diff options
Diffstat (limited to 'toolkit/components/passwordmgr')
317 files changed, 65577 insertions, 0 deletions
diff --git a/toolkit/components/passwordmgr/.eslintrc.js b/toolkit/components/passwordmgr/.eslintrc.js new file mode 100644 index 0000000000..ddb6e4fe25 --- /dev/null +++ b/toolkit/components/passwordmgr/.eslintrc.js @@ -0,0 +1,17 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +"use strict"; + +module.exports = { + rules: { + "block-scoped-var": "error", + + // XXX Bug 1358949 - This should be reduced down - probably to 20 or to + // be removed & synced with the mozilla/recommended value. + complexity: ["error", 59], + + "no-var": "error", + }, +}; diff --git a/toolkit/components/passwordmgr/CSV.sys.mjs b/toolkit/components/passwordmgr/CSV.sys.mjs new file mode 100644 index 0000000000..ef5e78c232 --- /dev/null +++ b/toolkit/components/passwordmgr/CSV.sys.mjs @@ -0,0 +1,122 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/** + * A Class to parse CSV files + */ + +const QUOTATION_MARK = '"'; +const LINE_BREAKS = ["\r", "\n"]; +const EOL = {}; + +class ParsingFailedException extends Error { + constructor(message) { + super(message ? message : `Stopped parsing because of wrong csv format`); + } +} + +export class CSV { + /** + * Parses a csv formated string into rows split into [headerLine, parsedLines]. + * The csv string format has to follow RFC 4180, otherwise the parsing process is stopped and a ParsingFailedException is thrown, e.g.: + * (wrong format => right format): + * 'abc"def' => 'abc""def' + * abc,def => "abc,def" + * + * @param {string} text + * @param {string} delimiter a comma for CSV files and a tab for TSV files + * @returns {Array[]} headerLine: column names (first line of text), parsedLines: Array of Login Objects with column name as properties and login data as values. + */ + static parse(text, delimiter) { + let headerline = []; + let parsedLines = []; + + for (let row of this.mapValuesToRows(this.readCSV(text, delimiter))) { + if (!headerline.length) { + headerline = row; + } else { + let login = {}; + row.forEach((attr, i) => (login[headerline[i]] = attr)); + parsedLines.push(login); + } + } + return [headerline, parsedLines]; + } + static *readCSV(text, delimiter) { + function maySkipMultipleLineBreaks() { + while (LINE_BREAKS.includes(text[current])) { + current++; + } + } + function readUntilSingleQuote() { + const start = ++current; + while (current < text.length) { + if (text[current] === QUOTATION_MARK) { + if (text[current + 1] !== QUOTATION_MARK) { + const result = text.slice(start, current).replaceAll('""', '"'); + current++; + return result; + } + current++; + } + current++; + } + throw new ParsingFailedException(); + } + function readUntilDelimiterOrNewLine() { + const start = current; + while (current < text.length) { + if (text[current] === delimiter) { + const result = text.slice(start, current); + current++; + return result; + } else if (LINE_BREAKS.includes(text[current])) { + const result = text.slice(start, current); + return result; + } + current++; + } + return text.slice(start); + } + let current = 0; + maySkipMultipleLineBreaks(); + + while (current < text.length) { + if (LINE_BREAKS.includes(text[current])) { + maySkipMultipleLineBreaks(); + yield EOL; + } + + let quotedValue = ""; + let value = ""; + + if (text[current] === QUOTATION_MARK) { + quotedValue = readUntilSingleQuote(); + } + + value = readUntilDelimiterOrNewLine(); + + if (quotedValue && value) { + throw new ParsingFailedException(); + } + + yield quotedValue ? quotedValue : value; + } + } + + static *mapValuesToRows(values) { + let row = []; + for (const value of values) { + if (value === EOL) { + yield row; + row = []; + } else { + row.push(value); + } + } + if (!(row.length === 1 && row[0] === "") && row.length) { + yield row; + } + } +} diff --git a/toolkit/components/passwordmgr/FirefoxRelay.sys.mjs b/toolkit/components/passwordmgr/FirefoxRelay.sys.mjs new file mode 100644 index 0000000000..efff478eeb --- /dev/null +++ b/toolkit/components/passwordmgr/FirefoxRelay.sys.mjs @@ -0,0 +1,662 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +import { FirefoxRelayTelemetry } from "resource://gre/modules/FirefoxRelayTelemetry.mjs"; +import { + LoginHelper, + OptInFeature, + ParentAutocompleteOption, +} from "resource://gre/modules/LoginHelper.sys.mjs"; +import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs"; + +import { TelemetryUtils } from "resource://gre/modules/TelemetryUtils.sys.mjs"; + +const lazy = {}; + +// Static configuration +const gConfig = (function () { + const baseUrl = Services.prefs.getStringPref( + "signon.firefoxRelay.base_url", + undefined + ); + return { + scope: ["https://identity.mozilla.com/apps/relay"], + addressesUrl: baseUrl + `relayaddresses/`, + profilesUrl: baseUrl + `profiles/`, + learnMoreURL: Services.urlFormatter.formatURLPref( + "signon.firefoxRelay.learn_more_url" + ), + manageURL: Services.urlFormatter.formatURLPref( + "signon.firefoxRelay.manage_url" + ), + relayFeaturePref: "signon.firefoxRelay.feature", + termsOfServiceUrl: Services.urlFormatter.formatURLPref( + "signon.firefoxRelay.terms_of_service_url" + ), + privacyPolicyUrl: Services.urlFormatter.formatURLPref( + "signon.firefoxRelay.privacy_policy_url" + ), + }; +})(); + +XPCOMUtils.defineLazyGetter(lazy, "log", () => + LoginHelper.createLogger("FirefoxRelay") +); +XPCOMUtils.defineLazyGetter(lazy, "fxAccounts", () => + ChromeUtils.importESModule( + "resource://gre/modules/FxAccounts.sys.mjs" + ).getFxAccountsSingleton() +); +XPCOMUtils.defineLazyGetter(lazy, "strings", function () { + return new Localization([ + "branding/brand.ftl", + "browser/firefoxRelay.ftl", + "toolkit/branding/accounts.ftl", + "toolkit/branding/brandings.ftl", + ]); +}); + +if (Services.appinfo.processType !== Services.appinfo.PROCESS_TYPE_DEFAULT) { + throw new Error("FirefoxRelay.sys.mjs should only run in the parent process"); +} + +async function getRelayTokenAsync() { + try { + return await lazy.fxAccounts.getOAuthToken({ scope: gConfig.scope }); + } catch (e) { + console.error(`There was an error getting the user's token: ${e.message}`); + return undefined; + } +} + +async function hasFirefoxAccountAsync() { + if (!lazy.fxAccounts.constructor.config.isProductionConfig()) { + return false; + } + + return lazy.fxAccounts.hasLocalSession(); +} + +async function fetchWithReauth( + browser, + createRequest, + canGetFreshOAuthToken = true +) { + const relayToken = await getRelayTokenAsync(); + if (!relayToken) { + if (browser) { + await showErrorAsync(browser, "firefox-relay-must-login-to-fxa"); + } + return undefined; + } + + const headers = new Headers({ + Authorization: `Bearer ${relayToken}`, + Accept: "application/json", + "Accept-Language": Services.locale.requestedLocales, + "Content-Type": "application/json", + }); + + const request = createRequest(headers); + const response = await fetch(request); + + if (canGetFreshOAuthToken && response.status == 401) { + await lazy.fxAccounts.removeCachedOAuthToken({ token: relayToken }); + return fetchWithReauth(browser, createRequest, false); + } + return response; +} + +async function isRelayUserAsync() { + if (!(await hasFirefoxAccountAsync())) { + return false; + } + + const response = await fetchWithReauth( + null, + headers => new Request(gConfig.profilesUrl, { headers }) + ); + if (!response) { + return false; + } + + if (!response.ok) { + lazy.log.error( + `failed to check if user is a Relay user: ${response.status}:${ + response.statusText + }:${await response.text()}` + ); + } + + return response.ok; +} + +async function getReusableMasksAsync(browser, _origin) { + const response = await fetchWithReauth( + browser, + headers => + new Request(gConfig.addressesUrl, { + method: "GET", + headers, + }) + ); + + if (!response) { + // fetchWithReauth only returns undefined if login / obtaining a token failed. + // Otherwise, it will return a response object. + return [undefined, RelayFeature.AUTH_TOKEN_ERROR_CODE]; + } + + if (response.ok) { + return [await response.json(), response.status]; + } + + lazy.log.error( + `failed to find reusable Relay masks: ${response.status}:${response.statusText}` + ); + await showErrorAsync(browser, "firefox-relay-get-reusable-masks-failed", { + status: response.status, + }); + + return [undefined, response.status]; +} + +/** + * Show confirmation tooltip + * @param browser + * @param messageId message ID from browser/browser.properties + */ +function showConfirmation(browser, messageId) { + const anchor = browser.ownerDocument.getElementById("identity-icon"); + anchor.ownerGlobal.ConfirmationHint.show(anchor, messageId, {}); +} + +/** + * Show localized notification. + * @param browser + * @param messageId messageId from browser/firefoxRelay.ftl + * @param messageArgs + */ +async function showErrorAsync(browser, messageId, messageArgs) { + const { PopupNotifications } = browser.ownerGlobal.wrappedJSObject; + const [message] = await lazy.strings.formatValues([ + { id: messageId, args: messageArgs }, + ]); + PopupNotifications.show( + browser, + "relay-integration-error", + message, + "password-notification-icon", + null, + null, + { + autofocus: true, + removeOnDismissal: true, + popupIconURL: "page-icon:https://relay.firefox.com", + learnMoreURL: gConfig.learnMoreURL, + } + ); +} + +function customizeNotificationHeader(notification) { + const document = notification.owner.panel.ownerDocument; + const description = document.querySelector( + `description[popupid=${notification.id}]` + ); + const headerTemplate = document.getElementById("firefox-relay-header"); + description.replaceChildren(headerTemplate.firstChild.cloneNode(true)); +} + +async function formatMessages(...ids) { + for (let i in ids) { + if (typeof ids[i] == "string") { + ids[i] = { id: ids[i] }; + } + } + + const messages = await lazy.strings.formatMessages(ids); + return messages.map(message => { + if (message.attributes) { + return message.attributes.reduce( + (result, { name, value }) => ({ ...result, [name]: value }), + {} + ); + } + return message.value; + }); +} + +async function showReusableMasksAsync(browser, origin, error) { + const [reusableMasks, status] = await getReusableMasksAsync(browser, origin); + if (!reusableMasks) { + FirefoxRelayTelemetry.recordRelayReusePanelEvent( + "shown", + FirefoxRelay.flowId, + status + ); + return null; + } + + let fillUsername; + const fillUsernamePromise = new Promise(resolve => (fillUsername = resolve)); + const [getUnlimitedMasksStrings] = await formatMessages( + "firefox-relay-get-unlimited-masks" + ); + const getUnlimitedMasks = { + label: getUnlimitedMasksStrings.label, + accessKey: getUnlimitedMasksStrings.accesskey, + dismiss: true, + async callback() { + FirefoxRelayTelemetry.recordRelayReusePanelEvent( + "get_unlimited_masks", + FirefoxRelay.flowId + ); + browser.ownerGlobal.openWebLinkIn(gConfig.manageURL, "tab"); + }, + }; + + let notification; + + function getReusableMasksList() { + return notification.owner.panel.getElementsByClassName( + "reusable-relay-masks" + )[0]; + } + + function notificationShown() { + customizeNotificationHeader(notification); + + notification.owner.panel.getElementsByClassName( + "error-message" + )[0].textContent = error.detail || ""; + + // rebuild "reuse mask" buttons list + const list = getReusableMasksList(); + list.innerHTML = ""; + + const document = list.ownerDocument; + const fragment = document.createDocumentFragment(); + reusableMasks + .filter(mask => mask.enabled) + .forEach(mask => { + const button = document.createElement("button"); + + const maskFullAddress = document.createElement("span"); + maskFullAddress.textContent = mask.full_address; + button.appendChild(maskFullAddress); + + const maskDescription = document.createElement("span"); + maskDescription.textContent = + mask.description || mask.generated_for || mask.used_on; + button.appendChild(maskDescription); + + button.addEventListener("click", () => { + notification.remove(); + lazy.log.info("Reusing Relay mask"); + fillUsername(mask.full_address); + showConfirmation( + browser, + "confirmation-hint-firefox-relay-mask-reused" + ); + FirefoxRelayTelemetry.recordRelayReusePanelEvent( + "reuse_mask", + FirefoxRelay.flowId + ); + }); + fragment.appendChild(button); + }); + list.appendChild(fragment); + } + + function notificationRemoved() { + const list = getReusableMasksList(); + list.innerHTML = ""; + } + + function onNotificationEvent(event) { + switch (event) { + case "removed": + notificationRemoved(); + break; + case "shown": + notificationShown(); + FirefoxRelayTelemetry.recordRelayReusePanelEvent( + "shown", + FirefoxRelay.flowId + ); + break; + } + } + + const { PopupNotifications } = browser.ownerGlobal.wrappedJSObject; + notification = PopupNotifications.show( + browser, + "relay-integration-reuse-masks", + "", // content is provided after popup shown + "password-notification-icon", + getUnlimitedMasks, + [], + { + autofocus: true, + removeOnDismissal: true, + eventCallback: onNotificationEvent, + } + ); + + return fillUsernamePromise; +} + +async function generateUsernameAsync(browser, origin) { + const body = JSON.stringify({ + enabled: true, + description: origin.substr(0, 64), + generated_for: origin.substr(0, 255), + used_on: origin, + }); + + const response = await fetchWithReauth( + browser, + headers => + new Request(gConfig.addressesUrl, { + method: "POST", + headers, + body, + }) + ); + + if (!response) { + FirefoxRelayTelemetry.recordRelayUsernameFilledEvent( + "shown", + FirefoxRelay.flowId, + RelayFeature.AUTH_TOKEN_ERROR_CODE + ); + return undefined; + } + + if (response.ok) { + lazy.log.info(`generated Relay mask`); + const result = await response.json(); + showConfirmation(browser, "confirmation-hint-firefox-relay-mask-created"); + return result.full_address; + } + + if (response.status == 403) { + const error = await response.json(); + if (error?.error_code == "free_tier_limit") { + FirefoxRelayTelemetry.recordRelayUsernameFilledEvent( + "shown", + FirefoxRelay.flowId, + error?.error_code + ); + return showReusableMasksAsync(browser, origin, error); + } + } + + lazy.log.error( + `failed to generate Relay mask: ${response.status}:${response.statusText}` + ); + + await showErrorAsync(browser, "firefox-relay-mask-generation-failed", { + status: response.status, + }); + + FirefoxRelayTelemetry.recordRelayReusePanelEvent( + "shown", + FirefoxRelay.flowId, + response.status + ); + + return undefined; +} + +function isSignup(scenarioName) { + return scenarioName == "SignUpFormScenario"; +} + +class RelayOffered { + #isRelayUser; + + async *autocompleteItemsAsync(_origin, scenarioName, hasInput) { + if ( + !hasInput && + isSignup(scenarioName) && + !Services.prefs.prefIsLocked("signon.firefoxRelay.feature") + ) { + if (this.#isRelayUser === undefined) { + this.#isRelayUser = await isRelayUserAsync(); + } + + if (this.#isRelayUser) { + const [title, subtitle] = await formatMessages( + "firefox-relay-opt-in-title-1", + "firefox-relay-opt-in-subtitle-1" + ); + yield new ParentAutocompleteOption( + "page-icon:https://relay.firefox.com", + title, + subtitle, + "PasswordManager:offerRelayIntegration", + { + telemetry: { + flowId: FirefoxRelay.flowId, + isRelayUser: this.#isRelayUser, + scenarioName, + }, + } + ); + FirefoxRelayTelemetry.recordRelayOfferedEvent( + "shown", + FirefoxRelay.flowId, + scenarioName, + this.#isRelayUser + ); + } + } + } + + async offerRelayIntegration(feature, browser, origin) { + const fxaUser = await lazy.fxAccounts.getSignedInUser(); + + if (!fxaUser) { + return null; + } + const { PopupNotifications } = browser.ownerGlobal.wrappedJSObject; + let fillUsername; + const fillUsernamePromise = new Promise( + resolve => (fillUsername = resolve) + ); + const [enableStrings, disableStrings, postponeStrings] = + await formatMessages( + "firefox-relay-opt-in-confirmation-enable-button", + "firefox-relay-opt-in-confirmation-disable", + "firefox-relay-opt-in-confirmation-postpone" + ); + const enableIntegration = { + label: enableStrings.label, + accessKey: enableStrings.accesskey, + dismiss: true, + async callback() { + lazy.log.info("user opted in to Firefox Relay integration"); + feature.markAsEnabled(); + FirefoxRelayTelemetry.recordRelayOptInPanelEvent( + "enabled", + FirefoxRelay.flowId + ); + fillUsername(await generateUsernameAsync(browser, origin)); + }, + }; + const postpone = { + label: postponeStrings.label, + accessKey: postponeStrings.accesskey, + dismiss: true, + callback() { + lazy.log.info( + "user decided not to decide about Firefox Relay integration" + ); + feature.markAsOffered(); + FirefoxRelayTelemetry.recordRelayOptInPanelEvent( + "postponed", + FirefoxRelay.flowId + ); + }, + }; + const disableIntegration = { + label: disableStrings.label, + accessKey: disableStrings.accesskey, + dismiss: true, + callback() { + lazy.log.info("user opted out from Firefox Relay integration"); + feature.markAsDisabled(); + FirefoxRelayTelemetry.recordRelayOptInPanelEvent( + "disabled", + FirefoxRelay.flowId + ); + }, + }; + let notification; + feature.markAsOffered(); + notification = PopupNotifications.show( + browser, + "relay-integration-offer", + "", // content is provided after popup shown + "password-notification-icon", + enableIntegration, + [postpone, disableIntegration], + { + autofocus: true, + removeOnDismissal: true, + learnMoreURL: gConfig.learnMoreURL, + eventCallback: event => { + switch (event) { + case "shown": + customizeNotificationHeader(notification); + const document = notification.owner.panel.ownerDocument; + const tosLink = document.getElementById( + "firefox-relay-offer-tos-url" + ); + tosLink.href = gConfig.termsOfServiceUrl; + const privacyLink = document.getElementById( + "firefox-relay-offer-privacy-url" + ); + privacyLink.href = gConfig.privacyPolicyUrl; + const content = document.querySelector( + `popupnotification[id=${notification.id}-notification] popupnotificationcontent` + ); + const line3 = content.querySelector( + "[id=firefox-relay-offer-what-relay-provides]" + ); + document.l10n.setAttributes( + line3, + "firefox-relay-offer-what-relay-provides", + { + useremail: fxaUser.email, + } + ); + FirefoxRelayTelemetry.recordRelayOptInPanelEvent( + "shown", + FirefoxRelay.flowId + ); + break; + } + }, + } + ); + + return fillUsernamePromise; + } +} + +class RelayEnabled { + async *autocompleteItemsAsync(origin, scenarioName, hasInput) { + if ( + !hasInput && + isSignup(scenarioName) && + (await hasFirefoxAccountAsync()) + ) { + const [title] = await formatMessages("firefox-relay-use-mask-title"); + yield new ParentAutocompleteOption( + "page-icon:https://relay.firefox.com", + title, + "", // when the user has opted-in, there is no subtitle content + "PasswordManager:generateRelayUsername", + { + telemetry: { + flowId: FirefoxRelay.flowId, + }, + } + ); + FirefoxRelayTelemetry.recordRelayUsernameFilledEvent( + "shown", + FirefoxRelay.flowId + ); + } + } + + async generateUsername(browser, origin) { + return generateUsernameAsync(browser, origin); + } +} + +class RelayDisabled {} + +class RelayFeature extends OptInFeature { + // Using 418 to avoid conflict with other standard http error code + static AUTH_TOKEN_ERROR_CODE = 418; + + constructor() { + super(RelayOffered, RelayEnabled, RelayDisabled, gConfig.relayFeaturePref); + Services.telemetry.setEventRecordingEnabled("relay_integration", true); + // Update the config when the signon.firefoxRelay.base_url pref is changed. + // This is added mainly for tests. + Services.prefs.addObserver( + "signon.firefoxRelay.base_url", + this.updateConfig + ); + } + + get learnMoreUrl() { + return gConfig.learnMoreURL; + } + + updateConfig() { + const newBaseUrl = Services.prefs.getStringPref( + "signon.firefoxRelay.base_url" + ); + gConfig.addressesUrl = newBaseUrl + `relayaddresses/`; + gConfig.profilesUrl = newBaseUrl + `profiles/`; + } + + async autocompleteItemsAsync({ origin, scenarioName, hasInput }) { + const result = []; + + // Generate a flowID to unique identify a series of user action. FlowId + // allows us to link users' interaction on different UI component (Ex. autocomplete, notification) + // We can use flowID to build the Funnel Diagram + // This value need to always be regenerated in the entry point of an user + // action so we overwrite the previous one. + this.flowId = TelemetryUtils.generateUUID(); + + if (this.implementation.autocompleteItemsAsync) { + for await (const item of this.implementation.autocompleteItemsAsync( + origin, + scenarioName, + hasInput + )) { + result.push(item); + } + } + + return result; + } + + async generateUsername(browser, origin) { + return this.implementation.generateUsername?.(browser, origin); + } + + async offerRelayIntegration(browser, origin) { + return this.implementation.offerRelayIntegration?.(this, browser, origin); + } +} + +export const FirefoxRelay = new RelayFeature(); diff --git a/toolkit/components/passwordmgr/FirefoxRelayTelemetry.mjs b/toolkit/components/passwordmgr/FirefoxRelayTelemetry.mjs new file mode 100644 index 0000000000..96ad487b0d --- /dev/null +++ b/toolkit/components/passwordmgr/FirefoxRelayTelemetry.mjs @@ -0,0 +1,74 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +export const FirefoxRelayTelemetry = { + recordRelayIntegrationTelemetryEvent( + eventObject, + eventMethod, + eventFlowId, + eventExtras + ) { + Services.telemetry.recordEvent( + "relay_integration", + eventMethod, + eventObject, + eventFlowId ?? "", + eventExtras ?? {} + ); + }, + + recordRelayPrefEvent(eventMethod, eventFlowId, eventExtras) { + this.recordRelayIntegrationTelemetryEvent( + "pref_change", + eventMethod, + eventFlowId, + eventExtras + ); + }, + + recordRelayOfferedEvent(eventMethod, eventFlowId, scenarioName, isRelayUser) { + return this.recordRelayIntegrationTelemetryEvent( + "offer_relay", + eventMethod, + eventFlowId, + { + scenario: scenarioName, + is_relay_user: (isRelayUser ?? "") + "", + } + ); + }, + + recordRelayUsernameFilledEvent(eventMethod, eventFlowId, errorCode = 0) { + return this.recordRelayIntegrationTelemetryEvent( + "fill_username", + eventMethod, + eventFlowId, + { + error_code: errorCode + "", + } + ); + }, + + recordRelayReusePanelEvent(eventMethod, eventFlowId, errorCode = 0) { + return this.recordRelayIntegrationTelemetryEvent( + "reuse_panel", + eventMethod, + eventFlowId, + { + error_code: errorCode + "", + } + ); + }, + + recordRelayOptInPanelEvent(eventMethod, eventFlowId, eventExtras) { + return this.recordRelayIntegrationTelemetryEvent( + "opt_in_panel", + eventMethod, + eventFlowId, + eventExtras + ); + }, +}; + +export default FirefoxRelayTelemetry; diff --git a/toolkit/components/passwordmgr/InsecurePasswordUtils.sys.mjs b/toolkit/components/passwordmgr/InsecurePasswordUtils.sys.mjs new file mode 100644 index 0000000000..05c7eda457 --- /dev/null +++ b/toolkit/components/passwordmgr/InsecurePasswordUtils.sys.mjs @@ -0,0 +1,214 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* ownerGlobal doesn't exist in content privileged windows. */ +/* eslint-disable mozilla/use-ownerGlobal */ + +const STRINGS_URI = "chrome://global/locale/security/security.properties"; + +import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs"; + +const lazy = {}; + +ChromeUtils.defineESModuleGetters(lazy, { + LoginHelper: "resource://gre/modules/LoginHelper.sys.mjs", +}); + +XPCOMUtils.defineLazyGetter(lazy, "log", () => { + return lazy.LoginHelper.createLogger("InsecurePasswordUtils"); +}); + +/* + * A module that provides utility functions for form security. + * + */ +export const InsecurePasswordUtils = { + _formRootsWarned: new WeakMap(), + + /** + * Gets the ID of the inner window of this DOM window. + * + * @param nsIDOMWindow window + * @return integer + * Inner ID for the given window. + */ + _getInnerWindowId(window) { + return window.windowGlobalChild.innerWindowId; + }, + + _sendWebConsoleMessage(messageTag, domDoc) { + let windowId = this._getInnerWindowId(domDoc.defaultView); + let category = "Insecure Password Field"; + // All web console messages are warnings for now. + let flag = Ci.nsIScriptError.warningFlag; + let bundle = Services.strings.createBundle(STRINGS_URI); + let message = bundle.GetStringFromName(messageTag); + let consoleMsg = Cc["@mozilla.org/scripterror;1"].createInstance( + Ci.nsIScriptError + ); + consoleMsg.initWithWindowID( + message, + domDoc.location.href, + 0, + 0, + 0, + flag, + category, + windowId + ); + + Services.console.logMessage(consoleMsg); + }, + + /** + * Gets the security state of the passed form. + * + * @param {FormLike} aForm A form-like object. @See {FormLikeFactory} + * + * @returns {Object} An object with the following boolean values: + * isFormSubmitHTTP: if the submit action is an http:// URL + * isFormSubmitSecure: if the submit action URL is secure, + * either because it is HTTPS or because its origin is considered trustworthy + */ + _checkFormSecurity(aForm) { + let isFormSubmitHTTP = false, + isFormSubmitSecure = false; + if (HTMLFormElement.isInstance(aForm.rootElement)) { + let uri = Services.io.newURI( + aForm.rootElement.action || aForm.rootElement.baseURI + ); + let principal = Services.scriptSecurityManager.createContentPrincipal( + uri, + {} + ); + + if (uri.schemeIs("http")) { + isFormSubmitHTTP = true; + if ( + principal.isOriginPotentiallyTrustworthy || + // Ignore sites with local IP addresses pointing to local forms. + (this._isPrincipalForLocalIPAddress( + aForm.rootElement.nodePrincipal + ) && + this._isPrincipalForLocalIPAddress(principal)) + ) { + isFormSubmitSecure = true; + } + } else { + isFormSubmitSecure = true; + } + } + + return { isFormSubmitHTTP, isFormSubmitSecure }; + }, + + _isPrincipalForLocalIPAddress(aPrincipal) { + let res = aPrincipal.isLocalIpAddress; + if (res) { + lazy.log.debug( + "hasInsecureLoginForms: detected local IP address:", + aPrincipal.asciispec + ); + } + return res; + }, + + /**s + * Checks if there are insecure password fields present on the form's document + * i.e. passwords inside forms with http action, inside iframes with http src, + * or on insecure web pages. + * + * @param {FormLike} aForm A form-like object. @See {LoginFormFactory} + * @return {boolean} whether the form is secure + */ + isFormSecure(aForm) { + let isSafePage = aForm.ownerDocument.defaultView.isSecureContext; + + // Ignore insecure documents with URLs that are local IP addresses. + // This is done because the vast majority of routers and other devices + // on the network do not use HTTPS, making this warning show up almost + // constantly on local connections, which annoys users and hurts our cause. + if (!isSafePage && this._ignoreLocalIPAddress) { + let isLocalIP = this._isPrincipalForLocalIPAddress( + aForm.rootElement.nodePrincipal + ); + + let topIsLocalIP = + aForm.ownerDocument.defaultView.windowGlobalChild.windowContext + .topWindowContext.isLocalIP; + + // Only consider the page safe if the top window has a local IP address + // and, if this is an iframe, the iframe also has a local IP address. + if (isLocalIP && topIsLocalIP) { + isSafePage = true; + } + } + + let { isFormSubmitSecure, isFormSubmitHTTP } = + this._checkFormSecurity(aForm); + + return isSafePage && (isFormSubmitSecure || !isFormSubmitHTTP); + }, + + /** + * Report insecure password fields in a form to the web console to warn developers. + * + * @param {FormLike} aForm A form-like object. @See {FormLikeFactory} + */ + reportInsecurePasswords(aForm) { + if ( + this._formRootsWarned.has(aForm.rootElement) || + this._formRootsWarned.get(aForm.rootElement) + ) { + return; + } + + let domDoc = aForm.ownerDocument; + let isSafePage = domDoc.defaultView.isSecureContext; + + let { isFormSubmitHTTP, isFormSubmitSecure } = + this._checkFormSecurity(aForm); + + if (!isSafePage) { + if (domDoc.defaultView == domDoc.defaultView.parent) { + this._sendWebConsoleMessage("InsecurePasswordsPresentOnPage", domDoc); + } else { + this._sendWebConsoleMessage("InsecurePasswordsPresentOnIframe", domDoc); + } + this._formRootsWarned.set(aForm.rootElement, true); + } else if (isFormSubmitHTTP && !isFormSubmitSecure) { + this._sendWebConsoleMessage("InsecureFormActionPasswordsPresent", domDoc); + this._formRootsWarned.set(aForm.rootElement, true); + } + + // The safety of a password field determined by the form action and the page protocol + let passwordSafety; + if (isSafePage) { + if (isFormSubmitSecure) { + passwordSafety = 0; + } else if (isFormSubmitHTTP) { + passwordSafety = 1; + } else { + passwordSafety = 2; + } + } else if (isFormSubmitSecure) { + passwordSafety = 3; + } else if (isFormSubmitHTTP) { + passwordSafety = 4; + } else { + passwordSafety = 5; + } + + Services.telemetry + .getHistogramById("PWMGR_LOGIN_PAGE_SAFETY") + .add(passwordSafety); + }, +}; + +XPCOMUtils.defineLazyPreferenceGetter( + InsecurePasswordUtils, + "_ignoreLocalIPAddress", + "security.insecure_field_warning.ignore_local_ip_address", + true +); diff --git a/toolkit/components/passwordmgr/LoginAutoComplete.sys.mjs b/toolkit/components/passwordmgr/LoginAutoComplete.sys.mjs new file mode 100644 index 0000000000..c487e22075 --- /dev/null +++ b/toolkit/components/passwordmgr/LoginAutoComplete.sys.mjs @@ -0,0 +1,763 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/** + * nsIAutoCompleteResult and nsILoginAutoCompleteSearch implementations for saved logins. + */ + +import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs"; +import { GenericAutocompleteItem } from "resource://gre/modules/FillHelpers.sys.mjs"; + +const lazy = {}; + +ChromeUtils.defineESModuleGetters(lazy, { + InsecurePasswordUtils: "resource://gre/modules/InsecurePasswordUtils.sys.mjs", + LoginFormFactory: "resource://gre/modules/LoginFormFactory.sys.mjs", + LoginHelper: "resource://gre/modules/LoginHelper.sys.mjs", + LoginManagerChild: "resource://gre/modules/LoginManagerChild.sys.mjs", + NewPasswordModel: "resource://gre/modules/NewPasswordModel.sys.mjs", +}); +XPCOMUtils.defineLazyServiceGetter( + lazy, + "formFillController", + "@mozilla.org/satchel/form-fill-controller;1", + Ci.nsIFormFillController +); +XPCOMUtils.defineLazyGetter(lazy, "log", () => { + return lazy.LoginHelper.createLogger("LoginAutoComplete"); +}); +XPCOMUtils.defineLazyGetter(lazy, "passwordMgrBundle", () => { + return Services.strings.createBundle( + "chrome://passwordmgr/locale/passwordmgr.properties" + ); +}); +XPCOMUtils.defineLazyGetter(lazy, "dateAndTimeFormatter", () => { + return new Services.intl.DateTimeFormat(undefined, { + dateStyle: "medium", + }); +}); + +function loginSort(formHostPort, a, b) { + let maybeHostPortA = lazy.LoginHelper.maybeGetHostPortForURL(a.origin); + let maybeHostPortB = lazy.LoginHelper.maybeGetHostPortForURL(b.origin); + if (formHostPort == maybeHostPortA && formHostPort != maybeHostPortB) { + return -1; + } + if (formHostPort != maybeHostPortA && formHostPort == maybeHostPortB) { + return 1; + } + + if (a.httpRealm !== b.httpRealm) { + // Sort HTTP auth. logins after form logins for the same origin. + if (b.httpRealm === null) { + return 1; + } + if (a.httpRealm === null) { + return -1; + } + } + + let userA = a.username.toLowerCase(); + let userB = b.username.toLowerCase(); + + if (userA < userB) { + return -1; + } + + if (userA > userB) { + return 1; + } + + return 0; +} + +function findDuplicates(loginList) { + let seen = new Set(); + let duplicates = new Set(); + for (let login of loginList) { + if (seen.has(login.username)) { + duplicates.add(login.username); + } + seen.add(login.username); + } + return duplicates; +} + +function getLocalizedString(key, ...formatArgs) { + if (formatArgs.length) { + return lazy.passwordMgrBundle.formatStringFromName(key, formatArgs); + } + return lazy.passwordMgrBundle.GetStringFromName(key); +} + +class AutocompleteItem { + constructor(style) { + this.comment = ""; + this.style = style; + this.value = ""; + } + + removeFromStorage() { + /* Do nothing by default */ + } +} + +class InsecureLoginFormAutocompleteItem extends AutocompleteItem { + constructor() { + super("insecureWarning"); + + this.label = getLocalizedString( + "insecureFieldWarningDescription2", + getLocalizedString("insecureFieldWarningLearnMore") + ); + } +} + +class LoginAutocompleteItem extends AutocompleteItem { + login; + #actor; + + constructor( + login, + hasBeenTypePassword, + duplicateUsernames, + actor, + isOriginMatched + ) { + super("loginWithOrigin"); + this.login = login.QueryInterface(Ci.nsILoginMetaInfo); + this.#actor = actor; + + const isDuplicateUsername = + login.username && duplicateUsernames.has(login.username); + + let username = login.username + ? login.username + : getLocalizedString("noUsername"); + + // If login is empty or duplicated we want to append a modification date to it. + if (!login.username || isDuplicateUsername) { + const time = lazy.dateAndTimeFormatter.format( + new Date(login.timePasswordChanged) + ); + username = getLocalizedString("loginHostAge", username, time); + } + + this.label = username; + this.value = hasBeenTypePassword ? login.password : login.username; + this.comment = JSON.stringify({ + guid: login.guid, + login, + isDuplicateUsername, + isOriginMatched, + comment: + isOriginMatched && login.httpRealm === null + ? getLocalizedString("displaySameOrigin") + : login.displayOrigin, + }); + } + + removeFromStorage() { + if (this.#actor) { + let vanilla = lazy.LoginHelper.loginToVanillaObject(this.login); + this.#actor.sendAsyncMessage("PasswordManager:removeLogin", { + login: vanilla, + }); + } else { + Services.logins.removeLogin(this.login); + } + } +} + +class GeneratedPasswordAutocompleteItem extends AutocompleteItem { + constructor(generatedPassword, willAutoSaveGeneratedPassword) { + super("generatedPassword"); + + this.label = getLocalizedString("useASecurelyGeneratedPassword"); + + this.value = generatedPassword; + + this.comment = JSON.stringify({ + generatedPassword, + willAutoSaveGeneratedPassword, + }); + } +} + +class ImportableLearnMoreAutocompleteItem extends AutocompleteItem { + constructor() { + super("importableLearnMore"); + this.comment = JSON.stringify({ + fillMessageName: "PasswordManager:OpenImportableLearnMore", + }); + } +} + +class ImportableLoginsAutocompleteItem extends AutocompleteItem { + #actor; + + constructor(browserId, hostname, actor) { + super("importableLogins"); + this.label = browserId; + this.comment = JSON.stringify({ + hostname, + fillMessageName: "PasswordManager:HandleImportable", + fillMessageData: { + browserId, + }, + }); + this.#actor = actor; + + // This is sent for every item (re)shown, but the parent will debounce to + // reduce the count by 1 total. + this.#actor.sendAsyncMessage( + "PasswordManager:decreaseSuggestImportCount", + 1 + ); + } + + removeFromStorage() { + this.#actor.sendAsyncMessage( + "PasswordManager:decreaseSuggestImportCount", + 100 + ); + } +} + +class LoginsFooterAutocompleteItem extends AutocompleteItem { + constructor(formHostname, telemetryEventData) { + super("loginsFooter"); + + this.label = getLocalizedString("viewSavedLogins.label"); + + // The comment field of `loginsFooter` results have many additional pieces of + // information for telemetry purposes. After bug 1555209, this information + // can be passed to the parent process outside of nsIAutoCompleteResult APIs + // so we won't need this hack. + this.comment = JSON.stringify({ + telemetryEventData, + formHostname, + fillMessageName: "PasswordManager:OpenPreferences", + fillMessageData: { + entryPoint: "autocomplete", + }, + }); + } +} + +// nsIAutoCompleteResult implementation +export class LoginAutoCompleteResult { + #rows = []; + + constructor( + aSearchString, + matchingLogins, + autocompleteItems, + formOrigin, + { + generatedPassword, + willAutoSaveGeneratedPassword, + importable, + isSecure, + actor, + hasBeenTypePassword, + hostname, + telemetryEventData, + } + ) { + let hidingFooterOnPWFieldAutoOpened = false; + const importableBrowsers = + importable?.state === "import" && importable?.browsers; + + function isFooterEnabled() { + // We need to check LoginHelper.enabled here since the insecure warning should + // appear even if pwmgr is disabled but the footer should never appear in that case. + if ( + !lazy.LoginHelper.showAutoCompleteFooter || + !lazy.LoginHelper.enabled + ) { + return false; + } + + // Don't show the footer on non-empty password fields as it's not providing + // value and only adding noise since a password was already filled. + if (hasBeenTypePassword && aSearchString && !generatedPassword) { + lazy.log.debug("Hiding footer: non-empty password field"); + return false; + } + + if ( + !autocompleteItems?.length && + !importableBrowsers && + !matchingLogins.length && + !generatedPassword && + hasBeenTypePassword && + lazy.formFillController.passwordPopupAutomaticallyOpened + ) { + hidingFooterOnPWFieldAutoOpened = true; + lazy.log.debug( + "Hiding footer: no logins and the popup was opened upon focus of the pw. field" + ); + return false; + } + + return true; + } + + this.searchString = aSearchString; + + // Insecure field warning comes first. + if (!isSecure) { + this.#rows.push(new InsecureLoginFormAutocompleteItem()); + } + + // Saved login items + let formHostPort = lazy.LoginHelper.maybeGetHostPortForURL(formOrigin); + let logins = matchingLogins.sort(loginSort.bind(null, formHostPort)); + let duplicateUsernames = findDuplicates(matchingLogins); + + for (let login of logins) { + let item = new LoginAutocompleteItem( + login, + hasBeenTypePassword, + duplicateUsernames, + actor, + lazy.LoginHelper.isOriginMatching(login.origin, formOrigin, { + schemeUpgrades: lazy.LoginHelper.schemeUpgrades, + }) + ); + this.#rows.push(item); + } + + // The footer comes last if it's enabled + if (isFooterEnabled()) { + if (autocompleteItems) { + this.#rows.push( + ...autocompleteItems.map( + item => + new GenericAutocompleteItem( + item.icon, + item.title, + item.subtitle, + item.fillMessageName, + item.fillMessageData + ) + ) + ); + } + + if (generatedPassword) { + this.#rows.push( + new GeneratedPasswordAutocompleteItem( + generatedPassword, + willAutoSaveGeneratedPassword + ) + ); + } + + // Suggest importing logins if there are none found. + if (!logins.length && importableBrowsers) { + this.#rows.push( + ...importableBrowsers.map( + browserId => + new ImportableLoginsAutocompleteItem(browserId, hostname, actor) + ) + ); + this.#rows.push(new ImportableLearnMoreAutocompleteItem()); + } + + // If we have anything in autocomplete, then add "View Saved Logins" + this.