Description

Detects React Native TextInput components handling sensitive data (like passwords) without proper text masking enabled. Missing input masking can expose sensitive information in plain text on the mobile device screen, compromising user security.

Detection Strategy

• Check if the source file imports the 'react-native' module

• Identify TextInput components in the React Native application code

• Analyze if the TextInput is used for sensitive information (e.g. password fields)

• Report a vulnerability when a TextInput handling sensitive data lacks masking protection

Vulnerable code example

import React, { useState } from "react";
import { View, TextInput } from "react-native";

const LoginForm = () => {
  const [password, setPassword] = useState("");

  return (
    <View>...

✅ Secure code example

import React, { useState } from "react";
import { View, TextInput } from "react-native";

const LoginForm = () => {
  const [password, setPassword] = useState("");

  return (
    <View>...