1724136 - Password Manager fails when username is on one page and password is on another

Status: VERIFIED FIXED

(Toolkit :: Password Manager, defect, P2)

Description

[erosman]

Further to a discussion with dveditz on #security:mozilla.org, there appears to be an issue when a different domain is used for login process.

In this case:
From login.ubuntu.com to ubuntuforums.org.

STR

1. on ubuntuforums.org click the "login with SSO" button. I had already created an account with login.ubuntu.com, but hadn't logged into ubuntuforums yet.
2. autofill name and password and click submit (this is fine)
3. I get a "Personal Data Request" page that says ubuntuforums.org wants to know my name/address -- typical OAuth. On this page there's a hidden openid.usernamesecret hidden field, with the hidden label "Leave this field blank to prove your humanity". Firefox has filled in my email address there.
4. submit the form
5. get the "bad robot" text

Notes

• The issue started in Nightly 91
• Turning off Autofill logins and passwords in Settings prevents the problem

Also: https://ubuntuforums.org/showthread.php?t=2464990

Comment 1

[Daniel Veditz [:dveditz]]

If you've

Comment 2

[Dimi Lee [ooo 16.04 - 21.04］]

The markup of the form (In my case the form is hidden):

<form action="" method="POST" name="decideform">
<div style="display: none;">
    <label>Leave this field blank to prove your humanity
        <input type="text" name="openid.usernamesecret" value="">
    </label>
</div>
</form>

Comment 3

[Julien Cristau [:jcristau] (back April 22)]

Hey Dimi, is there a chance we'll be able to fix this regression in the 93 time frame?

Comment 4

[Dimi Lee [ooo 16.04 - 21.04］]

(In reply to Julien Cristau [:jcristau] from comment #3)

Hey Dimi, is there a chance we'll be able to fix this regression in the 93 time frame?

Hi Julien,
Probably not :(
Since my plan is to enable multi-page login form support in 94, I'll try to fix this in 94.

Comment 5

[Julien Cristau [:jcristau] (back April 22)]

Thanks for the pointers. I guess bug 1721971 means this bug does not currently affect release, just nightly?

Comment 6

[Dimi Lee [ooo 16.04 - 21.04］]

(In reply to Julien Cristau [:jcristau] from comment #5)

Thanks for the pointers. I guess bug 1721971 means this bug does not currently affect release, just nightly?

yes, nightly and early beta.

Comment 7

[Julien Cristau [:jcristau] (back April 22)]

Great, thank you.

Comment 8

[Dimi Lee [ooo 16.04 - 21.04］]

Attachment: Bug 1724136 - P1. Support filtering out username-only forms by site recipes r=sfoster,tgiles

Comment 9

[Dimi Lee [ooo 16.04 - 21.04］]

Attachment: Bug 1724136 - P2. Restructure onFormSubmit function r=sfoster,tgiles

Since _getFormFields calls getUsernameFieldFromUsernameOnlyForm,
we don't have to call getUsernameFieldFromUsernameOnlyForm in onFormSubmit.
Instead, We can just use the result of _getFormFields to know whether an username-only
form is submitted.
This also makes sure we use the site recipe while check if the form is a
username-only form during form submission.

Depends on D124339

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a8ca5104f6f8
P1. Support filtering out username-only forms by site recipes r=sfoster,tgiles
https://hg.mozilla.org/integration/autoland/rev/3a0f70175d72
P2. Restructure onFormSubmit function r=sfoster,tgiles

Comment 11

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/a8ca5104f6f8
https://hg.mozilla.org/mozilla-central/rev/3a0f70175d72

Comment 12

[Dimi Lee [ooo 16.04 - 21.04］]

Hi Timea, The patch is landed in 94 and the recipe is also in the RemoteSettting now, could you help verify whether this is fixed? thanks!

Comment 13

[Timea Cernea [:tbabos][inactive]]

Hi Dimi, something might've changed with the page since I am not able to reach the "Personal Data Request" page mentioned by the reporter. After hitting submit, I will reach the My Account page.

Hi erosman, could you please check this out if it is fixed on your side? Should be fixed in the latest Firefox Nightly 94 build, please download it from here: https://www.mozilla.org/en-US/firefox/channel/desktop/. Please make sure to Download the Nightly build and let us know how it goes.

Comment 14

[erosman]

I have been using it with Autofill logins and passwords set to unchecked which bypasses the bug.

I tested it right now with the latest Nightly and above checked and there was no problem, so it is fixed for the site/test-case that was mentioned in the initial post.

Comment 15

[Timea Cernea [:tbabos][inactive]]

Thanks for the fast check!

Dimi, seems like this is safe to be marked as Fixed.

Comment 16

[Monica Chiorean]

Hi erosman, I was not able to reproduce the issue before the fix. I know you already check in Nightly build, but would it possible for you to check against latest Beta 94 (just to make sure that issue is fixed on release version)?.

Thank you so much.

Comment 17

[erosman]

Tested on Win7 with 94.0b8 (http://ftp.mozilla.org/pub/firefox/releases/94.0b7/win64/en-US/Firefox%20Setup%2094.0b7.exe) and the bug appears to be fixed.

Comment 18

[Monica Chiorean]

Closing based on previous comment and since not reproducing on Beta 94.0b8 on Win10 and Ubuntu 20.4.