#rows.push( + new LoginsFooterAutocompleteItem(hostname, telemetryEventData) + ); + } + + // Determine the result code and default index. + if (this.matchCount > 0) { + this.searchResult = Ci.nsIAutoCompleteResult.RESULT_SUCCESS; + this.defaultIndex = 0; + } else if (hidingFooterOnPWFieldAutoOpened) { + // We use a failure result so that the empty results aren't re-used for when + // the user tries to manually open the popup (we want the footer in that case). + this.searchResult = Ci.nsIAutoCompleteResult.RESULT_FAILURE; + this.defaultIndex = -1; + } + } + + QueryInterface = ChromeUtils.generateQI([ + "nsIAutoCompleteResult", + "nsISupportsWeakReference", + ]); + + /** + * Accessed via .wrappedJSObject + * @private + */ + get logins() { + return this.#rows + .filter(item => item instanceof LoginAutocompleteItem) + .map(item => item.login); + } + + // Allow autoCompleteSearch to get at the JS object so it can + // modify some readonly properties for internal use. + get wrappedJSObject() { + return this; + } + + // Interfaces from idl... + searchString = null; + searchResult = Ci.nsIAutoCompleteResult.RESULT_NOMATCH; + defaultIndex = -1; + errorDescription = ""; + + get matchCount() { + return this.#rows.length; + } + + #throwOnBadIndex(index) { + if (index < 0 || index >= this.matchCount) { + throw new Error("Index out of range."); + } + } + + getValueAt(index) { + this.#throwOnBadIndex(index); + return this.#rows[index].value; + } + + getLabelAt(index) { + this.#throwOnBadIndex(index); + return this.#rows[index].label; + } + + getCommentAt(index) { + this.#throwOnBadIndex(index); + return this.#rows[index].comment; + } + + getStyleAt(index) { + this.#throwOnBadIndex(index); + return this.#rows[index].style; + } + + getImageAt(index) { + this.#throwOnBadIndex(index); + return ""; + } + + getFinalCompleteValueAt(index) { + return this.getValueAt(index); + } + + isRemovableAt(index) { + this.#throwOnBadIndex(index); + return true; + } + + removeValueAt(index) { + this.#throwOnBadIndex(index); + + let [removedItem] = this.#rows.splice(index, 1); + + if (this.defaultIndex > this.#rows.length) { + this.defaultIndex--; + } + + removedItem.removeFromStorage(); + } +} + +export class LoginAutoComplete { + // HTMLInputElement to number, the element's new-password heuristic confidence score + #cachedNewPasswordScore = new WeakMap(); + #autoCompleteLookupPromise = null; + classID = Components.ID("{2bdac17c-53f1-4896-a521-682ccdeef3a8}"); + QueryInterface = ChromeUtils.generateQI(["nsILoginAutoCompleteSearch"]); + + /** + * Yuck. This is called directly by satchel: + * nsFormFillController::StartSearch() + * [toolkit/components/satchel/nsFormFillController.cpp] + * + * We really ought to have a simple way for code to register an + * auto-complete provider, and not have satchel calling pwmgr directly. + * + * @param {string} aSearchString The value typed in the field. + * @param {nsIAutoCompleteResult} aPreviousResult + * @param {HTMLInputElement} aElement + * @param {nsIFormAutoCompleteObserver} aCallback + */ + startSearch(aSearchString, aPreviousResult, aElement, aCallback) { + let { isNullPrincipal } = aElement.nodePrincipal; + if ( + aElement.nodePrincipal.schemeIs("about") || + aElement.nodePrincipal.isSystemPrincipal + ) { + // Don't show autocomplete results for about: pages. + // XXX: Don't we need to call the callback here? + return; + } + + let searchStartTimeMS = Services.telemetry.msSystemNow(); + + // Show the insecure login warning in the passwords field on null principal documents. + // Avoid loading InsecurePasswordUtils.jsm in a sandboxed document (e.g. an ad. frame) if we + // already know it has a null principal and will therefore get the insecure autocomplete + // treatment. + // InsecurePasswordUtils doesn't handle the null principal case as not secure because we don't + // want the same treatment: + // * The web console warnings will be confusing (as they're primarily about http:) and not very + // useful if the developer intentionally sandboxed the document. + // * The site identity insecure field warning would require LoginManagerChild being loaded and + // listening to some of the DOM events we're ignoring in null principal documents. For memory + // reasons it's better to not load LMC at all for these sandboxed frames. Also, if the top- + // document is sandboxing a document, it probably doesn't want that sandboxed document to be + // able to affect the identity icon in the address bar by adding a password field. + let form = lazy.LoginFormFactory.createFromField(aElement); + let isSecure = + !isNullPrincipal && lazy.InsecurePasswordUtils.isFormSecure(form); + let { hasBeenTypePassword } = aElement; + let hostname = aElement.ownerDocument.documentURIObject.host; + let formOrigin = lazy.LoginHelper.getLoginOrigin( + aElement.ownerDocument.documentURI + ); + let loginManagerActor = lazy.LoginManagerChild.forWindow( + aElement.ownerGlobal + ); + let completeSearch = async autoCompleteLookupPromise => { + // Assign to the member synchronously before awaiting the Promise. + this.#autoCompleteLookupPromise = autoCompleteLookupPromise; + + let { + generatedPassword, + importable, + logins, + autocompleteItems, + willAutoSaveGeneratedPassword, + } = await autoCompleteLookupPromise; + + // If the search was canceled before we got our + // results, don't bother reporting them. + // N.B. This check must occur after the `await` above for it to be + // effective. + if (this.#autoCompleteLookupPromise !== autoCompleteLookupPromise) { + lazy.log.debug("Ignoring result from previous search."); + return; + } + + let telemetryEventData = { + acFieldName: aElement.getAutocompleteInfo().fieldName, + hadPrevious: !!aPreviousResult, + typeWasPassword: aElement.hasBeenTypePassword, + fieldType: aElement.type, + searchStartTimeMS, + stringLength: aSearchString.length, + }; + + this.#autoCompleteLookupPromise = null; + let results = new LoginAutoCompleteResult( + aSearchString, + logins, + autocompleteItems, + formOrigin, + { + generatedPassword, + willAutoSaveGeneratedPassword, + importable, + actor: loginManagerActor, + isSecure, + hasBeenTypePassword, + hostname, + telemetryEventData, + } + ); + aCallback.onSearchCompletion(results); + }; + + if (isNullPrincipal) { + // Don't search login storage when the field has a null principal as we don't want to fill + // logins for the `location` in this case. + completeSearch(Promise.resolve({ logins: [] })); + return; + } + + if ( + hasBeenTypePassword && + aSearchString && + !loginManagerActor.isPasswordGenerationForcedOn(aElement) + ) { + // Return empty result on password fields with password already filled, + // unless password generation was forced. + completeSearch(Promise.resolve({ logins: [] })); + return; + } + + if (!lazy.LoginHelper.enabled) { + completeSearch(Promise.resolve({ logins: [] })); + return; + } + + let previousResult; + if (aPreviousResult) { + previousResult = { + searchString: aPreviousResult.searchString, + logins: lazy.LoginHelper.loginsToVanillaObjects( + aPreviousResult.wrappedJSObject.logins + ), + }; + } else { + previousResult = null; + } + + let acLookupPromise = this.#requestAutoCompleteResultsFromParent({ + searchString: aSearchString, + previousResult, + inputElement: aElement, + form, + hasBeenTypePassword, + }); + completeSearch(acLookupPromise).catch(lazy.log.error.bind(lazy.log)); + } + + stopSearch() { + this.#autoCompleteLookupPromise = null; + } + + async #requestAutoCompleteResultsFromParent({ + searchString, + previousResult, + inputElement, + form, + hasBeenTypePassword, + }) { + let actionOrigin = lazy.LoginHelper.getFormActionOrigin(form); + let autocompleteInfo = inputElement.getAutocompleteInfo(); + + let loginManagerActor = lazy.LoginManagerChild.forWindow( + inputElement.ownerGlobal + ); + let forcePasswordGeneration = false; + let isProbablyANewPasswordField = false; + if (hasBeenTypePassword) { + forcePasswordGeneration = + loginManagerActor.isPasswordGenerationForcedOn(inputElement); + // Run the Fathom model only if the password field does not have the + // autocomplete="new-password" attribute. + isProbablyANewPasswordField = + autocompleteInfo.fieldName == "new-password" || + this.isProbablyANewPasswordField(inputElement); + } + const scenario = loginManagerActor.getScenario(inputElement); + + if (lazy.LoginHelper.showAutoCompleteFooter) { + gAutoCompleteListener.init(); + } + + lazy.log.debug("LoginAutoComplete search:", { + forcePasswordGeneration, + hasBeenTypePassword, + isProbablyANewPasswordField, + searchStringLength: searchString.length, + }); + + const result = await loginManagerActor.sendQuery( + "PasswordManager:autoCompleteLogins", + { + actionOrigin, + searchString, + previousResult, + forcePasswordGeneration, + hasBeenTypePassword, + isProbablyANewPasswordField, + scenarioName: scenario?.constructor.name, + inputMaxLength: inputElement.maxLength, + } + ); + + return { + generatedPassword: result.generatedPassword, + importable: result.importable, + autocompleteItems: result.autocompleteItems, + logins: lazy.LoginHelper.vanillaObjectsToLogins(result.logins), + willAutoSaveGeneratedPassword: result.willAutoSaveGeneratedPassword, + }; + } + + isProbablyANewPasswordField(inputElement) { + const threshold = lazy.LoginHelper.generationConfidenceThreshold; + if (threshold == -1) { + // Fathom is disabled + return false; + } + + let score = this.#cachedNewPasswordScore.get(inputElement); + if (score) { + return score >= threshold; + } + + const { rules, type } = lazy.NewPasswordModel; + const results = rules.against(inputElement); + score = results.get(inputElement).scoreFor(type); + this.#cachedNewPasswordScore.set(inputElement, score); + return score >= threshold; + } +} + +let gAutoCompleteListener = { + added: false, + fillRequestId: 0, + + init() { + if (!this.added) { + Services.obs.addObserver(this, "autocomplete-will-enter-text"); + this.added = true; + } + }, + + async observe(subject, topic, data) { + switch (topic) { + case "autocomplete-will-enter-text": { + await this.sendFillRequestToLoginManagerParent(subject, data); + break; + } + } + }, + + async sendFillRequestToLoginManagerParent(input, comment) { + if (!comment) { + return; + } + + if (input != lazy.formFillController.controller.input) { + return; + } + + const { fillMessageName, fillMessageData } = JSON.parse(comment ?? "{}"); + if (!fillMessageName) { + return; + } + + this.fillRequestId++; + const fillRequestId = this.fillRequestId; + const child = lazy.LoginManagerChild.forWindow( + input.focusedInput.ownerGlobal + ); + const value = await child.sendQuery(fillMessageName, fillMessageData ?? {}); + + // skip fill if another fill operation started during await + if (fillRequestId != this.fillRequestId) { + return; + } + + if (typeof value !== "string") { + return; + } + + // If LoginManagerParent returned a string to fill, we must do it here because + // nsAutoCompleteController.cpp already finished it's work before we finished await. + input.textValue = value; + input.selectTextRange(value.length, value.length); + }, +}; diff --git a/toolkit/components/passwordmgr/LoginCSVImport.sys.mjs b/toolkit/components/passwordmgr/LoginCSVImport.sys.mjs new file mode 100644 index 0000000000..247ed80a3a --- /dev/null +++ b/toolkit/components/passwordmgr/LoginCSVImport.sys.mjs @@ -0,0 +1,221 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/** + * Provides a class to import login-related data CSV files. + */ + +const lazy = {}; + +ChromeUtils.defineESModuleGetters(lazy, { + CSV: "resource://gre/modules/CSV.sys.mjs", + LoginHelper: "resource://gre/modules/LoginHelper.sys.mjs", + ResponsivenessMonitor: "resource://gre/modules/ResponsivenessMonitor.sys.mjs", +}); + +/** + * All the CSV column names will be converted to lower case before lookup + * so they must be specified here in lower case. + */ +const FIELD_TO_CSV_COLUMNS = { + origin: ["url", "login_uri"], + username: ["username", "login_username"], + password: ["password", "login_password"], + httpRealm: ["httprealm"], + formActionOrigin: ["formactionorigin"], + guid: ["guid"], + timeCreated: ["timecreated"], + timeLastUsed: ["timelastused"], + timePasswordChanged: ["timepasswordchanged"], +}; + +export const ImportFailedErrorType = Object.freeze({ + CONFLICTING_VALUES_ERROR: "CONFLICTING_VALUES_ERROR", + FILE_FORMAT_ERROR: "FILE_FORMAT_ERROR", + FILE_PERMISSIONS_ERROR: "FILE_PERMISSIONS_ERROR", + UNABLE_TO_READ_ERROR: "UNABLE_TO_READ_ERROR", +}); + +export class ImportFailedException extends Error { + constructor(errorType, message) { + super(message != null ? message : errorType); + this.errorType = errorType; + } +} + +/** + * Provides an object that has a method to import login-related data CSV files + */ +export class LoginCSVImport { + /** + * Returns a map that has the csv column name as key and the value the field name. + * + * @returns {Map} A map that has the csv column name as key and the value the field name. + */ + static _getCSVColumnToFieldMap() { + let csvColumnToField = new Map(); + for (let [field, columns] of Object.entries(FIELD_TO_CSV_COLUMNS)) { + for (let column of columns) { + csvColumnToField.set(column.toLowerCase(), field); + } + } + return csvColumnToField; + } + + /** + * Builds a vanilla JS object containing all the login fields from a row of CSV cells. + * + * @param {object} csvObject + * An object created from a csv row. The keys are the csv column names, the values are the cells. + * @param {Map} csvColumnToFieldMap + * A map where the keys are the csv properties and the values are the object keys. + * @returns {object} Representing login object with only properties, not functions. + */ + static _getVanillaLoginFromCSVObject(csvObject, csvColumnToFieldMap) { + let vanillaLogin = Object.create(null); + for (let columnName of Object.keys(csvObject)) { + let fieldName = csvColumnToFieldMap.get(columnName.toLowerCase()); + if (!fieldName) { + continue; + } + + if ( + typeof vanillaLogin[fieldName] != "undefined" && + vanillaLogin[fieldName] !== csvObject[columnName] + ) { + // Differing column values map to one property. + // e.g. if two headings map to `origin` we won't know which to use. + return {}; + } + + vanillaLogin[fieldName] = csvObject[columnName]; + } + + // Since `null` can't be represented in a CSV file and the httpRealm header + // cannot be an empty string, assume that an empty httpRealm means this is + // a form login and therefore null-out httpRealm. + if (vanillaLogin.httpRealm === "") { + vanillaLogin.httpRealm = null; + } + + return vanillaLogin; + } + static _recordHistogramTelemetry(histogram, report) { + for (let reportRow of report) { + let { result } = reportRow; + if (result.includes("error")) { + histogram.add("error"); + } else { + histogram.add(result); + } + } + } + /** + * Imports logins from a CSV file (comma-separated values file). + * Existing logins may be updated in the process. + * + * @param {string} filePath + * @returns {Object[]} An array of rows where each is mapped to a row in the CSV and it's import information. + */ + static async importFromCSV(filePath) { + TelemetryStopwatch.start("PWMGR_IMPORT_LOGINS_FROM_FILE_MS"); + let responsivenessMonitor; + try { + responsivenessMonitor = new lazy.ResponsivenessMonitor(); + let csvColumnToFieldMap = LoginCSVImport._getCSVColumnToFieldMap(); + let csvFieldToColumnMap = new Map(); + + let csvString; + try { + csvString = await IOUtils.readUTF8(filePath, { encoding: "utf-8" }); + } catch (ex) { + console.error(ex); + throw new ImportFailedException( + ImportFailedErrorType.FILE_PERMISSIONS_ERROR + ); + } + let headerLine; + let parsedLines; + try { + let delimiter = filePath.toUpperCase().endsWith(".CSV") ? "," : "\t"; + [headerLine, parsedLines] = lazy.CSV.parse(csvString, delimiter); + } catch { + throw new ImportFailedException( + ImportFailedErrorType.FILE_FORMAT_ERROR + ); + } + if (parsedLines && headerLine) { + for (const columnName of headerLine) { + const fieldName = csvColumnToFieldMap.get( + columnName.toLocaleLowerCase() + ); + if (fieldName) { + if (!csvFieldToColumnMap.has(fieldName)) { + csvFieldToColumnMap.set(fieldName, columnName); + } else { + throw new ImportFailedException( + ImportFailedErrorType.CONFLICTING_VALUES_ERROR + ); + } + } + } + } + if (csvFieldToColumnMap.size === 0) { + throw new ImportFailedException( + ImportFailedErrorType.FILE_FORMAT_ERROR + ); + } + if ( + parsedLines[0] && + (!csvFieldToColumnMap.has("origin") || + !csvFieldToColumnMap.has("username") || + !csvFieldToColumnMap.has("password")) + ) { + // The username *value* can be empty but we require a username column to + // ensure that we don't import logins without their usernames due to the + // username column not being recognized. + throw new ImportFailedException( + ImportFailedErrorType.FILE_FORMAT_ERROR + ); + } + + let loginsToImport = parsedLines.map(csvObject => { + return LoginCSVImport._getVanillaLoginFromCSVObject( + csvObject, + csvColumnToFieldMap + ); + }); + + let report = await lazy.LoginHelper.maybeImportLogins(loginsToImport); + + for (const reportRow of report) { + if (reportRow.result === "error_missing_field") { + reportRow.field_name = csvFieldToColumnMap.get(reportRow.field_name); + } + } + + // Record quantity, jank, and duration telemetry. + try { + let histogram = Services.telemetry.getHistogramById( + "PWMGR_IMPORT_LOGINS_FROM_FILE_CATEGORICAL" + ); + this._recordHistogramTelemetry(histogram, report); + let accumulatedDelay = responsivenessMonitor.finish(); + Services.telemetry + .getHistogramById("PWMGR_IMPORT_LOGINS_FROM_FILE_JANK_MS") + .add(accumulatedDelay); + TelemetryStopwatch.finish("PWMGR_IMPORT_LOGINS_FROM_FILE_MS"); + } catch (ex) { + console.error(ex); + } + LoginCSVImport.lastImportReport = report; + return report; + } finally { + if (TelemetryStopwatch.running("PWMGR_IMPORT_LOGINS_FROM_FILE_MS")) { + TelemetryStopwatch.cancel("PWMGR_IMPORT_LOGINS_FROM_FILE_MS"); + } + responsivenessMonitor.abort(); + } + } +} diff --git a/toolkit/components/passwordmgr/LoginExport.sys.mjs b/toolkit/components/passwordmgr/LoginExport.sys.mjs new file mode 100644 index 0000000000..181842c3db --- /dev/null +++ b/toolkit/components/passwordmgr/LoginExport.sys.mjs @@ -0,0 +1,76 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/** + * Module to support exporting logins to a .csv file. + */ + +export class LoginExport { + /** + * Builds an array of strings representing a row in a CSV. + * + * @param {nsILoginInfo} login + * The object that will be converted into a csv row. + * @param {string[]} columns + * The CSV columns, used to find the properties from the login object. + * @returns {string[]} Representing a row. + */ + static _buildCSVRow(login, columns) { + let row = []; + for (let columnName of columns) { + let columnValue = login[columnName]; + if (typeof columnValue == "string") { + columnValue = columnValue.split('"').join('""'); + } + if (columnValue !== null && columnValue != undefined) { + row.push(`"${columnValue}"`); + } else { + row.push(""); + } + } + return row; + } + + /** + * Given a path it saves all the logins as a CSV file. + * + * @param {string} path + * The file path to save the login to. + * @param {nsILoginInfo[]} [logins = null] + * An optional list of logins. + */ + static async exportAsCSV(path, logins = null) { + if (!logins) { + logins = await Services.logins.getAllLoginsAsync(); + } + let columns = [ + "origin", + "username", + "password", + "httpRealm", + "formActionOrigin", + "guid", + "timeCreated", + "timeLastUsed", + "timePasswordChanged", + ]; + let csvHeader = columns.map(name => { + if (name == "origin") { + return '"url"'; + } + return `"${name}"`; + }); + + let rows = []; + rows.push(csvHeader); + for (let login of logins) { + rows.push(LoginExport._buildCSVRow(login, columns)); + } + // https://tools.ietf.org/html/rfc7111 suggests always using CRLF. + const csvAsString = rows.map(e => e.join(",")).join("\r\n"); + await IOUtils.writeUTF8(path, csvAsString, { + tmpPath: path + ".tmp", + }); + } +} diff --git a/toolkit/components/passwordmgr/LoginFormFactory.sys.mjs b/toolkit/components/passwordmgr/LoginFormFactory.sys.mjs new file mode 100644 index 0000000000..bea8f9305d --- /dev/null +++ b/toolkit/components/passwordmgr/LoginFormFactory.sys.mjs @@ -0,0 +1,150 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/** + * A factory to generate LoginForm objects that represent a set of login fields + * which aren't necessarily marked up with a <form> element. + */ + +import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs"; + +const lazy = {}; + +ChromeUtils.defineESModuleGetters(lazy, { + FormLikeFactory: "resource://gre/modules/FormLikeFactory.sys.mjs", + LoginHelper: "resource://gre/modules/LoginHelper.sys.mjs", +}); + +XPCOMUtils.defineLazyGetter(lazy, "log", () => { + return lazy.LoginHelper.createLogger("LoginFormFactory"); +}); + +export const LoginFormFactory = { + /** + * WeakMap of the root element of a LoginForm to the LoginForm representing its fields. + * + * This is used to be able to lookup an existing LoginForm for a given root element since multiple + * calls to LoginFormFactory.createFrom* won't give the exact same object. When batching fills we don't always + * want to use the most recent list of elements for a LoginForm since we may end up doing multiple + * fills for the same set of elements when a field gets added between arming and running the + * DeferredTask. + * + * @type {WeakMap} + */ + _loginFormsByRootElement: new WeakMap(), + + /** + * Maps all DOM content documents in this content process, including those in + * frames, to a WeakSet of LoginForm.rootElement for the document. + */ + _loginFormRootElementsByDocument: new WeakMap(), + + /** + * Create a LoginForm object from a <form>. + * + * @param {HTMLFormElement} aForm + * @return {LoginForm} + * @throws Error if aForm isn't an HTMLFormElement + */ + createFromForm(aForm) { + let formLike = lazy.FormLikeFactory.createFromForm(aForm); + formLike.action = lazy.LoginHelper.getFormActionOrigin(aForm); + + let rootElementsSet = this.getRootElementsWeakSetForDocument( + formLike.ownerDocument + ); + rootElementsSet.add(formLike.rootElement); + lazy.log.debug( + "adding", + formLike.rootElement, + "to root elements for", + formLike.ownerDocument + ); + + this._loginFormsByRootElement.set(formLike.rootElement, formLike); + return formLike; + }, + + /** + * Create a LoginForm object from a password or username field. + * + * If the field is in a <form>, construct the LoginForm from the form. + * Otherwise, create a LoginForm with a rootElement (wrapper) according to + * heuristics. Currently all <input> not in a <form> are one LoginForm but this + * shouldn't be relied upon as the heuristics may change to detect multiple + * "forms" (e.g. registration and login) on one page with a <form>. + * + * Note that two LoginForms created from the same field won't return the same LoginForm object. + * Use the `rootElement` property on the LoginForm as a key instead. + * + * @param {HTMLInputElement} aField - a password or username field in a document + * @return {LoginForm} + * @throws Error if aField isn't a password or username field in a document + */ + createFromField(aField) { + if ( + !HTMLInputElement.isInstance(aField) || + (!aField.hasBeenTypePassword && + !lazy.LoginHelper.isUsernameFieldType(aField)) || + !aField.ownerDocument + ) { + throw new Error( + "createFromField requires a password or username field in a document" + ); + } + + let form = + aField.form || + lazy.FormLikeFactory.closestFormIgnoringShadowRoots(aField); + if (form) { + return this.createFromForm(form); + } else if (aField.hasAttribute("form")) { + lazy.log.debug( + "createFromField: field has form attribute but no form: ", + aField.getAttribute("form") + ); + } + + let formLike = lazy.FormLikeFactory.createFromField(aField); + formLike.action = lazy.LoginHelper.getLoginOrigin( + aField.ownerDocument.baseURI + ); + lazy.log.debug( + "Created non-form LoginForm for rootElement:", + aField.ownerDocument.documentElement + ); + + let rootElementsSet = this.getRootElementsWeakSetForDocument( + formLike.ownerDocument + ); + rootElementsSet.add(formLike.rootElement); + lazy.log.debug( + "adding", + formLike.rootElement, + "to root elements for", + formLike.ownerDocument + ); + + this._loginFormsByRootElement.set(formLike.rootElement, formLike); + + return formLike; + }, + + getRootElementsWeakSetForDocument(aDocument) { + let rootElementsSet = this._loginFormRootElementsByDocument.get(aDocument); + if (!rootElementsSet) { + rootElementsSet = new WeakSet(); + this._loginFormRootElementsByDocument.set(aDocument, rootElementsSet); + } + return rootElementsSet; + }, + + getForRootElement(aRootElement) { + return this._loginFormsByRootElement.get(aRootElement); + }, + + setForRootElement(aRootElement, aLoginForm) { + return this._loginFormsByRootElement.set(aRootElement, aLoginForm); + }, +}; diff --git a/toolkit/components/passwordmgr/LoginHelper.sys.mjs b/toolkit/components/passwordmgr/LoginHelper.sys.mjs new file mode 100644 index 0000000000..e22f0552ce --- /dev/null +++ b/toolkit/components/passwordmgr/LoginHelper.sys.mjs @@ -0,0 +1,1891 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/** + * Contains functions shared by different Login Manager components. + * + * This JavaScript module exists in order to share code between the different + * XPCOM components that constitute the Login Manager, including implementations + * of nsILoginManager and nsILoginManagerStorage. + */ + +import { Logic } from "resource://gre/modules/LoginManager.shared.mjs"; +import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs"; + +const lazy = {}; +ChromeUtils.defineESModuleGetters(lazy, { + OSKeyStore: "resource://gre/modules/OSKeyStore.sys.mjs", +}); + +export class ParentAutocompleteOption { + icon; + title; + subtitle; + fillMessageName; + fillMessageData; + + constructor(icon, title, subtitle, fillMessageName, fillMessageData) { + this.icon = icon; + this.title = title; + this.subtitle = subtitle; + this.fillMessageName = fillMessageName; + this.fillMessageData = fillMessageData; + } +} + +/** + * A helper class to deal with CSV import rows. + */ +class ImportRowProcessor { + uniqueLoginIdentifiers = new Set(); + originToRows = new Map(); + summary = []; + mandatoryFields = ["origin", "password"]; + + /** + * Validates if the login data contains a GUID that was already found in a previous row in the current import. + * If this is the case, the summary will be updated with an error. + * @param {object} loginData + * An vanilla object for the login without any methods. + * @returns {boolean} True if there is an error, false otherwise. + */ + checkNonUniqueGuidError(loginData) { + if (loginData.guid) { + if (this.uniqueLoginIdentifiers.has(loginData.guid)) { + this.addLoginToSummary({ ...loginData }, "error"); + return true; + } + this.uniqueLoginIdentifiers.add(loginData.guid); + } + return false; + } + + /** + * Validates if the login data contains invalid fields that are mandatory like origin and password. + * If this is the case, the summary will be updated with an error. + * @param {object} loginData + * An vanilla object for the login without any methods. + * @returns {boolean} True if there is an error, false otherwise. + */ + checkMissingMandatoryFieldsError(loginData) { + loginData.origin = LoginHelper.getLoginOrigin(loginData.origin); + for (let mandatoryField of this.mandatoryFields) { + if (!loginData[mandatoryField]) { + const missingFieldRow = this.addLoginToSummary( + { ...loginData }, + "error_missing_field" + ); + missingFieldRow.field_name = mandatoryField; + return true; + } + } + return false; + } + + /** + * Validates if there is already an existing entry with similar values. + * If there are similar values but not identical, a new "modified" entry will be added to the summary. + * If there are identical values, a new "no_change" entry will be added to the summary + * If either of these is the case, it will return true. + * @param {object} loginData + * An vanilla object for the login without any methods. + * @returns {boolean} True if the entry is similar or identical to another previously processed entry, false otherwise. + */ + async checkExistingEntry(loginData) { + if (loginData.guid) { + // First check for `guid` matches if it's set. + // `guid` matches will allow every kind of update, including reverting + // to older passwords which can be useful if the user wants to recover + // an old password. + let existingLogins = await Services.logins.searchLoginsAsync({ + guid: loginData.guid, + origin: loginData.origin, // Ignored outside of GV. + }); + + if (existingLogins.length) { + lazy.log.debug("maybeImportLogins: Found existing login with GUID."); + // There should only be one `guid` match. + let existingLogin = existingLogins[0].QueryInterface( + Ci.nsILoginMetaInfo + ); + + if ( + loginData.username !== existingLogin.username || + loginData.password !== existingLogin.password || + loginData.httpRealm !== existingLogin.httpRealm || + loginData.formActionOrigin !== existingLogin.formActionOrigin || + `${loginData.timeCreated}` !== `${existingLogin.timeCreated}` || + `${loginData.timePasswordChanged}` !== + `${existingLogin.timePasswordChanged}` + ) { + // Use a property bag rather than an nsILoginInfo so we don't clobber + // properties that the import source doesn't provide. + let propBag = LoginHelper.newPropertyBag(loginData); + this.addLoginToSummary({ ...existingLogin }, "modified", propBag); + return true; + } + this.addLoginToSummary({ ...existingLogin }, "no_change"); + return true; + } + } + return false; + } + + /** + * Validates if there is a conflict with previous rows based on the origin. + * We need to check the logins that we've already decided to add, to see if this is a duplicate. + * If this is the case, we mark this one as "no_change" in the summary and return true. + * @param {object} login + * A login object. + * @returns {boolean} True if the entry is similar or identical to another previously processed entry, false otherwise. + */ + checkConflictingOriginWithPreviousRows(login) { + let rowsPerOrigin = this.originToRows.get(login.origin); + if (rowsPerOrigin) { + if ( + rowsPerOrigin.some(r => + login.matches(r.login, false /* ignorePassword */) + ) + ) { + this.addLoginToSummary(login, "no_change"); + return true; + } + for (let row of rowsPerOrigin) { + let newLogin = row.login; + if (login.username == newLogin.username) { + this.addLoginToSummary(login, "no_change"); + return true; + } + } + } + return false; + } + + /** + * Validates if there is a conflict with existing logins based on the origin. + * If this is the case and there are some changes, we mark it as "modified" in the summary. + * If it matches an existing login without any extra modifications, we mark it as "no_change". + * For both cases we return true. + * @param {object} login + * A login object. + * @returns {boolean} True if the entry is similar or identical to another previously processed entry, false otherwise. + */ + checkConflictingWithExistingLogins(login) { + // While here we're passing formActionOrigin and httpRealm, they could be empty/null and get + // ignored in that case, leading to multiple logins for the same username. + let existingLogins = Services.logins.findLogins( + login.origin, + login.formActionOrigin, + login.httpRealm + ); + // Check for an existing login that matches *including* the password. + // If such a login exists, we do not need to add a new login. + if ( + existingLogins.some(l => login.matches(l, false /* ignorePassword */)) + ) { + this.addLoginToSummary(login, "no_change"); + return true; + } + // Now check for a login with the same username, where it may be that we have an + // updated password. + let foundMatchingLogin = false; + for (let existingLogin of existingLogins) { + if (login.username == existingLogin.username) { + foundMatchingLogin = true; + existingLogin.QueryInterface(Ci.nsILoginMetaInfo); + if ( + (login.password != existingLogin.password) & + (login.timePasswordChanged > existingLogin.timePasswordChanged) + ) { + // if a login with the same username and different password already exists and it's older + // than the current one, update its password and timestamp. + let propBag = Cc["@mozilla.org/hash-property-bag;1"].createInstance( + Ci.nsIWritablePropertyBag + ); + propBag.setProperty("password", login.password); + propBag.setProperty("timePasswordChanged", login.timePasswordChanged); + this.addLoginToSummary({ ...existingLogin }, "modified", propBag); + return true; + } + } + } + // if the new login is an update or is older than an exiting login, don't add it. + if (foundMatchingLogin) { + this.addLoginToSummary(login, "no_change"); + return true; + } + return false; + } + + /** + * Validates if there are any invalid values using LoginHelper.checkLoginValues. + * If this is the case we mark it as "error" and return true. + * @param {object} login + * A login object. + * @param {object} loginData + * An vanilla object for the login without any methods. + * @returns {boolean} True if there is a validation error we return true, false otherwise. + */ + checkLoginValuesError(login, loginData) { + try { + // Ensure we only send checked logins through, since the validation is optimized + // out from the bulk APIs below us. + LoginHelper.checkLoginValues(login); + } catch (e) { + this.addLoginToSummary({ ...loginData }, "error"); + console.error(e); + return true; + } + return false; + } + + /** + * Creates a new login from loginData. + * @param {object} loginData + * An vanilla object for the login without any methods. + * @returns {object} A login object. + */ + createNewLogin(loginData) { + let login = Cc["@mozilla.org/login-manager/loginInfo;1"].createInstance( + Ci.nsILoginInfo + ); + login.init( + loginData.origin, + loginData.formActionOrigin, + loginData.httpRealm, + loginData.username, + loginData.password, + loginData.usernameElement || "", + loginData.passwordElement || "" + ); + + login.QueryInterface(Ci.nsILoginMetaInfo); + login.timeCreated = loginData.timeCreated; + login.timeLastUsed = loginData.timeLastUsed || loginData.timeCreated; + login.timePasswordChanged = + loginData.timePasswordChanged || loginData.timeCreated; + login.timesUsed = loginData.timesUsed || 1; + login.guid = loginData.guid || null; + return login; + } + + /** + * Cleans the action and realm field of the loginData. + * @param {object} loginData + * An vanilla object for the login without any methods. + */ + cleanupActionAndRealmFields(loginData) { + const cleanOrigin = loginData.formActionOrigin + ? LoginHelper.getLoginOrigin(loginData.formActionOrigin, true) + : ""; + loginData.formActionOrigin = + cleanOrigin || (typeof loginData.httpRealm == "string" ? null : ""); + + loginData.httpRealm = + typeof loginData.httpRealm == "string" ? loginData.httpRealm : null; + } + + /** + * Adds a login to the summary. + * @param {object} login + * A login object. + * @param {string} result + * The result type. One of "added", "modified", "error", "error_invalid_origin", "error_invalid_password" or "no_change". + * @param {object} propBag + * An optional parameter with the properties bag. + * @returns {object} The row that was added. + */ + addLoginToSummary(login, result, propBag) { + let rows = this.originToRows.get(login.origin) || []; + if (rows.length === 0) { + this.originToRows.set(login.origin, rows); + } + const newSummaryRow = { result, login, propBag }; + rows.push(newSummaryRow); + this.summary.push(newSummaryRow); + return newSummaryRow; + } + + /** + * Iterates over all then rows where more than two match the same origin. It mutates the internal state of the processor. + * It makes sure that if the `timePasswordChanged` field is present it will be used to decide if it's a "no_change" or "added". + * The entry with the oldest `timePasswordChanged` will be "added", the rest will be "no_change". + */ + markLastTimePasswordChangedAsModified() { + const originUserToRowMap = new Map(); + for (let currentRow of this.summary) { + if ( + currentRow.result === "added" || + currentRow.result === "modified" || + currentRow.result === "no_change" + ) { + const originAndUser = + currentRow.login.origin + currentRow.login.username; + let lastTimeChangedRow = originUserToRowMap.get(originAndUser); + if (lastTimeChangedRow) { + if ( + (currentRow.login.password != lastTimeChangedRow.login.password) & + (currentRow.login.timePasswordChanged > + lastTimeChangedRow.login.timePasswordChanged) + ) { + lastTimeChangedRow.result = "no_change"; + currentRow.result = "added"; + originUserToRowMap.set(originAndUser, currentRow); + } + } else { + originUserToRowMap.set(originAndUser, currentRow); + } + } + } + } + + /** + * Iterates over all then rows where more than two match the same origin. It mutates the internal state of the processor. + * It makes sure that if the `timePasswordChanged` field is present it will be used to decide if it's a "no_change" or "added". + * The entry with the oldest `timePasswordChanged` will be "added", the rest will be "no_change". + * @returns {Object[]} An entry for each processed row containing how the row was processed and the login data. + */ + async processLoginsAndBuildSummary() { + this.markLastTimePasswordChangedAsModified(); + for (let summaryRow of this.summary) { + try { + if (summaryRow.result === "added") { + summaryRow.login = await Services.logins.addLoginAsync( + summaryRow.login + ); + } else if (summaryRow.result === "modified") { + Services.logins.modifyLogin(summaryRow.login, summaryRow.propBag); + } + } catch (e) { + console.error(e); + summaryRow.result = "error"; + } + } + return this.summary; + } +} + +/** + * Contains functions shared by different Login Manager components. + */ +export const LoginHelper = { + debug: null, + enabled: null, + storageEnabled: null, + formlessCaptureEnabled: null, + formRemovalCaptureEnabled: null, + generationAvailable: null, + generationConfidenceThreshold: null, + generationEnabled: null, + improvedPasswordRulesEnabled: null, + improvedPasswordRulesCollection: "password-rules", + includeOtherSubdomainsInLookup: null, + insecureAutofill: null, + privateBrowsingCaptureEnabled: null, + remoteRecipesEnabled: null, + remoteRecipesCollection: "password-recipes", + relatedRealmsEnabled: null, + relatedRealmsCollection: "websites-with-shared-credential-backends", + schemeUpgrades: null, + showAutoCompleteFooter: null, + showAutoCompleteImport: null, + signupDectectionConfidenceThreshold: null, + testOnlyUserHasInteractedWithDocument: null, + userInputRequiredToCapture: null, + captureInputChanges: null, + + init() { + // Watch for pref changes to update cached pref values. + Services.prefs.addObserver("signon.", () => this.updateSignonPrefs()); + this.updateSignonPrefs(); + Services.telemetry.setEventRecordingEnabled("pwmgr", true); + Services.telemetry.setEventRecordingEnabled("form_autocomplete", true); + }, + + updateSignonPrefs() { + this.autofillForms = Services.prefs.getBoolPref("signon.autofillForms"); + this.autofillAutocompleteOff = Services.prefs.getBoolPref( + "signon.autofillForms.autocompleteOff" + ); + this.captureInputChanges = Services.prefs.getBoolPref( + "signon.capture.inputChanges.enabled" + ); + this.debug = Services.prefs.getBoolPref("signon.debug"); + this.enabled = Services.prefs.getBoolPref("signon.rememberSignons"); + this.storageEnabled = Services.prefs.getBoolPref( + "signon.storeSignons", + true + ); + this.formlessCaptureEnabled = Services.prefs.getBoolPref( + "signon.formlessCapture.enabled" + ); + this.formRemovalCaptureEnabled = Services.prefs.getBoolPref( + "signon.formRemovalCapture.enabled" + ); + this.generationAvailable = Services.prefs.getBoolPref( + "signon.generation.available" + ); + this.generationConfidenceThreshold = parseFloat( + Services.prefs.getStringPref("signon.generation.confidenceThreshold") + ); + this.generationEnabled = Services.prefs.getBoolPref( + "signon.generation.enabled" + ); + this.improvedPasswordRulesEnabled = Services.prefs.getBoolPref( + "signon.improvedPasswordRules.enabled" + ); + this.insecureAutofill = Services.prefs.getBoolPref( + "signon.autofillForms.http" + ); + this.includeOtherSubdomainsInLookup = Services.prefs.getBoolPref( + "signon.includeOtherSubdomainsInLookup" + ); + this.passwordEditCaptureEnabled = Services.prefs.getBoolPref( + "signon.passwordEditCapture.enabled" + ); + this.privateBrowsingCaptureEnabled = Services.prefs.getBoolPref( + "signon.privateBrowsingCapture.enabled" + ); + this.schemeUpgrades = Services.prefs.getBoolPref("signon.schemeUpgrades"); + this.showAutoCompleteFooter = Services.prefs.getBoolPref( + "signon.showAutoCompleteFooter" + ); + + this.showAutoCompleteImport = Services.prefs.getStringPref( + "signon.showAutoCompleteImport", + "" + ); + this.signupDetectionConfidenceThreshold = parseFloat( + Services.prefs.getStringPref("signon.signupDetection.confidenceThreshold") + ); + this.signupDetectionEnabled = Services.prefs.getBoolPref( + "signon.signupDetection.enabled" + ); + + this.storeWhenAutocompleteOff = Services.prefs.getBoolPref( + "signon.storeWhenAutocompleteOff" + ); + + this.suggestImportCount = Services.prefs.getIntPref( + "signon.suggestImportCount", + 0 + ); + + if ( + Services.prefs.getBoolPref( + "signon.testOnlyUserHasInteractedByPrefValue", + false + ) + ) { + this.testOnlyUserHasInteractedWithDocument = Services.prefs.getBoolPref( + "signon.testOnlyUserHasInteractedWithDocument", + false + ); + lazy.log.debug( + `Using pref value for testOnlyUserHasInteractedWithDocument ${this.testOnlyUserHasInteractedWithDocument}.