Potential security issue in conjunction with script.extendedinfo?

[m4tt075]

I have installed the Amazon Prime Video Addon and your Prime Music Addon today. I have to admit that I don't know which one causes the issue but would like to ask you to double-check, please.

What happens is very simple: When I typed in my Amazon password extendedinfo's autocomplete function looks for matches at google. There are two problems with this: 1) Password fragments or even the full password are sent to google. 2) The password appear as clear text under /userdata/addon_data/script.extendedinfo/Google/[RANDOM STRING].txt. I have contacted @phil65 via the Kodi forum. Apparently extendedinfo checks for system.HasHiddenInput. If set properly, AutoCompletion won´t trigger for password input.

Could you please check whether this issue exists for your plugin and fix it if necessary?

[phil65]

Just for info, that functionality is not related to ExtendedInfo script anymore, but to plugin.program.autocompletion + script.module.autocompletion.

[phil65]

hmm apparently the script hosted here does it correctly: https://github.com/pitpompej/kodi_plugins/blob/master/plugin.audio.prime_music/default.py#L434 @m4tt075 Could you post some more info like kodi version, addon-versions etc?

[m4tt075]

@phil65 Thanks a lot for following up! I'm using OE 6.0.1 EGL build (as formerly provided by fritsch, now Matt Devo) script.extendedinfo = 3.1.3 I neither find plugin.program.autocompletion nor script.module.autocompletion in my addon folder, but please redirect me if I should be looking at the wrong place. The video add-on I installed is in sandmann79's repo here on github. But have not been able to create an issue there. Seems to be disabled. Please let me know if you should need anything else, ok?

[phil65]

Which Kodi version is that? 16.0 ? Or something older?

[m4tt075]

15.2 EGL

[pitpompej]

The credentials input is shown and executed before the browser for the credentials form input is even instantiated https://github.com/pitpompej/kodi_plugins/blob/master/plugin.audio.prime_music/default.py#L438 and as already shown by phil65 is the password input marked with the hidden input flag. After that the already stored input is inserted into the forms of the login webpage. as there is no auto-completion available in the mechanize browser itself (as far as I know) this script should not be the reason for the described behaviour.

[phil65]

I think I got the problem now. "System.HasHiddenInput" was introduced with jarvis and evaluates to false for previous kodi versions. Since this behaviour cannot get fixed at all for kodi versions < 16 I might have to get rid of AutoCompletion for those older Kodi versions completely.

[pitpompej]

Ok, thanks for that info. So as far as I see it, it is not really an issue of my script but an issue of your extendedinfo script in combination with pre kodi 16 versions. Really should be blocked in your script when using older kodi as this is a problem for all kodi wide credential inputs, I guess.

[phil65]

yep, I will just remove it completely for older versions. Thx for pointing in the right direction, @m4tt075

[m4tt075]

NP, and thank you for all those endless hours of efforts for making Kodi what it is! ;-) Closing this issue. Take care, guys...

[phil65]

https://github.com/xbmc/repo-scripts/pull/55/files