rstudio / shiny

Easy interactive web applications with R
http://shiny.rstudio.com
Other
5.3k stars 1.87k forks source link

Password managers try to autofill selectInput #4086

Open stuartfn opened 3 weeks ago

stuartfn commented 3 weeks ago

System details

Browser Versions:

Output of sessionInfo():

R version 4.4.0 (2024-04-24)
Platform: aarch64-apple-darwin20
Running under: macOS Sonoma 14.5

Matrix products: default
BLAS:   /Library/Frameworks/R.framework/Versions/4.4-arm64/Resources/lib/libRblas.0.dylib
LAPACK: /Library/Frameworks/R.framework/Versions/4.4-arm64/Resources/lib/libRlapack.dylib;  LAPACK version 3.12.0

locale:
[1] en_GB.UTF-8/en_GB.UTF-8/en_GB.UTF-8/C/en_GB.UTF-8/en_GB.UTF-8

time zone: Europe/London
tzcode source: internal

attached base packages:
[1] stats     graphics  grDevices datasets  utils     methods   base

other attached packages:
[1] shiny_1.8.1.1

loaded via a namespace (and not attached):
 [1] digest_0.6.35     later_1.3.2       R6_2.5.1          httpuv_1.6.15
 [5] fastmap_1.2.0     magrittr_2.0.3    htmltools_0.5.8.1 lifecycle_1.0.4
 [9] promises_1.3.0    cli_3.6.2         xtable_1.8-4      renv_1.0.7
[13] compiler_4.4.0    tools_4.4.0       mime_0.12         Rcpp_1.0.12
[17] rlang_1.1.3

Example application or steps to reproduce the problem

```R library(shiny) ui <- fluidPage( # this is the input the password manager recognises as a password field selectInput("1", "test", choices = list(a=1, b=2)) ) server <- function(input, output, session) { } shinyApp(ui, server) ``` ### Describe the problem in detail I noticed on new shiny apps my team created, our password manager software (Keeper) started recognising `selectInput` as a password field. The password manager then generates a popup to prompting to create a new password, creating an annoying experience for users. I have tested with LastPass, which does not recognise the input field or cause any issues. With some testing, this behaviour was found in shiny versions 1.8.0 through to the current version (1.8.1.1 at the time of writing). Rolling back to version 1.7.5.1 stops this behaviour. Digging a bit deeper, I found this is due to a `autocomplete="new-password"` attribute in the HTML input element; whereas this tag is `autocomplete="off"` in older versions. **Input element generated using shiny version 1.8.1.1:** ```html ``` **Input element generated using shiny version 1.7.5.1:** ```html ``` This appears to be due to the upgrade of the selectize.js shiny dependency from v0.12.4 to v0.15.2 in [shiny version 1.8.0](https://rstudio.github.io/shiny/news/index.html#shiny-180). ## Work around This problem can be solved by replacing `selectInput` with `selectizeInput` and using the `autofill_disable` plugin: ```R selectizeInput( "1", "test", choices = list(a=1, b=2), options = list( plugins=list('autofill_disable') ) ) ```
daattali commented 3 weeks ago

Looks like this was introduced to selectize in v0.13.16 as a poor "fix" to an issue, and has been properly fixed in Jan 2023 but s electize hasn't had a new release since then