New issue
Advanced search Search tips

Issue 659173 link

Starred by 2 users

Issue metadata

Status: WontFix
Owner: ----
Closed: Apr 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: iOS
Pri: 3
Type: Bug



Sign in to add a comment

Autofill and password autofill on iOS causes errors when trying to fill cross-origin frames

Project Member Reported by vabr@chromium.org, Oct 25 2016

Issue description

Repro steps:
(0) Save a credential for www.barrysbootcamp.com.
(1) Load http://www.barrysbootcamp.com/reserve/index.cfm?action=Account.login in the simulator.
(2) Inspect the tab in Safari Developer tools.
(3) Attempt to get the username filled.
(4) Check the console logs in the Developer tools window.

The console shows: "Blocked a frame with origin "http://www.barrysbootcamp.com" from accessing a frame with origin "http://staticxx.facebook.com". The frame being accessed set "document.domain" to "facebook.com", but the frame requesting access did not. Both must set "document.domain" to the same value to allow access."

It points to the final part of __gCrWeb.fillPasswordFormWithData of password_controller.js, which does:
    // Recursively invoke for all frames/iframes.
    var frames = win.frames;
    for (var i = 0; i < frames.length; i++) {
      if (__gCrWeb.fillPasswordFormWithData(
              formData, username, password, frames[i], opt_normalizedOrigin)) {
        filled = true;
      }
    }

The filling does not succeed, and fillPasswordFormWithData returns false. The user-visible result is: autofill not working.

When that part of the code is commented out, the same error is triggered by extractFormsAndFormElements_ of autofill_controller_.js.
 

Comment 1 by vabr@chromium.org, Jan 27 2017

This might have been solved by  bug 683385 . Need to check this and possibly mark as duplicate.

Comment 2 by vabr@chromium.org, Apr 19 2017

It does not seem fixed.
Status: WontFix (was: Available)
Problem with cross-origin iframes excelption was fixed, now Password Manager tries to fill only same origin iframes by calling getSameOriginIframes 
https://cs.chromium.org/chromium/src/ios/chrome/browser/passwords/resources/password_controller.js?type=cs&q=var+frames+%3D+getSameOriginFrames_&sq=package:chromium&l=262

I've checked this site, it changed, and now there are no iframes anymore. iOS Chrome fills credentials normally.

Sign in to add a comment