DC-492 - Add Meta Pixel support to Enrollment app by pkarman · Pull Request #352 · codeforamerica/sebt-self-service-portal

pkarman · 2026-05-27T15:05:40Z

Add Meta Pixel support to Enrollment app

🔗 Jira ticket

✍️ Description

If the NEXT_PUBLIC_META_PIXEL env var is set at build time, inserts the FB Meta Pixel JS snippet into the page head.

If the NEXT_PUBLIC_META_PIXEL_ACTION env var is set, calls a trigger action on the final Review page Submit button click.

Expects that the public/meta_pixel.js file is updated at build time to replace NEXT_PUBLIC_META_PIXEL string with the Meta account id. This is left as an exercise to the builder, but in our Makefile it's:

build-enrollment: NEXT_PUBLIC_META_PIXEL ?= $(shell jq '.settings.NEXT_PUBLIC_META_PIXEL' < config/$(BUILD_ENV)/frontend.json)
build-enrollment: NEXT_PUBLIC_META_PIXEL_ACTION ?= $(shell jq '.settings.NEXT_PUBLIC_META_PIXEL_ACTION' < config/$(BUILD_ENV)/frontend.json)
build-enrollment: ## Build the static enrollment app
  perl -pi -e 's/NEXT_PUBLIC_META_PIXEL/$(NEXT_PUBLIC_META_PIXEL)/' $(BUILD)/$(PORTAL)/src/SEBT.EnrollmentChecker.Web/public/meta_pixel.js
  # more build commands here

🔗 Links to related PRs

✅ Completion tasks

Added relevant tests
Meets acceptance criteria in ticket
Configuration changes:
- If new environment variables are added, update in Tofu
- If new environment secrets are added, update in Tofu and set in AWS Secret Manager
- If you're adding an appsetting, add it to the requisite example file, and update it in the AWS AppConfig
- If appsetttings are changed, update in AWS AppConfig

pkarman · 2026-05-27T15:40:07Z

it's not clear to me that this will fire on each route change, since this is a SPA. I am not sure if that is desirable either.

aikido-pr-checks · 2026-05-28T19:04:38Z

    setError(null)
    setIsSubmitting(true)
    try {
+      if (process.env.NEXT_PUBLIC_META_PIXEL && process.env.NEXT_PUBLIC_META_PIXEL_ACTION) {


Invokes window.fbq contingent on an externally loaded Meta Pixel script that isn't version-pinned or checksum-verified. Ensure the Pixel script is pinned and integrity-checked before relying on fbq.

Details

✨ AI Reasoning
The new submit handler calls the global fbq function if environment variables are present. This runtime call depends on an external Meta Pixel script being loaded and untampered. Since the script is added elsewhere in this PR without checksum or version pinning, this change increases risk: it couples application behavior to an unpinned external dependency and lacks verification that fbq originates from an expected, immutable artifact.

🔧 How do I fix it?
Include lockfiles in your repo and CI. Pin exact versions or SHAs in manifests. Enable checksum verification. Set ignore-scripts in npm or equivalent. Enforce a 72hr minimum package age policy to avoid newly published malicious packages.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

aikido-pr-checks · 2026-05-28T19:04:39Z

        {process.env.NEXT_PUBLIC_BUILD_SHA && (
          <meta name="build-sha" content={process.env.NEXT_PUBLIC_BUILD_SHA} />
        )}
+        {process.env.NEXT_PUBLIC_META_PIXEL && (


Loads meta_pixel.js from a runtime path without pinning or integrity checks. Pin the script version and include checksum verification (or vendor the file) to avoid silent/unauthorized updates.

Details

✨ AI Reasoning
The new code injects an external JavaScript asset at runtime using an environment-controlled path. This introduces an unmanaged third-party dependency into the production build: its exact contents, version, and integrity are not pinned, nor is there any checksum or package-lock-style verification. According to strict dependency management practices, externally loaded scripts should be versioned and verified (lockfile/integrity) to prevent silent or malicious upgrades. This change therefore worsens the repository's dependency management posture by adding an unpinned, unverifiable script load.

🔧 How do I fix it?
Include lockfiles in your repo and CI. Pin exact versions or SHAs in manifests. Enable checksum verification. Set ignore-scripts in npm or equivalent. Enforce a 72hr minimum package age policy to avoid newly published malicious packages.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

aikido-pr-checks · 2026-05-28T20:16:00Z

+!function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod?
+n.callMethod.apply(n,arguments):n.queue.push(arguments)};if(!f._fbq)f._fbq=n;
+n.push=n;n.loaded=!0;n.version='2.0';n.queue=[];t=b.createElement(e);t.async=!0;
+t.src=v;s=b.getElementsByTagName(e)[0];s.parentNode.insertBefore(t,s)}(window,


Sets t.src to an unpinned external URL ('https://connect.facebook.net/en_US/fbevents.js') without checksum or version pinning; include a pinned version and integrity verification.

Details

✨ AI Reasoning
The new code injects an external script by setting t.src to a public CDN URL. This introduces an unmanaged runtime dependency that can silently change (no pinned version or checksum), which violates strict dependency management expectations. It increases risk of unexpected behavior or supply-chain changes because there is no integrity or pinned reference for the fetched asset.

