1185443 - Firefox fills in wrong type="password" input field without checking "name" attribute

Status: RESOLVED DUPLICATE of bug 623910

(Toolkit :: Password Manager, defect)

Description

[VIktor]

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.132 Safari/537.36

Steps to reproduce:

Windows 8.1 Pro x64

Firefox fill other password field (with another "name" attribute and on other page).

1. Login in some site (with saving login and passwords)
2. Go to page for Change password (may be settings)
3. Firefox finds a first field with type "password" and put into it saved password. But this may be NOT field "old password" but "new password".

the 38 version of this problem is missing.
autocomplete="off" does not solve the problem


Actual results:

Firefox use different field for autocomplete, and did not check it for compliance by attribute "name" (it is not "password" and "new_password")


Expected results:

The field should be empty, since it has a different name

Comment 1

[Chris Peterson [:cpeterson]]

@Matt: is this form manager behavior a bug or a feature?

hi VIktor. Thanks for reporting this problem!

Is the problem you see that Firefox fills in your saved password into the first password input field on a page (such as a website's "Change Password" page), regardless of the input field's "name" attribute?

I can reproduce this problem on Hacker News. On Hacker News' login page, the "name" attribute of the password field is "pw":

https://news.ycombinator.com/login

<input type="password" name="pw" size="20">

Hacker News' "Change Password" page has two type="password" input fields. The first password field is labelled "Current Password" and its "name" attribute is "oldpw". The second password field is labelled "New Password" and its "name" attribute is "pw" (like the login page). But Firefox fills my current password into the "Current Password" field, even though its "name" attribute is "oldpw", not "pw".

On one hand, Firefox is doing the right thing: my current password is filled into the password field labelled "Current Password". On the other hand, that password field's "name" attribute does not match the "name" attribute for the login page from which it was saved.

https://news.ycombinator.com/changepw

<form method="post" action="/r">
<input type="hidden" name="fnid" value="EwFFrczuufxuTTwt7F5wbC">
<input type="hidden" name="fnop" value="changepw-page">
<table border="0">
<tr><td>Current Password:</td><td><input type="password" name="oldpw" size="20"></td></tr>
<tr><td>New Password:</td><td><input type="password" name="pw" size="20"></td></tr>
<tr><td></td><td><input type="submit" value="Change"></td></tr>
</table>
</form>

Comment 2

[VIktor]

Autocomplete is a very correct and helpful. But to fill up the first available password field is a courageous decision :D

Comment 3

[Philippe MOUGEL]

I reported a similar problem.
see: Bug 1197545 - autocompletion of credentials (userId/Password) wrongly done on any field preceding a field having type="password"

Comment 5

[Matthew N. [:MattN]]

We don't consider @name for our heuristics.

Comment 6

[Matthew N. [:MattN]]

Bug 623910 may help for login forms. The site can also now use autocomplete="new-password" to tell browsers that a field is for a new password instead of a current-password.