test: Add tests for masking of sensitive data by mydea · Pull Request #165 · getsentry/rrweb

mydea · 2024-02-01T15:07:09Z

This tests masking of initial & updated values for password & credit card fields.

You can see that for now credit card data is not masked, which demonstrates the current behavior.
In a future PR we can then verify that our fixed masking is working.

ref getsentry/sentry-javascript#10258

add tests for sensitive data

billyvg · 2024-02-01T15:43:01Z

 \\"class\\": \\"rr-block\\",
 \\"rr_width\\": \\"1904px\\",
- \\"rr_height\\": \\"21px\\"
+ \\"rr_height\\": \\"21.5px\\"


This is flakey :(

yeah, sucks a lot 😬

billyvg · 2024-02-01T15:45:25Z

+ <label>
+ <input autocomplete="cc-number" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-exp" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-exp-month" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-exp-year" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-csc" value="initial" />
+ </label>


LGTM
(ref: https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete-cc-name)

billyvg

Should we add a test for dynamically inserted elements as well?

mydea · 2024-02-01T16:03:10Z

Should we add a test for dynamically inserted elements as well?

I'll add some in the follow up PR!

This is on top of #165, actually fixing the behavior so that certain fields cannot be unmasked. This is a pretty straightforward fix, a bit "hacky" but should work well enough. Fixesgetsentry/sentry-javascript#10258 --------- Co-authored-by: mydea <mydea@users.noreply.github.com>

This tests masking of initial & updated values for password & credit card fields. You can see that for now credit card data is not masked, which demonstrates the current behavior. In a future PR we can then verify that our fixed masking is working. ref getsentry/sentry-javascript#10258

This is on top of #165, actually fixing the behavior so that certain fields cannot be unmasked. This is a pretty straightforward fix, a bit "hacky" but should work well enough. Fixesgetsentry/sentry-javascript#10258 --------- Co-authored-by: mydea <mydea@users.noreply.github.com>

Bump the core build/test tooling across all workspace packages: - **vite** ^5.2.8 → ^6.4.1 - **vitest** ^1.4.0 → ^2.1.9 - **vite-plugin-dts** ^3.8.1 → ^4.5.4 - **rollup-plugin-terser** (deprecated) → **@rollup/plugin-terser** in rrweb-worker Added `cssFileName: 'style'` to the shared vite config to preserve the `style.css` output filename (Vite 6 changed the default to package-name-based). ### Dependabot alerts resolved **Fully resolved** (vulnerable version completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #113 | CRITICAL | `vitest` | Remote Code Execution when accessing a malicious website while Vitest API server is listening | | #203 | HIGH | `rollup` | Rollup 4 has Arbitrary File Write via Path Traversal | | #110 | MEDIUM | `vue-template-compiler` | Client-side XSS (no fix available — removed by vite-plugin-dts v4 dropping the dependency) | **Partially resolved** (some vulnerable entries removed, but package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #154, #146, #145, #141, #140, #139, #138, #126, #111 | MEDIUM/LOW | `vite` | `@sveltejs/vite-plugin-svelte@3` still pulls in vite@5 (needs Svelte 5 upgrade) | | #114 | MEDIUM | `esbuild` | `esbuild-plugin-umd-wrapper` still uses esbuild@0.18 | | #214 | HIGH | `serialize-javascript` | webpack (via `@size-limit`) still pulls in v6 | | #105, #104 | MEDIUM | `nanoid` | postcss (via vite internally) still uses nanoid@3 | | #165, #155 | HIGH/MEDIUM | `validator` | `@microsoft/api-extractor` (via vite-plugin-dts) — needs further investigation | The partially resolved alerts will be addressed in later phases (Svelte 5 upgrade, @size-limit bump, mop-up). closes https://linear.app/getsentry/issue/SDK-1095/bump-vitest-vite-56-1-critical-7-alerts --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: chargome <chargome@users.noreply.github.com>

mydea · 2024-02-01T15:07:09Z

This tests masking of initial & updated values for password & credit card fields.

You can see that for now credit card data is not masked, which demonstrates the current behavior.
In a future PR we can then verify that our fixed masking is working.

ref getsentry/sentry-javascript#10258

add tests for sensitive data

billyvg · 2024-02-01T15:43:01Z

 \\"class\\": \\"rr-block\\",
 \\"rr_width\\": \\"1904px\\",
- \\"rr_height\\": \\"21px\\"
+ \\"rr_height\\": \\"21.5px\\"


This is flakey :(

yeah, sucks a lot 😬

billyvg · 2024-02-01T15:45:25Z

+ <label>
+ <input autocomplete="cc-number" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-exp" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-exp-month" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-exp-year" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-csc" value="initial" />
+ </label>


LGTM
(ref: https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete-cc-name)

billyvg

Should we add a test for dynamically inserted elements as well?

mydea · 2024-02-01T16:03:10Z

Should we add a test for dynamically inserted elements as well?

