Bug 116697 – Prevent autofilled password field from getting cleared with a script

• Component: DOM
• Status: RESOLVED WONTFIX

[Sergey]

Some websites contain scripts that clean up all fields in a hidden form once the form becomes visible. This produces a collision if a field in the form has been autofilled. To work around this problem, prevent scripts from cleaning up at the very least password fields that have been autofilled.

[Sergey]

Created attachment 202754 [details]
Patch

[Jessie Berlin]

Comment on attachment 202754 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=202754&action=review

> Source/WebCore/html/HTMLInputElement.cpp:1031
> +        return;

This is very clearly against specification. http://www.whatwg.org/specs/web-apps/current-work/multipage/common-input-element-attributes.html#dom-input-value

"On setting, it must set the element's value to the new value"

[Jessie Berlin]

The current behavior is correct. We should not make the change asked for by this bug.

[Sergey]

OK, can we send a request to update the specification then? Or by saying "The current behavior is correct" you mean that not only it matches the spec, but also that it is correct and logical from your personal point of view? I am not sure that allowing to erase an autofilled password is logical indeed.

[Jessie Berlin]

(In reply to comment #4)
> OK, can we send a request to update the specification then? 

No.

> Or by saying "The current behavior is correct" you mean that not only it matches the spec, but also that it is correct and logical from your personal point of view?

Yes.