finding(plugin-grid,security): on the host-fetched path an untyped view column over a password / secret field draws its raw value until the grid's object schema settles, and for good if that read fails #10706

Filing-gate category: ① a security defect with named sites (class a): a credential drawn in the clear. Reader: triage first (route and grade), then the seat that claims it.

Filed by the domain:ui seat #2 (session_014mXUNuFomfj24w7s1pZzhN) from the round-3 security review of PR objectui#10643 (objectui#10583) at 4d341308a, which measured it. PR objectui#10643 states this window in its "Not covered" list and does not close it: the draw half predates that PR, and closing it is a design choice outside objectui#10583. ⛔ Not graded here.

The window

ObjectGrid resolves a column's type, and so its cell renderer and every masked-field guard, from objectSchema?.fields?.[key]?.type when the view column authors no type. The console's ordinary view columns author none.

On the inline path, objectSchema starts null. This is the path every fetching host takes: dataConfig.provider === 'value', with ListView handing its rows down as data and ObjectView doing the same through list-view.

• packages/plugin-grid/src/ObjectGrid.tsx:1919-1931 sets data from the host synchronously and ends loading.
• :1937-1960 fetches the object schema afterwards (dataSource.getObjectSchema(objectName), :1946).
• So the rows paint before the grid knows which fields are password / secret.

Measured by the reviewer (probe at 4d341308a; ⛔ not re-run by the seat)

The setup: an object-declared password field api_key, an untyped view column, inline rows, and getObjectSchema held pending.

• Before the schema settled, the cell drew the raw value as text. With grouping: { fields: [{ field: 'api_key' }] }, the one group row's .group-label was the raw credential.
• After it settled, the mask drew and there were 0 group rows (PR objectui#10643's grouping refusal).
• PR objectui#10643's copy, tooltip, edit, export and card guards key on the same type, so they are open in the same window. That is unmeasured, but they read the same key.

Worse than a window when the read fails (read by the seat at origin/main 1e946c96a)

:1950-1954 swallows a failed schema read: "Schema fetch failure for inline data is non-fatal; columns will still fall back to heuristic inference". So a failed or refused getObjectSchema leaves an untyped credential column drawn in the clear for the life of the grid.

Reach

A schema cache miss is a network round trip: the first visit to an object in data-objectstack's MetadataCache, or any adapter without a cache. The failure branch is reachable on any refused or failed metadata read. The server's own masking of the row payload is the other guard; this card is about the client drawing whatever the row carries.

Direction (for triage, not a ruling)

Two shapes the review named, with different costs:

• the host hands the grid the object types it already holds (ListView has objectSchema), so there is no window;
• or an object-bound untyped column is withheld (drawn as unknown, not as text) until the schema settles, and stays withheld if the read fails.

The first changes a props seam between plugin-list and plugin-grid. The second changes first paint for every object-bound grid on a cache miss. Pins: the reviewer's held-schema probe (draw, group label), red on base and green on head, plus the failed-read arm.

Dedupe

REST read of objectui issues and PRs (the 1000 most recent, plus every item updated since 2026-09-25T12:00Z), matched against schema settles|objectSchema.{0,40}null|host-fetched|untyped view column and masked.{0,80}(first paint|before the schema). The 5 hits are lookup-label, test-harness and ObjectGantt cards (objectui#10487, PR objectui#10557, PR objectui#10513, objectui#7502, objectui#7232), none about a masked field. objectui#10657 (the other data-table producers set no masked, folding objectui#10658) is a different gap. Lit control: the same walk finds objectui#10487 for objectSchema.

Dedupe words: masked column first paint schema window · inline data objectSchema null password raw · untyped view column credential drawn before schema

Generated by Claude Code