Skip to content

feat: Enforce masking of credit card fields #166

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mydea merged 3 commits into from
Feb 1, 2024
Merged

feat: Enforce masking of credit card fields #166

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1a61a0f
feat: Enforce masking of credit card fields
mydea Feb 1, 2024
42e28c3
add further test
mydea Feb 1, 2024
eb22d8a
Apply formatting changes
mydea Feb 1, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions packages/rrweb-snapshot/src/snapshot.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -383,6 +383,24 @@ export function needMaskingText(
: node.parentElement;
if (el === null) return false;

if (el.tagName === 'INPUT') {
// Special cases: We want to enforce some masking for password & credit-card related fields,
// no matter the settings
const autocomplete = el.getAttribute('autocomplete');
const disallowedAutocompleteValues = [
'current-password',
'new-password',
'cc-number',
'cc-exp',
'cc-exp-month',
'cc-exp-year',
'cc-csc',
];
if (disallowedAutocompleteValues.includes(autocomplete as string)) {
return true;
}
}

let maskDistance = -1;
let unmaskDistance = -1;

Expand Down
28 changes: 14 additions & 14 deletions packages/rrweb-snapshot/test/__snapshots__/integration.test.ts.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -277,25 +277,25 @@ exports[`integration tests [html file]: form-fields-sensitive.html 1`] = `
<input type=\\"password\\" value=\\"*******\\" />
</label>
<label>
<input autocomplete=\\"current-password\\" value=\\"initial\\" />
<input autocomplete=\\"current-password\\" value=\\"*******\\" />
</label>
<label>
<input autocomplete=\\"new-password\\" value=\\"initial\\" />
<input autocomplete=\\"new-password\\" value=\\"*******\\" />
</label>
<label>
<input autocomplete=\\"cc-number\\" value=\\"initial\\" />
<input autocomplete=\\"cc-number\\" value=\\"*******\\" />
</label>
<label>
<input autocomplete=\\"cc-exp\\" value=\\"initial\\" />
<input autocomplete=\\"cc-exp\\" value=\\"*******\\" />
</label>
<label>
<input autocomplete=\\"cc-exp-month\\" value=\\"initial\\" />
<input autocomplete=\\"cc-exp-month\\" value=\\"*******\\" />
</label>
<label>
<input autocomplete=\\"cc-exp-year\\" value=\\"initial\\" />
<input autocomplete=\\"cc-exp-year\\" value=\\"*******\\" />
</label>
<label>
<input autocomplete=\\"cc-csc\\" value=\\"initial\\" />
<input autocomplete=\\"cc-csc\\" value=\\"*******\\" />
</label>
</form>
</body></html>"
Expand All @@ -313,25 +313,25 @@ exports[`integration tests [html file]: form-fields-sensitive-update.html 1`] =
<input type=\\"password\\" value=\\"*********\\" />
</label>
<label>
<input autocomplete=\\"current-password\\" value=\\"new value\\" />
<input autocomplete=\\"current-password\\" value=\\"*********\\" />
</label>
<label>
<input autocomplete=\\"new-password\\" value=\\"new value\\" />
<input autocomplete=\\"new-password\\" value=\\"*********\\" />
</label>
<label>
<input autocomplete=\\"cc-number\\" value=\\"new value\\" />
<input autocomplete=\\"cc-number\\" value=\\"*********\\" />
</label>
<label>
<input autocomplete=\\"cc-exp\\" value=\\"new value\\" />
<input autocomplete=\\"cc-exp\\" value=\\"*********\\" />
</label>
<label>
<input autocomplete=\\"cc-exp-month\\" value=\\"new value\\" />
<input autocomplete=\\"cc-exp-month\\" value=\\"*********\\" />
</label>
<label>
<input autocomplete=\\"cc-exp-year\\" value=\\"new value\\" />
<input autocomplete=\\"cc-exp-year\\" value=\\"*********\\" />
</label>
<label>
<input autocomplete=\\"cc-csc\\" value=\\"new value\\" />
<input autocomplete=\\"cc-csc\\" value=\\"*********\\" />
</label>
</form>

Expand Down
30 changes: 30 additions & 0 deletions packages/rrweb-snapshot/test/snapshot.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -497,4 +497,34 @@ describe('needMaskingText', () => {
),
).toEqual(false);
});

describe('enforced masking', () => {
it.each([
'current-password',
'new-password',
'cc-number',
'cc-exp',
'cc-exp-month',
'cc-exp-year',
'cc-csc',
])('enforces masking for autocomplete="%s"', (autocompleteValue) => {
document.write(
`<input autocomplete='${autocompleteValue}' value='initial' class='unmaskmask'></input>`,
);
const el = document.querySelector('input')!;
expect(
needMaskingText(el, 'maskmask', '.foo', 'unmaskmask', null, false),
).toEqual(true);
});

it('does not mask other autocomplete values', () => {
document.write(
`<input autocomplete='name' value='initial' class='unmaskmask'></input>`,
);
const el = document.querySelector('input')!;
expect(
needMaskingText(el, 'maskmask', '.foo', 'unmaskmask', null, false),
).toEqual(false);
});
});
});
Loading