1265201 - Port Bug 1191092 to SeaMonkey (Warn about insecure <input type=password> outside of a <form>.InsecurePasswordUtils should handle <input type=password> outside of a <form>)

Status: RESOLVED FIXED

(SeaMonkey :: Passwords & Permissions, defect)

Description

[Philip Chee]

Some sites (e.g. hulu.com's homepage) have insecure logins pages without using a <form> element and those get missed by InsecurePasswordUtils. InsecurePasswordUtils should use DOMInputPasswordAdded to catch those cases.

We want to have (some/all) of checkForInsecurePasswords work from DOMInputPasswordAdded. We should probably use FormLikeFactory.createFromField(event.target) then use the "FormLike" instead of the real HTMLFormElement in the helper functions where it makes sense.

Comment 1

[Frank-Rainer Grahl (:frg)]

Attachment: 1265201-insecurepassword.patch

This is/was hopefully a no brainer.

Tested on Windows 7 en-US x64 VS2015 build

>> User agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:48.0) Gecko/20100101 
>> Firefox/48.0 SeaMonkey/2.45a1
>> Build identifier: 20160417103718

Javascript error is gone and warning is shown in the console. Wasn't there a warning in the browser itself in some cases? I can't seem to get it and can't find it in the code.

>> Timestamp: 4/17/2016 11:07:27 AM
>> Warning: Password fields present in a form with an insecure (http://) form 
>> action. This is a security risk that allows user login credentials to be 
>> stolen.
>> Source File: http://www.pinballz.net/?s=168276e5ee016c3363608a511b
>> Line: 0
>> Source Code: 0

Comment 2

[Philip Chee]

Comment on attachment 8742104 [details] [diff] [review]
1265201-insecurepassword.patch

r=me

Comment 3

[Philip Chee]

http://mxr.mozilla.org/comm-central/source/mozilla/dom/locales/en-US/chrome/security/security.properties?rev=6c7d5b56e472&mark=49-49#49
http://mxr.mozilla.org/comm-central/source/mozilla/toolkit/components/passwordmgr/InsecurePasswordUtils.jsm?rev=41fa5b9cf8dc&mark=97-99,101-101#96

Comment 4

[Philip Chee]

http://hg.mozilla.org/comm-central/rev/cf03cf8f0fb6