Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

fill: a sensitive value can still come back in an altered form (iOS read-back)

Aperta
  • Qualcosa non va?
#3,392 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
45/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
swift, typescript
Ambito
mobile, security

Direzione di ricerca

Start with the TEXT_ENTRY_MISMATCH message in RunnerTests+TypeExecution.swift around line 111, which quotes the observed read-back value, and with FillUnconfirmedVerification in packages/contracts/src/fill-evidence.ts, which carries before and after. Check how #3351 redacts the expected and requested values for sensitive fills, then apply the same treatment to observed, before and after. Done means a sensitive fill that fails or settles on a different value returns no read-back text in the error or the response, while the error code and verification status remain. A device run is not required to verify the change, but the design of the placeholder should be agreed first.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Follow-up from #3351, as suggested in review.

#3351 keeps the exact text of a sensitive fill (--text-stdin, --record-as) out of responses and errors. Two places can still carry a changed form of that text, which no literal match catches:

  • Error: the iOS runner's TEXT_ENTRY_MISMATCH message quotes both sides: text entry read-back did not match: expected "…", observed "…" (RunnerTests+TypeExecution.swift:111). expected is the exact value and is now redacted. observed is what the field read back. Per the fill help this error covers dropped characters, so it can be the value with a character or two missing.
  • Success: a fill that settles on a different value returns verification: "unconfirmed" with requested, before and after (FillUnconfirmedVerification in packages/contracts/src/fill-evidence.ts). requested is the exact value, but after can be a formatted form of it, like the help's "00 062 91 77" for "000629177".

I found these by reading the code and have not reproduced them on a device, since that needs a field that alters its input.

A possible direction: for a sensitive fill, drop the read-back values instead of matching them. For example, keep the error code with a generic message, and replace before/after with the placeholder. Related: #3261 (the same value in native XCTest logs).

Lingua principale
TypeScript
Stelle
5k
Fork
334
Merge medio
13h 19m
PR unite (30g)
630

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di callstack/agent-device

Tutte le issue di callstack/agent-device

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.