Skip to content

Prevent invalid search form submissions

Sarah German requested to merge gps-search-customevent into main

What does this MR do and why?

Since Google search went up on production, one of the most popular queries has been [object*customevent]. This is something malformed coming from frontend code, not an actual human-submitted query.

I haven't been able to trace where it comes from. There aren't any CustomEvent references in our codebase, or GitLab UI, which provides our search form components. Looking at the network requests in dev tools when making a search, I can't reproduce passing an invalid query like this, and I don't see requests going through besides manual searches. But they do show up in our statistics on the Google side, at a high enough volume that it seems automated.

Since we never saw this until production, it may be coming from one of the third-party analytics/trackers on the site that come in via Google Tag Manager, or some sort of crawler, or a browser extension.

In any case, we don't want to be sending unnecessary requests to Google as our service there is billed based on API usage. This MR validates that the query we're sending to Google is a string, not an object. This should hopefully catch the [object*customevent] searches before they run, but we'll need to validate this in production in a few days.

Screenshots, screen recordings, or links to review app

No visual changes.

Review app:

Merge request acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Sarah German

Merge request reports

Loading