520561 - Autocomplete is too aggressive and overwrites values of hidden fields.

Status: RESOLVED INVALID

(Toolkit :: Form Manager, defect)

Description

[Harold Weir]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)

If I have an .ASPX page set a value of a hidden field, the autofill of FF 3.5.3 overwrites that value with it's own auto fill value.

Reproducible: Always

Steps to Reproduce:
1. Create an aspx page with a hidden field
2. Set the value of the hidden field in the code behind (onLoad, or OnPreRender doesn't matter).
3. Check the value of the hidden field through a javascript event, and see it is reset to a previous value.
Actual Results:  
The .aspx page contains...
...
<a runat="server" id="toggleText" href="" style="cursor:pointer;">Toggle</a>
<input id="hd_Text" runat="server" type="hidden" />
...

The code behind sets the initial value...
protected override void OnLoad(EventArgs e)
{
    ...
    HtmlAnchor btn = (HtmlAnchor)FindControl("toggleText");
    HtmlInputHidden hf = (HtmlInputHidden)FindControl("hd_Text");
    if (btn != null && hf != null)
    {
        string clickText = String.Format("ToggleText('{0}');", hf.UniqueID.Replace("$", "_"));
        btn.Attributes.Add("onclick", clickText);
        hf.Value = "1";
    }
    ....
}
The javascript implements...
function ToggleText(hf_id) {
    var hf = document.getElementById(hf_id);
    if (hf != null) {
        var statusValue = parseInt(hf.value);
        alert(hf.value);
        var newvalue = parseInt(statusValue) + parseInt("1");
        hf.value = newvalue;
    }
}

Expected Results:  
Note that the javascript displays the value of the hidden field.  In FF 3.5.3 when I toggle the hidden field several times, and then refresh the page, the value is not reset to the original value.  Instead FF 3.5 set's it to the toggled value.   Q: why is FF setting hidden fields anyway???

I can run the same simple page in IE 6-8, Chrome 3.0, Safari 4.0 (none of which form fill as well, but they also leave the hidden field alone). This did not happen in FF 3.0.

Comment 1

[Aufgeschissener Kunde]

Fast forward to Firefox 16 and Firefox still bungles with INPUT[TYPE=HIDDEN] elements by setting random values.  I've found that adding AUTOCOMPLETE=OFF is a competent workaround, but then (albeit "experimental") HTML5 validaters wail and insist that I've done something wrong.

Comment 2

[Vincent MONIER]

I'm running into the same issue of Firefox autocompleting input fields. Here's a sample page: https://tests.reinom.com/html/autocomplete-hidden/

4 hidden fields in there: [no value, autocomplete default], [value, autocomplete default], [no value, autocomplete=off], [value, autocomplete=off]. The later 2 are non-standard. https://html.spec.whatwg.org/multipage/forms.html#attr-fe-autocomplete says "On an input element whose type attribute is in the Hidden state, the autocomplete attribute wears the autofill anchor mantle." and "When wearing the autofill anchor mantle, the autocomplete attribute, if specified, must have a value that is an ordered set of space-separated tokens consisting of just autofill detail tokens (i.e. the "on" and "off" keywords are not allowed)."

When the fields are filled by a javascript, Firefox updates their value (OK).
Then, when doing a backward/forward history go, the values are kept (OK, the page's state is kept).
But when doing a refresh, the first 2 fields keep their value while the later 2 (those invalid with autocomplete=off") don't.

Opera behave differently: the values are always discarded: field 1 and 3 have no value after a refresh, and field 2 and 4 have the value "foo" set by the HTML code. This sounds to be the right way to me and the spec (hidden fields have no reasons to be autocompleted by the browser since they have no reason to be altered by the user).

Comment 3

[BMO Automation]

Per policy at https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Inactive_Bugs. If this bug is not an enhancement request or a bug not present in a supported release of Firefox, then it may be reopened.

Comment 4

[biser]

This is still reproducible on 75.0 (64-bit) on macOS 10.15.

The caching overrides the value set in HTML. I'm not sure what the minimal reproduction scenario might be, but the code is as follows:

<input type="hidden" name="field1" id="field1" size="180" value="test value" />

On initial page load this is fine, but after submitting, there's some JS that clears out the field. On every subsequent page reload, the field is restored as an empty value ( "" ), even though the HTML specifies it's value.

Closing and reopening the tab doesn't help.

Adding autocomplete="off" fixes the issue, as mentioned above.

Comment 5

[moshe.kamensky]

Is there any way to re-open it?

Comment 6

[Kiril Mitov]

For reference - I was able to reproduce it and resolve it with autocomplete='off' at https://bugzilla.mozilla.org/show_bug.cgi?id=1667657 with firefox 80

Comment 7

[Asif Youssuff]

Reopening per latest comments.

Comment 9

[Razvan Caliman [:rcaliman]]

As mentioned in comment#6 this issue is still occurring for users. Closed Bug 1667657 as a duplicate of this one.

Comment 10

[jpgithub]

This is bad, folks.

If bugzilla allowed image uploads I'd upload for you a side-by-side (Firefox on the left, Chrome on the right) showing you Firefox corrupting a Ruby/Rails generated hidden field named "_method" that was SET to the string "patch" but which (only) Firefox mangled to be "5f4ledBRFGRYSUpaeJ29y-J0SX6KRSzbr1zSjVvgy1fhGmQAXXzsjLxdswyBtqopEnO6pQAaJTEFUJKXDVyisg"

Since you don't seem to support uploads here, I posted it on my blog at:
https://149362717.v2.pressablecdn.com/wp-content/uploads/2021/06/sidebyside.jpg

Pretty challenging for developers to debug why a form that worked perfectly - and still works perfectly on _any other browser than Firefox - just stops working?

FWIW I think closing/reopening the browser makes it go away for a little while.

FF 89.0.1 (64-bit) on Mac.

Comment 11

[michal.zubkowicz]

I can confirm that even hidden fields are autocompleted which can break site functionality

Comment 12

[BugBot [:suhaib / :marco/ :calixte]]

In the process of migrating remaining bugs to the new severity system, the severity for this bug cannot be automatically determined. Please retriage this bug using the new severity system.

Comment 13

[Sergey Galich [:serg]]

Please reopen with attached HTML to reproduce the problem.