I'll add some in the follow up PR!

This is on top of #165, actually fixing the behavior so that certain fields cannot be unmasked. This is a pretty straightforward fix, a bit "hacky" but should work well enough. Fixesgetsentry/sentry-javascript#10258 --------- Co-authored-by: mydea <mydea@users.noreply.github.com>

This tests masking of initial & updated values for password & credit card fields. You can see that for now credit card data is not masked, which demonstrates the current behavior. In a future PR we can then verify that our fixed masking is working. ref getsentry/sentry-javascript#10258

This is on top of #165, actually fixing the behavior so that certain fields cannot be unmasked. This is a pretty straightforward fix, a bit "hacky" but should work well enough. Fixesgetsentry/sentry-javascript#10258 --------- Co-authored-by: mydea <mydea@users.noreply.github.com>

Bump the core build/test tooling across all workspace packages: - **vite** ^5.2.8 → ^6.4.1 - **vitest** ^1.4.0 → ^2.1.9 - **vite-plugin-dts** ^3.8.1 → ^4.5.4 - **rollup-plugin-terser** (deprecated) → **@rollup/plugin-terser** in rrweb-worker Added `cssFileName: 'style'` to the shared vite config to preserve the `style.css` output filename (Vite 6 changed the default to package-name-based). ### Dependabot alerts resolved **Fully resolved** (vulnerable version completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #113 | CRITICAL | `vitest` | Remote Code Execution when accessing a malicious website while Vitest API server is listening | | #203 | HIGH | `rollup` | Rollup 4 has Arbitrary File Write via Path Traversal | | #110 | MEDIUM | `vue-template-compiler` | Client-side XSS (no fix available — removed by vite-plugin-dts v4 dropping the dependency) | **Partially resolved** (some vulnerable entries removed, but package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #154, #146, #145, #141, #140, #139, #138, #126, #111 | MEDIUM/LOW | `vite` | `@sveltejs/vite-plugin-svelte@3` still pulls in vite@5 (needs Svelte 5 upgrade) | | #114 | MEDIUM | `esbuild` | `esbuild-plugin-umd-wrapper` still uses esbuild@0.18 | | #214 | HIGH | `serialize-javascript` | webpack (via `@size-limit`) still pulls in v6 | | #105, #104 | MEDIUM | `nanoid` | postcss (via vite internally) still uses nanoid@3 | | #165, #155 | HIGH/MEDIUM | `validator` | `@microsoft/api-extractor` (via vite-plugin-dts) — needs further investigation | The partially resolved alerts will be addressed in later phases (Svelte 5 upgrade, @size-limit bump, mop-up). closes https://linear.app/getsentry/issue/SDK-1095/bump-vitest-vite-56-1-critical-7-alerts --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: chargome <chargome@users.noreply.github.com>

mydea · 2024-02-01T15:07:09Z

This tests masking of initial & updated values for password & credit card fields.

You can see that for now credit card data is not masked, which demonstrates the current behavior.
In a future PR we can then verify that our fixed masking is working.

ref getsentry/sentry-javascript#10258

add tests for sensitive data

billyvg · 2024-02-01T15:43:01Z

 \\"class\\": \\"rr-block\\",
 \\"rr_width\\": \\"1904px\\",
- \\"rr_height\\": \\"21px\\"
+ \\"rr_height\\": \\"21.5px\\"


This is flakey :(

yeah, sucks a lot 😬

billyvg · 2024-02-01T15:45:25Z

+ <label>
+ <input autocomplete="cc-number" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-exp" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-exp-month" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-exp-year" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-csc" value="initial" />
+ </label>


LGTM
(ref: https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete-cc-name)

billyvg

Should we add a test for dynamically inserted elements as well?

mydea · 2024-02-01T16:03:10Z

Should we add a test for dynamically inserted elements as well?

I'll add some in the follow up PR!

