✨ Add href and aria-label to composed_path_selector

[LFBarreto]

Motivation

_dd.action.target.composed_path_selector helps identify the clicked element for auto-collected click actions, but it does not collect href or aria-label. These two attributes make the selector more useful: href identifies which link was clicked, and aria-label identifies icon-only controls that have no visible text.

We add both attributes while keeping the field PII-safe. No JIRA ticket exists for this change yet.

Changes

• getComposedPathSelector now takes the RUM configuration instead of a single attribute name.
• href is reduced to the origin plus a path where generated-looking segments (segments with a digit) are replaced with ?. The hash and any non-http(s) payload (mailto:, tel:, javascript:, data:, ...) are dropped. Query string values are dropped too, but the (deduplicated) parameter names are kept, since they are typically static field names rather than user data. This sanitization is href's only protection — it is never masked by the privacy level, data-dd-privacy, or enablePrivacyForActionName.
• aria-label goes through the same masking pipeline as action names (enablePrivacyForActionName, defaultPrivacyLevel, data-dd-privacy, $DD_ALLOW).
• Both attributes are gated behind a new composed_path_selector_attributes experimental flag, so we can validate cardinality and PII exposure before turning them on by default.
• _dd.action.target.composed_path_selector stays outside beforeSend's modifiable fields, so the field's format stays stable for anything parsing it downstream. The sanitization above is therefore the only protection href has, by design.

See getComposedPathSelector.ts for the implementation.

Test instructions

• Unit tests: yarn test:unit --spec packages/browser-rum-core/src/domain/getComposedPathSelector.spec.ts --spec packages/browser-rum-core/src/domain/action/trackClickActions.spec.ts
• E2E test: yarn test:e2e -g "composed path selector"
• Manual check: run yarn dev, add enableExperimentalFeatures: ['composed_path_selector_attributes'] to the sandbox DD_RUM.init() call in sandbox/index.html, click a link with a query string and an icon button with an aria-label, and confirm _dd.action.target.composed_path_selector on the intake payload contains the sanitized href (origin, grouped path, query param names only, never masked) and the aria-label (masked according to the privacy level), with no raw query values or tokens.

Checklist

• Tested locally
• Tested on staging
• Added unit tests for this change.
• Added e2e/integration tests for this change.
• Updated documentation and/or relevant AGENTS.md file

[datadog-official]

✅ All CI checks and tests passed.

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 73.21%
• Overall Coverage: 77.04% (+0.01%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 3808b57 | Docs | View more details | Give us feedback!}

[cit-pr-commenter-54b7da]

Bundles Sizes Evolution

📦 Bundle Name	Base Size	Local Size	𝚫	𝚫%	Status
Rum	181.63 KiB	182.86 KiB	+1.24 KiB	+0.68%	✅
Rum Profiler	8.43 KiB	8.43 KiB	0 B	0.00%	✅
Rum Recorder	25.32 KiB	25.32 KiB	0 B	0.00%	✅
Logs	57.93 KiB	58.00 KiB	+72 B	+0.12%	✅
Rum Salesforce	N/A	140.88 KiB	N/A	N/A	N/A
Rum Slim	139.68 KiB	140.88 KiB	+1.19 KiB	+0.85%	✅
Worker	22.96 KiB	22.96 KiB	0 B	0.00%	✅
Rum Shopify	N/A	207.22 KiB	N/A	N/A	N/A
Rum-shopify Profiler	N/A	8.43 KiB	N/A	N/A	N/A
Rum-shopify Recorder	N/A	3.74 KiB	N/A	N/A	N/A