Skip to content

Text field with type: :password leaks value through stimulus data values #307

@bjornforsberg

Description

@bjornforsberg

The following component:

        <% form_layout.with_item do %>
          <%= form.polaris_text_field(
            :password,
            label: t(".password_label"),
            type: :password,
            value: smtp_config.password.presence,
          ) %>

Leaks the password value in the data attributes added for Stimulus controller:

CleanShot 2023-07-08 at 02 57 47

The form itself correctly masks the password value, but stimulus would also need to mask it for type: :password.

Note: The value must be passed explicitly for the dot dot dot mask to show up in browsers. When no value is set then the field looks empty, which is confusing as well.

I'll see if I can come up with a PR to fix the above.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions