New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 669045 link

Starred by 3 users

Issue metadata

Status: Fixed
Owner:
hobby only
Closed: Feb 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 3
Type: Bug



Sign in to add a comment

Autofilled Password field stay unreadable in iframe after user interaction

Reported by remy.gra...@treves-group.com, Nov 28 2016

Issue description

UserAgent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.99 Safari/537.36

Steps to reproduce the problem:
1. Create a page with a form with a <input type="password" />
2. Create another page with the first loaded within an iframe (same domain)
3. Submit this form and validate the chrome password saving prompt
4. Reload the 2nd page
5. Interact with the page by clicking in it
6. Try to access the password value throught js => It return an empty string

What is the expected behavior?
The page is expected to allow js access the password value after the user interacted with the page (in this case, the iframe content)

What went wrong?
The page return an empty string for the password input value unless the user re-input something in the field

Did this work before? N/A 

Chrome version: 54.0.2840.99  Channel: stable
OS Version: 6.1 (Windows 7, Windows Server 2008 R2)
Flash Version: Shockwave Flash 23.0 r0

I understand the sercurity standpoint on this but the behavior is incoherent between a fully fledge page where it works as described (value available after first user interaction) and an iframed page (where it doesn't work)

Possibly linked to #636425
 
Cc: vabr@chromium.org
Components: -Blink Blink>Forms UI>Browser>Autofill

Comment 2 by tkent@chromium.org, Nov 28 2016

Components: -Blink>Forms UI>Browser>Passwords
Cc: ligim...@chromium.org
Labels: M-54 Needs-Feedback Needs-Triage-M54
Please provide us with sample webpages/ testcases for the ease of finding regressions.

Comment 4 by vabr@chromium.org, Dec 12 2016

Cc: -vabr@chromium.org
Labels: -OS-Windows -Pri-2 -Needs-Feedback -M-54 -Needs-Triage-M54 Hotlist-Polish OS-All Pri-3
Owner: vabr@chromium.org
Status: Started (was: Unconfirmed)
I could reproduce this issue with the tweak that the iframe was loaded dynamically not as part of the initial page load. The attached example, once staged on a web server, shows the issue. Also demonstrated on the screenshot, which captures the page after pressing "Add frame".
669045_repro.tar.bz2
929 bytes Download
frames.png
50.4 KB View Download

Comment 5 by vabr@chromium.org, Dec 12 2016

This is indeed a bug.

Normally, the frame which registers the first user interaction notifies the  ChromeAutofillClient::OnFirstUserGestureObserved, which in turn notifies all frames of that tab.

But this only happens once, since then all frames are considered notified. Adding a frame later does not trigger the notification. That's what I'm going to fix.
I had forgot to mention that the iframe was dynamicly added, sorry for that ...
Anyway, I can confirm this is exactly my use case (a sign in page loaded in a iframe modal)

Thanks vabr !

Comment 7 by vabr@chromium.org, Dec 12 2016

Thanks for the confirmation (and the report, in the first place)!

Comment 8 by vabr@chromium.org, Dec 14 2016

Sorry for the delay, some other work takes most of my days recently.
The fix itself here will be easy, but the tests will be a challenge, which is why it may take longer. Still on it, though.
Project Member

Comment 9 by bugdroid1@chromium.org, Dec 23 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/603bbb6727a01a230ec804a2367537dd9aa11dc5

commit 603bbb6727a01a230ec804a2367537dd9aa11dc5
Author: vabr <vabr@chromium.org>
Date: Fri Dec 23 13:37:52 2016

Add user-gesture-related tests for ContentAutofillDriver

The methods ContentAutofillDriver::FirstUserGestureObserved and
ContentAutofillDriver::NotifyFirstUserGestureObservedInTab do not seem to be
tested yet. This CL adds tests for that.

This is in preparation to fixing  https://crbug.com/669045 , to avoid inflating
the CL with the fix by adding tests for existing code.

BUG= 669045 

Review-Url: https://codereview.chromium.org/2603583002
Cr-Commit-Position: refs/heads/master@{#440624}

[modify] https://crrev.com/603bbb6727a01a230ec804a2367537dd9aa11dc5/components/autofill/content/browser/content_autofill_driver_unittest.cc

Comment 10 by vabr@chromium.org, Dec 23 2016

The fix is https://codereview.chromium.org/2603623002 (works locally with my reproduction case). It is blocked on a refactoring needed to make testing possible: https://codereview.chromium.org/2606473003/.

I'm afraid landing the fix will take a while, because (1) most of reviewers are currently on holiday, and (2) the refactoring might be a bit controversial (testing this part of code turns out to be challenging https://groups.google.com/a/chromium.org/d/msg/chromium-dev/EMMjQcJacvo/4ICuw0xjDwAJ), and (3) I expect to be away for a longer period soon.

Comment 11 by vabr@chromium.org, Feb 21 2017

Sorry for the delay, I was on a long leave. Now back at work. My first step here is to propose a necessary refactoring of ContentAutofillDriverFactory to allow reasonable tests for the fix (https://codereview.chromium.org/2603623002) to the autofill team (I scrapped the idea from https://codereview.chromium.org/2606473003/, because it only worked by good luck). Once agreed, I'll make that refactoring and land the fix.

