search

microsoft / clarity

A behavioral analytics library that uses dom mutations and user interactions to generate aggregated insights.
https://clarity.microsoft.com
MIT License
2.16k stars 214 forks source link

aria-label elements are not masked #480

Open mhr-timroberts opened 1 year ago

mhr-timroberts commented 1 year ago

With strict masking mode enabled, aria-label elements are not being masked in the data being sent to Microsoft. These elements might contain data that identifies an individual.

e.g. The following data was included in the payload being sent to Clarity 

      {
        "id": 441,
        "parent": 391,
        "previous": null,
        "tag": "DIV",
        "attributes": {
          "role": "img",
          "class": "MyImage-container",
          "aria-label": "-- A Person's Name -- photo"
        }
      },

While this cannot be viewed in the recording, it should still be masked, as the data could be sensitive, and despite not being visible at present, it is still being captured and stored.