thunderbird / thunderbird/thunderbird-android

[BUG] Pii-Safe Compiler Plugin — FIR checker not considering Type Arguments annotated with `@PiiSafe.HasPii`

Open
#11,570 2 comments 0 reactions 1 assignee View on GitHub

@taljeon is already working on this.

Since Sep 16, 2026.

good first issue
Dominant language
Kotlin
Stars
14k
Forks
2.8k
Avg merge
3d 3h
Merged PRs (30d)
57

Description

Description

When a data class is NOT annotated with @PiiSafe.HasPii, the FIR checker HasPiiRequiresAnnotatedPropertyChecker verifies if any of its properties are annotated with @PiiSafe.HasPii. However, it is missing checking the Type Arguments as well, leaving the following scenario prone to leaking PII:

@PiiSafe.HasPii
data class MessageAddress(
    @get:PiiSafe.Mask
    val value: String,
    val label: String,
)

data class MessageEnvelope(
    val subject: String,
    val from: List<MessageAddress>,
    ...
)

Expected behaviour

  1. Build should fail with the following message:
     > Task :feature:mail:message:api:compileKotlinJvm FAILED
     e: file:///<file-path>/MessageEnvelope.kt:22:5 This class holds a property of a type annotated @PiiSafe.HasPii; this class must also be annotated @PiiSafe.HasPii.
    
  2. (In case of enabled) IDE should mark the properties whose type argument is annotated with @PiiSafe.HasPii as an error, showing the above-mentioned message

Actual behaviour

  1. The build succeeds
  2. No toString method is overridden if no other property type is annotated with @PiiSafe.HasPii
  3. (In case of enabled) No IDE error

Build output:

> BUILD SUCCESSFUL

Instructions

  • Although this is labelled as good first issue, it involves a complex topic with not much documentation. You may need to check the Kotlin Compiler source code to succeed in this task.
  • This is a bug in the newly introduced Kotlin Compiler Plugin, located at library/pii-safe/compiler-plugin
  • You will need to change the logic inside the HasPiiRequiresAnnotatedPropertyChecker.check method to look after type arguments.
  • You MUST implement test cases to handle this scenario inside HasPiiRequiresAnnotatedPropertyCheckerTest

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.