tbosch / autofill-event

A polyfill to fire a change event when the browser auto fills form fields
MIT License
383 stars 51 forks source link

Input values in url security risk #37

Closed nwpray closed 4 years ago

nwpray commented 7 years ago

When using firefox on a login page, I was having an issue where it was telling me that -webkit-autofill was not a valid selector. Because it this it would crash on login submit. The security risk is that I notices that it appended the input fields and their values to the end of the url when it failed. So had I pushed this to production, the user names and passwords would have been publicly exposed in the url. Leaving the high probability that the password would get logged in numerous places. Sorry, I do not have any screens because I was more concerned about getting this out of my app for now. I will update when I have reproduced it again in a sample app I can post.