This is on top of #165, actually fixing the behavior so that certain fields cannot be unmasked. This is a pretty straightforward fix, a bit "hacky" but should work well enough. Fixesgetsentry/sentry-javascript#10258 --------- Co-authored-by: mydea <mydea@users.noreply.github.com>

This tests masking of initial & updated values for password & credit card fields. You can see that for now credit card data is not masked, which demonstrates the current behavior. In a future PR we can then verify that our fixed masking is working. ref getsentry/sentry-javascript#10258

This is on top of #165, actually fixing the behavior so that certain fields cannot be unmasked. This is a pretty straightforward fix, a bit "hacky" but should work well enough. Fixesgetsentry/sentry-javascript#10258 --------- Co-authored-by: mydea <mydea@users.noreply.github.com>

Bump the core build/test tooling across all workspace packages: - **vite** ^5.2.8 → ^6.4.1 - **vitest** ^1.4.0 → ^2.1.9 - **vite-plugin-dts** ^3.8.1 → ^4.5.4 - **rollup-plugin-terser** (deprecated) → **@rollup/plugin-terser** in rrweb-worker Added `cssFileName: 'style'` to the shared vite config to preserve the `style.css` output filename (Vite 6 changed the default to package-name-based). ### Dependabot alerts resolved **Fully resolved** (vulnerable version completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #113 | CRITICAL | `vitest` | Remote Code Execution when accessing a malicious website while Vitest API server is listening | | #203 | HIGH | `rollup` | Rollup 4 has Arbitrary File Write via Path Traversal | | #110 | MEDIUM | `vue-template-compiler` | Client-side XSS (no fix available — removed by vite-plugin-dts v4 dropping the dependency) | **Partially resolved** (some vulnerable entries removed, but package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #154, #146, #145, #141, #140, #139, #138, #126, #111 | MEDIUM/LOW | `vite` | `@sveltejs/vite-plugin-svelte@3` still pulls in vite@5 (needs Svelte 5 upgrade) | | #114 | MEDIUM | `esbuild` | `esbuild-plugin-umd-wrapper` still uses esbuild@0.18 | | #214 | HIGH | `serialize-javascript` | webpack (via `@size-limit`) still pulls in v6 | | #105, #104 | MEDIUM | `nanoid` | postcss (via vite internally) still uses nanoid@3 | | #165, #155 | HIGH/MEDIUM | `validator` | `@microsoft/api-extractor` (via vite-plugin-dts) — needs further investigation | The partially resolved alerts will be addressed in later phases (Svelte 5 upgrade, @size-limit bump, mop-up). closes https://linear.app/getsentry/issue/SDK-1095/bump-vitest-vite-56-1-critical-7-alerts --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: chargome <chargome@users.noreply.github.com>

mydea · 2024-02-01T15:07:09Z

This tests masking of initial & updated values for password & credit card fields.

You can see that for now credit card data is not masked, which demonstrates the current behavior.
In a future PR we can then verify that our fixed masking is working.

ref getsentry/sentry-javascript#10258

add tests for sensitive data

billyvg · 2024-02-01T15:43:01Z

 \\"class\\": \\"rr-block\\",
 \\"rr_width\\": \\"1904px\\",
- \\"rr_height\\": \\"21px\\"
+ \\"rr_height\\": \\"21.5px\\"


This is flakey :(

yeah, sucks a lot 😬

billyvg · 2024-02-01T15:45:25Z

+ <label>
+ <input autocomplete="cc-number" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-exp" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-exp-month" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-exp-year" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-csc" value="initial" />
+ </label>


LGTM
(ref: https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete-cc-name)

billyvg

Should we add a test for dynamically inserted elements as well?

mydea · 2024-02-01T16:03:10Z

Should we add a test for dynamically inserted elements as well?

I'll add some in the follow up PR!

This is on top of #165, actually fixing the behavior so that certain fields cannot be unmasked. This is a pretty straightforward fix, a bit "hacky" but should work well enough. Fixesgetsentry/sentry-javascript#10258 --------- Co-authored-by: mydea <mydea@users.noreply.github.com>

This tests masking of initial & updated values for password & credit card fields. You can see that for now credit card data is not masked, which demonstrates the current behavior. In a future PR we can then verify that our fixed masking is working. ref getsentry/sentry-javascript#10258

This is on top of #165, actually fixing the behavior so that certain fields cannot be unmasked. This is a pretty straightforward fix, a bit "hacky" but should work well enough. Fixesgetsentry/sentry-javascript#10258 --------- Co-authored-by: mydea <mydea@users.noreply.github.com>

