fix: disable autocomplete on input fields during replay #1771
Conversation
|
There was a problem hiding this comment.
Pull request overview
This PR fixes a privacy concern during session replay by disabling browser autocomplete on input fields. When viewing replays, the browser's autocomplete dropdown could appear with the viewer's personal data, creating confusion about whether their information was being leaked.
Key Changes
- Adds
autocomplete="off"attribute to all input and textarea elements during DOM reconstruction for replay - Updates integration test snapshots to reflect the new autocomplete attribute on form fields
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| packages/rrweb-snapshot/src/rebuild.ts | Adds logic to set autocomplete="off" on input and textarea elements during node building to prevent viewer's browser autocomplete from appearing |
| packages/rrweb-snapshot/test/snapshots/integration.test.ts.snap | Updates test snapshot to include autocomplete="off" on all input and textarea elements in the form-fields.html test case |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
During replay, input fields in the replayer iframe can trigger the viewer's browser autocomplete dropdown, making users think their private data is being leaked.
This adds
autocomplete="off"to input and textarea elements when rebuilding the DOM for replay.Fixes #1587