` + ); + } else { + this.testOnlyUserHasInteractedWithDocument = null; + } + + this.userInputRequiredToCapture = Services.prefs.getBoolPref( + "signon.userInputRequiredToCapture.enabled" + ); + this.usernameOnlyFormEnabled = Services.prefs.getBoolPref( + "signon.usernameOnlyForm.enabled" + ); + this.usernameOnlyFormLookupThreshold = Services.prefs.getIntPref( + "signon.usernameOnlyForm.lookupThreshold" + ); + this.remoteRecipesEnabled = Services.prefs.getBoolPref( + "signon.recipes.remoteRecipes.enabled" + ); + this.relatedRealmsEnabled = Services.prefs.getBoolPref( + "signon.relatedRealms.enabled" + ); + }, + + createLogger(aLogPrefix) { + let getMaxLogLevel = () => { + return this.debug ? "Debug" : "Warn"; + }; + + // Create a new instance of the ConsoleAPI so we can control the maxLogLevel with a pref. + let consoleOptions = { + maxLogLevel: getMaxLogLevel(), + prefix: aLogPrefix, + }; + let logger = console.createInstance(consoleOptions); + + // Watch for pref changes and update this.debug and the maxLogLevel for created loggers + Services.prefs.addObserver("signon.debug", () => { + this.debug = Services.prefs.getBoolPref("signon.debug"); + if (logger) { + logger.maxLogLevel = getMaxLogLevel(); + } + }); + + return logger; + }, + + /** + * Due to the way the signons2.txt file is formatted, we need to make + * sure certain field values or characters do not cause the file to + * be parsed incorrectly. Reject origins that we can't store correctly. + * + * @throws String with English message in case validation failed. + */ + checkOriginValue(aOrigin) { + // Nulls are invalid, as they don't round-trip well. Newlines are also + // invalid for any field stored as plaintext, and an origin made of a + // single dot cannot be stored in the legacy format. + if ( + aOrigin == "." || + aOrigin.includes("\r") || + aOrigin.includes("\n") || + aOrigin.includes("\0") + ) { + throw new Error("Invalid origin"); + } + }, + + /** + * Due to the way the signons2.txt file was formatted, we needed to make + * sure certain field values or characters do not cause the file to + * be parsed incorrectly. These characters can cause problems in other + * formats/languages too so reject logins that may not be stored correctly. + * + * @throws String with English message in case validation failed. + */ + checkLoginValues(aLogin) { + function badCharacterPresent(l, c) { + return ( + (l.formActionOrigin && l.formActionOrigin.includes(c)) || + (l.httpRealm && l.httpRealm.includes(c)) || + l.origin.includes(c) || + l.usernameField.includes(c) || + l.passwordField.includes(c) + ); + } + + // Nulls are invalid, as they don't round-trip well. + // Mostly not a formatting problem, although ".\0" can be quirky. + if (badCharacterPresent(aLogin, "\0")) { + throw new Error("login values can't contain nulls"); + } + + if (!aLogin.password || typeof aLogin.password != "string") { + throw new Error("passwords must be non-empty strings"); + } + + // In theory these nulls should just be rolled up into the encrypted + // values, but nsISecretDecoderRing doesn't use nsStrings, so the + // nulls cause truncation. Check for them here just to avoid + // unexpected round-trip surprises. + if (aLogin.username.includes("\0") || aLogin.password.includes("\0")) { + throw new Error("login values can't contain nulls"); + } + + // Newlines are invalid for any field stored as plaintext. + if ( + badCharacterPresent(aLogin, "\r") || + badCharacterPresent(aLogin, "\n") + ) { + throw new Error("login values can't contain newlines"); + } + + // A line with just a "." can have special meaning. + if (aLogin.usernameField == "." || aLogin.formActionOrigin == ".") { + throw new Error("login values can't be periods"); + } + + // An origin with "\ \(" won't roundtrip. + // eg host="foo (", realm="bar" --> "foo ( (bar)" + // vs host="foo", realm=" (bar" --> "foo ( (bar)" + if (aLogin.origin.includes(" (")) { + throw new Error("bad parens in origin"); + } + }, + + /** + * Returns a new XPCOM property bag with the provided properties. + * + * @param {Object} aProperties + * Each property of this object is copied to the property bag. This + * parameter can be omitted to return an empty property bag. + * + * @return A new property bag, that is an instance of nsIWritablePropertyBag, + * nsIWritablePropertyBag2, nsIPropertyBag, and nsIPropertyBag2. + */ + newPropertyBag(aProperties) { + let propertyBag = Cc["@mozilla.org/hash-property-bag;1"].createInstance( + Ci.nsIWritablePropertyBag + ); + if (aProperties) { + for (let [name, value] of Object.entries(aProperties)) { + propertyBag.setProperty(name, value); + } + } + return propertyBag + .QueryInterface(Ci.nsIPropertyBag) + .QueryInterface(Ci.nsIPropertyBag2) + .QueryInterface(Ci.nsIWritablePropertyBag2); + }, + + /** + * Helper to avoid the property bags when calling + * Services.logins.searchLogins from JS. + * @deprecated Use Services.logins.searchLoginsAsync instead. + * + * @param {Object} aSearchOptions - A regular JS object to copy to a property bag before searching + * @return {nsILoginInfo[]} - The result of calling searchLogins. + */ + searchLoginsWithObject(aSearchOptions) { + return Services.logins.searchLogins(this.newPropertyBag(aSearchOptions)); + }, + + /** + * @param {string} aURL + * @returns {string} which is the hostPort of aURL if supported by the scheme + * otherwise, returns the original aURL. + */ + maybeGetHostPortForURL(aURL) { + try { + let uri = Services.io.newURI(aURL); + return uri.hostPort; + } catch (ex) { + // No need to warn for javascript:/data:/about:/chrome:/etc. + } + return aURL; + }, + + /** + * Get the parts of the URL we want for identification. + * Strip out things like the userPass portion and handle javascript:. + */ + getLoginOrigin(uriString, allowJS = false) { + let realm = ""; + try { + const mozProxyRegex = /^moz-proxy:\/\//i; + const isMozProxy = !!uriString.match(mozProxyRegex); + if (isMozProxy) { + // Special handling because uri.displayHostPort throws on moz-proxy:// + return ( + "moz-proxy://" + + Services.io.newURI(uriString.replace(mozProxyRegex, "https://")) + .displayHostPort + ); + } + + let uri = Services.io.newURI(uriString); + + if (allowJS && uri.scheme == "javascript") { + return "javascript:"; + } + + // Build this manually instead of using prePath to avoid including the userPass portion. + realm = uri.scheme + "://" + uri.displayHostPort; + } catch (e) { + // bug 159484 - disallow url types that don't support a hostPort. + // (although we handle "javascript:..." as a special case above.) + if (uriString && !uriString.startsWith("data")) { + lazy.log.warn( + `Couldn't parse specified uri ${uriString} with error ${e.name}` + ); + } + realm = null; + } + + return realm; + }, + + getFormActionOrigin(form) { + let uriString = form.action; + + // A blank or missing action submits to where it came from. + if (uriString == "") { + // ala bug 297761 + uriString = form.baseURI; + } + + return this.getLoginOrigin(uriString, true); + }, + + /** + * @param {String} aLoginOrigin - An origin value from a stored login's + * origin or formActionOrigin properties. + * @param {String} aSearchOrigin - The origin that was are looking to match + * with aLoginOrigin. This would normally come + * from a form or page that we are considering. + * @param {nsILoginFindOptions} aOptions - Options to affect whether the origin + * from the login (aLoginOrigin) is a + * match for the origin we're looking + * for (aSearchOrigin). + */ + isOriginMatching( + aLoginOrigin, + aSearchOrigin, + aOptions = { + schemeUpgrades: false, + acceptWildcardMatch: false, + acceptDifferentSubdomains: false, + acceptRelatedRealms: false, + relatedRealms: [], + } + ) { + if (aLoginOrigin == aSearchOrigin) { + return true; + } + + if (!aOptions) { + return false; + } + + if (aOptions.acceptWildcardMatch && aLoginOrigin == "") { + return true; + } + + // We can only match logins now if either of these flags are true, so + // avoid doing the work of constructing URL objects if neither is true. + if (!aOptions.acceptDifferentSubdomains && !aOptions.schemeUpgrades) { + return false; + } + + try { + let loginURI = Services.io.newURI(aLoginOrigin); + let searchURI = Services.io.newURI(aSearchOrigin); + let schemeMatches = + loginURI.scheme == "http" && searchURI.scheme == "https"; + + if (aOptions.acceptDifferentSubdomains) { + let loginBaseDomain = Services.eTLD.getBaseDomain(loginURI); + let searchBaseDomain = Services.eTLD.getBaseDomain(searchURI); + if ( + loginBaseDomain == searchBaseDomain && + (loginURI.scheme == searchURI.scheme || + (aOptions.schemeUpgrades && schemeMatches)) + ) { + return true; + } + if ( + aOptions.acceptRelatedRealms && + aOptions.relatedRealms.length && + (loginURI.scheme == searchURI.scheme || + (aOptions.schemeUpgrades && schemeMatches)) + ) { + for (let relatedOrigin of aOptions.relatedRealms) { + if (Services.eTLD.hasRootDomain(loginURI.host, relatedOrigin)) { + return true; + } + } + } + } + + if ( + aOptions.schemeUpgrades && + loginURI.host == searchURI.host && + schemeMatches && + loginURI.port == searchURI.port + ) { + return true; + } + } catch (ex) { + // newURI will throw for some values e.g. chrome://FirefoxAccounts + // uri.host and uri.port will throw for some values e.g. javascript: + return false; + } + + return false; + }, + + doLoginsMatch( + aLogin1, + aLogin2, + { ignorePassword = false, ignoreSchemes = false } + ) { + if ( + aLogin1.httpRealm != aLogin2.httpRealm || + aLogin1.username != aLogin2.username + ) { + return false; + } + + if (!ignorePassword && aLogin1.password != aLogin2.password) { + return false; + } + + if (ignoreSchemes) { + let login1HostPort = this.maybeGetHostPortForURL(aLogin1.origin); + let login2HostPort = this.maybeGetHostPortForURL(aLogin2.origin); + if (login1HostPort != login2HostPort) { + return false; + } + + if ( + aLogin1.formActionOrigin != "" && + aLogin2.formActionOrigin != "" && + this.maybeGetHostPortForURL(aLogin1.formActionOrigin) != + this.maybeGetHostPortForURL(aLogin2.formActionOrigin) + ) { + return false; + } + } else { + if (aLogin1.origin != aLogin2.origin) { + return false; + } + + // If either formActionOrigin is blank (but not null), then match. + if ( + aLogin1.formActionOrigin != "" && + aLogin2.formActionOrigin != "" && + aLogin1.formActionOrigin != aLogin2.formActionOrigin + ) { + return false; + } + } + + // The .usernameField and .passwordField values are ignored. + + return true; + }, + + /** + * Creates a new login object that results by modifying the given object with + * the provided data. + * + * @param {nsILoginInfo} aOldStoredLogin + * Existing login object to modify. + * @param {nsILoginInfo|nsIProperyBag} aNewLoginData + * The new login values, either as an nsILoginInfo or nsIProperyBag. + * + * @return {nsILoginInfo} The newly created nsILoginInfo object. + * + * @throws {Error} With English message in case validation failed. + */ + buildModifiedLogin(aOldStoredLogin, aNewLoginData) { + function bagHasProperty(aPropName) { + try { + aNewLoginData.getProperty(aPropName); + return true; + } catch (ex) {} + return false; + } + + aOldStoredLogin.QueryInterface(Ci.nsILoginMetaInfo); + + let newLogin; + if (aNewLoginData instanceof Ci.nsILoginInfo) { + // Clone the existing login to get its nsILoginMetaInfo, then init it + // with the replacement nsILoginInfo data from the new login. + newLogin = aOldStoredLogin.clone(); + newLogin.init( + aNewLoginData.origin, + aNewLoginData.formActionOrigin, + aNewLoginData.httpRealm, + aNewLoginData.username, + aNewLoginData.password, + aNewLoginData.usernameField, + aNewLoginData.passwordField + ); + newLogin.unknownFields = aNewLoginData.unknownFields; + newLogin.QueryInterface(Ci.nsILoginMetaInfo); + + // Automatically update metainfo when password is changed. + if (newLogin.password != aOldStoredLogin.password) { + newLogin.timePasswordChanged = Date.now(); + } + } else if (aNewLoginData instanceof Ci.nsIPropertyBag) { + // Clone the existing login, along with all its properties. + newLogin = aOldStoredLogin.clone(); + newLogin.QueryInterface(Ci.nsILoginMetaInfo); + + // Automatically update metainfo when password is changed. + // (Done before the main property updates, lest the caller be + // explicitly updating both .password and .timePasswordChanged) + if (bagHasProperty("password")) { + let newPassword = aNewLoginData.getProperty("password"); + if (newPassword != aOldStoredLogin.password) { + newLogin.timePasswordChanged = Date.now(); + } + } + + for (let prop of aNewLoginData.enumerator) { + switch (prop.name) { + // nsILoginInfo (fall through) + case "origin": + case "httpRealm": + case "formActionOrigin": + case "username": + case "password": + case "usernameField": + case "passwordField": + case "unknownFields": + // nsILoginMetaInfo (fall through) + case "guid": + case "timeCreated": + case "timeLastUsed": + case "timePasswordChanged": + case "timesUsed": + newLogin[prop.name] = prop.value; + break; + + // Fake property, allows easy incrementing. + case "timesUsedIncrement": + newLogin.timesUsed += prop.value; + break; + + // Fail if caller requests setting an unknown property. + default: + throw new Error("Unexpected propertybag item: " + prop.name); + } + } + } else { + throw new Error("newLoginData needs an expected interface!"); + } + + // Sanity check the login + if (newLogin.origin == null || !newLogin.origin.length) { + throw new Error("Can't add a login with a null or empty origin."); + } + + // For logins w/o a username, set to "", not null. + if (newLogin.username == null) { + throw new Error("Can't add a login with a null username."); + } + + if (newLogin.password == null || !newLogin.password.length) { + throw new Error("Can't add a login with a null or empty password."); + } + + if (newLogin.formActionOrigin || newLogin.formActionOrigin == "") { + // We have a form submit URL. Can't have a HTTP realm. + if (newLogin.httpRealm != null) { + throw new Error( + "Can't add a login with both a httpRealm and formActionOrigin." + ); + } + } else if (newLogin.httpRealm) { + // We have a HTTP realm. Can't have a form submit URL. + if (newLogin.formActionOrigin != null) { + throw new Error( + "Can't add a login with both a httpRealm and formActionOrigin." + ); + } + } else { + // Need one or the other! + throw new Error( + "Can't add a login without a httpRealm or formActionOrigin." + ); + } + + // Throws if there are bogus values. + this.checkLoginValues(newLogin); + + return newLogin; + }, + + /** + * Remove http: logins when there is an https: login with the same username and hostPort. + * Sort order is preserved. + * + * @param {nsILoginInfo[]} logins + * A list of logins we want to process for shadowing. + * @returns {nsILoginInfo[]} A subset of of the passed logins. + */ + shadowHTTPLogins(logins) { + /** + * Map a (hostPort, username) to a boolean indicating whether `logins` + * contains an https: login for that combo. + */ + let hasHTTPSByHostPortUsername = new Map(); + for (let login of logins) { + let key = this.getUniqueKeyForLogin(login, ["hostPort", "username"]); + let hasHTTPSlogin = hasHTTPSByHostPortUsername.get(key) || false; + let loginURI = Services.io.newURI(login.origin); + hasHTTPSByHostPortUsername.set( + key, + loginURI.scheme == "https" || hasHTTPSlogin + ); + } + + return logins.filter(login => { + let key = this.getUniqueKeyForLogin(login, ["hostPort", "username"]); + let loginURI = Services.io.newURI(login.origin); + if (loginURI.scheme == "http" && hasHTTPSByHostPortUsername.get(key)) { + // If this is an http: login and we have an https: login for the + // (hostPort, username) combo then remove it. + return false; + } + return true; + }); + }, + + /** + * Generate a unique key string from a login. + * @param {nsILoginInfo} login + * @param {string[]} uniqueKeys containing nsILoginInfo attribute names or "hostPort" + * @returns {string} to use as a key in a Map + */ + getUniqueKeyForLogin(login, uniqueKeys) { + const KEY_DELIMITER = ":"; + return uniqueKeys.reduce((prev, key) => { + let val = null; + if (key == "hostPort") { + val = Services.io.newURI(login.origin).hostPort; + } else { + val = login[key]; + } + + return prev + KEY_DELIMITER + val; + }, ""); + }, + + /** + * Removes duplicates from a list of logins while preserving the sort order. + * + * @param {nsILoginInfo[]} logins + * A list of logins we want to deduplicate. + * @param {string[]} [uniqueKeys = ["username", "password"]] + * A list of login attributes to use as unique keys for the deduplication. + * @param {string[]} [resolveBy = ["timeLastUsed"]] + * Ordered array of keyword strings used to decide which of the + * duplicates should be used. "scheme" would prefer the login that has + * a scheme matching `preferredOrigin`'s if there are two logins with + * the same `uniqueKeys`. The default preference to distinguish two + * logins is `timeLastUsed`. If there is no preference between two + * logins, the first one found wins. + * @param {string} [preferredOrigin = undefined] + * String representing the origin to use for preferring one login over + * another when they are dupes. This is used with "scheme" for + * `resolveBy` so the scheme from this origin will be preferred. + * @param {string} [preferredFormActionOrigin = undefined] + * String representing the action origin to use for preferring one login over + * another when they are dupes. This is used with "actionOrigin" for + * `resolveBy` so the scheme from this action origin will be preferred. + * + * @returns {nsILoginInfo[]} list of unique logins. + */ + dedupeLogins( + logins, + uniqueKeys = ["username", "password"], + resolveBy = ["timeLastUsed"], + preferredOrigin = undefined, + preferredFormActionOrigin = undefined + ) { + if (!preferredOrigin) { + if (resolveBy.includes("scheme")) { + throw new Error( + "dedupeLogins: `preferredOrigin` is required in order to " + + "prefer schemes which match it." + ); + } + if (resolveBy.includes("subdomain")) { + throw new Error( + "dedupeLogins: `preferredOrigin` is required in order to " + + "prefer subdomains which match it." + ); + } + } + + let preferredOriginScheme; + if (preferredOrigin) { + try { + preferredOriginScheme = Services.io.newURI(preferredOrigin).scheme; + } catch (ex) { + // Handle strings that aren't valid URIs e.g. chrome://FirefoxAccounts + } + } + + if (!preferredOriginScheme && resolveBy.includes("scheme")) { + lazy.log.warn( + "Deduping with a scheme preference but couldn't get the preferred origin scheme." + ); + } + + // We use a Map to easily lookup logins by their unique keys. + let loginsByKeys = new Map(); + + /** + * @return {bool} whether `login` is preferred over its duplicate (considering `uniqueKeys`) + * `existingLogin`. + * + * `resolveBy` is a sorted array so we can return true the first time `login` is preferred + * over the existingLogin. + */ + function isLoginPreferred(existingLogin, login) { + if (!resolveBy || !resolveBy.length) { + // If there is no preference, prefer the existing login. + return false; + } + + for (let preference of resolveBy) { + switch (preference) { + case "actionOrigin": { + if (!preferredFormActionOrigin) { + break; + } + if ( + LoginHelper.isOriginMatching( + existingLogin.formActionOrigin, + preferredFormActionOrigin, + { schemeUpgrades: LoginHelper.schemeUpgrades } + ) && + !LoginHelper.isOriginMatching( + login.formActionOrigin, + preferredFormActionOrigin, + { schemeUpgrades: LoginHelper.schemeUpgrades } + ) + ) { + return false; + } + break; + } + case "scheme": { + if (!preferredOriginScheme) { + break; + } + + try { + // Only `origin` is currently considered + let existingLoginURI = Services.io.newURI(existingLogin.origin); + let loginURI = Services.io.newURI(login.origin); + // If the schemes of the two logins are the same or neither match the + // preferredOriginScheme then we have no preference and look at the next resolveBy. + if ( + loginURI.scheme == existingLoginURI.scheme || + (loginURI.scheme != preferredOriginScheme && + existingLoginURI.scheme != preferredOriginScheme) + ) { + break; + } + + return loginURI.scheme == preferredOriginScheme; + } catch (e) { + // Some URLs aren't valid nsIURI (e.g. chrome://FirefoxAccounts) + lazy.log.debug( + "dedupeLogins/shouldReplaceExisting: Error comparing schemes:", + existingLogin.origin, + login.origin, + "preferredOrigin:", + preferredOrigin, + e.name + ); + } + break; + } + case "subdomain": { + // Replace the existing login only if the new login is an exact match on the host. + let existingLoginURI = Services.io.newURI(existingLogin.origin); + let newLoginURI = Services.io.newURI(login.origin); + let preferredOriginURI = Services.io.newURI(preferredOrigin); + if ( + existingLoginURI.hostPort != preferredOriginURI.hostPort && + newLoginURI.hostPort == preferredOriginURI.hostPort + ) { + return true; + } + if ( + existingLoginURI.host != preferredOriginURI.host && + newLoginURI.host == preferredOriginURI.host + ) { + return true; + } + // if the existing login host *is* a match and the new one isn't + // we explicitly want to keep the existing one + if ( + existingLoginURI.host == preferredOriginURI.host && + newLoginURI.host != preferredOriginURI.host + ) { + return false; + } + break; + } + case "timeLastUsed": + case "timePasswordChanged": { + // If we find a more recent login for the same key, replace the existing one. + let loginDate = login.QueryInterface(Ci.nsILoginMetaInfo)[ + preference + ]; + let storedLoginDate = existingLogin.QueryInterface( + Ci.nsILoginMetaInfo + )[preference]; + if (loginDate == storedLoginDate) { + break; + } + + return loginDate > storedLoginDate; + } + default: { + throw new Error( + "dedupeLogins: Invalid resolveBy preference: " + preference + ); + } + } + } + + return false; + } + + for (let login of logins) { + let key = this.getUniqueKeyForLogin(login, uniqueKeys); + + if (loginsByKeys.has(key)) { + if (!isLoginPreferred(loginsByKeys.get(key), login)) { + // If there is no preference for the new login, use the existing one. + continue; + } + } + loginsByKeys.set(key, login); + } + + // Return the map values in the form of an array. + return [...loginsByKeys.values()]; + }, + + /** + * Open the password manager window. + * + * @param {Window} window + * the window from where we want to open the dialog + * + * @param {object?} args + * params for opening the password manager + * @param {string} [args.filterString=""] + * the domain (not origin) to pass to the login manager dialog + * to pre-filter the results + * @param {string} args.entryPoint + * The name of the entry point, used for telemetry + */ + openPasswordManager( + window, + { filterString = "", entryPoint = "", loginGuid = null } = {} + ) { + // Get currently active tab's origin + const openedFrom = + window.gBrowser?.selectedTab.linkedBrowser.currentURI.spec; + + // If no loginGuid is set, get sanitized origin, this will return null for about:* uris + const preselectedLogin = loginGuid ?? this.getLoginOrigin(openedFrom); + + const params = new URLSearchParams({ + ...(filterString && { filter: filterString }), + ...(entryPoint && { entryPoint }), + }); + + const paramsPart = params.toString() ? `?${params}` : ""; + const fragmentsPart = preselectedLogin + ? `#${window.encodeURIComponent(preselectedLogin)}` + : ""; + const destination = `about:logins${paramsPart}${fragmentsPart}`; + + // We assume that managementURL has a '?' already + window.openTrustedLinkIn(destination, "tab"); + }, + + /** + * Checks if a field type is password compatible. + * + * @param {Element} element + * the field we want to check. + * @param {Object} options + * @param {bool} [options.ignoreConnect] - Whether to ignore checking isConnected + * of the element. + * + * @returns {Boolean} true if the field can + * be treated as a password input + */ + isPasswordFieldType(element, { ignoreConnect = false } = {}) { + if (!HTMLInputElement.isInstance(element)) { + return false; + } + + if (!element.isConnected && !ignoreConnect) { + // If the element isn't connected then it isn't visible to the user so + // shouldn't be considered. It must have been connected in the past. + return false; + } + + if (!element.hasBeenTypePassword) { + return false; + } + + // Ensure the element is of a type that could have autocomplete. + // These include the types with user-editable values. If not, even if it used to be + // a type=password, we can't treat it as a password input now + let acInfo = element.getAutocompleteInfo(); + if (!acInfo) { + return false; + } + + return true; + }, + + /** + * Checks if a field type is username compatible. + * + * @param {Element} element + * the field we want to check. + * @param {Object} options + * @param {bool} [options.ignoreConnect] - Whether to ignore checking isConnected + * of the element. + * + * @returns {Boolean} true if the field type is one + * of the username types. + */ + isUsernameFieldType(element, { ignoreConnect = false } = {}) { + if (!HTMLInputElement.isInstance(element)) { + return false; + } + + if (!element.isConnected && !ignoreConnect) { + // If the element isn't connected then it isn't visible to the user so + // shouldn't be considered. It must have been connected in the past. + return false; + } + + if (element.hasBeenTypePassword) { + return false; + } + + if (!Logic.inputTypeIsCompatibleWithUsername(element)) { + return false; + } + + let acFieldName = element.getAutocompleteInfo().fieldName; + if ( + !( + acFieldName == "username" || + // Bug 1540154: Some sites use tel/email on their username fields. + acFieldName == "email" || + acFieldName == "tel" || + acFieldName == "tel-national" || + acFieldName == "off" || + acFieldName == "on" || + acFieldName == "" + ) + ) { + return false; + } + return true; + }, + + /** + * Infer whether a form is a sign-in form by searching keywords + * in its attributes + * + * @param {Element} element + * the form we want to check. + * + * @returns {boolean} True if any of the rules matches + */ + isInferredLoginForm(formElement) { + // This is copied from 'loginFormAttrRegex' in NewPasswordModel.jsm + const loginExpr = + /login|log in|log on|log-on|sign in|sigin|sign\/in|sign-in|sign on|sign-on/i; + + if (Logic.elementAttrsMatchRegex(formElement, loginExpr)) { + return true; + } + + return false; + }, + + /** + * Infer whether an input field is a username field by searching + * 'username' keyword in its attributes + * + * @param {Element} element + * the field we want to check. + * + * @returns {boolean} True if any of the rules matches + */ + isInferredUsernameField(element) { + const expr = /username/i; + + let ac = element.getAutocompleteInfo()?.fieldName; + if (ac && ac == "username") { + return true; + } + + if ( + Logic.elementAttrsMatchRegex(element, expr) || + Logic.hasLabelMatchingRegex(element, expr) + ) { + return true; + } + + return false; + }, + + /** + * Search for keywords that indicates the input field is not likely a + * field of a username login form. + * + * @param {Element} element + * the input field we want to check. + * + * @returns {boolean} True if any of the rules matches + */ + isInferredNonUsernameField(element) { + const expr = /search|code/i; + + if ( + Logic.elementAttrsMatchRegex(element, expr) || + Logic.hasLabelMatchingRegex(element, expr) + ) { + return true; + } + + return false; + }, + + /** + * Infer whether an input field is an email field by searching + * 'email' keyword in its attributes. + * + * @param {Element} element + * the field we want to check. + * + * @returns {boolean} True if any of the rules matches + */ + isInferredEmailField(element) { + const expr = /email|邮箱/i; + + if (element.type == "email") { + return true; + } + + let ac = element.getAutocompleteInfo()?.fieldName; + if (ac && ac == "email") { + return true; + } + + if ( + Logic.elementAttrsMatchRegex(element, expr) || + Logic.hasLabelMatchingRegex(element, expr) + ) { + return true; + } + + return false; + }, + + /** + * For each login, add the login to the password manager if a similar one + * doesn't already exist. Merge it otherwise with the similar existing ones. + * + * @param {Object[]} loginDatas - For each login, the data that needs to be added. + * @returns {Object[]} An entry for each processed row containing how the row was processed and the login data. + */ + async maybeImportLogins(loginDatas) { + this.importing = true; + try { + const processor = new ImportRowProcessor(); + for (let rawLoginData of loginDatas) { + // Do some sanitization on a clone of the loginData. + let loginData = ChromeUtils.shallowClone(rawLoginData); + if (processor.checkNonUniqueGuidError(loginData)) { + continue; + } + if (processor.checkMissingMandatoryFieldsError(loginData)) { + continue; + } + processor.cleanupActionAndRealmFields(loginData); + if (await processor.checkExistingEntry(loginData)) { + continue; + } + let login = processor.createNewLogin(loginData); + if (processor.checkLoginValuesError(login, loginData)) { + continue; + } + if (processor.checkConflictingOriginWithPreviousRows(login)) { + continue; + } + if (processor.checkConflictingWithExistingLogins(login)) { + continue; + } + processor.addLoginToSummary(login, "added"); + } + return await processor.processLoginsAndBuildSummary(); + } finally { + this.importing = false; + + Services.obs.notifyObservers(null, "passwordmgr-reload-all"); + } + }, + + /** + * Convert an array of nsILoginInfo to vanilla JS objects suitable for + * sending over IPC. Avoid using this in other cases. + * + * NB: All members of nsILoginInfo (not nsILoginMetaInfo) are strings. + */ + loginsToVanillaObjects(logins) { + return logins.map(this.loginToVanillaObject); + }, + + /** + * Same as above, but for a single login. + */ + loginToVanillaObject(login) { + let obj = {}; + for (let i in login.QueryInterface(Ci.nsILoginMetaInfo)) { + if (typeof login[i] !== "function") { + obj[i] = login[i]; + } + } + return obj; + }, + + /** + * Convert an object received from IPC into an nsILoginInfo (with guid). + */ + vanillaObjectToLogin(login) { + let formLogin = Cc["@mozilla.org/login-manager/loginInfo;1"].createInstance( + Ci.nsILoginInfo + ); + formLogin.init( + login.origin, + login.formActionOrigin, + login.httpRealm, + login.username, + login.password, + login.usernameField, + login.passwordField + ); + + formLogin.QueryInterface(Ci.nsILoginMetaInfo); + for (let prop of [ + "guid", + "timeCreated", + "timeLastUsed", + "timePasswordChanged", + "timesUsed", + ]) { + formLogin[prop] = login[prop]; + } + return formLogin; + }, + + /** + * As above, but for an array of objects. + */ + vanillaObjectsToLogins(vanillaObjects) { + const logins = []; + for (const vanillaObject of vanillaObjects) { + logins.push(this.vanillaObjectToLogin(vanillaObject)); + } + return logins; + }, + + /** + * Returns true if the user has a primary password set and false otherwise. + */ + isPrimaryPasswordSet() { + let tokenDB = Cc["@mozilla.org/security/pk11tokendb;1"].getService( + Ci.nsIPK11TokenDB + ); + let token = tokenDB.getInternalKeyToken(); + return token.hasPassword; + }, + + /** + * Shows the Primary Password prompt if enabled, or the + * OS auth dialog otherwise. + * @param {Element} browser + * The <browser> that the prompt should be shown on + * @param OSReauthEnabled Boolean indicating if OS reauth should be tried + * @param expirationTime Optional timestamp indicating next required re-authentication + * @param messageText Formatted and localized string to be displayed when the OS auth dialog is used. + * @param captionText Formatted and localized string to be displayed when the OS auth dialog is used. + */ + async requestReauth( + browser, + OSReauthEnabled, + expirationTime, + messageText, + captionText + ) { + let isAuthorized = false; + let telemetryEvent; + + // This does no harm if primary password isn't set. + let tokendb = Cc["@mozilla.org/security/pk11tokendb;1"].createInstance( + Ci.nsIPK11TokenDB + ); + let token = tokendb.getInternalKeyToken(); + + // Do we have a recent authorization? + if (expirationTime && Date.now() < expirationTime) { + isAuthorized = true; + telemetryEvent = { + object: token.hasPassword ? "master_password" : "os_auth", + method: "reauthenticate", + value: "success_no_prompt", + }; + return { + isAuthorized, + telemetryEvent, + }; + } + + // Default to true if there is no primary password and OS reauth is not available + if (!token.hasPassword && !OSReauthEnabled) { + isAuthorized = true; + telemetryEvent = { + object: "os_auth", + method: "reauthenticate", + value: "success_disabled", + }; + return { + isAuthorized, + telemetryEvent, + }; + } + // Use the OS auth dialog if there is no primary password + if (!token.hasPassword && OSReauthEnabled) { + let result = await lazy.OSKeyStore.ensureLoggedIn( + messageText, + captionText, + browser.ownerGlobal, + false + ); + isAuthorized = result.authenticated; + telemetryEvent = { + object: "os_auth", + method: "reauthenticate", + value: result.auth_details, + extra: result.auth_details_extra, + }; + return { + isAuthorized, + telemetryEvent, + }; + } + // We'll attempt to re-auth via Primary Password, force a log-out + token.checkPassword(""); + + // If a primary password prompt is already open, just exit early and return false. + // The user can re-trigger it after responding to the already open dialog. + if (Services.logins.uiBusy) { + isAuthorized = false; + return { + isAuthorized, + telemetryEvent, + }; + } + + // So there's a primary password. But since checkPassword didn't succeed, we're logged out (per nsIPK11Token.idl). + try { + // Relogin and ask for the primary password. + token.login(true); // 'true' means always prompt for token password. User will be prompted until + // clicking 'Cancel' or entering the correct password. + } catch (e) { + // An exception will be thrown if the user cancels the login prompt dialog. + // User is also logged out of Software Security Device. + } + isAuthorized = token.isLoggedIn(); + telemetryEvent = { + object: "master_password", + method: "reauthenticate", + value: isAuthorized ? "success" : "fail", + }; + return { + isAuthorized, + telemetryEvent, + }; + }, + + /** + * Send a notification when stored data is changed. + */ + notifyStorageChanged(changeType, data) { + if (this.importing) { + return; + } + + let dataObject = data; + // Can't pass a raw JS string or array though notifyObservers(). :-( + if (Array.isArray(data)) { + dataObject = Cc["@mozilla.org/array;1"].createInstance( + Ci.nsIMutableArray + ); + for (let i = 0; i < data.length; i++) { + dataObject.appendElement(data[i]); + } + } else if (typeof data == "string") { + dataObject = Cc["@mozilla.org/supports-string;1"].createInstance( + Ci.nsISupportsString + ); + dataObject.data = data; + } + Services.obs.notifyObservers( + dataObject, + "passwordmgr-storage-changed", + changeType + ); + }, + + isUserFacingLogin(login) { + return login.origin != "chrome://FirefoxAccounts"; // FXA_PWDMGR_HOST + }, + + async getAllUserFacingLogins() { + try { + let logins = await Services.logins.getAllLoginsAsync(); + return logins.filter(this.isUserFacingLogin); + } catch (e) { + if (e.result == Cr.NS_ERROR_ABORT) { + // If the user cancels the MP prompt then return no logins. + return []; + } + throw e; + } + }, + + createLoginAlreadyExistsError(guid) { + // The GUID is stored in an nsISupportsString here because we cannot pass + // raw JS objects within Components.Exception due to bug 743121. + let guidSupportsString = Cc[ + "@mozilla.org/supports-string;1" + ].createInstance(Ci.nsISupportsString); + guidSupportsString.data = guid; + return Components.Exception("This login already exists.", { + data: guidSupportsString, + }); + }, + + /** + * Determine the <browser> that a prompt should be shown on. + * + * Some sites pop up a temporary login window, which disappears + * upon submission of credentials. We want to put the notification + * prompt in the opener window if this seems to be happening. + * + * @param {Element} browser + * The <browser> that a prompt was triggered for + * @returns {Element} The <browser> that the prompt should be shown on, + * which could be in a different window. + */ + getBrowserForPrompt(browser) { + let chromeWindow = browser.ownerGlobal; + let openerBrowsingContext = browser.browsingContext.opener; + let openerBrowser = openerBrowsingContext + ? openerBrowsingContext.top.embedderElement + : null; + if (openerBrowser) { + let chromeDoc = chromeWindow.document.documentElement; + + // Check to see if the current window was opened with chrome + // disabled, and if so use the opener window. But if the window + // has been used to visit other pages (ie, has a history), + // assume it'll stick around and *don't* use the opener. + if (chromeDoc.getAttribute("chromehidden") && !browser.canGoBack) { + lazy.log.debug("Using opener window for prompt."); + return openerBrowser; + } + } + + return browser; + }, +}; + +XPCOMUtils.defineLazyGetter(lazy, "log", () => { + let processName = + Services.appinfo.processType === Services.appinfo.PROCESS_TYPE_DEFAULT + ? "Main" + : "Content"; + return LoginHelper.createLogger(`LoginHelper(${processName})`); +}); + +LoginHelper.init(); + +export class OptInFeature { + implementation; + #offered; + #enabled; + #disabled; + #pref; + + static PREF_AVAILABLE_VALUE = "available"; + static PREF_OFFERED_VALUE = "offered"; + static PREF_ENABLED_VALUE = "enabled"; + static PREF_DISABLED_VALUE = "disabled"; + + constructor(offered, enabled, disabled, pref) { + this.