🔧 How do I fix it?
Include lockfiles in your repo and CI. Pin exact versions or SHAs in manifests. Enable checksum verification. Set ignore-scripts in npm or equivalent. Enforce a 72hr minimum package age policy to avoid newly published malicious packages.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

mtodd-cfa · 2026-05-29T00:57:39Z

Added myself as a reviewer and also re-applied the "do not merge" label as this PR should not be merged, as-is, without further discussion.

mtodd-cfa · 2026-05-29T01:05:31Z

https://codeforamerica.atlassian.net/browse/DC-492

pkarman added 2 commits May 27, 2026 08:48

optionally include NEXT_PUBLIC_META_PIXEL in head

8353c23

call trigger on submit

7753c2b

pkarman had a problem deploying to prod-dc-test May 27, 2026 15:05 — with GitHub Actions Failure

no legacy comments

11061de

pkarman had a problem deploying to prod-dc-test May 27, 2026 15:23 — with GitHub Actions Failure

quote js snip

6cffc71

pkarman had a problem deploying to prod-dc-test May 27, 2026 15:28 — with GitHub Actions Failure

quote js snip

38f0ae4

pkarman had a problem deploying to prod-dc-test May 27, 2026 15:31 — with GitHub Actions Failure

avoid typescript error

af9b4f2

pkarman had a problem deploying to prod-dc-test May 27, 2026 15:34 — with GitHub Actions Failure

interpolate

a33a9c4

pkarman had a problem deploying to prod-dc-test May 27, 2026 15:43 — with GitHub Actions Failure

CSP header for FB

47032b7

pkarman had a problem deploying to prod-dc-test May 27, 2026 15:55 — with GitHub Actions Failure

fix fb host

8dfbd75

pkarman had a problem deploying to prod-dc-test May 27, 2026 15:57 — with GitHub Actions Failure

fix nested tags

7651684

pkarman had a problem deploying to prod-dc-test May 27, 2026 16:33 — with GitHub Actions Failure

close tag

a279ec5

pkarman had a problem deploying to prod-dc-test May 27, 2026 16:40 — with GitHub Actions Failure

ShaynaCummings added Do Not Merge co labels May 27, 2026

load from external file

b2134fd

pkarman had a problem deploying to prod-dc-test May 28, 2026 14:12 — with GitHub Actions Failure

use base path prefix

8a93daf

pkarman had a problem deploying to prod-dc-test May 28, 2026 14:25 — with GitHub Actions Failure

Merge branch 'codeforamerica:main' into pek-meta-pixel

61de253

pkarman had a problem deploying to prod-dc-test May 28, 2026 14:26 — with GitHub Actions Failure

fix missing braces

bb45bc8

pkarman had a problem deploying to prod-dc-test May 28, 2026 15:00 — with GitHub Actions Failure

CSP via CF

baa8a76

pkarman had a problem deploying to prod-dc-test May 28, 2026 15:28 — with GitHub Actions Failure

Merge branch 'codeforamerica:main' into pek-meta-pixel

3c4fa31

pkarman had a problem deploying to prod-dc-test May 28, 2026 19:04 — with GitHub Actions Failure

aikido-pr-checks Bot reviewed May 28, 2026

View reviewed changes

add meta_pixel.js as standalone js

fcecf72

pkarman had a problem deploying to prod-dc-test May 28, 2026 20:15 — with GitHub Actions Failure

aikido-pr-checks Bot reviewed May 28, 2026

View reviewed changes

ShaynaCummings removed the Do Not Merge label May 28, 2026

mtodd-cfa self-assigned this May 29, 2026

mtodd-cfa added the Do Not Merge label May 29, 2026

mtodd-cfa changed the title ~~Add Meta Pixel support to Enrollment app~~ DC-492 - Add Meta Pixel support to Enrollment app May 29, 2026

Merge branch 'codeforamerica:main' into pek-meta-pixel

f1a5c82

pkarman had a problem deploying to prod-dc-test June 1, 2026 16:13 — with GitHub Actions Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

DC-492 - Add Meta Pixel support to Enrollment app#352

DC-492 - Add Meta Pixel support to Enrollment app#352
pkarman wants to merge 19 commits into
codeforamerica:mainfrom
pkarman:pek-meta-pixel

pkarman commented May 27, 2026 •

edited

Loading

Uh oh!

pkarman commented May 27, 2026

Uh oh!

aikido-pr-checks Bot May 28, 2026

Uh oh!

aikido-pr-checks Bot May 28, 2026

Uh oh!

aikido-pr-checks Bot May 28, 2026

Uh oh!

mtodd-cfa commented May 29, 2026

Uh oh!

mtodd-cfa commented May 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

pkarman commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Add Meta Pixel support to Enrollment app

🔗 Jira ticket

✍️ Description

🔗 Links to related PRs

✅ Completion tasks

Uh oh!

pkarman commented May 27, 2026

Uh oh!

aikido-pr-checks Bot May 28, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot May 28, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot May 28, 2026

Choose a reason for hiding this comment

Uh oh!

mtodd-cfa commented May 29, 2026

Uh oh!

mtodd-cfa commented May 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

pkarman commented May 27, 2026 •

edited

Loading