(setOnceProperties)) {
             return undefined
         }