#pref = pref; + this.#offered = offered; + this.#enabled = enabled; + this.#disabled = disabled; + + XPCOMUtils.defineLazyPreferenceGetter( + this, + "implementationPref", + pref, + undefined, + (_preference, _prevValue, _newValue) => this.#updateImplementation() + ); + + this.#updateImplementation(); + } + + get #currentPrefValue() { + // Read pref directly instead of relying on this.implementationPref because + // there is an implementationPref value update lag that affects tests. + return Services.prefs.getStringPref(this.#pref, undefined); + } + + get isAvailable() { + return [ + OptInFeature.PREF_AVAILABLE_VALUE, + OptInFeature.PREF_OFFERED_VALUE, + OptInFeature.PREF_ENABLED_VALUE, + OptInFeature.PREF_DISABLED_VALUE, + ].includes(this.#currentPrefValue); + } + + get isEnabled() { + return this.#currentPrefValue == OptInFeature.PREF_ENABLED_VALUE; + } + + get isDisabled() { + return this.#currentPrefValue == OptInFeature.PREF_DISABLED_VALUE; + } + + markAsAvailable() { + this.#markAs(OptInFeature.PREF_AVAILABLE_VALUE); + } + + markAsOffered() { + this.#markAs(OptInFeature.PREF_OFFERED_VALUE); + } + + markAsEnabled() { + this.#markAs(OptInFeature.PREF_ENABLED_VALUE); + } + + markAsDisabled() { + this.#markAs(OptInFeature.PREF_DISABLED_VALUE); + } + + #markAs(value) { + Services.prefs.setStringPref(this.#pref, value); + } + + #updateImplementation() { + switch (this.implementationPref) { + case OptInFeature.PREF_ENABLED_VALUE: + this.implementation = new this.#enabled(); + break; + case OptInFeature.PREF_AVAILABLE_VALUE: + case OptInFeature.PREF_OFFERED_VALUE: + this.implementation = new this.#offered(); + break; + case OptInFeature.PREF_DISABLED_VALUE: + default: + this.implementation = new this.#disabled(); + break; + } + } +} diff --git a/toolkit/components/passwordmgr/LoginInfo.sys.mjs b/toolkit/components/passwordmgr/LoginInfo.sys.mjs new file mode 100644 index 0000000000..8db67eb6f2 --- /dev/null +++ b/toolkit/components/passwordmgr/LoginInfo.sys.mjs @@ -0,0 +1,139 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +const lazy = {}; + +ChromeUtils.defineESModuleGetters(lazy, { + LoginHelper: "resource://gre/modules/LoginHelper.sys.mjs", +}); + +export function nsLoginInfo() {} + +nsLoginInfo.prototype = { + classID: Components.ID("{0f2f347c-1e4f-40cc-8efd-792dea70a85e}"), + QueryInterface: ChromeUtils.generateQI(["nsILoginInfo", "nsILoginMetaInfo"]), + + // + // nsILoginInfo interfaces... + // + + origin: null, + formActionOrigin: null, + httpRealm: null, + username: null, + password: null, + usernameField: null, + passwordField: null, + unknownFields: null, + + get displayOrigin() { + let displayOrigin = this.origin; + try { + let uri = Services.io.newURI(this.origin); + // Fallback to handle file: URIs + displayOrigin = uri.displayHostPort || this.origin; + } catch (ex) { + // Fallback to this.origin set above in case a URI can't be contructed e.g. + // file:// + } + + if (this.httpRealm === null) { + return displayOrigin; + } + + return `${displayOrigin} (${this.httpRealm})`; + }, + + /** + * @deprecated Use `origin` instead. + */ + get hostname() { + return this.origin; + }, + + /** + * @deprecated Use `formActionOrigin` instead. + */ + get formSubmitURL() { + return this.formActionOrigin; + }, + + init( + aOrigin, + aFormActionOrigin, + aHttpRealm, + aUsername, + aPassword, + aUsernameField = "", + aPasswordField = "" + ) { + this.origin = aOrigin; + this.formActionOrigin = aFormActionOrigin; + this.httpRealm = aHttpRealm; + this.username = aUsername; + this.password = aPassword; + this.usernameField = aUsernameField || ""; + this.passwordField = aPasswordField || ""; + }, + + matches(aLogin, ignorePassword) { + return lazy.LoginHelper.doLoginsMatch(this, aLogin, { + ignorePassword, + }); + }, + + equals(aLogin) { + if ( + this.origin != aLogin.origin || + this.formActionOrigin != aLogin.formActionOrigin || + this.httpRealm != aLogin.httpRealm || + this.username != aLogin.username || + this.password != aLogin.password || + this.usernameField != aLogin.usernameField || + this.passwordField != aLogin.passwordField + ) { + return false; + } + + return true; + }, + + clone() { + let clone = Cc["@mozilla.org/login-manager/loginInfo;1"].createInstance( + Ci.nsILoginInfo + ); + clone.init( + this.origin, + this.formActionOrigin, + this.httpRealm, + this.username, + this.password, + this.usernameField, + this.passwordField + ); + + // Copy nsILoginMetaInfo props + clone.QueryInterface(Ci.nsILoginMetaInfo); + clone.guid = this.guid; + clone.timeCreated = this.timeCreated; + clone.timeLastUsed = this.timeLastUsed; + clone.timePasswordChanged = this.timePasswordChanged; + clone.timesUsed = this.timesUsed; + + // Unknown fields from other clients + clone.unknownFields = this.unknownFields; + + return clone; + }, + + // + // nsILoginMetaInfo interfaces... + // + + guid: null, + timeCreated: null, + timeLastUsed: null, + timePasswordChanged: null, + timesUsed: null, +}; // end of nsLoginInfo implementation diff --git a/toolkit/components/passwordmgr/LoginManager.shared.mjs b/toolkit/components/passwordmgr/LoginManager.shared.mjs new file mode 100644 index 0000000000..bacbfc8696 --- /dev/null +++ b/toolkit/components/passwordmgr/LoginManager.shared.mjs @@ -0,0 +1,48 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/** + * Code that we can share across Firefox Desktop, Firefox Android and Firefox iOS. + */ + +class Logic { + static inputTypeIsCompatibleWithUsername(input) { + const fieldType = input.getAttribute("type")?.toLowerCase() || input.type; + return ( + fieldType == "text" || + fieldType == "email" || + fieldType == "url" || + fieldType == "tel" || + fieldType == "number" || + fieldType == "search" + ); + } + + /** + * Test whether the element has the keyword in its attributes. + * The tested attributes include id, name, className, and placeholder. + */ + static elementAttrsMatchRegex(element, regex) { + if ( + regex.test(element.id) || + regex.test(element.name) || + regex.test(element.className) + ) { + return true; + } + + const placeholder = element.getAttribute("placeholder"); + return placeholder && regex.test(placeholder); + } + + /** + * Test whether associated labels of the element have the keyword. + * This is a simplified rule of hasLabelMatchingRegex in NewPasswordModel.jsm + */ + static hasLabelMatchingRegex(element, regex) { + return regex.test(element.labels?.[0]?.textContent); + } +} + +export { Logic }; diff --git a/toolkit/components/passwordmgr/LoginManager.sys.mjs b/toolkit/components/passwordmgr/LoginManager.sys.mjs new file mode 100644 index 0000000000..da46244563 --- /dev/null +++ b/toolkit/components/passwordmgr/LoginManager.sys.mjs @@ -0,0 +1,707 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +const PERMISSION_SAVE_LOGINS = "login-saving"; +const MAX_DATE_MS = 8640000000000000; + +import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs"; + +const lazy = {}; + +ChromeUtils.defineESModuleGetters(lazy, { + LoginHelper: "resource://gre/modules/LoginHelper.sys.mjs", +}); + +XPCOMUtils.defineLazyGetter(lazy, "log", () => { + let logger = lazy.LoginHelper.createLogger("LoginManager"); + return logger; +}); + +const MS_PER_DAY = 24 * 60 * 60 * 1000; + +if (Services.appinfo.processType !== Services.appinfo.PROCESS_TYPE_DEFAULT) { + throw new Error("LoginManager.jsm should only run in the parent process"); +} + +export function LoginManager() { + this.init(); +} + +LoginManager.prototype = { + classID: Components.ID("{cb9e0de8-3598-4ed7-857b-827f011ad5d8}"), + QueryInterface: ChromeUtils.generateQI([ + "nsILoginManager", + "nsISupportsWeakReference", + "nsIInterfaceRequestor", + ]), + getInterface(aIID) { + if (aIID.equals(Ci.mozIStorageConnection) && this._storage) { + let ir = this._storage.QueryInterface(Ci.nsIInterfaceRequestor); + return ir.getInterface(aIID); + } + + if (aIID.equals(Ci.nsIVariant)) { + // Allows unwrapping the JavaScript object for regression tests. + return this; + } + + throw new Components.Exception( + "Interface not available", + Cr.NS_ERROR_NO_INTERFACE + ); + }, + + /* ---------- private members ---------- */ + + _storage: null, // Storage component which contains the saved logins + + /** + * Initialize the Login Manager. Automatically called when service + * is created. + * + * Note: Service created in BrowserGlue#_scheduleStartupIdleTasks() + */ + init() { + // Cache references to current |this| in utility objects + this._observer._pwmgr = this; + + Services.obs.addObserver(this._observer, "xpcom-shutdown"); + Services.obs.addObserver(this._observer, "passwordmgr-storage-replace"); + + // Initialize storage so that asynchronous data loading can start. + this._initStorage(); + + Services.obs.addObserver(this._observer, "gather-telemetry"); + }, + + _initStorage() { + this._storage = Cc[ + "@mozilla.org/login-manager/storage/default;1" + ].createInstance(Ci.nsILoginManagerStorage); + this.initializationPromise = this._storage.initialize(); + this.initializationPromise.then(() => { + lazy.log.debug( + "initializationPromise is resolved, updating isPrimaryPasswordSet in sharedData" + ); + Services.ppmm.sharedData.set( + "isPrimaryPasswordSet", + lazy.LoginHelper.isPrimaryPasswordSet() + ); + }); + }, + + /* ---------- Utility objects ---------- */ + + /** + * Internal utility object, implements the nsIObserver interface. + * Used to receive notification for: form submission, preference changes. + */ + _observer: { + _pwmgr: null, + + QueryInterface: ChromeUtils.generateQI([ + "nsIObserver", + "nsISupportsWeakReference", + ]), + + // nsIObserver + observe(subject, topic, data) { + if (topic == "xpcom-shutdown") { + delete this._pwmgr._storage; + this._pwmgr = null; + } else if (topic == "passwordmgr-storage-replace") { + (async () => { + await this._pwmgr._storage.terminate(); + this._pwmgr._initStorage(); + await this._pwmgr.initializationPromise; + Services.obs.notifyObservers( + null, + "passwordmgr-storage-replace-complete" + ); + })(); + } else if (topic == "gather-telemetry") { + // When testing, the "data" parameter is a string containing the + // reference time in milliseconds for time-based statistics. + this._pwmgr._gatherTelemetry( + data ? parseInt(data) : new Date().getTime() + ); + } else { + lazy.log.debug(`Unexpected notification: ${topic}.`); + } + }, + }, + + /** + * Collects statistics about the current logins and settings. The telemetry + * histograms used here are not accumulated, but are reset each time this + * function is called, since it can be called multiple times in a session. + * + * This function might also not be called at all in the current session. + * + * @param referenceTimeMs + * Current time used to calculate time-based statistics, expressed as + * the number of milliseconds since January 1, 1970, 00:00:00 UTC. + * This is set to a fake value during unit testing. + */ + async _gatherTelemetry(referenceTimeMs) { + function clearAndGetHistogram(histogramId) { + let histogram = Services.telemetry.getHistogramById(histogramId); + histogram.clear(); + return histogram; + } + + clearAndGetHistogram("PWMGR_BLOCKLIST_NUM_SITES").add( + this.getAllDisabledHosts().length + ); + clearAndGetHistogram("PWMGR_NUM_SAVED_PASSWORDS").add( + this.countLogins("", "", "") + ); + clearAndGetHistogram("PWMGR_NUM_HTTPAUTH_PASSWORDS").add( + this.countLogins("", null, "") + ); + Services.obs.notifyObservers( + null, + "weave:telemetry:histogram", + "PWMGR_BLOCKLIST_NUM_SITES" + ); + Services.obs.notifyObservers( + null, + "weave:telemetry:histogram", + "PWMGR_NUM_SAVED_PASSWORDS" + ); + + // This is a boolean histogram, and not a flag, because we don't want to + // record any value if _gatherTelemetry is not called. + clearAndGetHistogram("PWMGR_SAVING_ENABLED").add(lazy.LoginHelper.enabled); + Services.obs.notifyObservers( + null, + "weave:telemetry:histogram", + "PWMGR_SAVING_ENABLED" + ); + + // Don't try to get logins if MP is enabled, since we don't want to show a MP prompt. + if (!this.isLoggedIn) { + return; + } + + let logins = await this.getAllLoginsAsync(); + + let usernamePresentHistogram = clearAndGetHistogram( + "PWMGR_USERNAME_PRESENT" + ); + let loginLastUsedDaysHistogram = clearAndGetHistogram( + "PWMGR_LOGIN_LAST_USED_DAYS" + ); + + let originCount = new Map(); + for (let login of logins) { + usernamePresentHistogram.add(!!login.username); + + let origin = login.origin; + originCount.set(origin, (originCount.get(origin) || 0) + 1); + + login.QueryInterface(Ci.nsILoginMetaInfo); + let timeLastUsedAgeMs = referenceTimeMs - login.timeLastUsed; + if (timeLastUsedAgeMs > 0) { + loginLastUsedDaysHistogram.add( + Math.floor(timeLastUsedAgeMs / MS_PER_DAY) + ); + } + } + Services.obs.notifyObservers( + null, + "weave:telemetry:histogram", + "PWMGR_LOGIN_LAST_USED_DAYS" + ); + + let passwordsCountHistogram = clearAndGetHistogram( + "PWMGR_NUM_PASSWORDS_PER_HOSTNAME" + ); + for (let count of originCount.values()) { + passwordsCountHistogram.add(count); + } + Services.obs.notifyObservers( + null, + "weave:telemetry:histogram", + "PWMGR_NUM_PASSWORDS_PER_HOSTNAME" + ); + + Services.obs.notifyObservers(null, "passwordmgr-gather-telemetry-complete"); + }, + + /** + * Ensures that a login isn't missing any necessary fields. + * + * @param login + * The login to check. + */ + _checkLogin(login) { + // Sanity check the login + if (login.origin == null || !login.origin.length) { + throw new Error("Can't add a login with a null or empty origin."); + } + + // For logins w/o a username, set to "", not null. + if (login.username == null) { + throw new Error("Can't add a login with a null username."); + } + + if (login.password == null || !login.password.length) { + throw new Error("Can't add a login with a null or empty password."); + } + + // Duplicated from toolkit/components/passwordmgr/LoginHelper.jsm + // TODO: move all validations into this function. + // + // In theory these nulls should just be rolled up into the encrypted + // values, but nsISecretDecoderRing doesn't use nsStrings, so the + // nulls cause truncation. Check for them here just to avoid + // unexpected round-trip surprises. + if (login.username.includes("\0") || login.password.includes("\0")) { + throw new Error("login values can't contain nulls"); + } + + if (login.formActionOrigin || login.formActionOrigin == "") { + // We have a form submit URL. Can't have a HTTP realm. + if (login.httpRealm != null) { + throw new Error( + "Can't add a login with both a httpRealm and formActionOrigin." + ); + } + } else if (login.httpRealm) { + // We have a HTTP realm. Can't have a form submit URL. + if (login.formActionOrigin != null) { + throw new Error( + "Can't add a login with both a httpRealm and formActionOrigin." + ); + } + } else { + // Need one or the other! + throw new Error( + "Can't add a login without a httpRealm or formActionOrigin." + ); + } + + login.QueryInterface(Ci.nsILoginMetaInfo); + for (let pname of ["timeCreated", "timeLastUsed", "timePasswordChanged"]) { + // Invalid dates + if (login[pname] > MAX_DATE_MS) { + throw new Error("Can't add a login with invalid date properties."); + } + } + }, + + /* ---------- Primary Public interfaces ---------- */ + + /** + * @type Promise + * This promise is resolved when initialization is complete, and is rejected + * in case the asynchronous part of initialization failed. + */ + initializationPromise: null, + + /** + * Add a new login to login storage. + * @deprecated: use `addLoginAsync` instead. + */ + addLogin(login) { + this._checkLogin(login); + + // Look for an existing entry. + let logins = this.findLogins( + login.origin, + login.formActionOrigin, + login.httpRealm + ); + + let matchingLogin = logins.find(l => login.matches(l, true)); + if (matchingLogin) { + throw lazy.LoginHelper.createLoginAlreadyExistsError(matchingLogin.guid); + } + lazy.log.debug("addLogin is DEPRECATED, please use addLoginAsync instead."); + return this._storage.addLogin(login); + }, + + /** + * Add a new login to login storage. + */ + async addLoginAsync(login) { + this._checkLogin(login); + + const { origin, formActionOrigin, httpRealm } = login; + const existingLogins = this.findLogins(origin, formActionOrigin, httpRealm); + const matchingLogin = existingLogins.find(l => login.matches(l, true)); + if (matchingLogin) { + throw lazy.LoginHelper.createLoginAlreadyExistsError(matchingLogin.guid); + } + + const crypto = Cc["@mozilla.org/login-manager/crypto/SDR;1"].getService( + Ci.nsILoginManagerCrypto + ); + const plaintexts = [login.username, login.password, login.unknownFields]; + const [username, password, unknownFields] = await crypto.encryptMany( + plaintexts + ); + + const { username: plaintextUsername, password: plaintextPassword } = login; + login.username = username; + login.password = password; + login.unknownFields = unknownFields; + + lazy.log.debug("Adding login"); + return this._storage.addLogin( + login, + true, + plaintextUsername, + plaintextPassword + ); + }, + + async addLogins(logins) { + if (logins.length === 0) { + return logins; + } + + const crypto = Cc["@mozilla.org/login-manager/crypto/SDR;1"].getService( + Ci.nsILoginManagerCrypto + ); + const plaintexts = logins + .map(({ username }) => username) + .concat(logins.map(({ password }) => password)); + const ciphertexts = await crypto.encryptMany(plaintexts); + const usernames = ciphertexts.slice(0, logins.length); + const passwords = ciphertexts.slice(logins.length); + + const resultLogins = []; + for (const [i, login] of logins.entries()) { + try { + this._checkLogin(login); + } catch (e) { + console.error(e); + continue; + } + + const { origin, formActionOrigin, httpRealm } = login; + const existingLogins = this.findLogins( + origin, + formActionOrigin, + httpRealm + ); + const matchingLogin = existingLogins.find(l => login.matches(l, true)); + if (matchingLogin) { + console.error( + lazy.LoginHelper.createLoginAlreadyExistsError(matchingLogin.guid) + ); + continue; + } + + const { username: plaintextUsername, password: plaintextPassword } = + login; + login.username = usernames[i]; + login.password = passwords[i]; + lazy.log.debug("Adding login"); + const resultLogin = this._storage.addLogin( + login, + true, + plaintextUsername, + plaintextPassword + ); + + resultLogins.push(resultLogin); + } + return resultLogins; + }, + + /** + * Remove the specified login from the stored logins. + */ + removeLogin(login) { + lazy.log.debug( + "Removing login", + login.QueryInterface(Ci.nsILoginMetaInfo).guid + ); + return this._storage.removeLogin(login); + }, + + /** + * Change the specified login to match the new login or new properties. + */ + modifyLogin(oldLogin, newLogin) { + lazy.log.debug( + "Modifying login", + oldLogin.QueryInterface(Ci.nsILoginMetaInfo).guid + ); + return this._storage.modifyLogin(oldLogin, newLogin); + }, + + /** + * Record that the password of a saved login was used (e.g. submitted or copied). + */ + recordPasswordUse( + login, + privateContextWithoutExplicitConsent, + loginType, + filled + ) { + lazy.log.debug( + "Recording password use", + loginType, + login.QueryInterface(Ci.nsILoginMetaInfo).guid + ); + if (!privateContextWithoutExplicitConsent) { + // don't record non-interactive use in private browsing + this._storage.recordPasswordUse(login); + } + + Services.telemetry.recordEvent( + "pwmgr", + "saved_login_used", + loginType, + null, + { + filled: "" + filled, + } + ); + }, + + /** + * Get a dump of all stored logins. Used by the login manager UI. + * + * @return {nsILoginInfo[]} - If there are no logins, the array is empty. + */ + getAllLogins() { + lazy.log.debug("Getting a list of all logins."); + return this._storage.getAllLogins(); + }, + + /** + * Get a dump of all stored logins asynchronously. Used by the login manager UI. + * + * @return {nsILoginInfo[]} - If there are no logins, the array is empty. + */ + async getAllLoginsAsync() { + lazy.log.debug("Getting a list of all logins asynchronously."); + return this._storage.getAllLoginsAsync(); + }, + + /** + * Get a dump of all stored logins asynchronously. Used by the login detection service. + */ + getAllLoginsWithCallbackAsync(aCallback) { + lazy.log.debug("Searching a list of all logins asynchronously."); + this._storage.getAllLoginsAsync().then(logins => { + aCallback.onSearchComplete(logins); + }); + }, + + /** + * Remove all user facing stored logins. + * + * This will not remove the FxA Sync key, which is stored with the rest of a user's logins. + */ + removeAllUserFacingLogins() { + lazy.log.debug("Removing all user facing logins."); + this._storage.removeAllUserFacingLogins(); + }, + + /** + * Remove all logins from data store, including the FxA Sync key. + * + * NOTE: You probably want `removeAllUserFacingLogins()` instead of this function. + * This function will remove the FxA Sync key, which will break syncing of saved user data + * e.g. bookmarks, history, open tabs, logins and passwords, add-ons, and options + */ + removeAllLogins() { + lazy.log.debug("Removing all logins from local store, including FxA key."); + this._storage.removeAllLogins(); + }, + + /** + * Get a list of all origins for which logins are disabled. + * + * @param {Number} count - only needed for XPCOM. + * + * @return {String[]} of disabled origins. If there are no disabled origins, + * the array is empty. + */ + getAllDisabledHosts() { + lazy.log.debug("Getting a list of all disabled origins."); + + let disabledHosts = []; + for (let perm of Services.perms.all) { + if ( + perm.type == PERMISSION_SAVE_LOGINS && + perm.capability == Services.perms.DENY_ACTION + ) { + disabledHosts.push(perm.principal.URI.displayPrePath); + } + } + + lazy.log.debug(`Returning ${disabledHosts.length} disabled hosts.`); + return disabledHosts; + }, + + /** + * Search for the known logins for entries matching the specified criteria. + */ + findLogins(origin, formActionOrigin, httpRealm) { + lazy.log.debug( + "Searching for logins matching origin:", + origin, + "formActionOrigin:", + formActionOrigin, + "httpRealm:", + httpRealm + ); + + return this._storage.findLogins(origin, formActionOrigin, httpRealm); + }, + + async searchLoginsAsync(matchData) { + lazy.log.debug( + `Searching for matching logins for origin: ${matchData.origin}` + ); + + if (!matchData.origin) { + throw new Error("searchLoginsAsync: An `origin` is required"); + } + + return this._storage.searchLoginsAsync(matchData); + }, + + /** + * @return {nsILoginInfo[]} which are decrypted. + */ + searchLogins(matchData) { + lazy.log.debug( + `Searching for matching logins for origin: ${matchData.origin}` + ); + + matchData.QueryInterface(Ci.nsIPropertyBag2); + if (!matchData.hasKey("guid")) { + if (!matchData.hasKey("origin")) { + lazy.log.warn("An `origin` field is recommended."); + } + } + + return this._storage.searchLogins(matchData); + }, + + /** + * Search for the known logins for entries matching the specified criteria, + * returns only the count. + */ + countLogins(origin, formActionOrigin, httpRealm) { + const loginsCount = this._storage.countLogins( + origin, + formActionOrigin, + httpRealm + ); + + lazy.log.debug( + `Found ${loginsCount} matching origin: ${origin}, formActionOrigin: ${formActionOrigin} and realm: ${httpRealm}` + ); + + return loginsCount; + }, + + /* Sync metadata functions - see nsILoginManagerStorage for details */ + async getSyncID() { + return this._storage.getSyncID(); + }, + + async setSyncID(id) { + await this._storage.setSyncID(id); + }, + + async getLastSync() { + return this._storage.getLastSync(); + }, + + async setLastSync(timestamp) { + await this._storage.setLastSync(timestamp); + }, + + async ensureCurrentSyncID(newSyncID) { + let existingSyncID = await this.getSyncID(); + if (existingSyncID == newSyncID) { + return existingSyncID; + } + lazy.log.debug( + `ensureCurrentSyncID: newSyncID: ${newSyncID} existingSyncID: ${existingSyncID}` + ); + + await this.setSyncID(newSyncID); + await this.setLastSync(0); + return newSyncID; + }, + + get uiBusy() { + return this._storage.uiBusy; + }, + + get isLoggedIn() { + return this._storage.isLoggedIn; + }, + + /** + * Check to see if user has disabled saving logins for the origin. + */ + getLoginSavingEnabled(origin) { + lazy.log.debug(`Checking if logins to ${origin} can be saved.`); + if (!lazy.LoginHelper.enabled) { + return false; + } + + try { + let uri = Services.io.newURI(origin); + let principal = Services.scriptSecurityManager.createContentPrincipal( + uri, + {} + ); + return ( + Services.perms.testPermissionFromPrincipal( + principal, + PERMISSION_SAVE_LOGINS + ) != Services.perms.DENY_ACTION + ); + } catch (ex) { + if (!origin.startsWith("chrome:")) { + console.error(ex); + } + return false; + } + }, + + /** + * Enable or disable storing logins for the specified origin. + */ + setLoginSavingEnabled(origin, enabled) { + // Throws if there are bogus values. + lazy.LoginHelper.checkOriginValue(origin); + + let uri = Services.io.newURI(origin); + let principal = Services.scriptSecurityManager.createContentPrincipal( + uri, + {} + ); + if (enabled) { + Services.perms.removeFromPrincipal(principal, PERMISSION_SAVE_LOGINS); + } else { + Services.perms.addFromPrincipal( + principal, + PERMISSION_SAVE_LOGINS, + Services.perms.DENY_ACTION + ); + } + + lazy.log.debug( + `Enabling login saving for ${origin} now enabled? ${enabled}.` + ); + lazy.LoginHelper.notifyStorageChanged( + enabled ? "hostSavingEnabled" : "hostSavingDisabled", + origin + ); + }, +}; // end of LoginManager implementation diff --git a/toolkit/components/passwordmgr/LoginManagerAuthPrompter.sys.mjs b/toolkit/components/passwordmgr/LoginManagerAuthPrompter.sys.mjs new file mode 100644 index 0000000000..6d66b17d63 --- /dev/null +++ b/toolkit/components/passwordmgr/LoginManagerAuthPrompter.sys.mjs @@ -0,0 +1,1115 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +import { PrivateBrowsingUtils } from "resource://gre/modules/PrivateBrowsingUtils.sys.mjs"; +import { PromptUtils } from "resource://gre/modules/PromptUtils.sys.mjs"; +import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs"; + +const lazy = {}; + +XPCOMUtils.defineLazyServiceGetter( + lazy, + "gPrompterService", + "@mozilla.org/login-manager/prompter;1", + Ci.nsILoginManagerPrompter +); + +/* eslint-disable block-scoped-var, no-var */ + +ChromeUtils.defineESModuleGetters(lazy, { + LoginHelper: "resource://gre/modules/LoginHelper.sys.mjs", +}); + +const LoginInfo = Components.Constructor( + "@mozilla.org/login-manager/loginInfo;1", + "nsILoginInfo", + "init" +); + +/** + * A helper module to prevent modal auth prompt abuse. + */ +const PromptAbuseHelper = { + getBaseDomainOrFallback(hostname) { + try { + return Services.eTLD.getBaseDomainFromHost(hostname); + } catch (e) { + return hostname; + } + }, + + incrementPromptAbuseCounter(baseDomain, browser) { + if (!browser) { + return; + } + + if (!browser.authPromptAbuseCounter) { + browser.authPromptAbuseCounter = {}; + } + + if (!browser.authPromptAbuseCounter[baseDomain]) { + browser.authPromptAbuseCounter[baseDomain] = 0; + } + + browser.authPromptAbuseCounter[baseDomain] += 1; + }, + + resetPromptAbuseCounter(baseDomain, browser) { + if (!browser || !browser.authPromptAbuseCounter) { + return; + } + + browser.authPromptAbuseCounter[baseDomain] = 0; + }, + + hasReachedAbuseLimit(baseDomain, browser) { + if (!browser || !browser.authPromptAbuseCounter) { + return false; + } + + let abuseCounter = browser.authPromptAbuseCounter[baseDomain]; + // Allow for setting -1 to turn the feature off. + if (this.abuseLimit < 0) { + return false; + } + return !!abuseCounter && abuseCounter >= this.abuseLimit; + }, +}; + +XPCOMUtils.defineLazyPreferenceGetter( + PromptAbuseHelper, + "abuseLimit", + "prompts.authentication_dialog_abuse_limit" +); + +/** + * Implements nsIPromptFactory + * + * Invoked by [toolkit/components/prompts/src/Prompter.jsm] + */ +export function LoginManagerAuthPromptFactory() { + Services.obs.addObserver(this, "passwordmgr-crypto-login", true); +} + +LoginManagerAuthPromptFactory.prototype = { + classID: Components.ID("{749e62f4-60ae-4569-a8a2-de78b649660e}"), + QueryInterface: ChromeUtils.generateQI([ + "nsIPromptFactory", + "nsIObserver", + "nsISupportsWeakReference", + ]), + + // Tracks pending auth prompts per top level browser and hash key. + // browser -> hashkey -> prompt + // This enables us to consolidate auth prompts with the same browser and + // hashkey (level, origin, realm). + _pendingPrompts: new WeakMap(), + _pendingSavePrompts: new WeakMap(), + // We use a separate bucket for when we don't have a browser. + // _noBrowser -> hashkey -> prompt + _noBrowser: {}, + // Promise used to defer prompts if the password manager isn't ready when + // they're called. + _uiBusyPromise: null, + _uiBusyResolve: null, + + observe(subject, topic, data) { + this.log(`Observed topic: ${topic}.`); + if (topic == "passwordmgr-crypto-login") { + // Show the deferred prompters. + this._uiBusyResolve?.(); + } + }, + + getPrompt(aWindow, aIID) { + var prompt = new LoginManagerAuthPrompter().QueryInterface(aIID); + prompt.init(aWindow, this); + return prompt; + }, + + getPendingPrompt(browser, hashKey) { + // If there is already a matching auth prompt which has no browser + // associated we can reuse it. This way we avoid showing tab level prompts + // when there is already a pending window prompt. + let pendingNoBrowserPrompt = this._pendingPrompts + .get(this._noBrowser) + ?.get(hashKey); + if (pendingNoBrowserPrompt) { + return pendingNoBrowserPrompt; + } + return this._pendingPrompts.get(browser)?.get(hashKey); + }, + + _dismissPendingSavePrompt(browser) { + this._pendingSavePrompts.get(browser)?.dismiss(); + this._pendingSavePrompts.delete(browser); + }, + + _setPendingSavePrompt(browser, prompt) { + this._pendingSavePrompts.set(browser, prompt); + }, + + _setPendingPrompt(prompt, hashKey) { + let browser = prompt.prompter.browser || this._noBrowser; + let hashToPrompt = this._pendingPrompts.get(browser); + if (!hashToPrompt) { + hashToPrompt = new Map(); + this._pendingPrompts.set(browser, hashToPrompt); + } + hashToPrompt.set(hashKey, prompt); + }, + + _removePendingPrompt(prompt, hashKey) { + let browser = prompt.prompter.browser || this._noBrowser; + let hashToPrompt = this._pendingPrompts.get(browser); + if (!hashToPrompt) { + return; + } + hashToPrompt.delete(hashKey); + if (!hashToPrompt.size) { + this._pendingPrompts.delete(browser); + } + }, + + async _waitForLoginsUI(prompt) { + await this._uiBusyPromise; + + let [origin, httpRealm] = prompt.prompter._getAuthTarget( + prompt.channel, + prompt.authInfo + ); + + // No UI to wait for. + if (!Services.logins.uiBusy) { + return; + } + + let hasLogins = Services.logins.countLogins(origin, null, httpRealm) > 0; + if ( + !hasLogins && + lazy.LoginHelper.schemeUpgrades && + origin.startsWith("https://") + ) { + let httpOrigin = origin.replace(/^https:\/\//, "http://"); + hasLogins = Services.logins.countLogins(httpOrigin, null, httpRealm) > 0; + } + // We don't depend on saved logins. + if (!hasLogins) { + return; + } + + this.log("Waiting for primary password UI."); + + this._uiBusyPromise = new Promise(resolve => { + this._uiBusyResolve = resolve; + }); + await this._uiBusyPromise; + }, + + async _doAsyncPrompt(prompt, hashKey) { + this._setPendingPrompt(prompt, hashKey); + + // UI might be busy due to the primary password dialog. Wait for it to close. + await this._waitForLoginsUI(prompt); + + let ok = false; + let promptAborted = false; + try { + this.log(`Performing the prompt for ${hashKey}.`); + ok = await prompt.prompter.promptAuthInternal( + prompt.channel, + prompt.level, + prompt.authInfo + ); + } catch (e) { + if ( + e instanceof Components.Exception && + e.result == Cr.NS_ERROR_NOT_AVAILABLE + ) { + this.log("Bypassed, UI is not available in this context."); + // Prompts throw NS_ERROR_NOT_AVAILABLE if they're aborted. + promptAborted = true; + } else { + console.error("LoginManagerAuthPrompter: _doAsyncPrompt " + e + "\n"); + } + } + + this._removePendingPrompt(prompt, hashKey); + + // Handle callbacks + for (var consumer of prompt.consumers) { + if (!consumer.callback) { + // Not having a callback means that consumer didn't provide it + // or canceled the notification + continue; + } + + this.log(`Calling back to callback: ${consumer.callback} ok: ${ok}.`); + try { + if (ok) { + consumer.callback.onAuthAvailable(consumer.context, prompt.authInfo); + } else { + consumer.callback.onAuthCancelled(consumer.context, !promptAborted); + } + } catch (e) { + /* Throw away exceptions caused by callback */ + } + } + }, +}; // end of LoginManagerAuthPromptFactory implementation + +XPCOMUtils.defineLazyGetter( + LoginManagerAuthPromptFactory.prototype, + "log", + () => { + let logger = lazy.LoginHelper.createLogger("LoginManagerAuthPromptFactory"); + return logger.log.bind(logger); + } +); + +/* ==================== LoginManagerAuthPrompter ==================== */ + +/** + * Implements interfaces for prompting the user to enter/save/change auth info. + * + * nsIAuthPrompt: Used by SeaMonkey, Thunderbird, but not Firefox. + * + * nsIAuthPrompt2: Is invoked by a channel for protocol-based authentication + * (eg HTTP Authenticate, FTP login). + * + * nsILoginManagerAuthPrompter: Used by consumers to indicate which tab/window a + * prompt should appear on. + */ +export function LoginManagerAuthPrompter() {} + +LoginManagerAuthPrompter.prototype = { + classID: Components.ID("{8aa66d77-1bbb-45a6-991e-b8f47751c291}"), + QueryInterface: ChromeUtils.generateQI([ + "nsIAuthPrompt", + "nsIAuthPrompt2", + "nsILoginManagerAuthPrompter", + ]), + + _factory: null, + _chromeWindow: null, + _browser: null, + + __strBundle: null, // String bundle for L10N + get _strBundle() { + if (!this.__strBundle) { + this.__strBundle = Services.strings.createBundle( + "chrome://passwordmgr/locale/passwordmgr.properties" + ); + if (!this.__strBundle) { + throw new Error("String bundle for Login Manager not present!"); + } + } + + return this.__strBundle; + }, + + __ellipsis: null, + get _ellipsis() { + if (!this.__ellipsis) { + this.__ellipsis = "\u2026"; + try { + this.__ellipsis = Services.prefs.getComplexValue( + "intl.ellipsis", + Ci.nsIPrefLocalizedString + ).data; + } catch (e) {} + } + return this.