sanitize preview when handling secret parameters

[fdrab]

re-introducing sanitization of preview when handling secrets - issue #1005

[nzlosh]

Should this PR have a changelog entry?

[fdrab]

I'll add it.

[cognifloyd]

With this change the only way to check i typed a secret correctly will be to use the visibility button on each secret field added in #1035, right?

Will this affect secret fields with an object or array? Today, preview is the only way I can validate that I typed or pasted structured data correctly.

[fdrab]

With this change the only way to check i typed a secret correctly will be to use the visibility button on each secret field added in #1035, right?

Will this affect secret fields with an object or array? Today, preview is the only way I can validate that I typed or pasted structured data correctly.

Answer to both questions is "Yes":

[cognifloyd]

Does the preview make secret_object look like it is a string? If so, could it be masked as something like {****} instead of "****"?

[fdrab]

like this?

[fdrab]

If the above is not satisfactory, perhaps I can, instead of replacing all chars with * just generate random alphanumeric strings to replace the originals with? Would that be better?

[cognifloyd]

That is better. Something nicer would be great, but it's probably not required to get this in. That would be a great follow-up PR though.

I think we need the hide/show secrets button merged before this goes in.

[fdrab]

do not merge this pls, this needs adjustment