microsoft / microsoft/winappCli

[Bug]: `ui get-property` reports ordinary text boxes as password fields

Open
#694 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
C#
Stars
1.3k
Forks
80
Avg merge
3d 6h
Merged PRs (30d)
51

Description

Describe the bug

winapp ui get-property does not read the UI Automation IsPassword property. It derives the value as:

IsContentElement && ControlType == Edit

As a result, ordinary editable controls are reported as password fields. This makes the command's factual UIA output incorrect and prevents the value from being safely reused for future password redaction: applying the current value would redact every normal text box.

The authoritative source is UIA_IsPasswordPropertyId (30019), exposed by the UIA provider.

The current implementation is in UiAutomationService.GetPropertiesAsync.

To Reproduce
  1. Open Windows Settings.

  2. Identify the ordinary Settings search box with winapp ui inspect or ui search.

  3. Run:

    winapp ui get-property CommandSearchTextBox -w <settings-hwnd> --property IsPassword --json
    
  4. Observe that WinApp reports:

    { "properties": { "IsPassword": "True" } }
    

The same behavior applies to other normal UIA Edit controls that are content elements.

This was reproduced live on the Settings search box. A separate WinForms probe confirmed that UIA_IsPasswordPropertyId returns false for a normal text box and true only for a genuine password box.

Expected behavior
  • IsPassword is read from UIA_IsPasswordPropertyId rather than inferred from control type.
  • Ordinary text/search inputs report false.
  • Genuine password controls report true.
  • Password values are never exposed if this property is used for value redaction.
  • Provider errors or unsupported values are not converted into a guessed password classification.
  • Tests cover an ordinary Edit control and a real password control.

A real password-value leak was not reproduced: the tested password control's UIA ValuePattern returned Access denied. The confirmed current defect is incorrect classification; reliable redaction should be added with the authoritative property fix.

Screenshots

N/A — the incorrect value is directly observable in command output.

OS Version and details

Windows 11 ARM64; reproduced 2026-07-28 against Windows Settings and a controlled WinForms UIA probe.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with UiAutomationService.GetPropertiesAsync and trace how the IsPassword property is currently derived and exposed by ui get-property. Add or update tests for an ordinary Edit control and a genuine password control, and verify that provider errors or unsupported values are not guessed; done means both classifications use the authoritative UIA property and password values remain protected.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
cli, desktop
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.