From 4f1b534aec26e6f33e40f877282465f334c5f1fd Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Fri, 6 Nov 2026 10:24:23 +0100 Subject: fix(app): keep sensitive details out of debug logs A log export makes logs easy to share, so audit what they hold. Turn off the sshj trace level, which dumps SSH packets in the clear, password authentication included; until now only the minimum priority of the Android logger kept it out. Drop entry names from commit and autofill match lines, and log only descriptive HTML attributes of form fields, since value and placeholder can hold what the user typed. Co-Authored-By: Claude Opus 5.5 --- .../autofillparser/FormFieldLogTest.kt | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 autofill-parser/src/test/kotlin/com/github/androidpasswordstore/autofillparser/FormFieldLogTest.kt (limited to 'autofill-parser/src/test') diff --git a/autofill-parser/src/test/kotlin/com/github/androidpasswordstore/autofillparser/FormFieldLogTest.kt b/autofill-parser/src/test/kotlin/com/github/androidpasswordstore/autofillparser/FormFieldLogTest.kt new file mode 100644 index 00000000..be6b4b32 --- /dev/null +++ b/autofill-parser/src/test/kotlin/com/github/androidpasswordstore/autofillparser/FormFieldLogTest.kt @@ -0,0 +1,19 @@ +/* + * Copyright (C) 2026 Danilo M. + * SPDX-License-Identifier: GPL-3.0-only + */ + +package com.github.androidpasswordstore.autofillparser + +import kotlin.test.Test +import kotlin.test.assertEquals + +class FormFieldLogTest { + + @Test + fun onlyDescriptiveAttributesAreLogged() { + val attributes = + mapOf("type" to "email", "value" to "me@example.org", "placeholder" to "me@example.org") + assertEquals("type=email", htmlAttributesForLog(attributes)) + } +} -- cgit v1.2.3