26 ms·

Oh I am sure there are good uses for this but the code sample scares the pants off me. Never ever evah do the following: form.addEventListener('autocomplet

by geuis 13y ago

Oh I am sure there are good uses for this but the code sample scares the pants off me. Never ever evah do the following: form.addEventListener('autocomplete', function(){ form.submit(); }); This does not give the user any time to review or update the information that the browser autocompletes. Always show the user what information is being sent, always give them an option to change it.

nolok 13y ago
It is my understanding that the "autocomplete" event being referenced here, is after you 1 - ask the browser to autocomplete, 2 - the user is shown what will be shared, and accept to share it. That would cover it (by comparison the scenario you think of would be crazy terrible).
- shock-value 13y ago
  Well, I would expect those two actions to pre-fill the form data. I wouldn't expect them to also submit the form. I think that's the issue.
  - jschmitz28 13y ago
    I think in that case it would be almost the same as a malicious site calling form.submit() after detecting in javascript that all of the fields have been filled out. It would have a slightly worse accuracy, though, since the user has not yet double checked that the form is correct. Does anyone know if there are laws related to this? I could definitely see it being illegal to automatically submit forms that result in financial transactions.
    - eurleif 13y ago
      Look at the screenshot. The permissions dialog shows exactly what information is being submitted, and is labelled 'submit payment details'. No one should be misled.
deleted 13y ago
[deleted]
dragonwriter 13y ago
The UI provides a review before completion (which triggers the autocomplete event), and the feature is expressly designed to be used with hidden forms so that no actual form interaction is required.
estade 13y ago
As others have noted, Chrome does show the data that will be sent in a modal dialog until the user hits "submit". Calling form.submit() should send the user to a confirmation page which also shows parts of the data back to the user, and allows them to confirm the purchase.
quackerhacker 13y ago
You wouldn't even need form.submit() this could be accomplished just through url encoding and ajax. This is exactly why this concerns me too, but it sounds like it will prompt the end user when the api call is made (similar to geolocate apis). As long as the data is NOT filled in automatically on call and the user is prompted, then this feature SHOULD be safe to use.

by geuis 13y ago

nolok 13y ago

It is my understanding that the "autocomplete" event being referenced here, is after you 1 - ask the browser to autocomplete, 2 - the user is shown what will be shared, and accept to share it. That would cover it (by comparison the scenario you think of would be crazy terrible).

shock-value 13y ago
Well, I would expect those two actions to pre-fill the form data. I wouldn't expect them to also submit the form. I think that's the issue.
- jschmitz28 13y ago
  I think in that case it would be almost the same as a malicious site calling form.submit() after detecting in javascript that all of the fields have been filled out. It would have a slightly worse accuracy, though, since the user has not yet double checked that the form is correct. Does anyone know if there are laws related to this? I could definitely see it being illegal to automatically submit forms that result in financial transactions.
  - eurleif 13y ago
    Look at the screenshot. The permissions dialog shows exactly what information is being submitted, and is labelled 'submit payment details'. No one should be misled.

deleted 13y ago

[deleted]

dragonwriter 13y ago

The UI provides a review before completion (which triggers the autocomplete event), and the feature is expressly designed to be used with hidden forms so that no actual form interaction is required.

estade 13y ago

As others have noted, Chrome does show the data that will be sent in a modal dialog until the user hits "submit". Calling form.submit() should send the user to a confirmation page which also shows parts of the data back to the user, and allows them to confirm the purchase.

quackerhacker 13y ago

You wouldn't even need form.submit() this could be accomplished just through url encoding and ajax. This is exactly why this concerns me too, but it sounds like it will prompt the end user when the api call is made (similar to geolocate apis). As long as the data is NOT filled in automatically on call and the user is prompted, then this feature SHOULD be safe to use.