material-components / material-components/material-components-android

[TextInputLayout] - Password field sensitive information exposed to UI testing tool

Open
#4,600 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug Widget: TextField
Dominant language
Java
Stars
17.4k
Forks
3.2k
PR merge metrics
No merged PRs in 30d

Description

**Description:**

When the TextInputLayout is using endIconMode="password_toggle" such that it is operating as a password entry field - If you connect any ui testing tool like Appium it can read the password that is supposed to be hidden behind the DOTS.

I did some investigation and reach to conclusions that whenever I am using combination of TextInputLayout and TextInputEditText this issue occurs.

When I use only TextInputEditText and set PasswordTransformationMethod to transformationMethod property. Password value is hidden even when checking with Appium tool.

**Expected behavior:**

Appium or any other tool should not be able to read the text while the password is hidden.
TextInputLayout should not change TextInputEditText behaviour when used in combination for password field.

**Steps to repro:**

Go to a screen with a TextInputlayout in password mode:
Type password and ensure the password is hidden.
Connect device/emulator with Appium Inspector tool.
Select Password field and check attributes you would be able to see plain text password even though it is hidden on the screen.

**Material Library version:**
Material Android Library version 1.6.0

**Device:**
Can be reproduced in all devices.

**Similar Issue**
https://github.com/material-components/material-components-android/issues/2300

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue with TextInputLayout using endIconMode="password_toggle" and inspect the field through Appium. Compare it with TextInputEditText using PasswordTransformationMethod; done means the hidden password is not exposed to Appium or other UI testing tools.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, java
Domain
mobile-dev, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.