__ellipsis; + }, + + // Whether we are in private browsing mode + get _inPrivateBrowsing() { + if (this._chromeWindow) { + return PrivateBrowsingUtils.isWindowPrivate(this._chromeWindow); + } + // If we don't that we're in private browsing mode if the caller did + // not provide a window. The callers which really care about this + // will indeed pass down a window to us, and for those who don't, + // we can just assume that we don't want to save the entered login + // information. + this.log("We have no chromeWindow so assume we're in a private context."); + return true; + }, + + get _allowRememberLogin() { + if (!this._inPrivateBrowsing) { + return true; + } + return lazy.LoginHelper.privateBrowsingCaptureEnabled; + }, + + /* ---------- nsIAuthPrompt prompts ---------- */ + + /** + * Wrapper around the prompt service prompt. Saving random fields here + * doesn't really make sense and therefore isn't implemented. + */ + prompt( + aDialogTitle, + aText, + aPasswordRealm, + aSavePassword, + aDefaultText, + aResult + ) { + if (aSavePassword != Ci.nsIAuthPrompt.SAVE_PASSWORD_NEVER) { + throw new Components.Exception( + "prompt only supports SAVE_PASSWORD_NEVER", + Cr.NS_ERROR_NOT_IMPLEMENTED + ); + } + + if (aDefaultText) { + aResult.value = aDefaultText; + } + + return Services.prompt.prompt( + this._chromeWindow, + aDialogTitle, + aText, + aResult, + null, + {} + ); + }, + + /** + * Looks up a username and password in the database. Will prompt the user + * with a dialog, even if a username and password are found. + */ + async asyncPromptUsernameAndPassword( + aDialogTitle, + aText, + aPasswordRealm, + aSavePassword, + aUsername, + aPassword + ) { + if (aSavePassword == Ci.nsIAuthPrompt.SAVE_PASSWORD_FOR_SESSION) { + throw new Components.Exception( + "asyncPromptUsernameAndPassword doesn't support SAVE_PASSWORD_FOR_SESSION", + Cr.NS_ERROR_NOT_IMPLEMENTED + ); + } + + let foundLogins = null; + let canRememberLogin = false; + var selectedLogin = null; + var [origin, realm] = this._getRealmInfo(aPasswordRealm); + + // If origin is null, we can't save this login. + if (origin) { + if (this._allowRememberLogin) { + canRememberLogin = + aSavePassword == Ci.nsIAuthPrompt.SAVE_PASSWORD_PERMANENTLY && + Services.logins.getLoginSavingEnabled(origin); + } + + // Look for existing logins. + foundLogins = Services.logins.findLogins(origin, null, realm); + + // XXX Like the original code, we can't deal with multiple + // account selection. (bug 227632) + if (foundLogins.length) { + selectedLogin = foundLogins[0]; + + // If the caller provided a username, try to use it. If they + // provided only a password, this will try to find a password-only + // login (or return null if none exists). + if (aUsername.value) { + selectedLogin = this._repickSelectedLogin( + foundLogins, + aUsername.value + ); + } + + if (selectedLogin) { + aUsername.value = selectedLogin.username; + // If the caller provided a password, prefer it. + if (!aPassword.value) { + aPassword.value = selectedLogin.password; + } + } + } + } + + let autofilled = !!aPassword.value; + var ok = Services.prompt.promptUsernameAndPassword( + this._chromeWindow, + aDialogTitle, + aText, + aUsername, + aPassword + ); + + if (!ok || !canRememberLogin) { + return ok; + } + + if (!aPassword.value) { + this.log("No password entered, so won't offer to save."); + return ok; + } + + // XXX We can't prompt with multiple logins yet (bug 227632), so + // the entered login might correspond to an existing login + // other than the one we originally selected. + selectedLogin = this._repickSelectedLogin(foundLogins, aUsername.value); + + // If we didn't find an existing login, or if the username + // changed, save as a new login. + let newLogin = new LoginInfo( + origin, + null, + realm, + aUsername.value, + aPassword.value + ); + if (!selectedLogin) { + // add as new + this.log(`New login seen for: ${realm}.`); + await Services.logins.addLoginAsync(newLogin); + } else if (aPassword.value != selectedLogin.password) { + // update password + this.log(`Updating password for ${realm}.`); + this._updateLogin(selectedLogin, newLogin); + } else { + this.log("Login unchanged, no further action needed."); + Services.logins.recordPasswordUse( + selectedLogin, + this._inPrivateBrowsing, + "prompt_login", + autofilled + ); + } + + return ok; + }, + + /** + * If a password is found in the database for the password realm, it is + * returned straight away without displaying a dialog. + * + * If a password is not found in the database, the user will be prompted + * with a dialog with a text field and ok/cancel buttons. If the user + * allows it, then the password will be saved in the database. + */ + async asyncPromptPassword( + aDialogTitle, + aText, + aPasswordRealm, + aSavePassword, + aPassword + ) { + if (aSavePassword == Ci.nsIAuthPrompt.SAVE_PASSWORD_FOR_SESSION) { + throw new Components.Exception( + "promptPassword doesn't support SAVE_PASSWORD_FOR_SESSION", + Cr.NS_ERROR_NOT_IMPLEMENTED + ); + } + + var [origin, realm, username] = this._getRealmInfo(aPasswordRealm); + + username = decodeURIComponent(username); + + let canRememberLogin = false; + // If origin is null, we can't save this login. + if (origin && !this._inPrivateBrowsing) { + canRememberLogin = + aSavePassword == Ci.nsIAuthPrompt.SAVE_PASSWORD_PERMANENTLY && + Services.logins.getLoginSavingEnabled(origin); + if (!aPassword.value) { + // Look for existing logins. + var foundLogins = Services.logins.findLogins(origin, null, realm); + + // XXX Like the original code, we can't deal with multiple + // account selection (bug 227632). We can deal with finding the + // account based on the supplied username - but in this case we'll + // just return the first match. + for (var i = 0; i < foundLogins.length; ++i) { + if (foundLogins[i].username == username) { + aPassword.value = foundLogins[i].password; + // wallet returned straight away, so this mimics that code + return true; + } + } + } + } + + var ok = Services.prompt.promptPassword( + this._chromeWindow, + aDialogTitle, + aText, + aPassword + ); + + if (ok && canRememberLogin && aPassword.value) { + let newLogin = new LoginInfo( + origin, + null, + realm, + username, + aPassword.value + ); + + this.log(`New login seen for ${realm}.`); + + await Services.logins.addLoginAsync(newLogin); + } + + return ok; + }, + + /* ---------- nsIAuthPrompt helpers ---------- */ + + /** + * Given aRealmString, such as "http://user@example.com/foo", returns an + * array of: + * - the formatted origin + * - the realm (origin + path) + * - the username, if present + * + * If aRealmString is in the format produced by NS_GetAuthKey for HTTP[S] + * channels, e.g. "example.com:80 (httprealm)", null is returned for all + * arguments to let callers know the login can't be saved because we don't + * know whether it's http or https. + */ + _getRealmInfo(aRealmString) { + var httpRealm = /^.+ \(.+\)$/; + if (httpRealm.test(aRealmString)) { + return [null, null, null]; + } + + var uri = Services.io.newURI(aRealmString); + var pathname = ""; + + if (uri.pathQueryRef != "/") { + pathname = uri.pathQueryRef; + } + + var formattedOrigin = this._getFormattedOrigin(uri); + + return [formattedOrigin, formattedOrigin + pathname, uri.username]; + }, + + async promptAuthInternal(aChannel, aLevel, aAuthInfo) { + var selectedLogin = null; + var epicfail = false; + var canAutologin = false; + var foundLogins; + let autofilled = false; + + try { + // If the user submits a login but it fails, we need to remove the + // notification prompt that was displayed. Conveniently, the user will + // be prompted for authentication again, which brings us here. + this._factory._dismissPendingSavePrompt(this._browser); + + var [origin, httpRealm] = this._getAuthTarget(aChannel, aAuthInfo); + + // Looks for existing logins to prefill the prompt with. + foundLogins = await Services.logins.searchLoginsAsync({ + origin, + httpRealm, + schemeUpgrades: lazy.LoginHelper.schemeUpgrades, + }); + this.log(`Found ${foundLogins.length} matching logins.`); + let resolveBy = ["scheme", "timePasswordChanged"]; + foundLogins = lazy.LoginHelper.dedupeLogins( + foundLogins, + ["username"], + resolveBy, + origin + ); + this.log(`${foundLogins.length} matching logins remain after deduping.`); + + // XXX Can't select from multiple accounts yet. (bug 227632) + if (foundLogins.length) { + selectedLogin = foundLogins[0]; + this._SetAuthInfo( + aAuthInfo, + selectedLogin.username, + selectedLogin.password + ); + autofilled = true; + + // Allow automatic proxy login + if ( + aAuthInfo.flags & Ci.nsIAuthInformation.AUTH_PROXY && + !(aAuthInfo.flags & Ci.nsIAuthInformation.PREVIOUS_FAILED) && + Services.prefs.getBoolPref("signon.autologin.proxy") && + !PrivateBrowsingUtils.permanentPrivateBrowsing + ) { + this.log("Autologin enabled, skipping auth prompt."); + canAutologin = true; + } + } + + var canRememberLogin = Services.logins.getLoginSavingEnabled(origin); + if (!this._allowRememberLogin) { + canRememberLogin = false; + } + } catch (e) { + // Ignore any errors and display the prompt anyway. + epicfail = true; + console.error( + "LoginManagerAuthPrompter: Epic fail in promptAuth: " + e + "\n" + ); + } + + var ok = canAutologin; + let browser = this._browser; + let baseDomain; + + // We might not have a browser or browser.currentURI.host could fail + // (e.g. on about:blank). Fall back to the subresource hostname in that case. + try { + let topLevelHost = browser.currentURI.host; + baseDomain = PromptAbuseHelper.getBaseDomainOrFallback(topLevelHost); + } catch (e) { + baseDomain = PromptAbuseHelper.getBaseDomainOrFallback(origin); + } + + if (!ok) { + if (PromptAbuseHelper.hasReachedAbuseLimit(baseDomain, browser)) { + this.log("Blocking auth dialog, due to exceeding dialog bloat limit."); + return false; + } + + // Set up a counter for ensuring that the basic auth prompt can not + // be abused for DOS-style attacks. With this counter, each eTLD+1 + // per browser will get a limited number of times a user can + // cancel the prompt until we stop showing it. + PromptAbuseHelper.incrementPromptAbuseCounter(baseDomain, browser); + + if (this._chromeWindow) { + PromptUtils.fireDialogEvent( + this._chromeWindow, + "DOMWillOpenModalDialog", + this._browser + ); + } + + ok = await Services.prompt.asyncPromptAuth( + this._browser?.browsingContext, + LoginManagerAuthPrompter.promptAuthModalType, + aChannel, + aLevel, + aAuthInfo + ); + } + + let [username, password] = this._GetAuthInfo(aAuthInfo); + + // Reset the counter state if the user replied to a prompt and actually + // tried to login (vs. simply clicking any button to get out). + if (ok && (username || password)) { + PromptAbuseHelper.resetPromptAbuseCounter(baseDomain, browser); + } + + if (!ok || !canRememberLogin || epicfail) { + return ok; + } + + try { + if (!password) { + this.log("No password entered, so won't offer to save."); + return ok; + } + + // XXX We can't prompt with multiple logins yet (bug 227632), so + // the entered login might correspond to an existing login + // other than the one we originally selected. + selectedLogin = this._repickSelectedLogin(foundLogins, username); + + // If we didn't find an existing login, or if the username + // changed, save as a new login. + let newLogin = new LoginInfo(origin, null, httpRealm, username, password); + if (!selectedLogin) { + this.log(`New login seen for origin: ${origin}.`); + + let promptBrowser = lazy.LoginHelper.getBrowserForPrompt(browser); + let savePrompt = lazy.gPrompterService.promptToSavePassword( + promptBrowser, + newLogin + ); + this._factory._setPendingSavePrompt(promptBrowser, savePrompt); + } else if (password != selectedLogin.password) { + this.log(`Updating password for origin: ${origin}.`); + + let promptBrowser = lazy.LoginHelper.getBrowserForPrompt(browser); + let savePrompt = lazy.gPrompterService.promptToChangePassword( + promptBrowser, + selectedLogin, + newLogin + ); + this._factory._setPendingSavePrompt(promptBrowser, savePrompt); + } else { + this.log("Login unchanged, no further action needed."); + Services.logins.recordPasswordUse( + selectedLogin, + this._inPrivateBrowsing, + "auth_login", + autofilled + ); + } + } catch (e) { + console.error("LoginManagerAuthPrompter: Fail2 in promptAuth: " + e); + } + + return ok; + }, + + /* ---------- nsIAuthPrompt2 prompts ---------- */ + + /** + * Implementation of nsIAuthPrompt2. + * + * @param {nsIChannel} aChannel + * @param {int} aLevel + * @param {nsIAuthInformation} aAuthInfo + */ + promptAuth(aChannel, aLevel, aAuthInfo) { + let closed = false; + let result = false; + this.promptAuthInternal(aChannel, aLevel, aAuthInfo) + .then(ok => (result = ok)) + .finally(() => (closed = true)); + Services.tm.spinEventLoopUntilOrQuit( + "LoginManagerAuthPrompter.jsm:promptAuth", + () => closed + ); + return result; + }, + + asyncPromptAuth(aChannel, aCallback, aContext, aLevel, aAuthInfo) { + var cancelable = null; + + try { + // If the user submits a login but it fails, we need to remove the + // notification prompt that was displayed. Conveniently, the user will + // be prompted for authentication again, which brings us here. + this._factory._dismissPendingSavePrompt(this._browser); + + cancelable = this._newAsyncPromptConsumer(aCallback, aContext); + + let [origin, httpRealm] = this._getAuthTarget(aChannel, aAuthInfo); + + let hashKey = aLevel + "|" + origin + "|" + httpRealm; + let pendingPrompt = this._factory.getPendingPrompt( + this._browser, + hashKey + ); + if (pendingPrompt) { + this.log( + `Prompt bound to an existing one in the queue, callback: ${aCallback}.` + ); + pendingPrompt.consumers.push(cancelable); + return cancelable; + } + + this.log(`Adding new async prompt, callback: ${aCallback}.`); + let asyncPrompt = { + consumers: [cancelable], + channel: aChannel, + authInfo: aAuthInfo, + level: aLevel, + prompter: this, + }; + + this._factory._doAsyncPrompt(asyncPrompt, hashKey); + } catch (e) { + console.error( + "LoginManagerAuthPrompter: " + + "asyncPromptAuth: " + + e + + "\nFalling back to promptAuth\n" + ); + // Fail the prompt operation to let the consumer fall back + // to synchronous promptAuth method + throw e; + } + + return cancelable; + }, + + /* ---------- nsILoginManagerAuthPrompter prompts ---------- */ + + init(aWindow = null, aFactory = null) { + if (!aWindow) { + // There may be no applicable window e.g. in a Sandbox or JSM. + this._chromeWindow = null; + this._browser = null; + } else if (aWindow.isChromeWindow) { + this._chromeWindow = aWindow; + // needs to be set explicitly using setBrowser + this._browser = null; + } else { + let { win, browser } = this._getChromeWindow(aWindow); + this._chromeWindow = win; + this._browser = browser; + } + this._factory = aFactory || null; + }, + + set browser(aBrowser) { + this._browser = aBrowser; + }, + + get browser() { + return this._browser; + }, + + /* ---------- Internal Methods ---------- */ + + _updateLogin(login, aNewLogin) { + var now = Date.now(); + var propBag = Cc["@mozilla.org/hash-property-bag;1"].createInstance( + Ci.nsIWritablePropertyBag + ); + propBag.setProperty("formActionOrigin", aNewLogin.formActionOrigin); + propBag.setProperty("origin", aNewLogin.origin); + propBag.setProperty("password", aNewLogin.password); + propBag.setProperty("username", aNewLogin.username); + // Explicitly set the password change time here (even though it would + // be changed automatically), to ensure that it's exactly the same + // value as timeLastUsed. + propBag.setProperty("timePasswordChanged", now); + propBag.setProperty("timeLastUsed", now); + propBag.setProperty("timesUsedIncrement", 1); + // Note that we don't call `recordPasswordUse` so we won't potentially record + // both a use and a save/update. See bug 1640096. + Services.logins.modifyLogin(login, propBag); + }, + + /** + * Given a content DOM window, returns the chrome window and browser it's in. + */ + _getChromeWindow(aWindow) { + let browser = aWindow.docShell.chromeEventHandler; + if (!browser) { + return null; + } + + let chromeWin = browser.ownerGlobal; + if (!chromeWin) { + return null; + } + + return { win: chromeWin, browser }; + }, + + /** + * The user might enter a login that isn't the one we prefilled, but + * is the same as some other existing login. So, pick a login with a + * matching username, or return null. + */ + _repickSelectedLogin(foundLogins, username) { + for (var i = 0; i < foundLogins.length; i++) { + if (foundLogins[i].username == username) { + return foundLogins[i]; + } + } + return null; + }, + + /** + * Can be called as: + * _getLocalizedString("key1"); + * _getLocalizedString("key2", ["arg1"]); + * _getLocalizedString("key3", ["arg1", "arg2"]); + * (etc) + * + * Returns the localized string for the specified key, + * formatted if required. + * + */ + _getLocalizedString(key, formatArgs) { + if (formatArgs) { + return this._strBundle.formatStringFromName(key, formatArgs); + } + return this._strBundle.GetStringFromName(key); + }, + + /** + * Sanitizes the specified username, by stripping quotes and truncating if + * it's too long. This helps prevent an evil site from messing with the + * "save password?" prompt too much. + */ + _sanitizeUsername(username) { + if (username.length > 30) { + username = username.substring(0, 30); + username += this._ellipsis; + } + return username.replace(/['"]/g, ""); + }, + + /** + * The aURI parameter may either be a string uri, or an nsIURI instance. + * + * Returns the origin to use in a nsILoginInfo object (for example, + * "http://example.com"). + */ + _getFormattedOrigin(aURI) { + let uri; + if (aURI instanceof Ci.nsIURI) { + uri = aURI; + } else { + uri = Services.io.newURI(aURI); + } + + return uri.scheme + "://" + uri.displayHostPort; + }, + + /** + * Converts a login's origin field (a URL) to a short string for + * prompting purposes. Eg, "http://foo.com" --> "foo.com", or + * "ftp://www.site.co.uk" --> "site.co.uk". + */ + _getShortDisplayHost(aURIString) { + var displayHost; + + var idnService = Cc["@mozilla.org/network/idn-service;1"].getService( + Ci.nsIIDNService + ); + try { + var uri = Services.io.newURI(aURIString); + var baseDomain = Services.eTLD.getBaseDomain(uri); + displayHost = idnService.convertToDisplayIDN(baseDomain, {}); + } catch (e) { + this.log(`Couldn't process supplied URIString ${aURIString}.`); + } + + if (!displayHost) { + displayHost = aURIString; + } + + return displayHost; + }, + + /** + * Returns the origin and realm for which authentication is being + * requested, in the format expected to be used with nsILoginInfo. + */ + _getAuthTarget(aChannel, aAuthInfo) { + var origin, realm; + + // If our proxy is demanding authentication, don't use the + // channel's actual destination. + if (aAuthInfo.flags & Ci.nsIAuthInformation.AUTH_PROXY) { + this.log("getAuthTarget is for proxy auth."); + if (!(aChannel instanceof Ci.nsIProxiedChannel)) { + throw new Error("proxy auth needs nsIProxiedChannel"); + } + + var info = aChannel.proxyInfo; + if (!info) { + throw new Error("proxy auth needs nsIProxyInfo"); + } + + // Proxies don't have a scheme, but we'll use "moz-proxy://" + // so that it's more obvious what the login is for. + var idnService = Cc["@mozilla.org/network/idn-service;1"].getService( + Ci.nsIIDNService + ); + origin = + "moz-proxy://" + + idnService.convertUTF8toACE(info.host) + + ":" + + info.port; + realm = aAuthInfo.realm; + if (!realm) { + realm = origin; + } + + return [origin, realm]; + } + + origin = this._getFormattedOrigin(aChannel.URI); + + // If a HTTP WWW-Authenticate header specified a realm, that value + // will be available here. If it wasn't set or wasn't HTTP, we'll use + // the formatted origin instead. + realm = aAuthInfo.realm; + if (!realm) { + realm = origin; + } + + return [origin, realm]; + }, + + /** + * Returns [username, password] as extracted from aAuthInfo (which + * holds this info after having prompted the user). + * + * If the authentication was for a Windows domain, we'll prepend the + * return username with the domain. (eg, "domain\user") + */ + _GetAuthInfo(aAuthInfo) { + var username, password; + + var flags = aAuthInfo.flags; + if (flags & Ci.nsIAuthInformation.NEED_DOMAIN && aAuthInfo.domain) { + username = aAuthInfo.domain + "\\" + aAuthInfo.username; + } else { + username = aAuthInfo.username; + } + + password = aAuthInfo.password; + + return [username, password]; + }, + + /** + * Given a username (possibly in DOMAIN\user form) and password, parses the + * domain out of the username if necessary and sets domain, username and + * password on the auth information object. + */ + _SetAuthInfo(aAuthInfo, username, password) { + var flags = aAuthInfo.flags; + if (flags & Ci.nsIAuthInformation.NEED_DOMAIN) { + // Domain is separated from username by a backslash + var idx = username.indexOf("\\"); + if (idx == -1) { + aAuthInfo.username = username; + } else { + aAuthInfo.domain = username.substring(0, idx); + aAuthInfo.username = username.substring(idx + 1); + } + } else { + aAuthInfo.username = username; + } + aAuthInfo.password = password; + }, + + _newAsyncPromptConsumer(aCallback, aContext) { + return { + QueryInterface: ChromeUtils.generateQI(["nsICancelable"]), + callback: aCallback, + context: aContext, + cancel() { + this.callback.onAuthCancelled(this.context, false); + this.callback = null; + this.context = null; + }, + }; + }, +}; // end of LoginManagerAuthPrompter implementation + +XPCOMUtils.defineLazyGetter(LoginManagerAuthPrompter.prototype, "log", () => { + let logger = lazy.LoginHelper.createLogger("LoginManagerAuthPrompter"); + return logger.log.bind(logger); +}); + +XPCOMUtils.defineLazyPreferenceGetter( + LoginManagerAuthPrompter, + "promptAuthModalType", + "prompts.modalType.httpAuth", + Services.prompt.MODAL_TYPE_WINDOW +); diff --git a/toolkit/components/passwordmgr/LoginManagerChild.sys.mjs b/toolkit/components/passwordmgr/LoginManagerChild.sys.mjs new file mode 100644 index 0000000000..118226c207 --- /dev/null +++ b/toolkit/components/passwordmgr/LoginManagerChild.sys.mjs @@ -0,0 +1,3183 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/** + * Module doing most of the content process work for the password manager. + */ + +// Disable use-ownerGlobal since LoginForm doesn't have it. +/* eslint-disable mozilla/use-ownerGlobal */ + +const PASSWORD_INPUT_ADDED_COALESCING_THRESHOLD_MS = 1; +// The amount of time a context menu event supresses showing a +// popup from a focus event in ms. This matches the threshold in +// toolkit/components/satchel/nsFormFillController.cpp +const AUTOCOMPLETE_AFTER_RIGHT_CLICK_THRESHOLD_MS = 400; +const AUTOFILL_STATE = "autofill"; + +const SUBMIT_FORM_SUBMIT = 1; +const SUBMIT_PAGE_NAVIGATION = 2; +const SUBMIT_FORM_IS_REMOVED = 3; + +const LOG_MESSAGE_FORM_SUBMISSION = "form submission"; +const LOG_MESSAGE_FIELD_EDIT = "field edit"; + +import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs"; +import { AppConstants } from "resource://gre/modules/AppConstants.sys.mjs"; +import { PrivateBrowsingUtils } from "resource://gre/modules/PrivateBrowsingUtils.sys.mjs"; +import { CreditCard } from "resource://gre/modules/CreditCard.sys.mjs"; + +const lazy = {}; + +ChromeUtils.defineESModuleGetters(lazy, { + ContentDOMReference: "resource://gre/modules/ContentDOMReference.sys.mjs", + DeferredTask: "resource://gre/modules/DeferredTask.sys.mjs", + FormLikeFactory: "resource://gre/modules/FormLikeFactory.sys.mjs", + InsecurePasswordUtils: "resource://gre/modules/InsecurePasswordUtils.sys.mjs", + LoginFormFactory: "resource://gre/modules/LoginFormFactory.sys.mjs", + LoginHelper: "resource://gre/modules/LoginHelper.sys.mjs", + LoginRecipesContent: "resource://gre/modules/LoginRecipes.sys.mjs", + SignUpFormRuleset: "resource://gre/modules/SignUpFormRuleset.sys.mjs", +}); + +XPCOMUtils.defineLazyServiceGetter( + lazy, + "gFormFillService", + "@mozilla.org/satchel/form-fill-controller;1", + "nsIFormFillController" +); + +XPCOMUtils.defineLazyGetter(lazy, "log", () => { + let logger = lazy.LoginHelper.createLogger("LoginManagerChild"); + return logger.log.bind(logger); +}); + +Services.cpmm.addMessageListener("clearRecipeCache", () => { + lazy.LoginRecipesContent._clearRecipeCache(); +}); + +let gLastRightClickTimeStamp = Number.NEGATIVE_INFINITY; + +// Events on pages with Shadow DOM could return the shadow host element +// (aEvent.target) rather than the actual username or password field +// (aEvent.composedTarget). +// Only allow input elements (can be extended later) to avoid false negatives. +class WeakFieldSet extends WeakSet { + add(value) { + if (!HTMLInputElement.isInstance(value)) { + throw new Error("Non-field type added to a WeakFieldSet"); + } + super.add(value); + } +} + +const observer = { + QueryInterface: ChromeUtils.generateQI([ + "nsIObserver", + "nsIWebProgressListener", + "nsISupportsWeakReference", + ]), + + // nsIWebProgressListener + onLocationChange(aWebProgress, aRequest, aLocation, aFlags) { + // Only handle pushState/replaceState here. + if ( + !(aFlags & Ci.nsIWebProgressListener.LOCATION_CHANGE_SAME_DOCUMENT) || + !(aWebProgress.loadType & Ci.nsIDocShell.LOAD_CMD_PUSHSTATE) + ) { + return; + } + + const window = aWebProgress.DOMWindow; + lazy.log( + "onLocationChange handled:", + aLocation.displaySpec, + window.document + ); + LoginManagerChild.forWindow(window)._onNavigation(window.document); + }, + + onStateChange(aWebProgress, aRequest, aState, aStatus) { + const window = aWebProgress.DOMWindow; + const loginManagerChild = () => LoginManagerChild.forWindow(window); + + if ( + aState & Ci.nsIWebProgressListener.STATE_RESTORING && + aState & Ci.nsIWebProgressListener.STATE_STOP + ) { + // Re-fill a document restored from bfcache since password field values + // aren't persisted there. + loginManagerChild()._onDocumentRestored(window.document); + return; + } + + if (!(aState & Ci.nsIWebProgressListener.STATE_START)) { + return; + } + + // We only care about when a page triggered a load, not the user. For example: + // clicking refresh/back/forward, typing a URL and hitting enter, and loading a bookmark aren't + // likely to be when a user wants to save a login. + let channel = aRequest.QueryInterface(Ci.nsIChannel); + let triggeringPrincipal = channel.loadInfo.triggeringPrincipal; + if ( + triggeringPrincipal.isNullPrincipal || + triggeringPrincipal.equals( + Services.scriptSecurityManager.getSystemPrincipal() + ) + ) { + return; + } + + // Don't handle history navigation, reload, or pushState not triggered via chrome UI. + // e.g. history.go(-1), location.reload(), history.replaceState() + if (!(aWebProgress.loadType & Ci.nsIDocShell.LOAD_CMD_NORMAL)) { + lazy.log(`loadType isn't LOAD_CMD_NORMAL: ${aWebProgress.loadType}.`); + return; + } + + lazy.log(`Handled channel: ${channel}`); + loginManagerChild()._onNavigation(window.document); + }, + + // nsIObserver + observe(subject, topic, data) { + switch (topic) { + case "autocomplete-did-enter-text": { + let input = subject.QueryInterface(Ci.nsIAutoCompleteInput); + let { selectedIndex } = input.popup; + if (selectedIndex < 0) { + break; + } + + let { focusedInput } = lazy.gFormFillService; + if (focusedInput.nodePrincipal.isNullPrincipal) { + // If we have a null principal then prevent any more password manager code from running and + // incorrectly using the document `location`. + return; + } + + let window = focusedInput.ownerGlobal; + let loginManagerChild = LoginManagerChild.forWindow(window); + + let style = input.controller.getStyleAt(selectedIndex); + if (style == "login" || style == "loginWithOrigin") { + let details = JSON.parse( + input.controller.getCommentAt(selectedIndex) + ); + loginManagerChild.onFieldAutoComplete(focusedInput, details.guid); + } else if (style == "generatedPassword") { + loginManagerChild._filledWithGeneratedPassword(focusedInput); + } + break; + } + } + }, + + // nsIDOMEventListener + handleEvent(aEvent) { + if (!aEvent.isTrusted) { + return; + } + + if (!lazy.LoginHelper.enabled) { + return; + } + + const ownerDocument = aEvent.target.ownerDocument; + const window = ownerDocument.defaultView; + const loginManagerChild = LoginManagerChild.forWindow(window); + const docState = loginManagerChild.stateForDocument(ownerDocument); + const field = aEvent.composedTarget; + + switch (aEvent.type) { + // Used to mask fields with filled generated passwords when blurred. + case "blur": { + if (docState.generatedPasswordFields.has(field)) { + docState._togglePasswordFieldMasking(field, false); + } + break; + } + + // Used to watch for changes to username and password fields. + case "change": { + let formLikeRoot = lazy.FormLikeFactory.findRootForField(field); + if (!docState.fieldModificationsByRootElement.get(formLikeRoot)) { + lazy.log( + "Ignoring change event on form that hasn't been user-modified." + ); + if (field.hasBeenTypePassword) { + // Send notification that the password field has not been changed. + // This is used only for testing. + loginManagerChild._ignorePasswordEdit(); + } + break; + } + + docState.storeUserInput(field); + let detail = { + possibleValues: { + usernames: docState.possibleUsernames, + passwords: docState.possiblePasswords, + }, + }; + loginManagerChild.sendAsyncMessage( + "PasswordManager:updateDoorhangerSuggestions", + detail + ); + + if (field.hasBeenTypePassword) { + let triggeredByFillingGenerated = + docState.generatedPasswordFields.has(field); + // Autosave generated password initial fills and subsequent edits + if (triggeredByFillingGenerated) { + loginManagerChild._passwordEditedOrGenerated(field, { + triggeredByFillingGenerated, + }); + } else { + // Send a notification that we are not saving the edit to the password field. + // This is used only for testing. + loginManagerChild._ignorePasswordEdit(); + } + } + break; + } + + case "input": { + let isPasswordType = lazy.LoginHelper.isPasswordFieldType(field); + // React to input into fields filled with generated passwords. + if ( + docState.generatedPasswordFields.has(field) && + // Depending on the edit, we may no longer want to consider + // the field a generated password field to avoid autosaving. + loginManagerChild._doesEventClearPrevFieldValue(aEvent) + ) { + docState._stopTreatingAsGeneratedPasswordField(field); + } + + if (!isPasswordType && !lazy.LoginHelper.isUsernameFieldType(field)) { + break; + } + + // React to input into potential username or password fields + let formLikeRoot = lazy.FormLikeFactory.findRootForField(field); + + if (formLikeRoot !== aEvent.currentTarget) { + break; + } + // flag this form as user-modified for the closest form/root ancestor + let alreadyModified = + docState.fieldModificationsByRootElement.get(formLikeRoot); + let { login: filledLogin, userTriggered: fillWasUserTriggered } = + docState.fillsByRootElement.get(formLikeRoot) || {}; + + // don't flag as user-modified if the form was autofilled and doesn't appear to have changed + let isAutofillInput = filledLogin && !fillWasUserTriggered; + if (!alreadyModified && isAutofillInput) { + if (isPasswordType && filledLogin.password == field.value) { + lazy.log( + "Ignoring password input event that doesn't change autofilled values." + ); + break; + } + if ( + !isPasswordType && + filledLogin.usernameField && + filledLogin.username == field.value + ) { + lazy.log( + "Ignoring username input event that doesn't change autofilled values." + ); + break; + } + } + docState.fieldModificationsByRootElement.set(formLikeRoot, true); + // Keep track of the modified formless password field to trigger form submission + // when it is removed from DOM. + let alreadyModifiedFormLessField = true; + if (!HTMLFormElement.isInstance(formLikeRoot)) { + alreadyModifiedFormLessField = + docState.formlessModifiedPasswordFields.has(field); + if (!alreadyModifiedFormLessField) { + docState.formlessModifiedPasswordFields.add(field); + } + } + + // Infer form submission only when there has been an user interaction on the form + // or the formless password field. + if ( + lazy.LoginHelper.formRemovalCaptureEnabled && + (!alreadyModified || !alreadyModifiedFormLessField) + ) { + ownerDocument.setNotifyFetchSuccess(true); + } + + if ( + // When the password field value is cleared or entirely replaced we don't treat it as + // an autofilled form any more. We don't do the same for username edits to avoid snooping + // on the autofilled password in the resulting doorhanger + isPasswordType && + loginManagerChild._doesEventClearPrevFieldValue(aEvent) && + // Don't clear last recorded autofill if THIS is an autofilled value. This will be true + // when filling from the context menu. + filledLogin && + filledLogin.password !== field.value + ) { + docState.fillsByRootElement.delete(formLikeRoot); + } + + if (!lazy.LoginHelper.passwordEditCaptureEnabled) { + break; + } + if (field.hasBeenTypePassword) { + // When a field is filled with a generated password, we also fill a confirm password field + // if found. To do this, _fillConfirmFieldWithGeneratedPassword calls setUserInput, which fires + // an "input" event on the confirm password field. compareAndUpdatePreviouslySentValues will + // allow that message through due to triggeredByFillingGenerated, so early return here. + let form = lazy.LoginFormFactory.createFromField(field); + if ( + docState.generatedPasswordFields.has(field) && + docState._getFormFields(form).confirmPasswordField === field + ) { + break; + } + // Don't check for triggeredByFillingGenerated, as we do not want to autosave + // a field marked as a generated password field on every "input" event + loginManagerChild._passwordEditedOrGenerated(field); + } else { + let [usernameField, passwordField] = + docState.getUserNameAndPasswordFields(field); + if (field == usernameField && passwordField?.value) { + loginManagerChild._passwordEditedOrGenerated(passwordField, { + triggeredByFillingGenerated: + docState.generatedPasswordFields.has(passwordField), + }); + } + } + break; + } + + case "keydown": { + if ( + field.value && + (aEvent.keyCode == aEvent.DOM_VK_TAB || + aEvent.keyCode == aEvent.DOM_VK_RETURN) + ) { + const autofillForm = + lazy.LoginHelper.autofillForms && + !PrivateBrowsingUtils.isContentWindowPrivate( + ownerDocument.defaultView + ); + + if (autofillForm) { + loginManagerChild.onUsernameAutocompleted(field); + } + } + break; + } + + case "focus": { + //@sg see if we can drop focusedField (aEvent.target) and use field (aEvent.composedTarget) + docState.onFocus(field, aEvent.target); + break; + } + + case "mousedown": { + if (aEvent.button == 2) { + // Date.now() is used instead of event.timeStamp since + // dom.event.highrestimestamp.enabled isn't true on all channels yet. + gLastRightClickTimeStamp = Date.now(); + } + + break; + } + + default: { + throw new Error("Unexpected event"); + } + } + }, +}; + +// Add this observer once for the process. +Services.obs.addObserver(observer, "autocomplete-did-enter-text"); + +/** + * Form scenario defines what can be done with form. + */ +class FormScenario {} + +/** + * Sign up scenario defines typical account registration flow. + */ +class SignUpFormScenario extends FormScenario { + usernameField; + passwordField; +} + +/** + * Logic of Capture and Filling. + * + * This class will be shared with Firefox iOS and should have no references to + * Gecko internals. See Bug 1774208. + */ +export class LoginFormState { + /** + * Keeps track of filled fields and values. + */ + fillsByRootElement = new WeakMap(); + /** + * Keeps track of fields we've filled with generated passwords + */ + generatedPasswordFields = new WeakFieldSet(); + /** + * Keeps track of logins that were last submitted. + */ + lastSubmittedValuesByRootElement = new WeakMap(); + fieldModificationsByRootElement = new WeakMap(); + /** + * Anything entered into an <input> that we think might be a username + */ + possibleUsernames = new Set(); + /** + * Anything entered into an <input> that we think might be a password + */ + possiblePasswords = new Set(); + + /** + * Keeps track of the formLike of nodes (form or formless password field) + * that we are watching when they are removed from DOM. + */ + formLikeByObservedNode = new WeakMap(); + + /** + * Keeps track of all formless password fields that have been + * updated by the user. + */ + formlessModifiedPasswordFields = new WeakFieldSet(); + + /** + * Caches the results of the username heuristics + */ + #cachedIsInferredUsernameField = new WeakMap(); + #cachedIsInferredEmailField = new WeakMap(); + #cachedIsInferredLoginForm = new WeakMap(); + + /** + * Caches the scores when running the SignUpFormRuleset against a form + */ + #cachedSignUpFormScore = new WeakMap(); + + /** + * Records the mock username field when its associated form is submitted. + */ + mockUsernameOnlyField = null; + + /** + * Records the number of possible username event received for this document. + */ + numFormHasPossibleUsernameEvent = 0; + + captureLoginTimeStamp = 0; + + // Scenarios detected on this page + #scenariosByRoot = new WeakMap(); + + getScenario(inputElement) { + const formLikeRoot = lazy.FormLikeFactory.findRootForField(inputElement); + return this.#scenariosByRoot.get(formLikeRoot); + } + + setScenario(formLikeRoot, scenario) { + this.#scenariosByRoot.set(formLikeRoot, scenario); + } + + storeUserInput(field) { + if (field.value && lazy.LoginHelper.captureInputChanges) { + if (lazy.LoginHelper.isPasswordFieldType(field)) { + this.possiblePasswords.add(field.value); + } else if (lazy.LoginHelper.isUsernameFieldType(field)) { + this.possibleUsernames.add(field.value); + } + } + } + + /** + * Returns true if the input field is considered an email field by + * 'LoginHelper.isInferredEmailField'. + * + * @param {Element} element the field to check. + * @returns {boolean} True if the element is likely an email field + */ + isProbablyAnEmailField(inputElement) { + if (!inputElement) { + return false; + } + + let result = this.#cachedIsInferredEmailField.get(inputElement); + if (result === undefined) { + result = lazy.LoginHelper.isInferredEmailField(inputElement); + this.#cachedIsInferredEmailField.set(inputElement, result); + } + + return result; + } + + /** + * Returns true if the input field is considered a username field by + * 'LoginHelper.isInferredUsernameField'. The main purpose of this method + * is to cache the result because _getFormFields has many call sites and we + * want to avoid applying the heuristic every time. + * + * @param {Element} element the field to check. + * @returns {boolean} True if the element is likely a username field + */ + isProbablyAUsernameField(inputElement) { + let result = this.#cachedIsInferredUsernameField.get(inputElement); + if (result === undefined) { + result = lazy.LoginHelper.isInferredUsernameField(inputElement); + this.#cachedIsInferredUsernameField.set(inputElement, result); + } + + return result; + } + + /** + * Returns true if the form is considered a username login form if + * 1. The input element looks like a username field or the form looks + * like a login form + * 2. The input field doesn't match keywords that indicate the username + * is not used for login (ex, search) or the login form is not use + * a username to sign-in (ex, authentication code) + * + * @param {Element} element the form to check. + * @returns {boolean} True if the element is likely a login form + */ + #isProbablyAUsernameLoginForm(formElement, inputElement) { + let result = this.#cachedIsInferredLoginForm.get(formElement); + if (result === undefined) { + // We should revisit these rules after we collect more positive or negative + // cases for username-only forms. Right now, if-else-based rules are good + // enough to cover the sites we know, but if we find out defining "weight" for each + // rule is necessary to improve the heuristic, we should consider switching + // this with Fathom. + + result = false; + // Check whether the input field looks like a username field or the + // form looks like a sign-in or sign-up form. + if ( + this.isProbablyAUsernameField(inputElement) || + lazy.LoginHelper.isInferredLoginForm(formElement) + ) { + // This is where we collect hints that indicate this is not a username + // login form. + if (!lazy.LoginHelper.isInferredNonUsernameField(inputElement)) { + result = true; + } + } + this.