Wikipedia form fields misidentified as login fields

77vjdplu1N2h commented 3 months ago

Steps To Reproduce

Go to https://en.wikipedia.org/w/index.php?title=Special:Log
Click to place the cursor in the box below Target (title or User:username for user):
See Bitwarden active within the field.

Also, why can't this be disabled globally or per-website? I don't want to enter passwords on Wikipedia forms... ever.

Expected Result

Bitwarden should do nothing on WIkipedia forms. The login page and the create account pages can be identified by looking for &title=Special:UserLogin or &title=Special:CreateAccount. The title can also be represented in a path like https://en.wikipedia.org/wiki/Special:UserLogin or https://en.wikipedia.org/wiki/Special:CreateAccount (followed by optional parameters), but that is less common.

The details may differ on non-English Wikipedias.

example URL:

https://en.wikipedia.org/w/index.php?returnto=Main+Page&title=Special:UserLogin&centralAuthAutologinTried=1&centralAuthError=Not+centrally+logged+in

Actual Result

See attached screenshot.

Screenshots or Videos

Additional Context

No response

Operating System

macOS

Operating System Version

No response

Web Browser

Chrome

Browser Version

No response

Build Version

2024.2.1

Issue Tracking Info

[X] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

SergeantConfused commented 3 months ago

Hi @77vjdplu1N2h,

Thank you for your report. I was able to reproduce this behaviour and have flagged it to our Engineering team. As a side note, with regard to "why can't this be disabled globally", you can deactivate Inline Auto-Fill via the Settings > Auto-Fill menu; Then, you'd be able to use the keyboard shortcuts and/or the context menu to perform Auto-Fill.

If you'd like to be able to deactivate all Auto-Fill functions completely only for certain URLs, please feel free to submit that as a feature request in the Bitwarden Community.

If you wish to add any further information, such as screenshots or screen recordings, please feel free to do so at any time - our Engineering team will be happy to review them.

Thank you again,

77vjdplu1N2h commented 3 months ago

deactivate Inline Auto-Fill via the Settings > Auto-Fill menu

Thank you for flagging the issue and for the explanation. I was expecting to find that under the Options menu.

pmusiala commented 3 months ago

Hey I looked into this issue. Please note I'm noob here and I could be totally wrong.

I assumed the issue here is caused by input label that contains "username" word. I checked the behaviour:

turn off autofilling
change label in the wikipedia html
turn on autfilling

I also found this code which tries to fuzzy find by username keyword when other options to guess autofill field failed. https://github.com/bitwarden/clients/blob/d6fa7a4e467a96fa1296c5077ee818aa4f94fd58/apps/browser/src/autofill/services/autofill.service.ts#L699

TBH I dont have any idea how to sort it out. I would even say that this is expected behaviour here

bitwarden / clients