From c04216723873396353b09ad71641d3f28e3c49bc Mon Sep 17 00:00:00 2001
From: Ben Gourley <bn@grly.me>
Date: Fri, 8 Sep 2017 15:26:46 +0100
Subject: [PATCH] Enforce that onBeforeNotifyCallbacks can't mess with
 handledState

Also detects if any callback changed "severity" and update
"defaultSeverity" accordingly.
---
 lib/notification.js  | 18 ++++++++++++++++++
 test/notification.js | 18 ++++++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/lib/notification.js b/lib/notification.js
index 5557fdb..dc37894 100644
--- a/lib/notification.js
+++ b/lib/notification.js
@@ -123,6 +123,14 @@ function Notification(bugsnagErrors, options, handledState) {
 
 Notification.prototype.deliver = function(cb, originalError) {
 
+    // save handledState properties, because the user shouldn't be able to set them
+    var before = {
+        severity: this.events[0].severity,
+        defaultSeverity: this.events[0].defaultSeverity,
+        unhandled: this.events[0].unhandled,
+        severityReason: this.events[0].severityReason
+    }
+
     // run before notify callbacks
     var shouldNotify = true;
     Configuration.beforeNotifyCallbacks.forEach(function (callback) {
@@ -139,6 +147,16 @@ Notification.prototype.deliver = function(cb, originalError) {
         return;
     }
 
+    // reinstate handledState properties
+    this.events[0].defaultSeverity = before.defaultSeverity
+    this.events[0].unhandled = before.unhandled
+    this.events[0].severityReason = before.severityReason
+
+    // but do one last check to see if severity was changed as a result of the callback(s)
+    if (before.severity !== this.events[0].severity) {
+        this.events[0].defaultSeverity = false;
+    }
+
     this._deliver(cb);
 };
 
diff --git a/test/notification.js b/test/notification.js
index cd1b8aa..ab413d7 100644
--- a/test/notification.js
+++ b/test/notification.js
@@ -351,6 +351,24 @@ describe("Notification", function() {
 
             Configuration.beforeNotifyCallbacks = [];
         });
+
+        it("should not be able to modify handledState", function () {
+            Bugsnag.onBeforeNotify(function (notification, error) {
+                notification.events[0].unhandled = true;
+                notification.events[0].defaultSeverity = false;
+            });
+            Bugsnag.notify(new Error('breaky'));
+            deliverStub.firstCall.thisValue.events[0].unhandled.should.equal(false);
+            deliverStub.firstCall.thisValue.events[0].defaultSeverity.should.equal(true);
+        });
+
+        it("should cause defaultSeverity=false if any callback changes severity", function () {
+          Bugsnag.onBeforeNotify(function (notification, error) {
+              notification.events[0].severity = "error";
+          });
+          Bugsnag.notify(new Error('breaky'));
+          deliverStub.firstCall.thisValue.events[0].defaultSeverity.should.equal(false);
+        })
     });
 
     describe("autoNotify", function() {