#cachedIsInferredLoginForm.set(formElement, result); + } + + return result; + } + + /** + * Determine if the form is a sign-up form. + * This is done by running the rules of the Fathom SignUpFormRuleset against the form and calucating a score between 0 and 1. + * It's considered a sign-up form, if the score is higher than the confidence threshold (default=0.75) + * + * @param {HTMLFormElement} formElement + * @returns {boolean} returns true if the calculcated score is higher than the confidenceThreshold + */ + isProbablyASignUpForm(formElement) { + if (!HTMLFormElement.isInstance(formElement)) { + return false; + } + const threshold = lazy.LoginHelper.signupDetectionConfidenceThreshold; + let score = this.#cachedSignUpFormScore.get(formElement); + if (!score) { + TelemetryStopwatch.start("PWMGR_SIGNUP_FORM_DETECTION_MS"); + try { + const { rules, type } = lazy.SignUpFormRuleset; + const results = rules.against(formElement); + score = results.get(formElement).scoreFor(type); + TelemetryStopwatch.finish("PWMGR_SIGNUP_FORM_DETECTION_MS"); + } finally { + if (TelemetryStopwatch.running("PWMGR_SIGNUP_FORM_DETECTION_MS")) { + TelemetryStopwatch.cancel("PWMGR_SIGNUP_FORM_DETECTION_MS"); + } + } + this.#cachedSignUpFormScore.set(formElement, score); + } + return score > threshold; + } + + /** + * Given a field, determine whether that field was last filled as a username + * field AND whether the username is still filled in with the username AND + * whether the associated password field has the matching password. + * + * @note This could possibly be unified with getFieldContext but they have + * slightly different use cases. getFieldContext looks up recipes whereas this + * method doesn't need to since it's only returning a boolean based upon the + * recipes used for the last fill (in _fillForm). + * + * @param {HTMLInputElement} aUsernameField element contained in a LoginForm + * cached in LoginFormFactory. + * @returns {Boolean} whether the username and password fields still have the + * last-filled values, if previously filled. + */ + #isLoginAlreadyFilled(aUsernameField) { + let formLikeRoot = lazy.FormLikeFactory.findRootForField(aUsernameField); + // Look for the existing LoginForm. + let existingLoginForm = + lazy.LoginFormFactory.getForRootElement(formLikeRoot); + if (!existingLoginForm) { + throw new Error( + "#isLoginAlreadyFilled called with a username field with " + + "no rootElement LoginForm" + ); + } + + let { login: filledLogin } = + this.fillsByRootElement.get(formLikeRoot) || {}; + if (!filledLogin) { + return false; + } + + // Unpack the weak references. + let autoFilledUsernameField = filledLogin.usernameField?.get(); + let autoFilledPasswordField = filledLogin.passwordField?.get(); + + // Check username and password values match what was filled. + if ( + !autoFilledUsernameField || + autoFilledUsernameField != aUsernameField || + autoFilledUsernameField.value != filledLogin.username || + (autoFilledPasswordField && + autoFilledPasswordField.value != filledLogin.password) + ) { + return false; + } + + return true; + } + + _togglePasswordFieldMasking(passwordField, unmask) { + let { editor } = passwordField; + + if (passwordField.type != "password") { + // The type may have been changed by the website. + lazy.log("Field isn't type=password."); + return; + } + + if (!unmask && !editor) { + // It hasn't been created yet but the default is to be masked anyways. + return; + } + + if (unmask) { + editor.unmask(0); + return; + } + + if (editor.autoMaskingEnabled) { + return; + } + editor.mask(); + } + + /** + * Track a form field as has having been filled with a generated password. This adds explicit + * focus & blur handling to unmask & mask the value, and enables special handling of edits to + * generated password values (see the observer's input event handler.) + * + * @param {HTMLInputElement} passwordField + */ + _treatAsGeneratedPasswordField(passwordField) { + this.generatedPasswordFields.add(passwordField); + + // blur/focus: listen for focus changes to we can mask/unmask generated passwords + for (let eventType of ["blur", "focus"]) { + passwordField.addEventListener(eventType, observer, { + capture: true, + mozSystemGroup: true, + }); + } + if (passwordField.ownerDocument.activeElement == passwordField) { + // Unmask the password field + this._togglePasswordFieldMasking(passwordField, true); + } + } + + _formHasModifiedFields(form) { + const doc = form.rootElement.ownerDocument; + let userHasInteracted; + const testOnlyUserHasInteracted = + lazy.LoginHelper.testOnlyUserHasInteractedWithDocument; + if (Cu.isInAutomation && testOnlyUserHasInteracted !== null) { + userHasInteracted = testOnlyUserHasInteracted; + } else { + userHasInteracted = + !lazy.LoginHelper.userInputRequiredToCapture || + this.captureLoginTimeStamp != doc.lastUserGestureTimeStamp; + } + + lazy.log( + `_formHasModifiedFields: userHasInteracted: ${userHasInteracted}.` + ); + + // Skip if user didn't interact with the page since last call or ever + if (!userHasInteracted) { + return false; + } + + // check for user inputs to the form fields + let fieldsModified = this.fieldModificationsByRootElement.get( + form.rootElement + ); + // also consider a form modified if there's a difference between fields' .value and .defaultValue + if (!fieldsModified) { + fieldsModified = Array.from(form.elements).some( + field => + field.defaultValue !== undefined && field.value !== field.defaultValue + ); + } + return fieldsModified; + } + + _stopTreatingAsGeneratedPasswordField(passwordField) { + this.generatedPasswordFields.delete(passwordField); + + // Remove all the event listeners added in _passwordEditedOrGenerated + for (let eventType of ["blur", "focus"]) { + passwordField.removeEventListener(eventType, observer, { + capture: true, + mozSystemGroup: true, + }); + } + + // Mask the password field + this._togglePasswordFieldMasking(passwordField, false); + } + + onFocus(field, focusedField) { + if (field.hasBeenTypePassword && this.generatedPasswordFields.has(field)) { + // Used to unmask fields with filled generated passwords when focused. + this._togglePasswordFieldMasking(field, true); + return; + } + + // Only used for username fields. + this.#onUsernameFocus(focusedField); + } + + /** + * Focus event handler for username fields to decide whether to show autocomplete. + * @param {HTMLInputElement} focusedField + */ + #onUsernameFocus(focusedField) { + if ( + !focusedField.mozIsTextField(true) || + focusedField.hasBeenTypePassword || + focusedField.readOnly + ) { + return; + } + + if (this.#isLoginAlreadyFilled(focusedField)) { + lazy.log("Login already filled."); + return; + } + + /* + * A `mousedown` event is fired before the `focus` event if the user right clicks into an + * unfocused field. In that case we don't want to show both autocomplete and a context menu + * overlapping so we check against the timestamp that was set by the `mousedown` event if the + * button code indicated a right click. + * We use a timestamp instead of a bool to avoid complexity when dealing with multiple input + * forms and the fact that a mousedown into an already focused field does not trigger another focus. + * Date.now() is used instead of event.timeStamp since dom.event.highrestimestamp.enabled isn't + * true on all channels yet. + */ + let timeDiff = Date.now() - gLastRightClickTimeStamp; + if (timeDiff < AUTOCOMPLETE_AFTER_RIGHT_CLICK_THRESHOLD_MS) { + lazy.log( + `Not opening autocomplete after focus since a context menu was opened within ${timeDiff}ms.` + ); + return; + } + + lazy.log("Opening the autocomplete popup."); + lazy.gFormFillService.showPopup(); + } + + /** Remove login field highlight when its value is cleared or overwritten. + */ + static #removeFillFieldHighlight(event) { + let winUtils = event.target.ownerGlobal.windowUtils; + winUtils.removeManuallyManagedState(event.target, AUTOFILL_STATE); + } + + /** + * Highlight login fields on autocomplete or autofill on page load. + * @param {Node} element that needs highlighting. + */ + static _highlightFilledField(element) { + let winUtils = element.ownerGlobal.windowUtils; + + winUtils.addManuallyManagedState(element, AUTOFILL_STATE); + // Remove highlighting when the field is changed. + element.addEventListener( + "input", + LoginFormState.#removeFillFieldHighlight, + { + mozSystemGroup: true, + once: true, + } + ); + } + + /** + * Returns the username field of the passed form if the form is a + * username-only form. + * A form is considered a username-only form only if it meets all the + * following conditions: + * 1. Does not have any password field, + * 2. Only contains one input field whose type is username compatible. + * 3. The username compatible input field looks like a username field + * or the form itself looks like a sign-in or sign-up form. + * + * @param {Element} formElement + * the form to check. + * @param {Object} recipe=null + * A relevant field override recipe to use. + * @returns {Element} The username field or null (if the form is not a + * username-only form). + */ + getUsernameFieldFromUsernameOnlyForm(formElement, recipe = null) { + if (!HTMLFormElement.isInstance(formElement)) { + return null; + } + + let candidate = null; + for (let element of formElement.elements) { + // We are looking for a username-only form, so if there is a password + // field in the form, this is NOT a username-only form. + if (element.hasBeenTypePassword) { + return null; + } + + // Ignore input fields whose type are not username compatiable, ex, hidden. + if (!lazy.LoginHelper.isUsernameFieldType(element)) { + continue; + } + + if ( + recipe?.notUsernameSelector && + element.matches(recipe.notUsernameSelector) + ) { + continue; + } + + // If there are more than two input fields whose type is username + // compatiable, this is NOT a username-only form. + if (candidate) { + return null; + } + candidate = element; + } + + if ( + candidate && + this.#isProbablyAUsernameLoginForm(formElement, candidate) + ) { + return candidate; + } + + return null; + } + + /** + * @param {LoginForm} form - the LoginForm to look for password fields in. + * @param {Object} options + * @param {bool} [options.skipEmptyFields=false] - Whether to ignore password fields with no value. + * Used at capture time since saving empty values isn't + * useful. + * @param {Object} [options.fieldOverrideRecipe=null] - A relevant field override recipe to use. + * @return {Array|null} Array of password field elements for the specified form. + * If no pw fields are found, or if more than 5 are found, then null + * is returned. + */ + static _getPasswordFields( + form, + { + fieldOverrideRecipe = null, + minPasswordLength = 0, + ignoreConnect = false, + } = {} + ) { + // Locate the password fields in the form. + let pwFields = []; + for (let i = 0; i < form.elements.length; i++) { + let element = form.elements[i]; + if ( + !HTMLInputElement.isInstance(element) || + !element.hasBeenTypePassword || + (!element.isConnected && !ignoreConnect) + ) { + continue; + } + + // Exclude ones matching a `notPasswordSelector`, if specified. + if ( + fieldOverrideRecipe?.notPasswordSelector && + element.matches(fieldOverrideRecipe.notPasswordSelector) + ) { + lazy.log( + `Skipping password field with id: ${element.id}, name: ${element.name} due to recipe ${fieldOverrideRecipe}.` + ); + continue; + } + + // XXX: Bug 780449 tracks our handling of emoji and multi-code-point characters in + // password fields. To avoid surprises, we should be consistent with the visual + // representation of the masked password + if ( + minPasswordLength && + element.value.trim().length < minPasswordLength + ) { + lazy.log( + `Skipping password field with id: ${element.id}, name: ${element.name} as value is too short.` + ); + continue; // Ignore empty or too-short passwords fields + } + + pwFields[pwFields.length] = { + index: i, + element, + }; + } + + // If too few or too many fields, bail out. + if (!pwFields.length) { + lazy.log("Form ignored, no password fields."); + return null; + } + + if (pwFields.length > 5) { + lazy.log(`Form ignored, too many password fields: ${pwFields.length}.`); + return null; + } + + return pwFields; + } + + /** + * Stores passed arguments, and returns whether or not they match the args given the last time + * this method was called with the same [formLikeRoot]. This is used to avoid sending duplicate + * messages to the parent. + * + * @param {Element} formLikeRoot + * @param {string} usernameValue + * @param {string} passwordValue + * @param {boolean?} [dismissed=false] + * @param {boolean?} [triggeredByFillingGenerated=false] whether or not this call was triggered by a generated + * password being filled into a form-like element. + * + * @returns {boolean} true if args match the most recently passed values + */ + compareAndUpdatePreviouslySentValues( + formLikeRoot, + usernameValue, + passwordValue, + dismissed = false, + triggeredByFillingGenerated = false + ) { + const lastSentValues = + this.lastSubmittedValuesByRootElement.get(formLikeRoot); + if (lastSentValues) { + if (dismissed && !lastSentValues.dismissed) { + // preserve previous dismissed value if it was false (i.e. shown/open) + dismissed = false; + } + if ( + lastSentValues.username == usernameValue && + lastSentValues.password == passwordValue && + lastSentValues.dismissed == dismissed && + lastSentValues.triggeredByFillingGenerated == + triggeredByFillingGenerated + ) { + lazy.log( + "compareAndUpdatePreviouslySentValues: values are equivalent, returning true." + ); + return true; + } + } + + // Save the last submitted values so we don't prompt twice for the same values using + // different capture methods e.g. a form submit event and upon navigation. + this.lastSubmittedValuesByRootElement.set(formLikeRoot, { + username: usernameValue, + password: passwordValue, + dismissed, + triggeredByFillingGenerated, + }); + lazy.log( + "compareAndUpdatePreviouslySentValues: values not equivalent, returning false." + ); + return false; + } + + fillConfirmFieldWithGeneratedPassword(passwordField) { + // Fill a nearby password input if it looks like a confirm-password field + let form = lazy.LoginFormFactory.createFromField(passwordField); + let confirmPasswordInput = null; + // The confirm-password field shouldn't be more than 3 form elements away from the password field we filled + let MAX_CONFIRM_PASSWORD_DISTANCE = 3; + + let startIndex = form.elements.indexOf(passwordField); + if (startIndex == -1) { + throw new Error( + "Password field is not in the form's elements collection" + ); + } + + // If we've already filled another field with a generated password, + // this might be the confirm-password field, so don't try and find another + let previousGeneratedPasswordField = form.elements.some( + inp => inp !== passwordField && this.generatedPasswordFields.has(inp) + ); + if (previousGeneratedPasswordField) { + lazy.log("Previously-filled generated password input found."); + return; + } + + // Get a list of input fields to search in. + // Pre-filter type=hidden fields; they don't count against the distance threshold + let afterFields = form.elements + .slice(startIndex + 1) + .filter(elem => elem.type !== "hidden"); + + let acFieldName = passwordField.getAutocompleteInfo()?.fieldName; + + // Match same autocomplete values first + if (acFieldName == "new-password") { + let matchIndex = afterFields.findIndex( + elem => + lazy.LoginHelper.isPasswordFieldType(elem) && + elem.getAutocompleteInfo().fieldName == acFieldName && + !elem.disabled && + !elem.readOnly + ); + if (matchIndex >= 0 && matchIndex < MAX_CONFIRM_PASSWORD_DISTANCE) { + confirmPasswordInput = afterFields[matchIndex]; + } + } + if (!confirmPasswordInput) { + for ( + let idx = 0; + idx < Math.min(MAX_CONFIRM_PASSWORD_DISTANCE, afterFields.length); + idx++ + ) { + if ( + lazy.LoginHelper.isPasswordFieldType(afterFields[idx]) && + !afterFields[idx].disabled && + !afterFields[idx].readOnly + ) { + confirmPasswordInput = afterFields[idx]; + break; + } + } + } + if (confirmPasswordInput && !confirmPasswordInput.value) { + this._treatAsGeneratedPasswordField(confirmPasswordInput); + confirmPasswordInput.setUserInput(passwordField.value); + LoginFormState._highlightFilledField(confirmPasswordInput); + } + } + + /** + * Returns the username and password fields found in the form. + * Can handle complex forms by trying to figure out what the + * relevant fields are. + * + * @param {LoginForm} form + * @param {bool} isSubmission + * @param {Set} recipes + * @param {Object} options + * @param {bool} [options.ignoreConnect] - Whether to ignore checking isConnected + * of the element. + * @return {Object} {usernameField, newPasswordField, oldPasswordField, confirmPasswordField} + * + * usernameField may be null. + * newPasswordField may be null. If null, this is a username-only form. + * oldPasswordField may be null. If null, newPasswordField is just + * "theLoginField". If not null, the form is apparently a + * change-password field, with oldPasswordField containing the password + * that is being changed. + * + * Note that even though we can create a LoginForm from a text field, + * this method will only return a non-null usernameField if the + * LoginForm has a password field. + */ + _getFormFields(form, isSubmission, recipes, { ignoreConnect = false } = {}) { + let usernameField = null; + let newPasswordField = null; + let oldPasswordField = null; + let confirmPasswordField = null; + let emptyResult = { + usernameField: null, + newPasswordField: null, + oldPasswordField: null, + confirmPasswordField: null, + }; + + let pwFields = null; + let fieldOverrideRecipe = lazy.LoginRecipesContent.getFieldOverrides( + recipes, + form + ); + if (fieldOverrideRecipe) { + lazy.log("fieldOverrideRecipe found ", fieldOverrideRecipe); + let pwOverrideField = lazy.LoginRecipesContent.queryLoginField( + form, + fieldOverrideRecipe.passwordSelector + ); + if (pwOverrideField) { + lazy.log("pwOverrideField found ", pwOverrideField); + // The field from the password override may be in a different LoginForm. + let formLike = lazy.LoginFormFactory.createFromField(pwOverrideField); + pwFields = [ + { + index: [...formLike.elements].indexOf(pwOverrideField), + element: pwOverrideField, + }, + ]; + } + + let usernameOverrideField = lazy.LoginRecipesContent.queryLoginField( + form, + fieldOverrideRecipe.usernameSelector + ); + if (usernameOverrideField) { + usernameField = usernameOverrideField; + } + } + + if (!pwFields) { + // Locate the password field(s) in the form. Up to 3 supported. + // If there's no password field, there's nothing for us to do. + const minSubmitPasswordLength = 2; + pwFields = LoginFormState._getPasswordFields(form, { + fieldOverrideRecipe, + minPasswordLength: isSubmission ? minSubmitPasswordLength : 0, + ignoreConnect, + }); + } + + // Check whether this is a username-only form when the form doesn't have + // a password field. Note that recipes are not supported in username-only + // forms currently (Bug 1708455). + if (!pwFields) { + if (!lazy.LoginHelper.usernameOnlyFormEnabled) { + return emptyResult; + } + + usernameField = this.getUsernameFieldFromUsernameOnlyForm( + form.rootElement, + fieldOverrideRecipe + ); + + if (usernameField) { + lazy.log(`Found username field with name: ${usernameField.name}.`); + } + + return { + ...emptyResult, + usernameField, + }; + } + + if (!usernameField) { + // Searching backwards from the first password field until we find a field + // that looks like a "username" field. If no "username" field is found, + // consider an email-like field a username field, if any. + // If neither a username-like or an email-like field exists, assume the + // first text field before the password field is the username. + // We might not find a username field if the user is already logged in to the site. + // + // Note: We only search fields precede the first password field because we + // don't see sites putting a username field after a password field. We can + // extend searching to all fields in the form if this turns out not to be the case. + + for (let i = pwFields[0].index - 1; i >= 0; i--) { + let element = form.elements[i]; + if (!lazy.LoginHelper.isUsernameFieldType(element, { ignoreConnect })) { + continue; + } + + if ( + fieldOverrideRecipe?.notUsernameSelector && + element.matches(fieldOverrideRecipe.notUsernameSelector) + ) { + continue; + } + + // Assume the first text field is the username by default. + // It will be replaced if we find a likely username field afterward. + if (!usernameField) { + usernameField = element; + } + + if (this.isProbablyAUsernameField(element)) { + // An username field is found, we are done. + usernameField = element; + break; + } else if (this.isProbablyAnEmailField(element)) { + // An email field is found, consider it a username field but continue + // to search for an "username" field. + // In current implementation, if another email field is found during + // the process, we will use the new one. + usernameField = element; + } + } + } + + if (!usernameField) { + lazy.log("No username field found."); + } else { + lazy.log(`Found username field with name: ${usernameField.name}.`); + } + + let pwGeneratedFields = pwFields.filter(pwField => + this.generatedPasswordFields.has(pwField.element) + ); + if (pwGeneratedFields.length) { + // we have at least the newPasswordField + [newPasswordField, confirmPasswordField] = pwGeneratedFields.map( + pwField => pwField.element + ); + // if the user filled a field with a generated password, + // a field immediately previous to that is most likely the old password field + let idx = pwFields.findIndex( + pwField => pwField.element === newPasswordField + ); + if (idx > 0) { + oldPasswordField = pwFields[idx - 1].element; + } + return { + ...emptyResult, + usernameField, + newPasswordField, + oldPasswordField: oldPasswordField || null, + confirmPasswordField: confirmPasswordField || null, + }; + } + + // If we're not submitting a form (it's a page load), there are no + // password field values for us to use for identifying fields. So, + // just assume the first password field is the one to be filled in. + if (!isSubmission || pwFields.length == 1) { + let passwordField = pwFields[0].element; + lazy.log(`Found Password field with name: ${passwordField.name}.`); + return { + ...emptyResult, + usernameField, + newPasswordField: passwordField, + oldPasswordField: null, + }; + } + + // We're looking for both new and old password field + // Try to figure out what is in the form based on the password values. + let pw1 = pwFields[0].element.value; + let pw2 = pwFields[1] ? pwFields[1].element.value : null; + let pw3 = pwFields[2] ? pwFields[2].element.value : null; + + if (pwFields.length == 3) { + // Look for two identical passwords, that's the new password + + if (pw1 == pw2 && pw2 == pw3) { + // All 3 passwords the same? Weird! Treat as if 1 pw field. + newPasswordField = pwFields[0].element; + oldPasswordField = null; + } else if (pw1 == pw2) { + newPasswordField = pwFields[0].element; + oldPasswordField = pwFields[2].element; + } else if (pw2 == pw3) { + oldPasswordField = pwFields[0].element; + newPasswordField = pwFields[2].element; + } else if (pw1 == pw3) { + // A bit odd, but could make sense with the right page layout. + newPasswordField = pwFields[0].element; + oldPasswordField = pwFields[1].element; + } else { + // We can't tell which of the 3 passwords should be saved. + lazy.log(`Form ignored -- all 3 pw fields differ.`); + return emptyResult; + } + } else if (pw1 == pw2) { + // pwFields.length == 2 + // Treat as if 1 pw field + newPasswordField = pwFields[0].element; + oldPasswordField = null; + } else { + // Just assume that the 2nd password is the new password + oldPasswordField = pwFields[0].element; + newPasswordField = pwFields[1].element; + } + + lazy.log( + `New Password field id: ${newPasswordField.id}, name: ${newPasswordField.name}.` + ); + + lazy.log( + oldPasswordField + ? `Old Password field id: ${oldPasswordField.id}, name: ${oldPasswordField.name}.` + : "No Old password field." + ); + return { + ...emptyResult, + usernameField, + newPasswordField, + oldPasswordField, + }; + } + + /** + * Returns the username and password fields found in the form by input + * element into form. + * + * @param {HTMLInputElement} aField + * A form field + * @return {Array} [usernameField, newPasswordField, oldPasswordField] + * + * Details of these values are the same as _getFormFields. + */ + getUserNameAndPasswordFields(aField) { + const noResult = [null, null, null]; + if (!HTMLInputElement.isInstance(aField)) { + throw new Error("getUserNameAndPasswordFields: input element required"); + } + + if (aField.nodePrincipal.isNullPrincipal || !aField.isConnected) { + return noResult; + } + + // If the element is not a login form field, return all null. + if ( + !aField.hasBeenTypePassword && + !lazy.LoginHelper.isUsernameFieldType(aField) + ) { + return noResult; + } + + const form = lazy.LoginFormFactory.createFromField(aField); + const doc = aField.ownerDocument; + const formOrigin = lazy.LoginHelper.getLoginOrigin(doc.documentURI); + const recipes = lazy.LoginRecipesContent.getRecipes( + formOrigin, + doc.defaultView + ); + const { usernameField, newPasswordField, oldPasswordField } = + this._getFormFields(form, false, recipes); + + return [usernameField, newPasswordField, oldPasswordField]; + } + + /** + * Verify if a field is a valid login form field and + * returns some information about it's LoginForm. + * + * @param {Element} aField + * A form field we want to verify. + * + * @returns {Object} an object with information about the + * LoginForm username and password field + * or null if the passed field is invalid. + */ + getFieldContext(aField) { + // If the element is not a proper form field, return null. + if ( + !HTMLInputElement.isInstance(aField) || + (!aField.hasBeenTypePassword && + !lazy.LoginHelper.isUsernameFieldType(aField)) || + aField.nodePrincipal.isNullPrincipal || + aField.nodePrincipal.schemeIs("about") || + !aField.ownerDocument + ) { + return null; + } + let { hasBeenTypePassword } = aField; + + // This array provides labels that correspond to the return values from + // `getUserNameAndPasswordFields` so we can know which one aField is. + const LOGIN_FIELD_ORDER = ["username", "new-password", "current-password"]; + let usernameAndPasswordFields = this.getUserNameAndPasswordFields(aField); + let fieldNameHint; + let indexOfFieldInUsernameAndPasswordFields = + usernameAndPasswordFields.indexOf(aField); + if (indexOfFieldInUsernameAndPasswordFields == -1) { + // For fields in the form that are neither username nor password, + // set fieldNameHint to "other". Right now, in contextmenu, we treat both + // "username" and "other" field as username fields. + fieldNameHint = hasBeenTypePassword ? "current-password" : "other"; + } else { + fieldNameHint = + LOGIN_FIELD_ORDER[indexOfFieldInUsernameAndPasswordFields]; + } + let [, newPasswordField] = usernameAndPasswordFields; + + return { + activeField: { + disabled: aField.disabled || aField.readOnly, + fieldNameHint, + }, + // `passwordField` may be the same as `activeField`. + passwordField: { + found: !!newPasswordField, + disabled: + newPasswordField && + (newPasswordField.disabled || newPasswordField.readOnly), + }, + }; + } +} + +/** + * Integration with browser and IPC with LoginManagerParent. + * + * NOTE: there are still bits of code here that needs to be moved to + * LoginFormState. + */ +export class LoginManagerChild extends JSWindowActorChild { + /** + * WeakMap of the root element of a LoginForm to the DeferredTask to fill its fields. + * + * This is used to be able to throttle fills for a LoginForm since onDOMInputPasswordAdded gets + * dispatched for each password field added to a document but we only want to fill once per + * LoginForm when multiple fields are added at once. + * + * @type {WeakMap} + */ + #deferredPasswordAddedTasksByRootElement = new WeakMap(); + + /** + * WeakMap of a document to the array of callbacks to execute when it becomes visible + * + * This is used to defer handling DOMFormHasPassword and onDOMInputPasswordAdded events when the + * containing document is hidden. + * When the document first becomes visible, any queued events will be handled as normal. + * + * @type {WeakMap} + */ + #visibleTasksByDocument = new WeakMap(); + + /** + * Maps all DOM content documents in this content process, including those in + * frames, to the current state used by the Login Manager. + */ + #loginFormStateByDocument = new WeakMap(); + + /** + * Set of fields where the user specifically requested password generation + * (from the context menu) even if we wouldn't offer it on this field by default. + */ + #fieldsWithPasswordGenerationForcedOn = new WeakSet(); + + static forWindow(window) { + return window.windowGlobalChild?.getActor("LoginManager"); + } + + receiveMessage(msg) { + switch (msg.name) { + case "PasswordManager:fillForm": { + this.fillForm({ + loginFormOrigin: msg.data.loginFormOrigin, + loginsFound: lazy.LoginHelper.vanillaObjectsToLogins(msg.data.logins), + recipes: msg.data.recipes, + inputElementIdentifier: msg.data.inputElementIdentifier, + originMatches: msg.data.originMatches, + style: msg.data.style, + }); + break; + } + case "PasswordManager:useGeneratedPassword": { + this.#onUseGeneratedPassword(msg.data.inputElementIdentifier); + break; + } + case "PasswordManager:repopulateAutocompletePopup": { + this.repopulateAutocompletePopup(); + break; + } + case "PasswordManager:formIsPending": { + return this.#visibleTasksByDocument.has(this.document); + } + case "PasswordManager:formProcessed": { + this.notifyObserversOfFormProcessed(msg.data.formid); + break; + } + } + + return undefined; + } + + #onUseGeneratedPassword(inputElementIdentifier) { + let inputElement = lazy.ContentDOMReference.resolve(inputElementIdentifier); + if (!inputElement) { + lazy.log("Could not resolve inputElementIdentifier to a living element."); + return; + } + + if (inputElement != lazy.gFormFillService.focusedInput) { + lazy.log("Could not open popup on input that's no longer focused."); + return; + } + + this.#fieldsWithPasswordGenerationForcedOn.add(inputElement); + this.repopulateAutocompletePopup(); + } + + repopulateAutocompletePopup() { + // Clear the cache of previous autocomplete results to show new options. + lazy.gFormFillService.QueryInterface(Ci.nsIAutoCompleteInput); + lazy.gFormFillService.controller.resetInternalState(); + lazy.gFormFillService.showPopup(); + } + + shouldIgnoreLoginManagerEvent(event) { + let nodePrincipal = event.target.nodePrincipal; + // If we have a system or null principal then prevent any more password manager code from running and + // incorrectly using the document `location`. Also skip password manager for about: pages. + return ( + nodePrincipal.isSystemPrincipal || + nodePrincipal.isNullPrincipal || + nodePrincipal.schemeIs("about") + ); + } + + handleEvent(event) { + if ( + AppConstants.platform == "android" && + Services.prefs.getBoolPref("reftest.remote", false) + ) { + // XXX known incompatibility between reftest harness and form-fill. Is this still needed? + return; + } + + if (this.shouldIgnoreLoginManagerEvent(event)) { + return; + } + + switch (event.type) { + case "DOMDocFetchSuccess": { + this.#onDOMDocFetchSuccess(event); + break; + } + case "DOMFormBeforeSubmit": { + this.#onDOMFormBeforeSubmit(event); + break; + } + case "DOMFormHasPassword": { + this.#onDOMFormHasPassword(event, this.document.defaultView); + let formLike = lazy.LoginFormFactory.createFromForm( + event.originalTarget + ); + lazy.InsecurePasswordUtils.reportInsecurePasswords(formLike); + break; + } + case "DOMFormHasPossibleUsername": { + this.#onDOMFormHasPossibleUsername(event); + break; + } + case "DOMFormRemoved": + case "DOMInputPasswordRemoved": { + this.#onDOMFormRemoved(event); + break; + } + case "DOMInputPasswordAdded": { + this.#onDOMInputPasswordAdded(event, this.document.defaultView); + let formLike = lazy.LoginFormFactory.createFromField( + event.originalTarget + ); + lazy.InsecurePasswordUtils.reportInsecurePasswords(formLike); + break; + } + } + } + + notifyObserversOfFormProcessed(formid) { + Services.obs.notifyObservers(this, "passwordmgr-processed-form", formid); + } + + /** + * Get relevant logins and recipes from the parent + * + * @param {HTMLFormElement} form - form to get login data for + * @param {Object} options + * @param {boolean} options.guid - guid of a login to retrieve + * @param {boolean} options.showPrimaryPassword - whether to show a primary password prompt + */ + _getLoginDataFromParent(form, options) { + let actionOrigin = lazy.LoginHelper.getFormActionOrigin(form); + let messageData = { actionOrigin, options }; + let resultPromise = this.sendQuery( + "PasswordManager:findLogins", + messageData + ); + return resultPromise.then(result => { + return { + form, + importable: result.importable, + loginsFound: lazy.LoginHelper.vanillaObjectsToLogins(result.logins), + recipes: result.recipes, + }; + }); + } + + setupProgressListener(window) { + if (!lazy.LoginHelper.formlessCaptureEnabled) { + return; + } + + // Get the highest accessible docshell and attach the progress listener to that. + let docShell; + for ( + let browsingContext = BrowsingContext.getFromWindow(window); + browsingContext?.docShell; + browsingContext = browsingContext.parent + ) { + docShell = browsingContext.docShell; + } + + try { + let webProgress = docShell + .QueryInterface(Ci.nsIInterfaceRequestor) + .getInterface(Ci.nsIWebProgress); + webProgress.addProgressListener( + observer, + Ci.nsIWebProgress.NOTIFY_STATE_DOCUMENT | + Ci.nsIWebProgress.NOTIFY_LOCATION + ); + } catch (ex) { + // Ignore NS_ERROR_FAILURE if the progress listener was already added + } + } + + /** + * This method sets up form removal listener for form and password fields that + * users have interacted with. + */ + #onDOMDocFetchSuccess(event) { + let document = event.target; + let docState = this.stateForDocument(document); + let weakModificationsRootElements = + ChromeUtils.nondeterministicGetWeakMapKeys( + docState.fieldModificationsByRootElement + ); + + lazy.log( + `modificationsByRootElement approx size: ${weakModificationsRootElements.length}.` + ); + // Start to listen to form/password removed event after receiving a fetch/xhr + // complete event. + document.setNotifyFormOrPasswordRemoved(true); + this.docShell.chromeEventHandler.addEventListener( + "DOMFormRemoved", + this, + true + ); + this.docShell.chromeEventHandler.addEventListener( + "DOMInputPasswordRemoved", + this, + true + ); + + for (let rootElement of weakModificationsRootElements) { + if (HTMLFormElement.isInstance(rootElement)) { + // If we create formLike when it is removed, we might not have the + // right elements at that point, so create formLike object now. + let formLike = lazy.LoginFormFactory.createFromForm(rootElement); + docState.formLikeByObservedNode.set(rootElement, formLike); + } + } + + let weakFormlessModifiedPasswordFields = + ChromeUtils.nondeterministicGetWeakSetKeys( + docState.formlessModifiedPasswordFields + ); + + lazy.log( + `formlessModifiedPasswordFields approx size: ${weakFormlessModifiedPasswordFields.length}.` + ); + for (let passwordField of weakFormlessModifiedPasswordFields) { + let formLike = lazy.LoginFormFactory.createFromField(passwordField); + // force elements lazy getter being called. + if (formLike.elements.length) { + docState.formLikeByObservedNode.set(passwordField, formLike); + } + } + + // Observers have been setted up, removed the listener. + document.setNotifyFetchSuccess(false); + } + + /* + * Trigger capture when a form/formless password is removed from DOM. + * This method is used to capture logins for cases where form submit events + * are not used. + * + * The heuristic works as follow: + * 1. Set up 'DOMDocFetchSuccess' event listener when users have interacted + * with a form (by calling setNotifyFetchSuccess) + * 2. After receiving `DOMDocFetchSuccess`, set up form removal event listener + * (see onDOMDocFetchSuccess) + * 3. When a form is removed, onDOMFormRemoved triggers the login capture + * code. + */ + #onDOMFormRemoved(event) { + let document = event.composedTarget.ownerDocument; + let docState = this.stateForDocument(document); + let formLike = docState.formLikeByObservedNode.get(event.target); + if (!formLike) { + return; + } + + lazy.log("Form is removed."); + this._onFormSubmit(formLike, SUBMIT_FORM_IS_REMOVED); + + docState.formLikeByObservedNode.delete(event.target); + let weakObserveredNodes = ChromeUtils.nondeterministicGetWeakMapKeys( + docState.formLikeByObservedNode + ); + + if (!weakObserveredNodes.length) { + document.setNotifyFormOrPasswordRemoved(false); + this.docShell.chromeEventHandler.removeEventListener( + "DOMFormRemoved", + this + ); + this.docShell.chromeEventHandler.removeEventListener( + "DOMInputPasswordRemoved", + this + ); + } + } + + #onDOMFormBeforeSubmit(event) { + if (!event.isTrusted) { + return; + } + + // We're invoked before the content's |submit| event handlers, so we + // can grab form data before it might be modified (see bug 257781). + let formLike = lazy.LoginFormFactory.createFromForm(event.target); + this._onFormSubmit(formLike, SUBMIT_FORM_SUBMIT); + } + + onDocumentVisibilityChange(event) { + if (!event.isTrusted) { + return; + } + let document = event.target; + let onVisibleTasks = this.#visibleTasksByDocument.get(document); + if (!onVisibleTasks) { + return; + } + for (let task of onVisibleTasks) { + lazy.log("onDocumentVisibilityChange: executing queued task."); + task(); + } + this.#visibleTasksByDocument.delete(document); + } + + _deferHandlingEventUntilDocumentVisible(event, document, fn) { + lazy.log( + `Defer handling event, document.visibilityState: ${document.visibilityState}, defer handling ${event.type}.` + ); + let onVisibleTasks = this.#visibleTasksByDocument.get(document); + if (!onVisibleTasks) { + lazy.log( + "Defer handling first queued event and register the visibilitychange handler." + ); + onVisibleTasks = []; + this.#visibleTasksByDocument.set(document, onVisibleTasks); + document.addEventListener( + "visibilitychange", + event => { + this.onDocumentVisibilityChange(event); + }, + { once: true } + ); + } + onVisibleTasks.push(fn); + } + + #getIsPrimaryPasswordSet() { + return Services.cpmm.sharedData.get("isPrimaryPasswordSet"); + } + + #onDOMFormHasPassword(event, window) { + if (!event.isTrusted) { + return; + } + + this.setupProgressListener(window); + + const isPrimaryPasswordSet = this.