feat: Ensure password is always masked by default

getsentry · Jul 29, 2023 · cffefa2 · cffefa2
1 parent 3f87051
commit cffefa2
Show file tree

Hide file tree

Showing 9 changed files with 941 additions and 597 deletions.
diff --git a/packages/rrweb-snapshot/src/snapshot.ts b/packages/rrweb-snapshot/src/snapshot.ts
@@ -1524,12 +1524,9 @@ function snapshot(
           week: true,
           textarea: true,
           select: true,
-          password: true,
         }
       : maskAllInputs === false
-      ? {
-          password: true,
-        }
+      ? {}
       : maskAllInputs;
   const slimDOMOptions: SlimDOMOptions =
     slimDOM === true || slimDOM === 'all'

diff --git a/packages/rrweb-snapshot/src/types.ts b/packages/rrweb-snapshot/src/types.ts
@@ -134,7 +134,7 @@ export type MaskInputOptions = Partial<{
   // unify textarea and select element with text input
   textarea: boolean;
   select: boolean;
-  password: boolean;
+  // password is _always_ masked, can't opt out of this
   radio: boolean;
   checkbox: boolean;
 }>;

diff --git a/packages/rrweb-snapshot/src/utils.ts b/packages/rrweb-snapshot/src/utils.ts
@@ -180,7 +180,10 @@ export function shouldMaskInput({
   const actualType = type && toLowerCase(type);
   return Boolean(
     maskInputOptions[tagName.toLowerCase() as keyof MaskInputOptions] ||
-      (actualType && maskInputOptions[actualType as keyof MaskInputOptions]),
+      (actualType && maskInputOptions[actualType as keyof MaskInputOptions]) ||
+      actualType === 'password' ||
+      // Default to "text" option for inputs without a "type" attribute defined
+      (tagName === 'INPUT' && !type && maskInputOptions['text'])
   );
 }
 

diff --git a/packages/rrweb/src/record/index.ts b/packages/rrweb/src/record/index.ts
@@ -146,13 +146,12 @@ function record<T = eventWithTime>(
           week: true,
           textarea: true,
           select: true,
-          password: true,
           radio: true,
           checkbox: true,
         }
       : _maskInputOptions !== undefined
       ? _maskInputOptions
-      : { password: true };
+      : {};
 
   const slimDOMOptions: SlimDOMOptions =
     _slimDOMOptions === true || _slimDOMOptions === 'all'