From 4f1b534aec26e6f33e40f877282465f334c5f1fd Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Fri, 6 Nov 2026 10:24:23 +0100 Subject: fix(app): keep sensitive details out of debug logs A log export makes logs easy to share, so audit what they hold. Turn off the sshj trace level, which dumps SSH packets in the clear, password authentication included; until now only the minimum priority of the Android logger kept it out. Drop entry names from commit and autofill match lines, and log only descriptive HTML attributes of form fields, since value and placeholder can hold what the user typed. Co-Authored-By: Claude Opus 5.5 --- .../com/github/androidpasswordstore/autofillparser/FormField.kt | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'autofill-parser/src/main/java/com/github/androidpasswordstore/autofillparser') diff --git a/autofill-parser/src/main/java/com/github/androidpasswordstore/autofillparser/FormField.kt b/autofill-parser/src/main/java/com/github/androidpasswordstore/autofillparser/FormField.kt index b8df0664..bcd1081d 100644 --- a/autofill-parser/src/main/java/com/github/androidpasswordstore/autofillparser/FormField.kt +++ b/autofill-parser/src/main/java/com/github/androidpasswordstore/autofillparser/FormField.kt @@ -141,7 +141,7 @@ internal class FormField( ?.filter { it.first != null && it.second != null } ?.associate { Pair(it.first.lowercase(Locale.US), it.second.lowercase(Locale.US)) } ?: emptyMap() - private val htmlAttributesDebug = htmlAttributes.entries.joinToString { "${it.key}=${it.value}" } + private val htmlAttributesDebug = htmlAttributesForLog(htmlAttributes) private val htmlInputType = htmlAttributes["type"] private val htmlName = htmlAttributes["name"] ?: "" private val htmlMaxLength = htmlAttributes["maxlength"]?.toIntOrNull() @@ -292,3 +292,10 @@ internal class FormField( return autofillId.hashCode() } } + +/** The [attributes] that describe a field: `value` and the like can hold what the user typed. */ +internal fun htmlAttributesForLog(attributes: Map): String = + attributes + .filterKeys { it in setOf("id", "name", "type", "autocomplete", "maxlength") } + .entries + .joinToString { "${it.key}=${it.value}" } -- cgit v1.2.3