bug: [P2] trace records fetch calls to data: URLs as HTTP accesses #74

Scope

• Commit: 1a88d503e83ceb6688d41be1e00495abfd17f054
• Package: @cellfence/trace (0.4.0)
• Test environment: Windows, Node.js v24.12.0

Actual and expected behavior

fetch("data:text/plain,hello") returns the body hello without making an HTTP request, but trace records it as an HTTP access. As a result, ordinary local data processing is included in HTTP resource access totals.

Consistent with the HTTP(S) tracing described in the README, fetch calls that do not use HTTP should not be recorded as kind: "http".

Reproduction

The fetch call is executed normally. Only file writes are mocked.

import fs from "node:fs";
import path from "node:path";

const root = process.cwd();
const writes = [];
fs.mkdirSync = () => undefined;
fs.writeFileSync = (filename, data) => {
  writes.push({ filename: path.resolve(filename), data: String(data) });
};
process.env.CELLFENCE_TRACE_COMMIT_SHA = "0000000000000000000000000000000000000000";
process.env.CELLFENCE_TRACE_OUT = path.join(root, "mock-evidence.json");
const trace = await import("./packages/trace/dist/index.js");
trace.installTrace();
console.log(await (await fetch("data:text/plain,hello")).text());
trace.flushEvidence();
console.log(JSON.parse(writes[0].data).accesses);

The observed response was hello, and the evidence contained the following entry:

{"kind":"http","access":"call","selector":"data:text/plain,hello","detectedBy":"cellfence-trace","confidence":"transient"}

Cause and fix requirements

The fetch wrapper calls recordHttpAccess without checking the URL scheme. Tests should verify that data URLs are excluded from HTTP access records while regular HTTP/HTTPS tracing continues to work.

Validation scope

Verified using the trace implementation compiled from the specified commit. Because the environment was read-only, file creation and evidence writes were replaced with in-memory mocks. After building the repository, save the reproduction code as repro.mjs in the repository root and run it with node repro.mjs. The full test suite was not run.

If you find this repository useful, please consider giving it a star.