4 ms·

No need for a submit click. Presumably auto-fill triggers a change event on each affected input, but even if it didn't, an attacker could just repeatedly check

No need for a submit click. Presumably auto-fill triggers a change event on each affected input, but even if it didn't, an attacker could just repeatedly check for new content in the inputs. This means an optimistic solution (autofilling and then unobtrusively notifying the user what was autofilled) is not viable.

tiglionabbit 10y ago
Notice that it's not checking the data with JavaScript. I was under the impression that there is already a security measure against this as far as JavaScript is concerned. The browser is already instructed to lie to JavaScript about certain details such as the :visited state of a link and any CSS rules that follow as a result of this.
- greenhatman 10y ago
  Even if you can't read the values with JavaScript, you can submit the form with JavaScript. So then you'd need to prompt the users to confirm that they want to auto fill, not just notify that auto fill happened. Otherwise it may already be too late.
  - nommm-nommm 10y ago
    Even if you couldn't read any hidden value with JS and had no way of telling if they changed (didn't try it myself) you could submit the form every 5-10 seconds or so in the background and reject it server side if a hidden field is missing.
- tyingq 10y ago
  You can check the data with JavaScript if you poll. Try it out: https://jsfiddle.net/k91o1dw9/7/ https://jsfiddle.net/k91o1dw9/7/
bsimpson 10y ago
I don't think it does trigger a change for exactly this reason. I tried to build a Material login page a couple years back, where the placeholder became the label when you typed. I couldn't get it to work with autofill, because I couldn't find a vector to detect when autofill had happened. Here's a related issue: https://bugs.chromium.org/p/chromium/issues/detail?id=352527 https://bugs.chromium.org/p/chromium/issues/detail?id=352527
- deleted 10y ago
  [deleted]
- mbrookes 10y ago
  That's correct - this has also been a massive issue for React, and still isn't fixed in a released version. There's a fix that was merged some time ago, pending release with React 16 [1]. There's some discussion about a 3rd party effort to back-port to 15.x. [1] https://github.com/facebook/react/issues/7211#issuecomment-266774957 https://github.com/facebook/react/issues/7211#issuecomment-2...)
- tyingq 10y ago
  It doesn't trigger a change, but you can certainly poll for non empty strings: https://jsfiddle.net/k91o1dw9/7/ https://jsfiddle.net/k91o1dw9/7/ Edit: That is, for the purposes of this exploit. I understand it's ugly.

tiglionabbit 10y ago

Notice that it's not checking the data with JavaScript. I was under the impression that there is already a security measure against this as far as JavaScript is concerned. The browser is already instructed to lie to JavaScript about certain details such as the :visited state of a link and any CSS rules that follow as a result of this.

greenhatman 10y ago
Even if you can't read the values with JavaScript, you can submit the form with JavaScript. So then you'd need to prompt the users to confirm that they want to auto fill, not just notify that auto fill happened. Otherwise it may already be too late.
- nommm-nommm 10y ago
  Even if you couldn't read any hidden value with JS and had no way of telling if they changed (didn't try it myself) you could submit the form every 5-10 seconds or so in the background and reject it server side if a hidden field is missing.
tyingq 10y ago
You can check the data with JavaScript if you poll. Try it out: https://jsfiddle.net/k91o1dw9/7/ https://jsfiddle.net/k91o1dw9/7/

bsimpson 10y ago

I don't think it does trigger a change for exactly this reason. I tried to build a Material login page a couple years back, where the placeholder became the label when you typed. I couldn't get it to work with autofill, because I couldn't find a vector to detect when autofill had happened. Here's a related issue: https://bugs.chromium.org/p/chromium/issues/detail?id=352527 https://bugs.chromium.org/p/chromium/issues/detail?id=352527

deleted 10y ago
[deleted]
mbrookes 10y ago
That's correct - this has also been a massive issue for React, and still isn't fixed in a released version. There's a fix that was merged some time ago, pending release with React 16 [1]. There's some discussion about a 3rd party effort to back-port to 15.x. [1] https://github.com/facebook/react/issues/7211#issuecomment-266774957 https://github.com/facebook/react/issues/7211#issuecomment-2...)
tyingq 10y ago
It doesn't trigger a change, but you can certainly poll for non empty strings: https://jsfiddle.net/k91o1dw9/7/ https://jsfiddle.net/k91o1dw9/7/ Edit: That is, for the purposes of this exploit. I understand it's ugly.