[Hector Hernandez (hectorhdzg)]

Summary

Fixes #2771.

ClickAnalytics auto capture used a hardcoded <input> type allowlist (button, checkbox, radio, reset, submit) that was independent of trackElementTypes and not documented. Including INPUT in trackElementTypes silently ignored clicks on text, email, number, search and untyped inputs.

Changes

• New trackInputTypes config: comma separated list of <input> type values to auto capture. The default BUTTON,CHECKBOX,RADIO,RESET,SUBMIT keeps existing behavior. Case and whitespace insensitive, and supports dynamic config changes.
• Privacy guard: the value of input types other than button, checkbox, radio, reset and submit is never used as the default content name; it falls back to name, alt or id. Opting in to text-like inputs cannot leak user entered data through the content name. This also applies to manual capturePageAction calls on such inputs, which previously could use the typed value.
• Bug fix (dynamic config): on any config change the plugin unloads the previous AutoCaptureHandler (removing its listeners) and creates a new one, but only called click() when autoCapture transitioned from off to on. Any runtime config change therefore silently stopped auto capture, including trackElementTypes changes. Listeners are now re-attached whenever autoCapture is enabled.
• Docs: README now documents trackElementTypes, trackInputTypes and the input capture behavior.

Validation

• rush build --to @microsoft/applicationinsights-clickanalytics-js
• npm test in extensions/applicationinsights-clickanalytics-js: 27 tests, 0 failed. New test covers default filtering, untyped inputs, dynamic opt-in, typed values not being captured, and an empty list disabling input capture.
• npm run lint-fix

[Copilot]

🟡 Changes recommended

Lowercase XHTML input tags bypass the privacy guard and can expose user-entered values in telemetry.

1 open issue

• Prevent XHTML input values from bypassing privacy filtering · New

What changed in this PR

This PR makes ClickAnalytics input-type capture configurable while preserving the default allowlist. It also adds protection against capturing typed values and fixes listener reattachment after configuration changes.

Changes:

• Adds trackInputTypes with runtime configuration support.
• Adds an input-value privacy guard and restores auto-capture listeners after configuration updates.
• Documents input filtering and adds tests for defaults, dynamic opt-in, and value exclusion.

File	Description
extensions/​applicationinsights-clickanalytics-js/​Tests/​Unit/​src/​ClickEventTest.ts	Tests input filtering, runtime updates, and value exclusion.
extensions/​applicationinsights-clickanalytics-js/​src/​Interfaces/​Datamodel.ts	Declares and documents trackInputTypes.
extensions/​applicationinsights-clickanalytics-js/​src/​handlers/​DomContentHandler.ts	Restricts input values used as default content names.
extensions/​applicationinsights-clickanalytics-js/​src/​handlers/​AutoCaptureHandler.ts	Parses and applies configurable input-type filtering.
extensions/​applicationinsights-clickanalytics-js/​src/​ClickAnalyticsPlugin.ts	Adds defaults and reattaches listeners after configuration changes.
extensions/​applicationinsights-clickanalytics-js/​README.md	Documents filtering options and input privacy behavior.

_{Review effort: Balanced}