Uh oh!
There was an error while loading. Please reload this page.
feat: Enforce masking of credit card fields - #166
Merged
Conversation
size-limit report 📦
|
billyvg
approved these changes
Feb 1, 2024
mydeaforce-pushed
the
fn/disallow-cc-autocomplete
branch
from
February 1, 2024 16:06
7d782e9 to
42e28c3Comparemydea
commented
Feb 1, 2024
MemberAuthor
@billyvg added another test here in rrweb that tests this "in-depth", both adding new elements, changing their values etc. |
mydea
marked this pull request as ready for review
February 1, 2024 16:07
billyvg
approved these changes
Feb 1, 2024
billyvg pushed a commit
that referenced
this pull request
Apr 26, 2024
This is on top of #165, actually fixing the behavior so that certain fields cannot be unmasked. This is a pretty straightforward fix, a bit "hacky" but should work well enough. Fixesgetsentry/sentry-javascript#10258 --------- Co-authored-by: mydea <mydea@users.noreply.github.com>
chargome added a commit
that referenced
this pull request
Apr 1, 2026
Remove the `fast-mhtml` dependency which was only used in one test utility function (`packages/rrweb/test/utils.ts`) for parsing MHTML snapshots in replayer E2E tests. Replace with a minimal inline parser (~30 lines) that handles multipart MIME boundary splitting and quoted-printable content decoding. All 47 replayer tests pass. `fast-mhtml` pulled in `cheerio`, `express`, `undici`, `qs`, `bluebird`, and `cookie` — a massive transitive tree for a simple test helper. This removes ~584 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #166 | MEDIUM | `qs` | arrayLimit bypass allows DoS via memory exhaustion | | #183 | LOW | `qs` | arrayLimit bypass in comma parsing allows DoS | **Partially resolved** (some entries removed, but package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #225, #224, #223, #222, #221, #170, #130, #112 | HIGH/MEDIUM/LOW | `undici` | Still pulled in by `puppeteer` (Phase 3) | | #100 | LOW | `cookie` | Still pulled in by `@sveltejs/kit` (Phase 5) | closes https://linear.app/getsentry/issue/SDK-1097/replace-fast-mhtml-9-alerts --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: chargome <chargome@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is on top of #165, actually fixing the behavior so that certain fields cannot be unmasked.
This is a pretty straightforward fix, a bit "hacky" but should work well enough.
Fixesgetsentry/sentry-javascript#10258