material-components / material-components/material-components-android
[TextInputLayout] - Password field sensitive information exposed to UI testing tool
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 17.4k
- Forks
- 3.2k
- PR merge metrics
- No merged PRs in 30d
Description
**Description:**
When the TextInputLayout is using endIconMode="password_toggle" such that it is operating as a password entry field - If you connect any ui testing tool like Appium it can read the password that is supposed to be hidden behind the DOTS.
I did some investigation and reach to conclusions that whenever I am using combination of TextInputLayout and TextInputEditText this issue occurs.
When I use only TextInputEditText and set PasswordTransformationMethod to transformationMethod property. Password value is hidden even when checking with Appium tool.
**Expected behavior:**
Appium or any other tool should not be able to read the text while the password is hidden.
TextInputLayout should not change TextInputEditText behaviour when used in combination for password field.
**Steps to repro:**
Go to a screen with a TextInputlayout in password mode:
Type password and ensure the password is hidden.
Connect device/emulator with Appium Inspector tool.
Select Password field and check attributes you would be able to see plain text password even though it is hidden on the screen.
**Material Library version:**
Material Android Library version 1.6.0
**Device:**
Can be reproduced in all devices.
**Similar Issue**
https://github.com/material-components/material-components-android/issues/2300
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue with TextInputLayout using endIconMode="password_toggle" and inspect the field through Appium. Compare it with TextInputEditText using PasswordTransformationMethod; done means the hidden password is not exposed to Appium or other UI testing tools.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, java
- Domain
- mobile-dev, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100