Bump the core build/test tooling across all workspace packages: - **vite** ^5.2.8 → ^6.4.1 - **vitest** ^1.4.0 → ^2.1.9 - **vite-plugin-dts** ^3.8.1 → ^4.5.4 - **rollup-plugin-terser** (deprecated) → **@rollup/plugin-terser** in rrweb-worker Added `cssFileName: 'style'` to the shared vite config to preserve the `style.css` output filename (Vite 6 changed the default to package-name-based). ### Dependabot alerts resolved **Fully resolved** (vulnerable version completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #113 | CRITICAL | `vitest` | Remote Code Execution when accessing a malicious website while Vitest API server is listening | | #203 | HIGH | `rollup` | Rollup 4 has Arbitrary File Write via Path Traversal | | #110 | MEDIUM | `vue-template-compiler` | Client-side XSS (no fix available — removed by vite-plugin-dts v4 dropping the dependency) | **Partially resolved** (some vulnerable entries removed, but package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #154, #146, #145, #141, #140, #139, #138, #126, #111 | MEDIUM/LOW | `vite` | `@sveltejs/vite-plugin-svelte@3` still pulls in vite@5 (needs Svelte 5 upgrade) | | #114 | MEDIUM | `esbuild` | `esbuild-plugin-umd-wrapper` still uses esbuild@0.18 | | #214 | HIGH | `serialize-javascript` | webpack (via `@size-limit`) still pulls in v6 | | #105, #104 | MEDIUM | `nanoid` | postcss (via vite internally) still uses nanoid@3 | | #165, #155 | HIGH/MEDIUM | `validator` | `@microsoft/api-extractor` (via vite-plugin-dts) — needs further investigation | The partially resolved alerts will be addressed in later phases (Svelte 5 upgrade, @size-limit bump, mop-up). closes https://linear.app/getsentry/issue/SDK-1095/bump-vitest-vite-56-1-critical-7-alerts --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: chargome <chargome@users.noreply.github.com>

mydea · 2024-02-01T15:07:09Z

This tests masking of initial & updated values for password & credit card fields.

You can see that for now credit card data is not masked, which demonstrates the current behavior.
In a future PR we can then verify that our fixed masking is working.

ref getsentry/sentry-javascript#10258

add tests for sensitive data

billyvg · 2024-02-01T15:43:01Z

 \\"class\\": \\"rr-block\\",
 \\"rr_width\\": \\"1904px\\",
- \\"rr_height\\": \\"21px\\"
+ \\"rr_height\\": \\"21.5px\\"


This is flakey :(

yeah, sucks a lot 😬

billyvg · 2024-02-01T15:45:25Z

+ <label>
+ <input autocomplete="cc-number" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-exp" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-exp-month" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-exp-year" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-csc" value="initial" />
+ </label>


LGTM
(ref: https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete-cc-name)

billyvg

Should we add a test for dynamically inserted elements as well?

mydea · 2024-02-01T16:03:10Z

Should we add a test for dynamically inserted elements as well?

I'll add some in the follow up PR!

This is on top of #165, actually fixing the behavior so that certain fields cannot be unmasked. This is a pretty straightforward fix, a bit "hacky" but should work well enough. Fixesgetsentry/sentry-javascript#10258 --------- Co-authored-by: mydea <mydea@users.noreply.github.com>

This tests masking of initial & updated values for password & credit card fields. You can see that for now credit card data is not masked, which demonstrates the current behavior. In a future PR we can then verify that our fixed masking is working. ref getsentry/sentry-javascript#10258

This is on top of #165, actually fixing the behavior so that certain fields cannot be unmasked. This is a pretty straightforward fix, a bit "hacky" but should work well enough. Fixesgetsentry/sentry-javascript#10258 --------- Co-authored-by: mydea <mydea@users.noreply.github.com>

Bump the core build/test tooling across all workspace packages: - **vite** ^5.2.8 → ^6.4.1 - **vitest** ^1.4.0 → ^2.1.9 - **vite-plugin-dts** ^3.8.1 → ^4.5.4 - **rollup-plugin-terser** (deprecated) → **@rollup/plugin-terser** in rrweb-worker Added `cssFileName: 'style'` to the shared vite config to preserve the `style.css` output filename (Vite 6 changed the default to package-name-based). ### Dependabot alerts resolved **Fully resolved** (vulnerable version completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #113 | CRITICAL | `vitest` | Remote Code Execution when accessing a malicious website while Vitest API server is listening | | #203 | HIGH | `rollup` | Rollup 4 has Arbitrary File Write via Path Traversal | | #110 | MEDIUM | `vue-template-compiler` | Client-side XSS (no fix available — removed by vite-plugin-dts v4 dropping the dependency) | **Partially resolved** (some vulnerable entries removed, but package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #154, #146, #145, #141, #140, #139, #138, #126, #111 | MEDIUM/LOW | `vite` | `@sveltejs/vite-plugin-svelte@3` still pulls in vite@5 (needs Svelte 5 upgrade) | | #114 | MEDIUM | `esbuild` | `esbuild-plugin-umd-wrapper` still uses esbuild@0.18 | | #214 | HIGH | `serialize-javascript` | webpack (via `@size-limit`) still pulls in v6 | | #105, #104 | MEDIUM | `nanoid` | postcss (via vite internally) still uses nanoid@3 | | #165, #155 | HIGH/MEDIUM | `validator` | `@microsoft/api-extractor` (via vite-plugin-dts) — needs further investigation | The partially resolved alerts will be addressed in later phases (Svelte 5 upgrade, @size-limit bump, mop-up). closes https://linear.app/getsentry/issue/SDK-1095/bump-vitest-vite-56-1-critical-7-alerts --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: chargome <chargome@users.noreply.github.com>

