Repository navigation
Stop flagging autofill-suppressed and look-alike fields as sensitive - #89
Merged
Merged
Conversation
autocomplete=new-password alone no longer marks a field sensitive; sites use it on plain text inputs to suppress autofill. Secret names now match whole words only, so labels such as 'residual' no longer match 'cid'.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AgentTab refused to fill every text input on forms that set
autocomplete="new-password"on plain text fields to suppress browser autofill (the Azure portal does this on every input), and it flagged labels that only contained a secret word as a substring ("residual" and "incident" both contain "cid").autocomplete="new-password"alone no longer marks a field sensitive. Real new-password fields are still caught bytype="password"or a password name.current-password,one-time-code,webauthn, andcc-*autocomplete tokens; fields named for passwords, one-time codes, card data, or bank numbers.Verification: new regression test fails before and passes after;
bun run extension:checkpasses; a rebuilt extension filled an Azure portal text input that was previously refused.