1560029 - Make password field values visible when focused after a generated password is filled

Status: VERIFIED FIXED

(Toolkit :: Password Manager, enhancement, P1)

Description

[Matthew N. [:MattN]]

If we generate a password for the user, it may need editing in order to meet the website requirements so we should make it readable to the user to do so. We need an API that LoginManagerContent.jsm can call to toggling visibility.

Comment 1

[Matthew N. [:MattN]]

Attachment: Bug 1560029 - WIP: Check if a password field should be masked before masking. r=masayuki

This is a minimal approach that works in the common case but there are still cases to consider:

• Is this direction fine?
• Add a mochitest
• Check interaction with IMEs
• Check interaction with a11y, specifically screen readers
• Is there any easy way to clear the flag upon navigation (to not leave fields unmasked when restored from bfcache)?

Follow-up bugs:

• Support cut and copy from the unmasked pw field.

Comment 2

[Matthew N. [:MattN]]

Attachment: Bug 1560029 - Make password field values visible when focused after a generated password is filled. r=sfoster

TODO: Add tests

Depends on D33878

Comment 3

[Phabricator Automation]

Comment on attachment 9072715 [details]
Bug 1560029 - WIP: Check if a password field should be masked before masking. r=masayuki

Revision D33878 was moved to bug 1548389. Setting attachment 9072715 [details] to obsolete.

Comment 4

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(away: 6/25-6/28)]

I added new API to unmask specific range in <input type="password">. The API is, nsIEditor.unmask(). Its first argument is start offset of unmask range. Its second argument is optional, end offset of unmask range. So, those values are almost same as HTMLInputElement.setSelectionRange(). Its third argument is also optional, and important for the behavior. This is timeout value to re-mask the characters automatically if grater than 0. In such case, changing the value (e.g., setting HTMLInputElement.value, typing something) mask them immediately. If the value is 0, newly inputted character expands unmasking range. For example, if user types a character at start of the password field when only center 3rd character is unmasked, unmasked range becomes 0 to 3.

Another API, nsIEditor.mask() masks all characters. Then, auto-masking is restarted. I.e., newly inputted characters will be masked automatically. So, somebody can work on this bug right now.

I'll keep working on bug 1560032 and new security issue of the new behavior (currently, user cannot put caret between surrogate pair so that anybody can check its user typed surrogate pairs only with arrow keys).

Comment 5

[Matthew N. [:MattN]]

Thank you very much for implementing bug 1548389 and providing the details here!

Comment 6

[Matthew N. [:MattN]]

Attachment: Bug 1560029 - Import LoginTestUtils in pwmgr_common.js for mochitest-plain. r=sfoster

Comment 7

[Matthew N. [:MattN]]

Attachment: Bug 1560029 - Share GENERATED_PASSWORD_* consts between test frameworks. r=sfoster

Depends on D39404

Comment 8

[Matthew N. [:MattN]]

Try push: https://treeherder.mozilla.org/#/jobs?repo=try&group_state=expanded&revision=a0b36963d2bf309a90c0c6707654267b75b151f5

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/38187d481a68
Import LoginTestUtils in pwmgr_common.js for mochitest-plain. r=sfoster
https://hg.mozilla.org/integration/autoland/rev/78387323c272
Share GENERATED_PASSWORD_* consts between test frameworks. r=sfoster
https://hg.mozilla.org/integration/autoland/rev/0a46342d12f4
Make password field values visible when focused after a generated password is filled. r=sfoster

Comment 10

[Daniel Varga [:dvarga]]

https://hg.mozilla.org/mozilla-central/rev/38187d481a68
https://hg.mozilla.org/mozilla-central/rev/78387323c272
https://hg.mozilla.org/mozilla-central/rev/0a46342d12f4

Comment 11

[Timea Cernea [:tbabos][inactive]]

Verified - Fixed on latest Nightly 70.0a1 (2019-07-29) (64-bit) on Windows 10, MacOS 10.14 and Ubuntu 18.04.

• after generating a password, it can be revealed by focusing the field via click or keyboard navigation
• NVDA screen reader will also read out loud the unmasked password