mydea · 2024-02-01T15:07:09Z

This tests masking of initial & updated values for password & credit card fields.

You can see that for now credit card data is not masked, which demonstrates the current behavior.
In a future PR we can then verify that our fixed masking is working.

ref getsentry/sentry-javascript#10258

add tests for sensitive data

billyvg · 2024-02-01T15:43:01Z

 \\"class\\": \\"rr-block\\",
 \\"rr_width\\": \\"1904px\\",
- \\"rr_height\\": \\"21px\\"
+ \\"rr_height\\": \\"21.5px\\"


This is flakey :(

yeah, sucks a lot 😬

billyvg · 2024-02-01T15:45:25Z

+ <label>
+ <input autocomplete="cc-number" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-exp" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-exp-month" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-exp-year" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-csc" value="initial" />
+ </label>


LGTM
(ref: https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete-cc-name)

billyvg

Should we add a test for dynamically inserted elements as well?

mydea · 2024-02-01T16:03:10Z

Should we add a test for dynamically inserted elements as well?

I'll add some in the follow up PR!

This is on top of #165, actually fixing the behavior so that certain fields cannot be unmasked. This is a pretty straightforward fix, a bit "hacky" but should work well enough. Fixesgetsentry/sentry-javascript#10258 --------- Co-authored-by: mydea <mydea@users.noreply.github.com>

This tests masking of initial & updated values for password & credit card fields. You can see that for now credit card data is not masked, which demonstrates the current behavior. In a future PR we can then verify that our fixed masking is working. ref getsentry/sentry-javascript#10258

This is on top of #165, actually fixing the behavior so that certain fields cannot be unmasked. This is a pretty straightforward fix, a bit "hacky" but should work well enough. Fixesgetsentry/sentry-javascript#10258 --------- Co-authored-by: mydea <mydea@users.noreply.github.com>

Bump the core build/test tooling across all workspace packages: - **vite** ^5.2.8 → ^6.4.1 - **vitest** ^1.4.0 → ^2.1.9 - **vite-plugin-dts** ^3.8.1 → ^4.5.4 - **rollup-plugin-terser** (deprecated) → **@rollup/plugin-terser** in rrweb-worker Added `cssFileName: 'style'` to the shared vite config to preserve the `style.css` output filename (Vite 6 changed the default to package-name-based). ### Dependabot alerts resolved **Fully resolved** (vulnerable version completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #113 | CRITICAL | `vitest` | Remote Code Execution when accessing a malicious website while Vitest API server is listening | | #203 | HIGH | `rollup` | Rollup 4 has Arbitrary File Write via Path Traversal | | #110 | MEDIUM | `vue-template-compiler` | Client-side XSS (no fix available — removed by vite-plugin-dts v4 dropping the dependency) | **Partially resolved** (some vulnerable entries removed, but package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #154, #146, #145, #141, #140, #139, #138, #126, #111 | MEDIUM/LOW | `vite` | `@sveltejs/vite-plugin-svelte@3` still pulls in vite@5 (needs Svelte 5 upgrade) | | #114 | MEDIUM | `esbuild` | `esbuild-plugin-umd-wrapper` still uses esbuild@0.18 | | #214 | HIGH | `serialize-javascript` | webpack (via `@size-limit`) still pulls in v6 | | #105, #104 | MEDIUM | `nanoid` | postcss (via vite internally) still uses nanoid@3 | | #165, #155 | HIGH/MEDIUM | `validator` | `@microsoft/api-extractor` (via vite-plugin-dts) — needs further investigation | The partially resolved alerts will be addressed in later phases (Svelte 5 upgrade, @size-limit bump, mop-up). closes https://linear.app/getsentry/issue/SDK-1095/bump-vitest-vite-56-1-critical-7-alerts --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: chargome <chargome@users.noreply.github.com>

mydea · 2024-02-01T15:07:09Z

This tests masking of initial & updated values for password & credit card fields.

