Repository navigation
fix(connections): keep spell checking off in secret and key fields - #1707
Merged
Merged
Conversation
A browser spell checker can send a field's text to an outside spelling service and keep its words in the user's dictionary. Every connection dialog field that holds a password, token, key, PEM or credential URI now sets spellCheck, autoCorrect and autoCapitalize off, and autoComplete off where the field is not masked. A component test walks every engine, SSL mode and SSH auth method and fails on a secret field without them.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
cevheri
marked this pull request as ready for review
October 12, 2026 14:48
This was referenced Oct 12, 2026
cevheri
added a commit
that referenced
this pull request
Oct 12, 2026
The walk from #1707 ran every engine in one test and went past bun's five-second timeout on a loaded runner, so Unit & Integration Tests was red on main. Each engine now has its own test on a fresh dialog, and a final test keeps the reach check.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A browser spell checker can send a field's text to an outside spelling service and may keep its words in the user's dictionary. Key material and credentials must never take that path.
Every connection dialog field that holds a secret now sets spellCheck={false}, autoCorrect="off" and autoCapitalize="off": the password and API key secret, the SSL CA, client certificate and client private key PEM fields, the SSH password, private key and passphrase, and the Paste URL and connection string inputs, since a URI carries the password. Unmasked fields also set autoComplete="off". Masked fields keep autoComplete="new-password", which keeps saved site passwords out of them.
A new component test walks the real dialog through every engine, every SSL mode that shows the PEM fields, both SSH auth methods and the connection string mode. It fails on any secret field without these attributes, so a new one cannot slip in.
Checks: the full local gate set passed (format, lint, typecheck, knip, the drift guards, every test file at 100% line coverage, build,
build:lib,attw).A browser check runs before this leaves draft.
No separate review agents ran on this branch.