Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Mask <option> values for selects & radio/checkbox value #75

Merged
merged 2 commits into from
Mar 3, 2023

Conversation

mydea
Copy link
Member

@mydea mydea commented Mar 2, 2023

This ensures we mask <option> when selects should be masked.

We mask both the value attribute as well as the text content of the <option>.

note that due to how masking work, the replay may not look completely correct. E.g. if you have the following:

<select name="" id="" value="BB">
  <option value="AA">A</option>
  <option value="BB">My B</option>
</select>

it is masked to:

<select name="" id="" value="**">
  <option value="**">*</option>
  <option value="**">****</option>
</select>

since technically both options have the same "value" now, when a user selects an option it may not reflect the longer text in the select box. However, I'd say that is OK, and better than to leak the values.

In addition, this also makes sure to mask value of radio/checkbox inputs. Note this only affects value='****' of these elements when maskAllInputs=true, not the content of their labels (which is masked via maskAllText: true).

Closes #74

See https://sentry-sdks.sentry.io/replays/javascript-vue-replays:7189262e513742719dbce6e5fe4556aa/?query=&referrer=%2Freplays%2F&statsPeriod=14d&yAxis=count%28%29 for a replay in action.

@mydea mydea requested review from billyvg and Lms24 March 2, 2023 10:18
@mydea mydea self-assigned this Mar 2, 2023
@mydea mydea changed the title fix: Mask <option> values for selects fix: Mask <option> values for selects & radio/checkbox value Mar 2, 2023
@mydea
Copy link
Member Author

mydea commented Mar 2, 2023

Also made a PR upstream for this: rrweb-io#1164

@mydea mydea merged commit 11d0458 into sentry-v1 Mar 3, 2023
@mydea mydea deleted the fn/select-options branch March 3, 2023 08:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Improve masking of select options
3 participants