You can see that for now credit card data is not masked, which demonstrates the current behavior.
In a future PR we can then verify that our fixed masking is working.

ref getsentry/sentry-javascript#10258

add tests for sensitive data

billyvg · 2024-02-01T15:43:01Z

 \\"class\\": \\"rr-block\\",
 \\"rr_width\\": \\"1904px\\",
- \\"rr_height\\": \\"21px\\"
+ \\"rr_height\\": \\"21.5px\\"


This is flakey :(

yeah, sucks a lot 😬

billyvg · 2024-02-01T15:45:25Z

+ <label>
+ <input autocomplete="cc-number" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-exp" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-exp-month" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-exp-year" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-csc" value="initial" />
+ </label>


LGTM
(ref: https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete-cc-name)

billyvg

Should we add a test for dynamically inserted elements as well?

mydea · 2024-02-01T16:03:10Z

Should we add a test for dynamically inserted elements as well?

I'll add some in the follow up PR!

This is on top of #165, actually fixing the behavior so that certain fields cannot be unmasked. This is a pretty straightforward fix, a bit "hacky" but should work well enough. Fixesgetsentry/sentry-javascript#10258 --------- Co-authored-by: mydea <mydea@users.noreply.github.com>

This tests masking of initial & updated values for password & credit card fields. You can see that for now credit card data is not masked, which demonstrates the current behavior. In a future PR we can then verify that our fixed masking is working. ref getsentry/sentry-javascript#10258

This is on top of #165, actually fixing the behavior so that certain fields cannot be unmasked. This is a pretty straightforward fix, a bit "hacky" but should work well enough. Fixesgetsentry/sentry-javascript#10258 --------- Co-authored-by: mydea <mydea@users.noreply.github.com>

Bump the core build/test tooling across all workspace packages: - **vite** ^5.2.8 → ^6.4.1 - **vitest** ^1.4.0 → ^2.1.9 - **vite-plugin-dts** ^3.8.1 → ^4.5.4 - **rollup-plugin-terser** (deprecated) → **@rollup/plugin-terser** in rrweb-worker Added `cssFileName: 'style'` to the shared vite config to preserve the `style.css` output filename (Vite 6 changed the default to package-name-based). ### Dependabot alerts resolved **Fully resolved** (vulnerable version completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #113 | CRITICAL | `vitest` | Remote Code Execution when accessing a malicious website while Vitest API server is listening | | #203 | HIGH | `rollup` | Rollup 4 has Arbitrary File Write via Path Traversal | | #110 | MEDIUM | `vue-template-compiler` | Client-side XSS (no fix available — removed by vite-plugin-dts v4 dropping the dependency) | **Partially resolved** (some vulnerable entries removed, but package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #154, #146, #145, #141, #140, #139, #138, #126, #111 | MEDIUM/LOW | `vite` | `@sveltejs/vite-plugin-svelte@3` still pulls in vite@5 (needs Svelte 5 upgrade) | | #114 | MEDIUM | `esbuild` | `esbuild-plugin-umd-wrapper` still uses esbuild@0.18 | | #214 | HIGH | `serialize-javascript` | webpack (via `@size-limit`) still pulls in v6 | | #105, #104 | MEDIUM | `nanoid` | postcss (via vite internally) still uses nanoid@3 | | #165, #155 | HIGH/MEDIUM | `validator` | `@microsoft/api-extractor` (via vite-plugin-dts) — needs further investigation | The partially resolved alerts will be addressed in later phases (Svelte 5 upgrade, @size-limit bump, mop-up). closes https://linear.app/getsentry/issue/SDK-1095/bump-vitest-vite-56-1-critical-7-alerts --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: chargome <chargome@users.noreply.github.com>

mydea · 2024-02-01T15:07:09Z

This tests masking of initial & updated values for password & credit card fields.

You can see that for now credit card data is not masked, which demonstrates the current behavior.
In a future PR we can then verify that our fixed masking is working.

ref getsentry/sentry-javascript#10258

add tests for sensitive data

billyvg · 2024-02-01T15:43:01Z

 \\"class\\": \\"rr-block\\",
 \\"rr_width\\": \\"1904px\\",
- \\"rr_height\\": \\"21px\\"
+ \\"rr_height\\": \\"21.5px\\"


This is flakey :(

yeah, sucks a lot 😬

billyvg · 2024-02-01T15:45:25Z

+ <label>
+ <input autocomplete="cc-number" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-exp" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-exp-month" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-exp-year" value="initial" />
+ </label>
+ <label>
+ <input autocomplete="cc-csc" value="initial" />
+ </label>


LGTM
(ref: https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete-cc-name)

billyvg

Should we add a test for dynamically inserted elements as well?

mydea · 2024-02-01T16:03:10Z

Should we add a test for dynamically inserted elements as well?

