thunderbird / thunderbird/thunderbird-android
[BUG] Pii-Safe Compiler Plugin — FIR checker not considering Type Arguments annotated with `@PiiSafe.HasPii`
Open
@taljeon is already working on this.
Since Sep 16, 2026.
good first issue
- Dominant language
- Kotlin
- Stars
- 14k
- Forks
- 2.8k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 57
Description
Description
When a data class is NOT annotated with @PiiSafe.HasPii, the FIR checker HasPiiRequiresAnnotatedPropertyChecker verifies if any of its properties are annotated with @PiiSafe.HasPii. However, it is missing checking the Type Arguments as well, leaving the following scenario prone to leaking PII:
@PiiSafe.HasPii
data class MessageAddress(
@get:PiiSafe.Mask
val value: String,
val label: String,
)
data class MessageEnvelope(
val subject: String,
val from: List<MessageAddress>,
...
)
Expected behaviour
- Build should fail with the following message:
> Task :feature:mail:message:api:compileKotlinJvm FAILED e: file:///<file-path>/MessageEnvelope.kt:22:5 This class holds a property of a type annotated @PiiSafe.HasPii; this class must also be annotated @PiiSafe.HasPii. - (In case of enabled) IDE should mark the properties whose type argument is annotated with
@PiiSafe.HasPiias an error, showing the above-mentioned message
Actual behaviour
- The build succeeds
- No
toStringmethod is overridden if no other property type is annotated with@PiiSafe.HasPii - (In case of enabled) No IDE error
Build output:
> BUILD SUCCESSFUL
Instructions
- Although this is labelled as
good first issue, it involves a complex topic with not much documentation. You may need to check the Kotlin Compiler source code to succeed in this task. - This is a bug in the newly introduced Kotlin Compiler Plugin, located at library/pii-safe/compiler-plugin
- You will need to change the logic inside the
HasPiiRequiresAnnotatedPropertyChecker.checkmethod to look after type arguments. - You MUST implement test cases to handle this scenario inside
HasPiiRequiresAnnotatedPropertyCheckerTest
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.