You are viewing a plain text version of this content. The canonical link for it is here.
Posted to pr@flagon.apache.org by "brucearctor (via GitHub)" <gi...@apache.org> on 2026/10/11 14:54:31 UTC
[PR] fix(security): prevent credential leakage, mask password inputs, and fix core/extension bugs (flagon)
brucearctor opened a new pull request, #183:
URL: https://github.com/apache/flagon/pull/183
## Summary
Addresses pre-v2.5.0 security and bug fixes across `flagon-userale` and `flagon-userale-ext`:
- **Credential attribute stripping & plaintext HTTP warning (#132)**:
- Exclude `data-api-key`, `data-auth`, `data-token`, `data-secret`, and `data-password` from `buildAttrs()` in `packageLogs.ts`.
- Avoid V8 `SyntaxError` exceptions on non-JSON HTML attributes in `buildAttrs()`.
- Emit a `console.warn` in `initSender()` when `apiKey` or `authHeader` is configured over plaintext `http:` on non-localhost hosts.
- **Password input masking**:
- Redact (`null`) keystroke/value details in `extractKeyboardDetails`, `extractInputDetails`, and `extractChangeDetails` when the target is `<input type="password">`.
- **Core & SSR bug fixes**:
- Fix `intervalCounter` falsy check (`&& intervalCounter !== null`) in `packageIntervalLog()` so interval `count` increments properly.
- Guard `detailFcn` in `packageCustomLog()`.
- Ensure `userale.start()` attaches handlers and initializes the sender when `autostart` was initially `false`.
- Guard against SSR environments (`typeof document === "undefined"`) in `getInitialSettings.ts` and `main.ts`.
- Move `@bufbuild/protobuf` to `devDependencies` (zero runtime dependencies) and order `types` first in `package.json` `exports`.
- **Browser extension OAuth fixes (#135)**:
- Call `e.preventDefault()` in `handleLogin` form submission handler and `encodeURIComponent(clientId)` in `auth.tsx`.
Closes #132
Closes #135
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: pr-unsubscribe@flagon.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: pr-unsubscribe@flagon.apache.org
For additional commands, e-mail: pr-help@flagon.apache.org
Re: [PR] fix(security): prevent credential leakage, mask password inputs, and fix core/extension bugs (flagon)
Posted by "brucearctor (via GitHub)" <gi...@apache.org>.
brucearctor merged PR #183:
URL: https://github.com/apache/flagon/pull/183
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: pr-unsubscribe@flagon.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: pr-unsubscribe@flagon.apache.org
For additional commands, e-mail: pr-help@flagon.apache.org