I'll add some in the follow up PR!

This is on top of #165, actually fixing the behavior so that certain fields cannot be unmasked. This is a pretty straightforward fix, a bit "hacky" but should work well enough. Fixesgetsentry/sentry-javascript#10258 --------- Co-authored-by: mydea <mydea@users.noreply.github.com>

This tests masking of initial & updated values for password & credit card fields. You can see that for now credit card data is not masked, which demonstrates the current behavior. In a future PR we can then verify that our fixed masking is working. ref getsentry/sentry-javascript#10258

This is on top of #165, actually fixing the behavior so that certain fields cannot be unmasked. This is a pretty straightforward fix, a bit "hacky" but should work well enough. Fixesgetsentry/sentry-javascript#10258 --------- Co-authored-by: mydea <mydea@users.noreply.github.com>

Bump the core build/test tooling across all workspace packages: - **vite** ^5.2.8 → ^6.4.1 - **vitest** ^1.4.0 → ^2.1.9 - **vite-plugin-dts** ^3.8.1 → ^4.5.4 - **rollup-plugin-terser** (deprecated) → **@rollup/plugin-terser** in rrweb-worker Added `cssFileName: 'style'` to the shared vite config to preserve the `style.css` output filename (Vite 6 changed the default to package-name-based). ### Dependabot alerts resolved **Fully resolved** (vulnerable version completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #113 | CRITICAL | `vitest` | Remote Code Execution when accessing a malicious website while Vitest API server is listening | | #203 | HIGH | `rollup` | Rollup 4 has Arbitrary File Write via Path Traversal | | #110 | MEDIUM | `vue-template-compiler` | Client-side XSS (no fix available — removed by vite-plugin-dts v4 dropping the dependency) | **Partially resolved** (some vulnerable entries removed, but package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #154, #146, #145, #141, #140, #139, #138, #126, #111 | MEDIUM/LOW | `vite` | `@sveltejs/vite-plugin-svelte@3` still pulls in vite@5 (needs Svelte 5 upgrade) | | #114 | MEDIUM | `esbuild` | `esbuild-plugin-umd-wrapper` still uses esbuild@0.18 | | #214 | HIGH | `serialize-javascript` | webpack (via `@size-limit`) still pulls in v6 | | #105, #104 | MEDIUM | `nanoid` | postcss (via vite internally) still uses nanoid@3 | | #165, #155 | HIGH/MEDIUM | `validator` | `@microsoft/api-extractor` (via vite-plugin-dts) — needs further investigation | The partially resolved alerts will be addressed in later phases (Svelte 5 upgrade, @size-limit bump, mop-up). closes https://linear.app/getsentry/issue/SDK-1095/bump-vitest-vite-56-1-critical-7-alerts --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: chargome <chargome@users.noreply.github.com>

WIP
b229885
add tests for sensitive data

mydea requested review from billyvg and c298lee February 1, 2024 15:07

mydea self-assigned this Feb 1, 2024

mydea mentioned this pull request Feb 1, 2024
feat: Enforce masking of credit card fields #166
Merged

billyvg approved these changes Feb 1, 2024
View reviewed changes

billyvg reviewed Feb 1, 2024
View reviewed changes

fix test?!
73bbb17

mydea merged commit 79d1fe2 into sentry-v2Feb 1, 2024

mydea deleted the fn/disallow-cc branch February 1, 2024 16:03

chargome mentioned this pull request Mar 26, 2026
chore(build): Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4 #273
Merged

WIP
b229885
add tests for sensitive data

mydea requested review from billyvg and c298lee February 1, 2024 15:07

mydea self-assigned this Feb 1, 2024

mydea mentioned this pull request Feb 1, 2024
feat: Enforce masking of credit card fields #166
Merged

billyvg approved these changes Feb 1, 2024
View reviewed changes

billyvg reviewed Feb 1, 2024
View reviewed changes

fix test?!
73bbb17

mydea merged commit 79d1fe2 into sentry-v2Feb 1, 2024

mydea deleted the fn/disallow-cc branch February 1, 2024 16:03

chargome mentioned this pull request Mar 26, 2026
chore(build): Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4 #273
Merged