Comment 12 by vabr@chromium.org, Feb 21 2017

The refactoring proposal is https://docs.google.com/a/chromium.org/document/d/1CZRzRv5p1SnClgOYydZ7epVpEqYxJdgRSCEpRXml-xU/edit?usp=sharing. It should be accessible to all @chromium.org accounts. Feel free to let me know if you need to view this but cannot. I will update this bug once the proposal is accepted and implemented.
Project Member

Comment 13 by bugdroid1@chromium.org, Feb 22 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f68e6ab0d88250d9547590aadc0d885399979158

commit f68e6ab0d88250d9547590aadc0d885399979158
Author: vabr <vabr@chromium.org>
Date: Wed Feb 22 23:08:42 2017

Split non-//content parts from ContentAutofillDriverFactory

This CL extracts the logic for managing AutofillDriver instances from
ContentAutofillDriverFactory and puts it in a separate AutofillDriverFactory
class. The goal is to achieve better testability. More details are in the
design doc
https://docs.google.com/a/chromium.org/document/d/1CZRzRv5p1SnClgOYydZ7epVpEqYxJdgRSCEpRXml-xU/edit?usp=sharing.

BUG= 669045 

Review-Url: https://codereview.chromium.org/2715483002
Cr-Commit-Position: refs/heads/master@{#452258}

[modify] https://crrev.com/f68e6ab0d88250d9547590aadc0d885399979158/components/autofill/content/browser/content_autofill_driver_factory.cc
[modify] https://crrev.com/f68e6ab0d88250d9547590aadc0d885399979158/components/autofill/content/browser/content_autofill_driver_factory.h
[modify] https://crrev.com/f68e6ab0d88250d9547590aadc0d885399979158/components/autofill/core/browser/BUILD.gn
[add] https://crrev.com/f68e6ab0d88250d9547590aadc0d885399979158/components/autofill/core/browser/autofill_driver_factory.cc
[add] https://crrev.com/f68e6ab0d88250d9547590aadc0d885399979158/components/autofill/core/browser/autofill_driver_factory.h
[add] https://crrev.com/f68e6ab0d88250d9547590aadc0d885399979158/components/autofill/core/browser/autofill_driver_factory_unittest.cc

Comment 14 by vabr@chromium.org, Feb 23 2017

The refactoring landed (#13 here) and I will be able to adapt the fix https://codereview.chromium.org/2603623002/ and land that hopefully on Friday.
Project Member

Comment 15 by bugdroid1@chromium.org, Feb 27 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ce7eba36c420dabb86b57f1851d5c86115d7d13c

commit ce7eba36c420dabb86b57f1851d5c86115d7d13c
Author: vabr <vabr@chromium.org>
Date: Mon Feb 27 17:41:47 2017

AutofillDriverFactory manages information about user gestures

When a password field is autofilled, the value is not accessible to JavaScript
until the user clicks or types in the page. To keep track of this, the frames
report such user gestures, and ChromeAutofillClient distributes such a signal
to all other frames in the same WebContent, via their common
AutofillDriverFactory.

This does not work when a new frame is added later, because the browser process
does not keep track whether the user gestures were seen already. Newly added
frames never learn about the user already having clicked in the page.

This CL fixes that by modifying AutofillDriverFactory to remember the
user gestures and notify also drivers added later. The flag is reset on main
page navigation.

The CL also makes parts of the AutofillDriverFactory API public, as long as they
do not modify the drivers map. This results in a slight reordering of methods.

BUG= 669045 

Review-Url: https://codereview.chromium.org/2603623002
Cr-Commit-Position: refs/heads/master@{#453245}

[modify] https://crrev.com/ce7eba36c420dabb86b57f1851d5c86115d7d13c/chrome/browser/ui/autofill/chrome_autofill_client.cc
[modify] https://crrev.com/ce7eba36c420dabb86b57f1851d5c86115d7d13c/components/autofill/content/browser/content_autofill_driver.h
[modify] https://crrev.com/ce7eba36c420dabb86b57f1851d5c86115d7d13c/components/autofill/core/browser/autofill_driver.h
[modify] https://crrev.com/ce7eba36c420dabb86b57f1851d5c86115d7d13c/components/autofill/core/browser/autofill_driver_factory.cc
[modify] https://crrev.com/ce7eba36c420dabb86b57f1851d5c86115d7d13c/components/autofill/core/browser/autofill_driver_factory.h
[modify] https://crrev.com/ce7eba36c420dabb86b57f1851d5c86115d7d13c/components/autofill/core/browser/autofill_driver_factory_unittest.cc

Comment 16 by vabr@chromium.org, Feb 27 2017

Status: Fixed (was: Started)
#15 should have fixed this issue on trunk. This means it reaches Canary in a day or two. Luckily, branch point for 58 is soon, so it should not take long for this to reach beta (as soon as it hits version 58).

If people still can see this issue in Chrome 58 the day after tomorrow, please update this bug or e-mail vabr@chromium.org.

Sign in to add a comment