Skip to content

Conversation

@mydea
Copy link
Member

@mydea mydea commented Mar 2, 2023

This ensures we mask <option> when selects should be masked.

We mask both the value attribute as well as the text content of the <option>.

note that due to how masking work, the replay may not look completely correct. E.g. if you have the following:

<select name="" id="" value="BB">
  <option value="AA">A</option>
  <option value="BB">My B</option>
</select>

it is masked to:

<select name="" id="" value="**">
  <option value="**">*</option>
  <option value="**">****</option>
</select>

since technically both options have the same "value" now, when a user selects an option it may not reflect the longer text in the select box. However, I'd say that is OK, and better than to leak the values.

In addition, this also makes sure to mask value of radio/checkbox inputs. Note this only affects value='****' of these elements when maskAllInputs=true, not the content of their labels (which is masked via maskAllText: true).

Closes #74

See https://sentry-sdks.sentry.io/replays/javascript-vue-replays:7189262e513742719dbce6e5fe4556aa/?query=&referrer=%2Freplays%2F&statsPeriod=14d&yAxis=count%28%29 for a replay in action.

@mydea mydea requested review from Lms24 and billyvg March 2, 2023 10:18
@mydea mydea self-assigned this Mar 2, 2023
@mydea mydea changed the title fix: Mask <option> values for selects fix: Mask <option> values for selects & radio/checkbox value Mar 2, 2023
@mydea
Copy link
Member Author

mydea commented Mar 2, 2023

Also made a PR upstream for this: rrweb-io#1164

@mydea mydea merged commit 11d0458 into sentry-v1 Mar 3, 2023
@mydea mydea deleted the fn/select-options branch March 3, 2023 08:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Improve masking of select options

4 participants