#getIsPrimaryPasswordSet(); + let document = event.target.ownerDocument; + + // don't attempt to defer handling when a primary password is set + // Showing the MP modal as soon as possible minimizes its interference with tab interactions + // See bug 1539091 and bug 1538460. + lazy.log( + `#onDOMFormHasPassword: visibilityState: ${document.visibilityState}, isPrimaryPasswordSet: ${isPrimaryPasswordSet}.` + ); + + if (document.visibilityState == "visible" || isPrimaryPasswordSet) { + this._processDOMFormHasPasswordEvent(event); + } else { + // wait until the document becomes visible before handling this event + this._deferHandlingEventUntilDocumentVisible(event, document, () => { + this._processDOMFormHasPasswordEvent(event); + }); + } + } + + _processDOMFormHasPasswordEvent(event) { + let form = event.target; + let formLike = lazy.LoginFormFactory.createFromForm(form); + this._fetchLoginsFromParentAndFillForm(formLike); + } + + #onDOMFormHasPossibleUsername(event) { + if (!event.isTrusted) { + return; + } + const isPrimaryPasswordSet = this.#getIsPrimaryPasswordSet(); + let document = event.target.ownerDocument; + + lazy.log( + `#onDOMFormHasPossibleUsername: visibilityState: ${document.visibilityState}, isPrimaryPasswordSet: ${isPrimaryPasswordSet}.` + ); + + // For simplicity, the result of the telemetry is stacked. This means if a + // document receives two `DOMFormHasPossibleEvent`, we add one counter to both + // bucket 1 & 2. + let docState = this.stateForDocument(document); + Services.telemetry + .getHistogramById("PWMGR_NUM_FORM_HAS_POSSIBLE_USERNAME_EVENT_PER_DOC") + .add(++docState.numFormHasPossibleUsernameEvent); + + // Infer whether a form is a username-only form is expensive, so we restrict the + // number of form looked up per document. + if ( + docState.numFormHasPossibleUsernameEvent > + lazy.LoginHelper.usernameOnlyFormLookupThreshold + ) { + return; + } + + if (document.visibilityState == "visible" || isPrimaryPasswordSet) { + this._processDOMFormHasPossibleUsernameEvent(event); + } else { + // wait until the document becomes visible before handling this event + this._deferHandlingEventUntilDocumentVisible(event, document, () => { + this._processDOMFormHasPossibleUsernameEvent(event); + }); + } + } + + _processDOMFormHasPossibleUsernameEvent(event) { + let form = event.target; + let formLike = lazy.LoginFormFactory.createFromForm(form); + + // If the form contains a passoword field, `getUsernameFieldFromUsernameOnlyForm` returns + // null, so we don't trigger autofill for those forms here. In this function, + // we only care about username-only forms. For forms contain a password, they'll be handled + // in onDOMFormHasPassword. + + // We specifically set the recipe to empty here to avoid loading site recipes during page loads. + // This is okay because if we end up finding a username-only form that should be ignore by + // the site recipe, the form will be skipped while autofilling later. + let docState = this.stateForDocument(form.ownerDocument); + let usernameField = docState.getUsernameFieldFromUsernameOnlyForm(form, {}); + if (usernameField) { + // Autofill the username-only form. + lazy.log("A username-only form is found."); + this._fetchLoginsFromParentAndFillForm(formLike); + } + + Services.telemetry + .getHistogramById("PWMGR_IS_USERNAME_ONLY_FORM") + .add(!!usernameField); + } + + #onDOMInputPasswordAdded(event, window) { + if (!event.isTrusted) { + return; + } + + this.setupProgressListener(window); + + let pwField = event.originalTarget; + if (pwField.form) { + // Fill is handled by onDOMFormHasPassword which is already throttled. + return; + } + + let document = pwField.ownerDocument; + const isPrimaryPasswordSet = this.#getIsPrimaryPasswordSet(); + lazy.log( + `#onDOMInputPasswordAdded, visibilityState: ${document.visibilityState}, isPrimaryPasswordSet: ${isPrimaryPasswordSet}.` + ); + + // don't attempt to defer handling when a primary password is set + // Showing the MP modal as soon as possible minimizes its interference with tab interactions + // See bug 1539091 and bug 1538460. + if (document.visibilityState == "visible" || isPrimaryPasswordSet) { + this._processDOMInputPasswordAddedEvent(event); + } else { + // wait until the document becomes visible before handling this event + this._deferHandlingEventUntilDocumentVisible(event, document, () => { + this._processDOMInputPasswordAddedEvent(event); + }); + } + } + + _processDOMInputPasswordAddedEvent(event) { + let pwField = event.originalTarget; + let formLike = lazy.LoginFormFactory.createFromField(pwField); + + let deferredTask = this.#deferredPasswordAddedTasksByRootElement.get( + formLike.rootElement + ); + if (!deferredTask) { + lazy.log( + "Creating a DeferredTask to call _fetchLoginsFromParentAndFillForm soon." + ); + lazy.LoginFormFactory.setForRootElement(formLike.rootElement, formLike); + + deferredTask = new lazy.DeferredTask( + () => { + // Get the updated LoginForm instead of the one at the time of creating the DeferredTask via + // a closure since it could be stale since LoginForm.elements isn't live. + let formLike2 = lazy.LoginFormFactory.getForRootElement( + formLike.rootElement + ); + lazy.log("Running deferred processing of onDOMInputPasswordAdded."); + this.#deferredPasswordAddedTasksByRootElement.delete( + formLike2.rootElement + ); + this._fetchLoginsFromParentAndFillForm(formLike2); + }, + PASSWORD_INPUT_ADDED_COALESCING_THRESHOLD_MS, + 0 + ); + + this.#deferredPasswordAddedTasksByRootElement.set( + formLike.rootElement, + deferredTask + ); + } + + let window = pwField.ownerGlobal; + if (deferredTask.isArmed) { + lazy.log("DeferredTask is already armed so just updating the LoginForm."); + // We update the LoginForm so it (most important .elements) is fresh when the task eventually + // runs since changes to the elements could affect our field heuristics. + lazy.LoginFormFactory.setForRootElement(formLike.rootElement, formLike); + } else if ( + ["interactive", "complete"].includes(window.document.readyState) + ) { + lazy.log( + "Arming the DeferredTask we just created since document.readyState == 'interactive' or 'complete'." + ); + deferredTask.arm(); + } else { + window.addEventListener( + "DOMContentLoaded", + function () { + lazy.log( + "Arming the onDOMInputPasswordAdded DeferredTask due to DOMContentLoaded." + ); + deferredTask.arm(); + }, + { once: true } + ); + } + } + + /** + * Fetch logins from the parent for a given form and then attempt to fill it. + * + * @param {LoginForm} form to fetch the logins for then try autofill. + */ + _fetchLoginsFromParentAndFillForm(form) { + if (!lazy.LoginHelper.enabled) { + return; + } + + // set up input event listeners so we know if the user has interacted with these fields + // * input: Listen for the field getting blanked (without blurring) or a paste + // * change: Listen for changes to the field filled with the generated password so we can preserve edits. + form.rootElement.addEventListener("input", observer, { + capture: true, + mozSystemGroup: true, + }); + form.rootElement.addEventListener("change", observer, { + capture: true, + mozSystemGroup: true, + }); + + this._getLoginDataFromParent(form, { showPrimaryPassword: true }) + .then(this.loginsFound.bind(this)) + .catch(console.error); + } + + isPasswordGenerationForcedOn(passwordField) { + return this.#fieldsWithPasswordGenerationForcedOn.has(passwordField); + } + + /** + * Retrieves a reference to the state object associated with the given + * document. This is initialized to an object with default values. + */ + stateForDocument(document) { + let loginFormState = this.#loginFormStateByDocument.get(document); + if (!loginFormState) { + loginFormState = new LoginFormState(); + this.#loginFormStateByDocument.set(document, loginFormState); + } + return loginFormState; + } + + /** + * Perform a password fill upon user request coming from the parent process. + * The fill will be in the form previously identified during page navigation. + * + * @param An object with the following properties: + * { + * loginFormOrigin: + * String with the origin for which the login UI was displayed. + * This must match the origin of the form used for the fill. + * loginsFound: + * Array containing the login to fill. While other messages may + * have more logins, for this use case this is expected to have + * exactly one element. The origin of the login may be different + * from the origin of the form used for the fill. + * recipes: + * Fill recipes transmitted together with the original message. + * inputElementIdentifier: + * An identifier generated for the input element via ContentDOMReference. + * originMatches: + * True if the origin of the form matches the page URI. + * } + */ + fillForm({ + loginFormOrigin, + loginsFound, + recipes, + inputElementIdentifier, + originMatches, + style, + }) { + if (!inputElementIdentifier) { + lazy.log("No input element specified."); + return; + } + + let inputElement = lazy.ContentDOMReference.resolve(inputElementIdentifier); + if (!inputElement) { + lazy.log("Could not resolve inputElementIdentifier to a living element."); + return; + } + + if (!originMatches) { + if ( + lazy.LoginHelper.getLoginOrigin( + inputElement.ownerDocument.documentURI + ) != loginFormOrigin + ) { + lazy.log( + "The requested origin doesn't match the one from the", + "document. This may mean we navigated to a document from a different", + "site before we had a chance to indicate this change in the user", + "interface." + ); + return; + } + } + + let clobberUsername = true; + let form = lazy.LoginFormFactory.createFromField(inputElement); + if (inputElement.hasBeenTypePassword) { + clobberUsername = false; + } + + this._fillForm(form, loginsFound, recipes, { + inputElement, + autofillForm: true, + clobberUsername, + clobberPassword: true, + userTriggered: true, + style, + }); + } + + loginsFound({ form, importable, loginsFound, recipes }) { + let doc = form.ownerDocument; + let autofillForm = + lazy.LoginHelper.autofillForms && + !PrivateBrowsingUtils.isContentWindowPrivate(doc.defaultView); + + let formOrigin = lazy.LoginHelper.getLoginOrigin(doc.documentURI); + lazy.LoginRecipesContent.cacheRecipes(formOrigin, doc.defaultView, recipes); + + this._fillForm(form, loginsFound, recipes, { autofillForm, importable }); + } + + /** + * A username or password was autocompleted into a field. + */ + onFieldAutoComplete(acInputField, loginGUID) { + if (!lazy.LoginHelper.enabled) { + return; + } + + // This is probably a bit over-conservatative. + if (!Document.isInstance(acInputField.ownerDocument)) { + return; + } + + if (!lazy.LoginFormFactory.createFromField(acInputField)) { + return; + } + + if (lazy.LoginHelper.isUsernameFieldType(acInputField)) { + this.onUsernameAutocompleted(acInputField, loginGUID); + } else if (acInputField.hasBeenTypePassword) { + // Ensure the field gets re-masked and edits don't overwrite the generated + // password in case a generated password was filled into it previously. + const docState = this.stateForDocument(acInputField.ownerDocument); + docState._stopTreatingAsGeneratedPasswordField(acInputField); + LoginFormState._highlightFilledField(acInputField); + } + } + + /** + * A username field was filled or tabbed away from so try fill in the + * associated password in the password field. + */ + onUsernameAutocompleted(acInputField, loginGUID = null) { + lazy.log(`Autocompleting input field with name: ${acInputField.name}`); + + let acForm = lazy.LoginFormFactory.createFromField(acInputField); + let doc = acForm.ownerDocument; + let formOrigin = lazy.LoginHelper.getLoginOrigin(doc.documentURI); + let recipes = lazy.LoginRecipesContent.getRecipes( + formOrigin, + doc.defaultView + ); + + // Make sure the username field fillForm will use is the + // same field as the autocomplete was activated on. + const docState = this.stateForDocument(acInputField.ownerDocument); + let { usernameField, newPasswordField: passwordField } = + docState._getFormFields(acForm, false, recipes); + if (usernameField == acInputField) { + // Fill the form when a password field is present. + if (passwordField) { + this._getLoginDataFromParent(acForm, { + guid: loginGUID, + showPrimaryPassword: false, + }) + .then(({ form, loginsFound, recipes }) => { + if (!loginGUID) { + // not an explicit autocomplete menu selection, filter for exact matches only + loginsFound = this._filterForExactFormOriginLogins( + loginsFound, + acForm + ); + // filter the list for exact matches with the username + // NOTE: this could be an empty string which is a valid username + let searchString = usernameField.value.toLowerCase(); + loginsFound = loginsFound.filter( + l => l.username.toLowerCase() == searchString + ); + } + + this._fillForm(form, loginsFound, recipes, { + autofillForm: true, + clobberPassword: true, + userTriggered: true, + }); + }) + .catch(console.error); + // Use `loginGUID !== null` to distinguish whether this is called when the + // field is filled or tabbed away from. For the latter, don't highlight the field. + } else if (loginGUID !== null) { + LoginFormState._highlightFilledField(usernameField); + } + } else { + // Ignore the event, it's for some input we don't care about. + } + } + + /** + * @return true if the page requests autocomplete be disabled for the + * specified element. + */ + _isAutocompleteDisabled(element) { + return element?.autocomplete == "off"; + } + + /** + * Fill a page that was restored from bfcache since we wouldn't receive + * DOMInputPasswordAdded or DOMFormHasPassword events for it. + * @param {Document} aDocument that was restored from bfcache. + */ + _onDocumentRestored(aDocument) { + let rootElsWeakSet = + lazy.LoginFormFactory.getRootElementsWeakSetForDocument(aDocument); + let weakLoginFormRootElements = + ChromeUtils.nondeterministicGetWeakSetKeys(rootElsWeakSet); + + lazy.log( + `loginFormRootElements approx size: ${weakLoginFormRootElements.length}.` + ); + + for (let formRoot of weakLoginFormRootElements) { + if (!formRoot.isConnected) { + continue; + } + + let formLike = lazy.LoginFormFactory.getForRootElement(formRoot); + this._fetchLoginsFromParentAndFillForm(formLike); + } + } + + /** + * Trigger capture on any relevant FormLikes due to a navigation alone (not + * necessarily due to an actual form submission). This method is used to + * capture logins for cases where form submit events are not used. + * + * To avoid multiple notifications for the same LoginForm, this currently + * avoids capturing when dealing with a real <form> which are ideally already + * using a submit event. + * + * @param {Document} document being navigated + */ + _onNavigation(aDocument) { + let rootElsWeakSet = + lazy.LoginFormFactory.getRootElementsWeakSetForDocument(aDocument); + let weakLoginFormRootElements = + ChromeUtils.nondeterministicGetWeakSetKeys(rootElsWeakSet); + + lazy.log(`root elements approx size: ${weakLoginFormRootElements.length}`); + + for (let formRoot of weakLoginFormRootElements) { + if (!formRoot.isConnected) { + continue; + } + + let formLike = lazy.LoginFormFactory.getForRootElement(formRoot); + this._onFormSubmit(formLike, SUBMIT_PAGE_NAVIGATION); + } + } + + /** + * Called by our observer when notified of a form submission. + * [Note that this happens before any DOM onsubmit handlers are invoked.] + * Looks for a password change in the submitted form, so we can update + * our stored password. + * + * @param {LoginForm} form + */ + _onFormSubmit(form, reason) { + lazy.log("Detected form submission."); + + this._maybeSendFormInteractionMessage( + form, + "PasswordManager:ShowDoorhanger", + { + targetField: null, + isSubmission: true, + // When this is trigger by inferring from form removal, the form is not + // connected anymore, skip checking isConnected in this case. + ignoreConnect: reason == SUBMIT_FORM_IS_REMOVED, + } + ); + } + + /** + * Extracts and validates information from a form-like element on the page. If validation is + * successful, sends a message to the parent process requesting that it show a dialog. + * + * The validation works are divided into two parts: + * 1. Whether this is a valid form with a password (validate in this function) + * 2. Whether the password manager decides to send interaction message for this form + * (validate in _maybeSendFormInteractionMessageContinue) + * + * When the function is triggered by a form submission event, and the form is valid (pass #1), + * We still send the message to the parent even the validation of #2 fails. This is because + * there might be someone who is interested in form submission events regardless of whether + * the password manager decides to show the doorhanger or not. + * + * @param {LoginForm} form + * @param {string} messageName used to categorize the type of message sent to the parent process. + * @param {Element?} options.targetField + * @param {boolean} options.isSubmission if true, this function call was prompted by a form submission. + * @param {boolean?} options.triggeredByFillingGenerated whether or not this call was triggered by a + * generated password being filled into a form-like element. + * @param {boolean?} options.ignoreConnect Whether to ignore isConnected attribute of a element. + * + * @returns {Boolean} whether the message is sent to the parent process. + */ + _maybeSendFormInteractionMessage( + form, + messageName, + { targetField, isSubmission, triggeredByFillingGenerated, ignoreConnect } + ) { + let logMessagePrefix = isSubmission + ? LOG_MESSAGE_FORM_SUBMISSION + : LOG_MESSAGE_FIELD_EDIT; + let doc = form.ownerDocument; + let win = doc.defaultView; + let passwordField = null; + if (targetField?.hasBeenTypePassword) { + passwordField = targetField; + } + + let origin = lazy.LoginHelper.getLoginOrigin(doc.documentURI); + if (!origin) { + lazy.log(`${logMessagePrefix} ignored -- invalid origin.`); + return; + } + + // Get the appropriate fields from the form. + let recipes = lazy.LoginRecipesContent.getRecipes(origin, win); + const docState = this.stateForDocument(form.ownerDocument); + let fields = { + targetField, + ...docState._getFormFields(form, true, recipes, { ignoreConnect }), + }; + + if (fields.usernameField) { + lazy.gFormFillService.markAsLoginManagerField(fields.usernameField); + } + + // It's possible the field triggering this message isn't one of those found by _getFormFields' heuristics + if ( + passwordField && + passwordField != fields.newPasswordField && + passwordField != fields.oldPasswordField && + passwordField != fields.confirmPasswordField + ) { + fields.newPasswordField = passwordField; + } + + // Need at least 1 valid password field to do anything. + if (fields.newPasswordField == null) { + if (isSubmission && fields.usernameField) { + lazy.log( + "_onFormSubmit: username-only form. Record the username field but not sending prompt." + ); + docState.mockUsernameOnlyField = { + name: fields.usernameField.name, + value: fields.usernameField.value, + }; + } + return; + } + + this._maybeSendFormInteractionMessageContinue(form, messageName, { + ...fields, + isSubmission, + triggeredByFillingGenerated, + }); + + if (isSubmission) { + // Notify `PasswordManager:onFormSubmit` as long as we detect submission event on a + // valid form with a password field. + this.sendAsyncMessage( + "PasswordManager:onFormSubmit", + {}, + { + fields, + isSubmission, + triggeredByFillingGenerated, + } + ); + } + } + + /** + * Continues the works that are not done in _maybeSendFormInteractionMessage. + * See comments in _maybeSendFormInteractionMessage for more details. + */ + _maybeSendFormInteractionMessageContinue( + form, + messageName, + { + targetField, + usernameField, + newPasswordField, + oldPasswordField, + confirmPasswordField, + isSubmission, + triggeredByFillingGenerated, + } + ) { + let logMessagePrefix = isSubmission + ? LOG_MESSAGE_FORM_SUBMISSION + : LOG_MESSAGE_FIELD_EDIT; + let doc = form.ownerDocument; + let win = doc.defaultView; + let detail = { messageSent: false }; + try { + // when filling a generated password, we do still want to message the parent + if ( + !triggeredByFillingGenerated && + PrivateBrowsingUtils.isContentWindowPrivate(win) && + !lazy.LoginHelper.privateBrowsingCaptureEnabled + ) { + // We won't do anything in private browsing mode anyway, + // so there's no need to perform further checks. + lazy.log(`${logMessagePrefix} ignored in private browsing mode.`); + return; + } + + // If password saving is disabled globally, bail out now. + if (!lazy.LoginHelper.enabled) { + return; + } + + let fullyMungedPattern = /^\*+$|^•+$|^\.+$/; + // Check `isSubmission` to allow munged passwords in dismissed by default doorhangers (since + // they are initiated by the user) in case this matches their actual password. + if (isSubmission && newPasswordField?.value.match(fullyMungedPattern)) { + lazy.log("New password looks munged. Not sending prompt."); + return; + } + + // When the username field is empty, check whether we have found it previously from + // a username-only form, if yes, fill in its value. + // XXX This is not ideal, we only use the previous saved username field when the current + // form doesn't have one. This means if there is a username field found in the current + // form, we don't compare it to the saved one, which might be a better choice in some cases. + // The reason we are not doing it now is because we haven't found a real world example. + let docState = this.stateForDocument(doc); + if (!usernameField) { + if (docState.mockUsernameOnlyField) { + usernameField = docState.mockUsernameOnlyField; + } + } + if (usernameField?.value.match(/\.{3,}|\*{3,}|•{3,}/)) { + lazy.log( + `usernameField with name ${usernameField.name} looks munged, setting to null.` + ); + usernameField = null; + } + + // Check for autocomplete=off attribute. We don't use it to prevent + // autofilling (for existing logins), but won't save logins when it's + // present and the storeWhenAutocompleteOff pref is false. + // XXX spin out a bug that we don't update timeLastUsed in this case? + if ( + (this._isAutocompleteDisabled(form) || + this._isAutocompleteDisabled(usernameField) || + this._isAutocompleteDisabled(newPasswordField) || + this._isAutocompleteDisabled(oldPasswordField)) && + !lazy.LoginHelper.storeWhenAutocompleteOff + ) { + lazy.log(`${logMessagePrefix} ignored -- autocomplete=off found.`); + return; + } + + // Don't try to send DOM nodes over IPC. + let mockUsername = usernameField + ? { name: usernameField.name, value: usernameField.value } + : null; + let mockPassword = { + name: newPasswordField.name, + value: newPasswordField.value, + }; + let mockOldPassword = oldPasswordField + ? { name: oldPasswordField.name, value: oldPasswordField.value } + : null; + + let usernameValue = usernameField?.value; + // Dismiss prompt if the username field is a credit card number AND + // if the password field is a three digit number. Also dismiss prompt if + // the password is a credit card number and the password field has attribute + // autocomplete="cc-number". + let dismissedPrompt = !isSubmission; + let newPasswordFieldValue = newPasswordField.value; + if ( + (!dismissedPrompt && + CreditCard.isValidNumber(usernameValue) && + newPasswordFieldValue.trim().match(/^[0-9]{3}$/)) || + (CreditCard.isValidNumber(newPasswordFieldValue) && + newPasswordField.getAutocompleteInfo().fieldName == "cc-number") + ) { + dismissedPrompt = true; + } + + const fieldsModified = docState._formHasModifiedFields(form); + if (!fieldsModified && lazy.LoginHelper.userInputRequiredToCapture) { + if (targetField) { + throw new Error("No user input on targetField"); + } + // we know no fields in this form had user modifications, so don't prompt + lazy.log( + `${logMessagePrefix} ignored -- submitting values that are not changed by the user.` + ); + return; + } + + if ( + docState.compareAndUpdatePreviouslySentValues( + form.rootElement, + usernameValue, + newPasswordField.value, + dismissedPrompt, + triggeredByFillingGenerated + ) + ) { + lazy.log( + `${logMessagePrefix} ignored -- already submitted with the same username and password.` + ); + return; + } + + let { login: autoFilledLogin } = + docState.fillsByRootElement.get(form.rootElement) || {}; + let browsingContextId = win.windowGlobalChild.browsingContext.id; + let formActionOrigin = lazy.LoginHelper.getFormActionOrigin(form); + + detail = { + browsingContextId, + formActionOrigin, + autoFilledLoginGuid: autoFilledLogin && autoFilledLogin.guid, + usernameField: mockUsername, + newPasswordField: mockPassword, + oldPasswordField: mockOldPassword, + dismissedPrompt, + triggeredByFillingGenerated, + possibleValues: { + usernames: docState.possibleUsernames, + passwords: docState.possiblePasswords, + }, + messageSent: true, + }; + + if (messageName == "PasswordManager:ShowDoorhanger") { + docState.captureLoginTimeStamp = doc.lastUserGestureTimeStamp; + } + this.sendAsyncMessage(messageName, detail); + } catch (ex) { + console.error(ex); + throw ex; + } finally { + detail.form = form; + const evt = new CustomEvent(messageName, { detail }); + win.windowRoot.dispatchEvent(evt); + } + } + + /** + * Heuristic for whether or not we should consider [field]s value to be 'new' (as opposed to + * 'changed') after applying [event]. + * + * @param {HTMLInputElement} event.target input element being changed. + * @param {string?} event.data new value being input into the field. + * + * @returns {boolean} + */ + _doesEventClearPrevFieldValue({ target, data, inputType }) { + return ( + !target.value || + // We check inputType here as a proxy for the previous field value. + // If the previous field value was empty, e.g. automatically filling + // a confirm password field when a new password field is filled with + // a generated password, there's nothing to replace. + // We may be able to use the "beforeinput" event instead when that + // ships (Bug 1609291). + (data && data == target.value && inputType !== "insertReplacementText") + ); + } + + /** + * The password field has been filled with a generated password, ensure the + * field is handled accordingly. + * @param {HTMLInputElement} passwordField + */ + _filledWithGeneratedPassword(passwordField) { + LoginFormState._highlightFilledField(passwordField); + this._passwordEditedOrGenerated(passwordField, { + triggeredByFillingGenerated: true, + }); + let docState = this.stateForDocument(passwordField.ownerDocument); + docState.fillConfirmFieldWithGeneratedPassword(passwordField); + } + + /** + * Notify the parent that we are ignoring the password edit + * so that tests can listen for this as opposed to waiting for + * nothing to happen. + */ + _ignorePasswordEdit() { + if (Cu.isInAutomation) { + this.sendAsyncMessage("PasswordManager:onIgnorePasswordEdit", {}); + } + } + /** + * Notify the parent that a generated password was filled into a field or + * edited so that it can potentially be saved. + * @param {HTMLInputElement} passwordField + */ + _passwordEditedOrGenerated( + passwordField, + { triggeredByFillingGenerated = false } = {} + ) { + lazy.log( + `Password field with name ${passwordField.name} was filled or edited.` + ); + + if (!lazy.LoginHelper.enabled && triggeredByFillingGenerated) { + throw new Error( + "A generated password was filled while the password manager was disabled." + ); + } + + let loginForm = lazy.LoginFormFactory.createFromField(passwordField); + + if (triggeredByFillingGenerated) { + LoginFormState._highlightFilledField(passwordField); + let docState = this.stateForDocument(passwordField.ownerDocument); + docState._treatAsGeneratedPasswordField(passwordField); + + // Once the generated password was filled we no longer want to autocomplete + // saved logins into a non-empty password field (see LoginAutoComplete.startSearch) + // because it is confusing. + this.#fieldsWithPasswordGenerationForcedOn.delete(passwordField); + } + + this._maybeSendFormInteractionMessage( + loginForm, + "PasswordManager:onPasswordEditedOrGenerated", + { + targetField: passwordField, + isSubmission: false, + triggeredByFillingGenerated, + } + ); + } + + /** + * Filter logins for exact origin/formActionOrigin and dedupe on usernamematche + * @param {nsILoginInfo[]} logins an array of nsILoginInfo that could be + * used for the form, including ones with a different form action origin + * which are only used when the fill is userTriggered + * @param {LoginForm} form + */ + _filterForExactFormOriginLogins(logins, form) { + let loginOrigin = lazy.LoginHelper.getLoginOrigin( + form.ownerDocument.documentURI + ); + let formActionOrigin = lazy.LoginHelper.getFormActionOrigin(form); + logins = logins.filter(l => { + let formActionMatches = lazy.LoginHelper.isOriginMatching( + l.formActionOrigin, + formActionOrigin, + { + schemeUpgrades: lazy.LoginHelper.schemeUpgrades, + acceptWildcardMatch: true, + acceptDifferentSubdomains: true, + } + ); + let formOriginMatches = lazy.LoginHelper.isOriginMatching( + l.origin, + loginOrigin, + { + schemeUpgrades: lazy.LoginHelper.schemeUpgrades, + acceptWildcardMatch: true, + acceptDifferentSubdomains: false, + } + ); + return formActionMatches && formOriginMatches; + }); + + // Since the logins are already filtered now to only match the origin and formAction, + // dedupe to just the username since remaining logins may have different schemes. + logins = lazy.LoginHelper.dedupeLogins( + logins, + ["username"], + ["scheme", "timePasswordChanged"], + loginOrigin, + formActionOrigin + ); + return logins; + } + + /** + * Attempt to find the username and password fields in a form, and fill them + * in using the provided logins and recipes. + * + * @param {LoginForm} form + * @param {nsILoginInfo[]} foundLogins an array of nsILoginInfo that could be + * used for the form, including ones with a different form action origin + * which are only used when the fill is userTriggered + * @param {Set} recipes a set of recipes that could be used to affect how the + * form is filled + * @param {Object} [options = {}] a list of options for this method + * @param {HTMLInputElement} [options.inputElement = null] an optional target + * input element we want to fill + * @param {bool} [options.autofillForm = false] denotes if we should fill the + * form in automatically + * @param {bool} [options.clobberUsername = false] controls if an existing + * username can be overwritten. If this is false and an inputElement + * of type password is also passed, the username field will be ignored. + * If this is false and no inputElement is passed, if the username + * field value is not found in foundLogins, it will not fill the + * password. + * @param {bool} [options.clobberPassword = false] controls if an existing + * password value can be overwritten + * @param {bool} [options.userTriggered = false] an indication of whether + * this filling was triggered by the user + */ + // eslint-disable-next-line complexity + _fillForm( + form, + foundLogins, + recipes, + { + inputElement = null, + autofillForm = false, + importable = null, + clobberUsername = false, + clobberPassword = false, + userTriggered = false, + style = null, + } = {} + ) { + if (HTMLFormElement.isInstance(form)) { + throw new Error("_fillForm should only be called with LoginForm objects"); + } + + lazy.log(`Found ${form.elements.length} form elements.`); + // Will be set to one of AUTOFILL_RESULT in the `try` block. + let autofillResult = -1; + const AUTOFILL_RESULT = { + FILLED: 0, + NO_PASSWORD_FIELD: 1, + PASSWORD_DISABLED_READONLY: 2, + NO_LOGINS_FIT: 3, + NO_SAVED_LOGINS: 4, + EXISTING_PASSWORD: 5, + EXISTING_USERNAME: 6, + MULTIPLE_LOGINS: 7, + NO_AUTOFILL_FORMS: 8, + AUTOCOMPLETE_OFF: 9, + INSECURE: 10, + PASSWORD_AUTOCOMPLETE_NEW_PASSWORD: 11, + TYPE_NO_LONGER_PASSWORD: 12, + FORM_IN_CROSSORIGIN_SUBFRAME: 13, + FILLED_USERNAME_ONLY_FORM: 14, + }; + const docState = this.stateForDocument(form.ownerDocument); + + // Heuristically determine what the user/pass fields are + // We do this before checking to see if logins are stored, + // so that the user isn't prompted for a primary password + // without need. + let { usernameField, newPasswordField: passwordField } = + docState._getFormFields(form, false, recipes); + + const passwordACFieldName = passwordField?.getAutocompleteInfo().fieldName; + + let scenario; + + // For SignUpFormScenario we expect an email like username + if (this.#relayIsAvailableOrEnabled() && usernameField) { + // Sign-up detection ruleset requires a <form>. + // When form.rootElement is not a form, fall back on the heuristic that + // assumes a form/document and a passwordField with autocomplete new-password + if ( + HTMLFormElement.isInstance(form.rootElement) && + lazy.LoginHelper.signupDetectionEnabled + ) { + if (docState.isProbablyASignUpForm(form.rootElement)) { + scenario = new SignUpFormScenario(usernameField, passwordField); + } + } else if (passwordACFieldName == "new-password") { + scenario = new SignUpFormScenario(usernameField, passwordField); + } + if (scenario) { + docState.setScenario(form.rootElement, scenario); + lazy.gFormFillService.markAsLoginManagerField(usernameField); + } + } + + try { + // Nothing to do if we have no matching (excluding form action + // checks) logins available, and there isn't a need to show + // the insecure form warning. + if ( + !foundLogins.length && + !(importable?.state === "import" && importable?.browsers) && + lazy.InsecurePasswordUtils.isFormSecure(form) + ) { + // We don't log() here since this is a very common case. + autofillResult = AUTOFILL_RESULT.NO_SAVED_LOGINS; + return; + } + + // If we have a password inputElement parameter and it's not + // the same as the one heuristically found, use the parameter + // one instead. + if (inputElement) { + if (inputElement.hasBeenTypePassword) { + passwordField = inputElement; + if (!clobberUsername) { + usernameField = null; + } + } else if (lazy.LoginHelper.isUsernameFieldType(inputElement)) { + usernameField = inputElement; + } else { + throw new Error("Unexpected input element type."); + } + } + + // Need a valid password or username field to do anything. + if (passwordField == null && usernameField == null) { + lazy.log("Not filling form, no password and username field found."); + autofillResult = AUTOFILL_RESULT.NO_PASSWORD_FIELD; + return; + } + + // Attach autocomplete stuff to the username field, if we have + // one. This is normally used to select from multiple accounts, + // but even with one account we should refill if the user edits. + // We would also need this attached to show the insecure login + // warning, regardless of saved login. + if (usernameField) { + lazy.gFormFillService.markAsLoginManagerField(usernameField); + usernameField.addEventListener("keydown", observer); + } + + // If the password field is disabled or read-only, there's nothing to do. + if (passwordField?.disabled || passwordField?.readOnly) { + lazy.log("Not filling form, password field disabled or read-only."); + autofillResult = AUTOFILL_RESULT.PASSWORD_DISABLED_READONLY; + return; + } + + if ( + !userTriggered && + !form.rootElement.ownerGlobal.windowGlobalChild.sameOriginWithTop + ) { + lazy.log("Not filling form; it is in a cross-origin subframe."); + autofillResult = AUTOFILL_RESULT.FORM_IN_CROSSORIGIN_SUBFRAME; + return; + } + + if (!userTriggered) { + // Only autofill logins that match the form's action and origin. In the above code + // we have attached autocomplete for logins that don't match the form action. + foundLogins = this._filterForExactFormOriginLogins(foundLogins, form); + } + + // Nothing to do if we have no matching logins available. + // Only insecure pages reach this block and logs the same + // telemetry flag. + if (!foundLogins.length) { + // We don't log() here since this is a very common case. + autofillResult = AUTOFILL_RESULT.NO_SAVED_LOGINS; + return; + } + + // Prevent autofilling insecure forms. + if ( + !userTriggered && + !lazy.LoginHelper.insecureAutofill && + !lazy.InsecurePasswordUtils.isFormSecure(form) + ) { + lazy.log("Not filling form since it's insecure."); + autofillResult = AUTOFILL_RESULT.INSECURE; + return; + } + + // Discard logins which have username/password values that don't + // fit into the fields (as specified by the maxlength attribute). + // The user couldn't enter these values anyway, and it helps + // with sites that have an extra PIN to be entered (bug 391514) + let maxUsernameLen = Number.MAX_VALUE; + let maxPasswordLen = Number.MAX_VALUE; + + // If attribute wasn't set, default is -1. + if (usernameField?.maxLength >= 0) { + maxUsernameLen = usernameField.maxLength; + } + if (passwordField?.maxLength >= 0) { + maxPasswordLen = passwordField.maxLength; + } + + let logins = foundLogins.filter(function (l) { + let fit = + l.username.length <= maxUsernameLen && + l.password.length <= maxPasswordLen; + if (!fit) { + lazy.log(`Ignored login: won't fit ${l.username.length}.