Mask placeholder attributes when input masking is enabled

[carlosdanieltt]

Summary

• When maskAllInputs or maskInputOptions is enabled, placeholder attributes on <input> and <textarea> elements are now masked through the same maskInputValue() path as input values
• Previously, placeholders were always recorded in plain text even with input masking on, which could leak PII if apps set placeholder text dynamically with user data (e.g., "Enter email: user@example.com")
• Masking respects maskInputOptions granularity (per input type) and custom maskInputFn callbacks

Test plan

• New integration test confirms placeholders are replaced with * characters when maskAllInputs: true
• Existing maskInputOptions test confirms non-masked input types still show plain placeholders
• Existing maskInputFn test confirms custom masking function applies to placeholders (textarea with data-unmask-example keeps its placeholder unmasked)
• All 51 integration tests pass

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: a10319d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[Copilot]

Pull request overview

This PR closes a masking gap by ensuring placeholder attributes on <input> and <textarea> are masked whenever input masking is enabled, preventing potential PII leakage via dynamically generated placeholder text.

Changes:

• Mask placeholder values during full snapshot serialization (rrweb-snapshot) using the existing maskInputValue() path.
• Mask placeholder attribute mutations during incremental recording (rrweb) alongside existing value masking.
• Add an integration test for masked placeholders and update the shared form fixture + related snapshots.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
packages/rrweb/test/integration.test.ts	Adds integration coverage asserting placeholders are masked under maskAllInputs.
packages/rrweb/test/html/form.html	Adds placeholder attributes to fixture inputs used across integration tests.
packages/rrweb/test/snapshots/integration.test.ts.snap	Updates snapshots to reflect placeholder attributes and masking behavior.
packages/rrweb/src/record/mutation.ts	Extends attribute-mutation masking to include placeholder.
packages/rrweb-snapshot/src/snapshot.ts	Masks serialized placeholder attributes for inputs/textareas using maskInputValue().

Comments suppressed due to low confidence (1)

packages/rrweb/src/record/mutation.ts:588

• When masking value/placeholder attribute mutations, the dedup guard compares the masked new value against the unmasked m.oldValue. This can cause redundant attribute-mutation records when the underlying value changes but masks to the same output (e.g., same-length placeholders, or a maskInputFn that returns a constant), increasing payload size and replay churn. Consider masking m.oldValue with the same inputs before comparing, so the comparison is done on the recorded representation.

        if (attributeName === 'value' || attributeName === 'placeholder') {
          const type = getInputType(target);

          value = maskInputValue({
            element: target,

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[eoghanmurray]

Hey Carlos, this looks sound enough; did you come up with an alternative fix?

[carlosdanieltt]

Closed in favor of a more cleaned up version here: #1912