1612161 - [a11y] Generated password entry is filled upon field navigation with TAB

Status: VERIFIED FIXED

(Toolkit :: Password Manager, defect, P2)

Description

Attachment: Recording of the issue

Affected platforms:
Windows 10 x64
MacOS 10.15
Ubuntu 18.04

Unaffected:
Nightly 71.0a1 2019-10-08

Steps to reproduce:

1. Launch Firefox
2. Go to twitter.com (or facebook, github)
3. Save 2 sets of credentials
4. Generate a secure password
5. Reload the form and toggle the autocomplete dropdown for the username (if its not toggled on page load)
6. Without selecting any username Press TAB to navigate to the password field

Expected:
Upon pressing TAB, the focus should be placed on the password field and the autocomplete dropdown should be toggled.

Actual:
The autocomplete dropdown is not toggled and the generated password is filled in the password field.

Regression-Range:
Regressed by: bug 1556953
Hey Sam, could you please take a look at this when you have the time? Thanks!

Comment 1

[Timea Cernea [:tbabos][inactive]]

Attachment: Log

Comment 2

[Sean Voisen (:svoisen)]

Marco — Can you give an assessment of how bad the a11y impact of this is?

Comment 3

[Sam Foster [:sfoster] (he/him)]

I can confirm the STR. The generated password causes an empty-username login to be auto-saved. When handling that tab out of the username field, we are matching the auto-saved login and filling the password field with the generated password. I think we just need to check for a non-zero-length username field value.

Comment 4

[Sam Foster [:sfoster] (he/him)]

Attachment: Bug 1612161 - Don't treat tab in username/password field as auto-completion when the field value is empty. r?MattN

Comment 5

[Marco Zehe (:MarcoZ)]

I believe Sam is on top of this. Cancelling NI.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4e23ae638ed5
Don't treat tab in username/password field as auto-completion when the field value is empty. r=MattN

Comment 7

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/4e23ae638ed5

Comment 8

[Timea Cernea [:tbabos][inactive]]

Verified - Fixed on latest Nightly 75.0a1 (2020-02-16) on Windows 10, MacOs 10.15 and Ubuntu 18.04.
Waiting for a potential uplift to Beta.

Comment 9

[Matthew N. [:MattN]]

Comment on attachment 9124894 [details]
Bug 1612161 - Don't treat tab in username/password field as auto-completion when the field value is empty. r?MattN

Beta/Release Uplift Approval Request

• User impact if declined: A generated password could get filled when a user tabs from an empty text field before it
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Adds a simple check that the username field isn't empty before filling a (generated) password
• String changes made/needed: None

Comment 10

[Pascal Chevrel:pascalc (PTO until April 26)]

Comment on attachment 9124894 [details]
Bug 1612161 - Don't treat tab in username/password field as auto-completion when the field value is empty. r?MattN

Low risk, verified on nightly, uplift approved for 74.0b6, thanks.

Comment 11

[Arthur Iakab [arthur_iakab]]

https://hg.mozilla.org/releases/mozilla-beta/rev/454c425d845d

Comment 12

[Timea Cernea [:tbabos][inactive]]

Verified-fixed on latest Beta 74.0b6 on Windows 10, MacOS 10.13 and Ubuntu 18.04.