WIP
b229885
add tests for sensitive data

mydea requested review from billyvg and c298lee February 1, 2024 15:07

mydea self-assigned this Feb 1, 2024

mydea mentioned this pull request Feb 1, 2024
feat: Enforce masking of credit card fields #166
Merged

billyvg approved these changes Feb 1, 2024
View reviewed changes

billyvg reviewed Feb 1, 2024
View reviewed changes

fix test?!
73bbb17

mydea merged commit 79d1fe2 into sentry-v2Feb 1, 2024

mydea deleted the fn/disallow-cc branch February 1, 2024 16:03

chargome mentioned this pull request Mar 26, 2026
chore(build): Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4 #273
Merged

WIP
b229885
add tests for sensitive data

mydea requested review from billyvg and c298lee February 1, 2024 15:07

mydea self-assigned this Feb 1, 2024

mydea mentioned this pull request Feb 1, 2024
feat: Enforce masking of credit card fields #166
Merged

billyvg approved these changes Feb 1, 2024
View reviewed changes

billyvg reviewed Feb 1, 2024
View reviewed changes

fix test?!
73bbb17

mydea merged commit 79d1fe2 into sentry-v2Feb 1, 2024

mydea deleted the fn/disallow-cc branch February 1, 2024 16:03

chargome mentioned this pull request Mar 26, 2026
chore(build): Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4 #273
Merged

WIP
b229885
add tests for sensitive data

mydea requested review from billyvg and c298lee February 1, 2024 15:07

mydea self-assigned this Feb 1, 2024

mydea mentioned this pull request Feb 1, 2024
feat: Enforce masking of credit card fields #166
Merged

billyvg approved these changes Feb 1, 2024
View reviewed changes

billyvg reviewed Feb 1, 2024
View reviewed changes

fix test?!
73bbb17

mydea merged commit 79d1fe2 into sentry-v2Feb 1, 2024

mydea deleted the fn/disallow-cc branch February 1, 2024 16:03

chargome mentioned this pull request Mar 26, 2026
chore(build): Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4 #273
Merged

WIP
b229885
add tests for sensitive data

mydea requested review from billyvg and c298lee February 1, 2024 15:07

mydea self-assigned this Feb 1, 2024

mydea mentioned this pull request Feb 1, 2024
feat: Enforce masking of credit card fields #166
Merged

billyvg approved these changes Feb 1, 2024
View reviewed changes

billyvg reviewed Feb 1, 2024
View reviewed changes

fix test?!
73bbb17

mydea merged commit 79d1fe2 into sentry-v2Feb 1, 2024

mydea deleted the fn/disallow-cc branch February 1, 2024 16:03

chargome mentioned this pull request Mar 26, 2026
chore(build): Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4 #273
Merged

WIP
b229885
add tests for sensitive data

mydea requested review from billyvg and c298lee February 1, 2024 15:07

mydea self-assigned this Feb 1, 2024

mydea mentioned this pull request Feb 1, 2024
feat: Enforce masking of credit card fields #166
Merged

billyvg approved these changes Feb 1, 2024
View reviewed changes

billyvg reviewed Feb 1, 2024
View reviewed changes

fix test?!
73bbb17

mydea merged commit 79d1fe2 into sentry-v2Feb 1, 2024

mydea deleted the fn/disallow-cc branch February 1, 2024 16:03

chargome mentioned this pull request Mar 26, 2026
chore(build): Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4 #273
Merged

WIP
b229885
add tests for sensitive data

mydea requested review from billyvg and c298lee February 1, 2024 15:07

mydea self-assigned this Feb 1, 2024

mydea mentioned this pull request Feb 1, 2024
feat: Enforce masking of credit card fields #166
Merged

billyvg approved these changes Feb 1, 2024
View reviewed changes

billyvg reviewed Feb 1, 2024
View reviewed changes

fix test?!
73bbb17

mydea merged commit 79d1fe2 into sentry-v2Feb 1, 2024

mydea deleted the fn/disallow-cc branch February 1, 2024 16:03

chargome mentioned this pull request Mar 26, 2026
chore(build): Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4 #273
Merged

Uh oh!

Conversation

mydea commented Feb 1, 2024• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

billyvg left a comment

Choose a reason for hiding this comment

Uh oh!

mydea commented Feb 1, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

mydea commented Feb 1, 2024• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

billyvg left a comment

Choose a reason for hiding this comment

Uh oh!

mydea commented Feb 1, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

mydea commented Feb 1, 2024• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

billyvg left a comment

Choose a reason for hiding this comment

Uh oh!

mydea commented Feb 1, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

mydea commented Feb 1, 2024• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

mydea commented Feb 1, 2024•
edited
Loading

mydea commented Feb 1, 2024•
edited
Loading

mydea commented Feb 1, 2024•
edited
Loading

mydea commented Feb 1, 2024•
edited
Loading

mydea commented Feb 1, 2024•
edited
Loading