feat(rrweb): add opt-in selectiveMaskingAttribute for selective masking#842
Open
melodyaws wants to merge 1 commit into
Open
feat(rrweb): add opt-in selectiveMaskingAttribute for selective masking#842melodyaws wants to merge 1 commit into
melodyaws wants to merge 1 commit into
Conversation
Adds a new RRWebPluginConfig option, selectiveMaskingAttribute, that lets customers mask only DOM elements carrying a specific attribute (e.g. data-rum-mask) instead of every text node and input. The default behavior is unchanged: when the option is omitted or empty, the plugin continues to enforce maskAllInputs: true and maskTextSelector: '*'. Customers opt in by passing a non-empty attribute string. The plugin still does not allow maskAllInputs / maskTextSelector / maskInputOptions / maskInputFn to be supplied via recordOptions — those values are derived from selectiveMaskingAttribute and managed by the plugin. The attribute string is escaped before being interpolated into a CSS selector to prevent breaking out of [...]. - Unit tests: default behavior preserved, attribute-driven masking, CSS selector escaping, and recordOptions cannot smuggle in maskInputFn. - Docs: new "Opt-in: selective masking" section with example usage. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue #, if available
N/A — opening directly per the contributing guide. Happy to convert to an issue first if maintainers prefer.
Description of changes
Adds an opt-in
selectiveMaskingAttributeoption toRRWebPluginso customers can record non-sensitive UI context (button labels, headings, dashboard layout) while still masking PII fields by attribute.The default is unchanged — when the option is omitted (or set to an empty string), the plugin continues to enforce full
maskAllInputs: true/maskTextSelector: '*'masking. Customers must pass a non-empty attribute string to opt in.Why
Out of the box, every text node and input becomes
***in playback, which makes replay much less useful for debugging support tickets where the page context (which step of the flow the user was on, which button label was showing, which dashboard) matters more than the PII fields themselves. Today the only way to get this is to patchnode_modulespost-install, which is fragile and has to be reapplied on everynpm install.Privacy posture
maskAllInputs/maskTextSelector/maskInputOptions/maskInputFnremain non-overridable viarecordOptions— they are derived fromselectiveMaskingAttributeand managed by the plugin (covered by an explicit unit test).[…](covered by a unit test).Tests
maskInputFnmasks elements that carry the attribute, leaves others as text ✅recordOptions.maskInputFncannot smuggle a custom function past the plugin ✅npm run buildsucceeds forcore/slim/webnpm run lint— 0 errorsChecklist
docs/plugins/RRWebPlugin.md) updatednpm run lint— 0 errorsnpm run build— succeedsBy submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.