snoopdave commented on PR #191:
URL: https://github.com/apache/roller/pull/191#issuecomment-5720267261
🤖Claude: Pushed `18a840ae5`, which widens this PR slightly beyond its title
— flagging it so reviewers are not surprised.
**What changed**
The password input is now rendered with no `value` attribute at all:
```java
sb.append("<input type=\"password\" name=\"ldapPass\">");
```
Previously it was rendered with the submitted password as its value.
Escaping that value made the markup well-formed, but the credential was still
being written into the response body, where it is reachable through
view-source, browser cache and back/forward history, and anything upstream that
records response HTML. Not returning it at all is the stronger position, and it
is what browsers and password managers expect from a password field.
The locals that carried the password through `getHtml` were removed with it.
**`authenticate()` is unaffected** — it reads
`request.getParameter("ldapPass")` directly, so signing in behaves exactly as
before. The only user-visible change is that a commenter who mistypes their
password retypes it rather than finding the field pre-filled, which is normal
for a password input.
**Tests**
- `omitsSubmittedPasswordFromMarkup` is new and covers the rendering.
- `preservesOrdinaryFormValues` and the shared `assertFields` helper
previously asserted the password round-trip, so both were updated.
- Assertions now use the supplier-message overload: a failure names the
expected markup and prints the actual HTML, instead of reporting only
`expected: <true> but was: <false>`.
Verified red/green on JDK 11 — restoring the `value` attribute fails the new
test. All 15 comment-related tests pass.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
