Enforce that onBeforeNotifyCallbacks can't mess with handledState

Also detects if any callback changed "severity" and update
"defaultSeverity" accordingly.

lib/notification.js

@@ -123,6 +123,14 @@ function Notification(bugsnagErrors, options, handledState) {
 
 Notification.prototype.deliver = function(cb, originalError) {
 
+    // save handledState properties, because the user shouldn't be able to set them
+    var before = {
+        severity: this.events[0].severity,
+        defaultSeverity: this.events[0].defaultSeverity,
+        unhandled: this.events[0].unhandled,
+        severityReason: this.events[0].severityReason
+    }
+
     // run before notify callbacks
     var shouldNotify = true;
     Configuration.beforeNotifyCallbacks.forEach(function (callback) {
@@ -139,6 +147,16 @@ Notification.prototype.deliver = function(cb, originalError) {
         return;
     }
 
+    // reinstate handledState properties
+    this.events[0].defaultSeverity = before.defaultSeverity
+    this.events[0].unhandled = before.unhandled
+    this.events[0].severityReason = before.severityReason
+
+    // but do one last check to see if severity was changed as a result of the callback(s)
+    if (before.severity !== this.events[0].severity) {
+        this.events[0].defaultSeverity = false;
+    }
+
     this._deliver(cb);
 };
 

test/notification.js

@@ -351,6 +351,24 @@ describe("Notification", function() {
 
             Configuration.beforeNotifyCallbacks = [];
         });
+
+        it("should not be able to modify handledState", function () {
+            Bugsnag.onBeforeNotify(function (notification, error) {
+                notification.events[0].unhandled = true;
+                notification.events[0].defaultSeverity = false;
+            });
+            Bugsnag.notify(new Error('breaky'));
+            deliverStub.firstCall.thisValue.events[0].unhandled.should.equal(false);
+            deliverStub.firstCall.thisValue.events[0].defaultSeverity.should.equal(true);
+        });
+
+        it("should cause defaultSeverity=false if any callback changes severity", function () {
+          Bugsnag.onBeforeNotify(function (notification, error) {
+              notification.events[0].severity = "error";
+          });
+          Bugsnag.notify(new Error('breaky'));
+          deliverStub.firstCall.thisValue.events[0].defaultSeverity.should.equal(false);
+        })
     });
 
     describe("autoNotify", function() {