`); + } + + return fit; + }, this); + + if (!logins.length) { + lazy.log("Form not filled, none of the logins fit in the field."); + autofillResult = AUTOFILL_RESULT.NO_LOGINS_FIT; + return; + } + + if (passwordField) { + if (!userTriggered && passwordField.type != "password") { + // We don't want to autofill (without user interaction) into a field + // that's unmasked. + lazy.log( + "Not autofilling, password field isn't currently type=password." + ); + autofillResult = AUTOFILL_RESULT.TYPE_NO_LONGER_PASSWORD; + return; + } + + // If the password field has the autocomplete value of "new-password" + // and we're autofilling without user interaction, there's nothing to do. + if (!userTriggered && passwordACFieldName == "new-password") { + lazy.log( + "Not filling form, password field has the autocomplete new-password value." + ); + autofillResult = AUTOFILL_RESULT.PASSWORD_AUTOCOMPLETE_NEW_PASSWORD; + return; + } + + // Don't clobber an existing password. + if (passwordField.value && !clobberPassword) { + lazy.log("Form not filled, the password field was already filled."); + autofillResult = AUTOFILL_RESULT.EXISTING_PASSWORD; + return; + } + } + + // Select a login to use for filling in the form. + let selectedLogin; + if ( + !clobberUsername && + usernameField && + (usernameField.value || + usernameField.disabled || + usernameField.readOnly) + ) { + // If username was specified in the field, it's disabled or it's readOnly, only fill in the + // password if we find a matching login. + let username = usernameField.value.toLowerCase(); + + let matchingLogins = logins.filter( + l => l.username.toLowerCase() == username + ); + if (!matchingLogins.length) { + lazy.log( + "Password not filled. None of the stored logins match the username already present." + ); + autofillResult = AUTOFILL_RESULT.EXISTING_USERNAME; + return; + } + + // If there are multiple, and one matches case, use it + for (let l of matchingLogins) { + if (l.username == usernameField.value) { + selectedLogin = l; + } + } + // Otherwise just use the first + if (!selectedLogin) { + selectedLogin = matchingLogins[0]; + } + } else if (logins.length == 1) { + selectedLogin = logins[0]; + } else { + // We have multiple logins. Handle a special case here, for sites + // which have a normal user+pass login *and* a password-only login + // (eg, a PIN). Prefer the login that matches the type of the form + // (user+pass or pass-only) when there's exactly one that matches. + let matchingLogins; + if (usernameField) { + matchingLogins = logins.filter(l => l.username); + } else { + matchingLogins = logins.filter(l => !l.username); + } + + if (matchingLogins.length != 1) { + lazy.log("Multiple logins for form, so not filling any."); + autofillResult = AUTOFILL_RESULT.MULTIPLE_LOGINS; + return; + } + + selectedLogin = matchingLogins[0]; + } + + // We will always have a selectedLogin at this point. + + if (!autofillForm) { + lazy.log("autofillForms=false but form can be filled."); + autofillResult = AUTOFILL_RESULT.NO_AUTOFILL_FORMS; + return; + } + + if ( + !userTriggered && + passwordACFieldName == "off" && + !lazy.LoginHelper.autofillAutocompleteOff + ) { + lazy.log( + "Not autofilling the login because we're respecting autocomplete=off." + ); + autofillResult = AUTOFILL_RESULT.AUTOCOMPLETE_OFF; + return; + } + + // Fill the form + + let willAutofill = + usernameField || passwordField.value != selectedLogin.password; + if (willAutofill) { + let autoFilledLogin = { + guid: selectedLogin.QueryInterface(Ci.nsILoginMetaInfo).guid, + username: selectedLogin.username, + usernameField: usernameField + ? Cu.getWeakReference(usernameField) + : null, + password: selectedLogin.password, + passwordField: passwordField + ? Cu.getWeakReference(passwordField) + : null, + }; + // Ensure the state is updated before setUserInput is called. + lazy.log( + "Saving autoFilledLogin", + autoFilledLogin.guid, + "for", + form.rootElement + ); + docState.fillsByRootElement.set(form.rootElement, { + login: autoFilledLogin, + userTriggered, + }); + } + if (usernameField) { + // Don't modify the username field because the user wouldn't be able to change it either. + let disabledOrReadOnly = + usernameField.disabled || usernameField.readOnly; + + if (selectedLogin.username && !disabledOrReadOnly) { + let userNameDiffers = selectedLogin.username != usernameField.value; + // Don't replace the username if it differs only in case, and the user triggered + // this autocomplete. We assume that if it was user-triggered the entered text + // is desired. + let userEnteredDifferentCase = + userTriggered && + userNameDiffers && + usernameField.value.toLowerCase() == + selectedLogin.username.toLowerCase(); + + if (!userEnteredDifferentCase && userNameDiffers) { + usernameField.setUserInput(selectedLogin.username); + } + LoginFormState._highlightFilledField(usernameField); + } + } + + if (passwordField) { + if (passwordField.value != selectedLogin.password) { + // Ensure the field gets re-masked in case a generated password was + // filled into it previously. + docState._stopTreatingAsGeneratedPasswordField(passwordField); + + passwordField.setUserInput(selectedLogin.password); + } + + LoginFormState._highlightFilledField(passwordField); + } + + if (style === "generatedPassword") { + this._filledWithGeneratedPassword(passwordField); + } + + lazy.log("_fillForm succeeded"); + if (passwordField) { + autofillResult = AUTOFILL_RESULT.FILLED; + } else if (usernameField) { + autofillResult = AUTOFILL_RESULT.FILLED_USERNAME_ONLY_FORM; + } + } catch (ex) { + console.error(ex); + throw ex; + } finally { + if (autofillResult == -1) { + // eslint-disable-next-line no-unsafe-finally + throw new Error("_fillForm: autofillResult must be specified"); + } + + if (!userTriggered) { + // Ignore fills as a result of user action for this probe. + Services.telemetry + .getHistogramById("PWMGR_FORM_AUTOFILL_RESULT") + .add(autofillResult); + + if (usernameField) { + let focusedElement = lazy.gFormFillService.focusedInput; + if ( + usernameField == focusedElement && + ![ + AUTOFILL_RESULT.FILLED, + AUTOFILL_STATE.FILLED_USERNAME_ONLY_FORM, + ].includes(autofillResult) + ) { + lazy.log( + "Opening username autocomplete popup since the form wasn't autofilled." + ); + lazy.gFormFillService.showPopup(); + } + } + } + + if (usernameField) { + lazy.log("Attaching event listeners to usernameField."); + usernameField.addEventListener("focus", observer); + usernameField.addEventListener("mousedown", observer); + } + + this.sendAsyncMessage("PasswordManager:formProcessed", { + formid: form.rootElement.id, + }); + } + } + #relayIsAvailableOrEnabled() { + // This code is a mirror of what FirefoxRelay.jsm is doing, + // but we can not load Relay module in the child process. + const value = Services.prefs.getStringPref( + "signon.firefoxRelay.feature", + undefined + ); + return ["available", "offered", "enabled"].includes(value); + } + + getScenario(inputElement) { + const docState = this.stateForDocument(inputElement.ownerDocument); + return docState.getScenario(inputElement); + } +} diff --git a/toolkit/components/passwordmgr/LoginManagerContextMenu.sys.mjs b/toolkit/components/passwordmgr/LoginManagerContextMenu.sys.mjs new file mode 100644 index 0000000000..4a6da4cb32 --- /dev/null +++ b/toolkit/components/passwordmgr/LoginManagerContextMenu.sys.mjs @@ -0,0 +1,240 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs"; + +const lazy = {}; + +ChromeUtils.defineESModuleGetters(lazy, { + LoginHelper: "resource://gre/modules/LoginHelper.sys.mjs", +}); + +/** + * Password manager object for the browser contextual menu. + */ +export const LoginManagerContextMenu = { + /** + * Look for login items and add them to the contextual menu. + * + * @param {Object} inputElementIdentifier + * An identifier generated for the input element via ContentDOMReference. + * @param {xul:browser} browser + * The browser for the document the context menu was open on. + * @param {string} formOrigin + * The origin of the document that the context menu was activated from. + * This isn't the same as the browser's top-level document origin + * when subframes are involved. + * @returns {DocumentFragment} a document fragment with all the login items. + */ + addLoginsToMenu(inputElementIdentifier, browser, formOrigin) { + let foundLogins = this._findLogins(formOrigin); + + if (!foundLogins.length) { + return null; + } + + let fragment = browser.ownerDocument.createDocumentFragment(); + let duplicateUsernames = this._findDuplicates(foundLogins); + for (let login of foundLogins) { + let item = fragment.ownerDocument.createXULElement("menuitem"); + + let username = login.username; + // If login is empty or duplicated we want to append a modification date to it. + if (!username || duplicateUsernames.has(username)) { + if (!username) { + username = this._getLocalizedString("noUsername"); + } + let meta = login.QueryInterface(Ci.nsILoginMetaInfo); + let time = this.dateAndTimeFormatter.format( + new Date(meta.timePasswordChanged) + ); + username = this._getLocalizedString("loginHostAge", [username, time]); + } + item.setAttribute("label", username); + item.setAttribute("class", "context-login-item"); + + // login is bound so we can keep the reference to each object. + item.addEventListener( + "command", + function (login, event) { + this._fillTargetField( + login, + inputElementIdentifier, + browser, + formOrigin + ); + }.bind(this, login) + ); + + fragment.appendChild(item); + } + + return fragment; + }, + + /** + * Undoes the work of addLoginsToMenu for the same menu. + * + * @param {Document} + * The context menu owner document. + */ + clearLoginsFromMenu(document) { + let loginItems = document.getElementsByClassName("context-login-item"); + while (loginItems.item(0)) { + loginItems.item(0).remove(); + } + }, + + /** + * Show the password autocomplete UI with the generation option forced to appear. + */ + async useGeneratedPassword(inputElementIdentifier, documentURI, browser) { + let browsingContextId = inputElementIdentifier.browsingContextId; + let browsingContext = BrowsingContext.get(browsingContextId); + let actor = browsingContext.currentWindowGlobal.getActor("LoginManager"); + + actor.sendAsyncMessage("PasswordManager:useGeneratedPassword", { + inputElementIdentifier, + }); + }, + + /** + * Find logins for the specified origin.. + * + * @param {string} formOrigin + * Origin of the logins we want to find that has be sanitized by `getLoginOrigin`. + * This isn't the same as the browser's top-level document URI + * when subframes are involved. + * + * @returns {nsILoginInfo[]} a login list + */ + _findLogins(formOrigin) { + let searchParams = { + origin: formOrigin, + schemeUpgrades: lazy.LoginHelper.schemeUpgrades, + }; + let logins = lazy.LoginHelper.searchLoginsWithObject(searchParams); + let resolveBy = ["scheme", "timePasswordChanged"]; + logins = lazy.LoginHelper.dedupeLogins( + logins, + ["username", "password"], + resolveBy, + formOrigin + ); + + // Sort logins in alphabetical order and by date. + logins.sort((loginA, loginB) => { + // Sort alphabetically + let result = loginA.username.localeCompare(loginB.username); + if (result) { + // Forces empty logins to be at the end + if (!loginA.username) { + return 1; + } + if (!loginB.username) { + return -1; + } + return result; + } + + // Same username logins are sorted by last change date + let metaA = loginA.QueryInterface(Ci.nsILoginMetaInfo); + let metaB = loginB.QueryInterface(Ci.nsILoginMetaInfo); + return metaB.timePasswordChanged - metaA.timePasswordChanged; + }); + + return logins; + }, + + /** + * Find duplicate usernames in a login list. + * + * @param {nsILoginInfo[]} loginList + * A list of logins we want to look for duplicate usernames. + * + * @returns {Set} a set with the duplicate usernames. + */ + _findDuplicates(loginList) { + let seen = new Set(); + let duplicates = new Set(); + for (let login of loginList) { + if (seen.has(login.username)) { + duplicates.add(login.username); + } + seen.add(login.username); + } + return duplicates; + }, + + /** + * @param {nsILoginInfo} login + * The login we want to fill the form with. + * @param {Object} inputElementIdentifier + * An identifier generated for the input element via ContentDOMReference. + * @param {xul:browser} browser + * The target tab browser. + * @param {string} formOrigin + * Origin of the document we're filling after sanitization via + * `getLoginOrigin`. + * This isn't the same as the browser's top-level + * origin when subframes are involved. + */ + _fillTargetField(login, inputElementIdentifier, browser, formOrigin) { + let browsingContextId = inputElementIdentifier.browsingContextId; + let browsingContext = BrowsingContext.get(browsingContextId); + if (!browsingContext) { + return; + } + + let actor = browsingContext.currentWindowGlobal.getActor("LoginManager"); + if (!actor) { + return; + } + + actor + .fillForm({ + browser, + inputElementIdentifier, + loginFormOrigin: formOrigin, + login, + }) + .catch(console.error); + }, + + /** + * @param {string} key + * The localized string key + * @param {string[]} formatArgs + * An array of formatting argument string + * + * @returns {string} the localized string for the specified key, + * formatted with arguments if required. + */ + _getLocalizedString(key, formatArgs) { + if (formatArgs) { + return this._stringBundle.formatStringFromName(key, formatArgs); + } + return this._stringBundle.GetStringFromName(key); + }, +}; + +XPCOMUtils.defineLazyGetter( + LoginManagerContextMenu, + "_stringBundle", + function () { + return Services.strings.createBundle( + "chrome://passwordmgr/locale/passwordmgr.properties" + ); + } +); + +XPCOMUtils.defineLazyGetter( + LoginManagerContextMenu, + "dateAndTimeFormatter", + function () { + return new Services.intl.DateTimeFormat(undefined, { + dateStyle: "medium", + }); + } +); diff --git a/toolkit/components/passwordmgr/LoginManagerParent.sys.mjs b/toolkit/components/passwordmgr/LoginManagerParent.sys.mjs new file mode 100644 index 0000000000..dcf770b9d1 --- /dev/null +++ b/toolkit/components/passwordmgr/LoginManagerParent.sys.mjs @@ -0,0 +1,1524 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +import { FirefoxRelayTelemetry } from "resource://gre/modules/FirefoxRelayTelemetry.mjs"; +import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs"; + +const LoginInfo = new Components.Constructor( + "@mozilla.org/login-manager/loginInfo;1", + Ci.nsILoginInfo, + "init" +); + +const lazy = {}; + +XPCOMUtils.defineLazyGetter(lazy, "LoginRelatedRealmsParent", () => { + const { LoginRelatedRealmsParent } = ChromeUtils.importESModule( + "resource://gre/modules/LoginRelatedRealms.sys.mjs" + ); + return new LoginRelatedRealmsParent(); +}); + +XPCOMUtils.defineLazyGetter(lazy, "PasswordRulesManager", () => { + const { PasswordRulesManagerParent } = ChromeUtils.importESModule( + "resource://gre/modules/PasswordRulesManager.sys.mjs" + ); + return new PasswordRulesManagerParent(); +}); + +ChromeUtils.defineESModuleGetters(lazy, { + ChromeMigrationUtils: "resource:///modules/ChromeMigrationUtils.sys.mjs", + FirefoxRelay: "resource://gre/modules/FirefoxRelay.sys.mjs", + LoginHelper: "resource://gre/modules/LoginHelper.sys.mjs", + MigrationUtils: "resource:///modules/MigrationUtils.sys.mjs", + NimbusFeatures: "resource://nimbus/ExperimentAPI.sys.mjs", + PasswordGenerator: "resource://gre/modules/PasswordGenerator.sys.mjs", + PrivateBrowsingUtils: "resource://gre/modules/PrivateBrowsingUtils.sys.mjs", +}); + +XPCOMUtils.defineLazyServiceGetter( + lazy, + "prompterSvc", + "@mozilla.org/login-manager/prompter;1", + Ci.nsILoginManagerPrompter +); + +XPCOMUtils.defineLazyGetter(lazy, "log", () => { + let logger = lazy.LoginHelper.createLogger("LoginManagerParent"); + return logger.log.bind(logger); +}); +XPCOMUtils.defineLazyGetter(lazy, "debug", () => { + let logger = lazy.LoginHelper.createLogger("LoginManagerParent"); + return logger.debug.bind(logger); +}); + +/** + * A listener for notifications to tests. + */ +let gListenerForTests = null; + +/** + * A map of a principal's origin (including suffixes) to a generated password string and filled flag + * so that we can offer the same password later (e.g. in a confirmation field). + * + * We don't currently evict from this cache so entries should last until the end of the browser + * session. That may change later but for now a typical session would max out at a few entries. + */ +let gGeneratedPasswordsByPrincipalOrigin = new Map(); + +/** + * Reference to the default LoginRecipesParent (instead of the initialization promise) for + * synchronous access. This is a temporary hack and new consumers should yield on + * recipeParentPromise instead. + * + * @type LoginRecipesParent + * @deprecated + */ +let gRecipeManager = null; + +/** + * Tracks the last time the user cancelled the primary password prompt, + * to avoid spamming primary password prompts on autocomplete searches. + */ +let gLastMPLoginCancelled = Number.NEGATIVE_INFINITY; + +let gGeneratedPasswordObserver = { + addedObserver: false, + + observe(subject, topic, data) { + if (topic == "last-pb-context-exited") { + // The last private browsing context closed so clear all cached generated + // passwords for private window origins. + for (let principalOrigin of gGeneratedPasswordsByPrincipalOrigin.keys()) { + let principal = + Services.scriptSecurityManager.createContentPrincipalFromOrigin( + principalOrigin + ); + if (!principal.privateBrowsingId) { + // The origin isn't for a private context so leave it alone. + continue; + } + gGeneratedPasswordsByPrincipalOrigin.delete(principalOrigin); + } + return; + } + + // We cache generated passwords in gGeneratedPasswordsByPrincipalOrigin. + // When generated password used on the page, + // we store a login with generated password and without username. + // When user updates that autosaved login with username, + // we must clear cached generated password. + // This will generate a new password next time user needs it. + if (topic == "passwordmgr-storage-changed" && data == "modifyLogin") { + const originalLogin = subject.GetElementAt(0); + const updatedLogin = subject.GetElementAt(1); + + if (originalLogin && !originalLogin.username && updatedLogin?.username) { + const generatedPassword = gGeneratedPasswordsByPrincipalOrigin.get( + originalLogin.origin + ); + + if ( + originalLogin.password == generatedPassword.value && + updatedLogin.password == generatedPassword.value + ) { + gGeneratedPasswordsByPrincipalOrigin.delete(originalLogin.origin); + } + } + } + + if ( + topic == "passwordmgr-autosaved-login-merged" || + (topic == "passwordmgr-storage-changed" && data == "removeLogin") + ) { + let { origin, guid } = subject; + let generatedPW = gGeneratedPasswordsByPrincipalOrigin.get(origin); + + // in the case where an autosaved login removed or merged into an existing login, + // clear the guid associated with the generated-password cache entry + if ( + generatedPW && + (guid == generatedPW.storageGUID || + topic == "passwordmgr-autosaved-login-merged") + ) { + lazy.log( + `Removing storageGUID for generated-password cache entry on origin: ${origin}.` + ); + generatedPW.storageGUID = null; + } + } + }, +}; + +Services.ppmm.addMessageListener("PasswordManager:findRecipes", message => { + let formHost = new URL(message.data.formOrigin).host; + return gRecipeManager?.getRecipesForHost(formHost) ?? []; +}); + +/** + * Lazily create a Map of origins to array of browsers with importable logins. + * + * @param {origin} formOrigin + * @returns {Object?} containing array of migration browsers and experiment state. + */ +async function getImportableLogins(formOrigin) { + // Include the experiment state for data and UI decisions; otherwise skip + // importing if not supported or disabled. + const state = + lazy.LoginHelper.suggestImportCount > 0 && + lazy.LoginHelper.showAutoCompleteImport; + return state + ? { + browsers: await lazy.ChromeMigrationUtils.getImportableLogins( + formOrigin + ), + state, + } + : null; +} + +export class LoginManagerParent extends JSWindowActorParent { + possibleValues = { + // This is stored at the parent (i.e., frame) scope because the LoginManagerPrompter + // is shared across all frames. + // + // It is mutated to update values without forcing us to set a new doorhanger. + usernames: new Set(), + passwords: new Set(), + }; + + // This is used by tests to listen to form submission. + static setListenerForTests(listener) { + gListenerForTests = listener; + } + + // Used by tests to clean up recipes only when they were actually used. + static get _recipeManager() { + return gRecipeManager; + } + + // Some unit tests need to access this. + static getGeneratedPasswordsByPrincipalOrigin() { + return gGeneratedPasswordsByPrincipalOrigin; + } + + getRootBrowser() { + let browsingContext = null; + if (this._overrideBrowsingContextId) { + browsingContext = BrowsingContext.get(this._overrideBrowsingContextId); + } else { + browsingContext = this.browsingContext.top; + } + return browsingContext.embedderElement; + } + + /** + * @param {origin} formOrigin + * @param {object} options + * @param {origin?} options.formActionOrigin To match on. Omit this argument to match all action origins. + * @param {origin?} options.httpRealm To match on. Omit this argument to match all realms. + * @param {boolean} options.acceptDifferentSubdomains Include results for eTLD+1 matches + * @param {boolean} options.ignoreActionAndRealm Include all form and HTTP auth logins for the site + * @param {string[]} options.relatedRealms Related realms to match against when searching + */ + static async searchAndDedupeLogins( + formOrigin, + { + acceptDifferentSubdomains, + formActionOrigin, + httpRealm, + ignoreActionAndRealm, + relatedRealms, + } = {} + ) { + let logins; + let matchData = { + origin: formOrigin, + schemeUpgrades: lazy.LoginHelper.schemeUpgrades, + acceptDifferentSubdomains, + }; + if (!ignoreActionAndRealm) { + if (typeof formActionOrigin != "undefined") { + matchData.formActionOrigin = formActionOrigin; + } else if (typeof httpRealm != "undefined") { + matchData.httpRealm = httpRealm; + } + } + if (lazy.LoginHelper.relatedRealmsEnabled) { + matchData.acceptRelatedRealms = lazy.LoginHelper.relatedRealmsEnabled; + matchData.relatedRealms = relatedRealms; + } + try { + logins = await Services.logins.searchLoginsAsync(matchData); + } catch (e) { + // Record the last time the user cancelled the MP prompt + // to avoid spamming them with MP prompts for autocomplete. + if (e.result == Cr.NS_ERROR_ABORT) { + lazy.log("User cancelled primary password prompt."); + gLastMPLoginCancelled = Date.now(); + return []; + } + throw e; + } + + logins = lazy.LoginHelper.shadowHTTPLogins(logins); + + let resolveBy = [ + "subdomain", + "actionOrigin", + "scheme", + "timePasswordChanged", + ]; + return lazy.LoginHelper.dedupeLogins( + logins, + ["username", "password"], + resolveBy, + formOrigin, + formActionOrigin + ); + } + + async receiveMessage(msg) { + let data = msg.data; + if (data.origin || data.formOrigin) { + throw new Error( + "The child process should not send an origin to the parent process. See bug 1513003" + ); + } + let context = {}; + XPCOMUtils.defineLazyGetter(context, "origin", () => { + // We still need getLoginOrigin to remove the path for file: URIs until we fix bug 1625391. + let origin = lazy.LoginHelper.getLoginOrigin( + this.manager.documentPrincipal?.originNoSuffix + ); + if (!origin) { + throw new Error("An origin is required. Message name: " + msg.name); + } + return origin; + }); + + switch (msg.name) { + case "PasswordManager:updateDoorhangerSuggestions": { + this.#onUpdateDoorhangerSuggestions(data.possibleValues); + break; + } + + case "PasswordManager:decreaseSuggestImportCount": { + this.decreaseSuggestImportCount(data); + break; + } + + case "PasswordManager:findLogins": { + return this.sendLoginDataToChild( + context.origin, + data.actionOrigin, + data.options + ); + } + + case "PasswordManager:onFormSubmit": { + this.#onFormSubmit(context); + break; + } + + case "PasswordManager:onPasswordEditedOrGenerated": { + this.#onPasswordEditedOrGenerated(context, data); + break; + } + + case "PasswordManager:onIgnorePasswordEdit": { + this.#onIgnorePasswordEdit(); + break; + } + + case "PasswordManager:ShowDoorhanger": { + this.#onShowDoorhanger(context, data); + break; + } + + case "PasswordManager:autoCompleteLogins": { + return this.doAutocompleteSearch(context.origin, data); + } + + case "PasswordManager:removeLogin": { + this.#onRemoveLogin(data.login); + break; + } + + case "PasswordManager:OpenImportableLearnMore": { + this.#onOpenImportableLearnMore(); + break; + } + + case "PasswordManager:HandleImportable": { + await this.#onHandleImportable(data.browserId); + break; + } + + case "PasswordManager:OpenPreferences": { + this.#onOpenPreferences(data.hostname, data.entryPoint); + break; + } + + // Used by tests to detect that a form-fill has occurred. This redirects + // to the top-level browsing context. + case "PasswordManager:formProcessed": { + this.#onFormProcessed(data.formid); + break; + } + + case "PasswordManager:offerRelayIntegration": { + FirefoxRelayTelemetry.recordRelayOfferedEvent( + "clicked", + data.telemetry.flowId, + data.telemetry.scenarioName, + data.telemetry.isRelayUser + ); + return this.#offerRelayIntegration(context.origin); + } + + case "PasswordManager:generateRelayUsername": { + FirefoxRelayTelemetry.recordRelayUsernameFilledEvent( + "clicked", + data.telemetry.flowId + ); + return this.#generateRelayUsername(context.origin); + } + } + + return undefined; + } + + #onUpdateDoorhangerSuggestions(possibleValues) { + this.possibleValues.usernames = possibleValues.usernames; + this.possibleValues.passwords = possibleValues.passwords; + } + + #onFormSubmit(context) { + Services.obs.notifyObservers( + null, + "passwordmgr-form-submission-detected", + context.origin + ); + } + + #onPasswordEditedOrGenerated(context, data) { + lazy.log("#onPasswordEditedOrGenerated: Received PasswordManager."); + if (gListenerForTests) { + lazy.log("#onPasswordEditedOrGenerated: Calling gListenerForTests."); + gListenerForTests("PasswordEditedOrGenerated", {}); + } + let browser = this.getRootBrowser(); + this._onPasswordEditedOrGenerated(browser, context.origin, data); + } + + #onIgnorePasswordEdit() { + lazy.log("#onIgnorePasswordEdit: Received PasswordManager."); + if (gListenerForTests) { + lazy.log("#onIgnorePasswordEdit: Calling gListenerForTests."); + gListenerForTests("PasswordIgnoreEdit", {}); + } + } + + #onShowDoorhanger(context, data) { + const browser = this.getRootBrowser(); + const submitPromise = this.showDoorhanger(browser, context.origin, data); + if (gListenerForTests) { + submitPromise.then(() => { + gListenerForTests("ShowDoorhanger", { + origin: context.origin, + data, + }); + }); + } + } + + #onRemoveLogin(login) { + login = lazy.LoginHelper.vanillaObjectToLogin(login); + Services.logins.removeLogin(login); + } + + #onOpenImportableLearnMore() { + const window = this.getRootBrowser().ownerGlobal; + window.openTrustedLinkIn( + Services.urlFormatter.formatURLPref("app.support.baseURL") + + "password-import", + "tab", + { relatedToCurrent: true } + ); + } + + async #onHandleImportable(browserId) { + // Directly migrate passwords for a single profile. + const migrator = await lazy.MigrationUtils.getMigrator(browserId); + const profiles = await migrator.getSourceProfiles(); + if ( + profiles.length == 1 && + lazy.NimbusFeatures["password-autocomplete"].getVariable( + "directMigrateSingleProfile" + ) + ) { + const loginAdded = new Promise(resolve => { + const obs = (_subject, _topic, data) => { + if (data == "addLogin") { + Services.obs.removeObserver(obs, "passwordmgr-storage-changed"); + resolve(); + } + }; + Services.obs.addObserver(obs, "passwordmgr-storage-changed"); + }); + + await migrator.migrate( + lazy.MigrationUtils.resourceTypes.PASSWORDS, + null, + profiles[0] + ); + await loginAdded; + + // Reshow the popup with the imported password. + this.sendAsyncMessage("PasswordManager:repopulateAutocompletePopup"); + } else { + // Open the migration wizard pre-selecting the appropriate browser. + lazy.MigrationUtils.showMigrationWizard( + this.getRootBrowser().ownerGlobal, + { + entrypoint: lazy.MigrationUtils.MIGRATION_ENTRYPOINTS.PASSWORDS, + migratorKey: browserId, + } + ); + } + } + + #onOpenPreferences(hostname, entryPoint) { + const window = this.getRootBrowser().ownerGlobal; + lazy.LoginHelper.openPasswordManager(window, { + filterString: hostname, + entryPoint, + }); + } + + #onFormProcessed(formid) { + const topActor = + this.browsingContext.currentWindowGlobal.getActor("LoginManager"); + topActor.sendAsyncMessage("PasswordManager:formProcessed", { formid }); + if (gListenerForTests) { + gListenerForTests("FormProcessed", { + browsingContext: this.browsingContext, + }); + } + } + + async #offerRelayIntegration(origin) { + const browser = lazy.LoginHelper.getBrowserForPrompt(this.getRootBrowser()); + return lazy.FirefoxRelay.offerRelayIntegration(browser, origin); + } + + async #generateRelayUsername(origin) { + const browser = lazy.LoginHelper.getBrowserForPrompt(this.getRootBrowser()); + return lazy.FirefoxRelay.generateUsername(browser, origin); + } + + /** + * Update the remaining number of import suggestion impressions with debounce + * to allow multiple popups showing the "same" items to count as one. + */ + decreaseSuggestImportCount(count) { + // Delay an existing timer with a potentially larger count. + if (this._suggestImportTimer) { + this._suggestImportTimer.delay = + LoginManagerParent.SUGGEST_IMPORT_DEBOUNCE_MS; + this._suggestImportCount = Math.max(count, this._suggestImportCount); + return; + } + + this._suggestImportTimer = Cc["@mozilla.org/timer;1"].createInstance( + Ci.nsITimer + ); + this._suggestImportTimer.init( + () => { + this._suggestImportTimer = null; + Services.prefs.setIntPref( + "signon.suggestImportCount", + lazy.LoginHelper.suggestImportCount - this._suggestImportCount + ); + }, + LoginManagerParent.SUGGEST_IMPORT_DEBOUNCE_MS, + Ci.nsITimer.TYPE_ONE_SHOT + ); + this._suggestImportCount = count; + } + + async #getRecipesForHost(origin) { + let recipes; + if (origin) { + try { + const formHost = new URL(origin).host; + let recipeManager = await LoginManagerParent.recipeParentPromise; + recipes = recipeManager.getRecipesForHost(formHost); + } catch (ex) { + // Some schemes e.g. chrome aren't supported by URL + } + } + + return recipes ?? []; + } + + /** + * Trigger a login form fill and send relevant data (e.g. logins and recipes) + * to the child process (LoginManagerChild). + */ + async fillForm({ + browser, + loginFormOrigin, + login, + inputElementIdentifier, + style, + }) { + const recipes = await this.#getRecipesForHost(loginFormOrigin); + + // Convert the array of nsILoginInfo to vanilla JS objects since nsILoginInfo + // doesn't support structured cloning. + const jsLogins = [lazy.LoginHelper.loginToVanillaObject(login)]; + + const browserURI = browser.currentURI.spec; + const originMatches = + lazy.LoginHelper.getLoginOrigin(browserURI) == loginFormOrigin; + + this.sendAsyncMessage("PasswordManager:fillForm", { + inputElementIdentifier, + loginFormOrigin, + originMatches, + logins: jsLogins, + recipes, + style, + }); + } + + /** + * Send relevant data (e.g. logins and recipes) to the child process (LoginManagerChild). + */ + async sendLoginDataToChild( + formOrigin, + actionOrigin, + { guid, showPrimaryPassword } + ) { + const recipes = await this.#getRecipesForHost(formOrigin); + + if (!showPrimaryPassword && !Services.logins.isLoggedIn) { + return { logins: [], recipes }; + } + + // If we're currently displaying a primary password prompt, defer + // processing this form until the user handles the prompt. + if (Services.logins.uiBusy) { + lazy.log( + "UI is busy. Deferring sendLoginDataToChild for form: ", + formOrigin + ); + + let uiBusyPromiseResolve; + const uiBusyPromise = new Promise(resolve => { + uiBusyPromiseResolve = resolve; + }); + + const self = this; + const observer = { + QueryInterface: ChromeUtils.generateQI([ + "nsIObserver", + "nsISupportsWeakReference", + ]), + + observe(_subject, topic, _data) { + lazy.log("Got deferred sendLoginDataToChild notification:", topic); + // Only run observer once. + Services.obs.removeObserver(this, "passwordmgr-crypto-login"); + Services.obs.removeObserver(this, "passwordmgr-crypto-loginCanceled"); + if (topic == "passwordmgr-crypto-loginCanceled") { + uiBusyPromiseResolve({ logins: [], recipes }); + return; + } + + const result = self.sendLoginDataToChild(formOrigin, actionOrigin, { + showPrimaryPassword, + }); + uiBusyPromiseResolve(result); + }, + }; + + // Possible leak: it's possible that neither of these notifications + // will fire, and if that happens, we'll leak the observer (and + // never return). We should guarantee that at least one of these + // will fire. + // See bug XXX. + Services.obs.addObserver(observer, "passwordmgr-crypto-login"); + Services.obs.addObserver(observer, "passwordmgr-crypto-loginCanceled"); + + return uiBusyPromise; + } + + // Autocomplete results do not need to match actionOrigin or exact origin. + let logins = null; + if (guid) { + logins = await Services.logins.searchLoginsAsync({ + guid, + origin: formOrigin, + }); + } else { + let relatedRealmsOrigins = []; + if (lazy.LoginHelper.relatedRealmsEnabled) { + relatedRealmsOrigins = + await lazy.LoginRelatedRealmsParent.findRelatedRealms(formOrigin); + } + logins = await LoginManagerParent.searchAndDedupeLogins(formOrigin, { + formActionOrigin: actionOrigin, + ignoreActionAndRealm: true, + acceptDifferentSubdomains: + lazy.LoginHelper.includeOtherSubdomainsInLookup, + relatedRealms: relatedRealmsOrigins, + }); + + if (lazy.LoginHelper.relatedRealmsEnabled) { + lazy.debug( + "Adding related logins on page load", + logins.map(l => l.origin) + ); + } + } + lazy.log(`Deduped ${logins.length} logins.`); + // Convert the array of nsILoginInfo to vanilla JS objects since nsILoginInfo + // doesn't support structured cloning. + let jsLogins = lazy.LoginHelper.loginsToVanillaObjects(logins); + return { + importable: await getImportableLogins(formOrigin), + logins: jsLogins, + recipes, + }; + } + + async doAutocompleteSearch( + formOrigin, + { + actionOrigin, + searchString, + previousResult, + forcePasswordGeneration, + hasBeenTypePassword, + isProbablyANewPasswordField, + scenarioName, + inputMaxLength, + } + ) { + // Note: previousResult is a regular object, not an + // nsIAutoCompleteResult. + + // Cancel if the primary password prompt is already showing or we unsuccessfully prompted for it too recently. + if (!Services.logins.isLoggedIn) { + if (Services.logins.uiBusy) { + lazy.log( + "Not searching logins for autocomplete since the primary password prompt is already showing." + ); + // Return an empty array to make LoginManagerChild clear the + // outstanding request it has temporarily saved. + return { logins: [] }; + } + + const timeDiff = Date.now() - gLastMPLoginCancelled; + if (timeDiff < LoginManagerParent._repromptTimeout) { + lazy.log( + `Not searching logins for autocomplete since the primary password prompt was last cancelled ${Math.round( + timeDiff / 1000 + )} seconds ago.` + ); + // Return an empty array to make LoginManagerChild clear the + // outstanding request it has temporarily saved. + return { logins: [] }; + } + } + + const searchStringLower = searchString.toLowerCase(); + let logins; + if ( + previousResult && + searchStringLower.startsWith(previousResult.searchString.toLowerCase()) + ) { + lazy.log("Using previous autocomplete result."); + + // We have a list of results for a shorter search string, so just + // filter them further based on the new search string. + logins = lazy.LoginHelper.vanillaObjectsToLogins(previousResult.logins); + } else { + lazy.log("Creating new autocomplete search result."); + let relatedRealmsOrigins = []; + if (lazy.LoginHelper.relatedRealmsEnabled) { + relatedRealmsOrigins = + await lazy.LoginRelatedRealmsParent.findRelatedRealms(formOrigin); + } + // Autocomplete results do not need to match actionOrigin or exact origin. + logins = await LoginManagerParent.searchAndDedupeLogins(formOrigin, { + formActionOrigin: actionOrigin, + ignoreActionAndRealm: true, + acceptDifferentSubdomains: + lazy.LoginHelper.includeOtherSubdomainsInLookup, + relatedRealms: relatedRealmsOrigins, + }); + } + + const matchingLogins = logins.filter(fullMatch => { + // Remove results that are too short, or have different prefix. + // Also don't offer empty usernames as possible results except + // for on password fields. + if (hasBeenTypePassword) { + return true; + } + + const match = fullMatch.username; + + return match && match.toLowerCase().startsWith(searchStringLower); + }); + + let generatedPassword = null; + let willAutoSaveGeneratedPassword = false; + if ( + // If MP was cancelled above, don't try to offer pwgen or access storage again (causing a new MP prompt). + Services.logins.isLoggedIn && + (forcePasswordGeneration || + (isProbablyANewPasswordField && + Services.logins.getLoginSavingEnabled(formOrigin))) + ) { + // We either generate a new password here, or grab the previously generated password + // if we're still on the same domain when we generated the password + generatedPassword = await this.getGeneratedPassword({ inputMaxLength }); + const potentialConflictingLogins = + await Services.logins.searchLoginsAsync({ + origin: formOrigin, + formActionOrigin: actionOrigin, + httpRealm: null, + }); + willAutoSaveGeneratedPassword = !potentialConflictingLogins.find( + login => login.username == "" + ); + } + + // Convert the array of nsILoginInfo to vanilla JS objects since nsILoginInfo + // doesn't support structured cloning. + let jsLogins = lazy.LoginHelper.loginsToVanillaObjects(matchingLogins); + + return { + generatedPassword, + importable: await getImportableLogins(formOrigin), + autocompleteItems: hasBeenTypePassword + ? [] + : await lazy.FirefoxRelay.autocompleteItemsAsync({ + formOrigin, + scenarioName, + hasInput: !!searchStringLower.length, + }), + logins: jsLogins, + willAutoSaveGeneratedPassword, + }; + } + + /** + * Expose `BrowsingContext` so we can stub it in tests. + */ + static get _browsingContextGlobal() { + return BrowsingContext; + } + + // Set an override context within a test. + useBrowsingContext(browsingContextId = 0) { + this._overrideBrowsingContextId = browsingContextId; + } + + getBrowsingContextToUse() { + if (this._overrideBrowsingContextId) { + return BrowsingContext.get(this._overrideBrowsingContextId); + } + + return this.browsingContext; + } + + async getGeneratedPassword({ inputMaxLength } = {}) { + if ( + !lazy.LoginHelper.enabled || + !lazy.LoginHelper.generationAvailable || + !lazy.LoginHelper.generationEnabled + ) { + return null; + } + + let browsingContext = this.getBrowsingContextToUse(); + if (!browsingContext) { + return null; + } + let framePrincipalOrigin = + browsingContext.currentWindowGlobal.documentPrincipal.origin; + // Use the same password if we already generated one for this origin so that it doesn't change + // with each search/keystroke and the user can easily re-enter a password in a confirmation field. + let generatedPW = + gGeneratedPasswordsByPrincipalOrigin.get(framePrincipalOrigin); + if (generatedPW) { + return generatedPW.value; + } + + generatedPW = { + autocompleteShown: false, + edited: false, + filled: false, + /** + * GUID of a login that was already saved for this generated password that + * will be automatically updated with password changes. This shouldn't be + * an existing saved login for the site unless the user chose to + * merge/overwrite via a doorhanger. + */ + storageGUID: null, + }; + if (lazy.LoginHelper.improvedPasswordRulesEnabled) { + generatedPW.value = await lazy.PasswordRulesManager.generatePassword( + browsingContext.currentWindowGlobal.documentURI, + { inputMaxLength } + ); + } else { + generatedPW.value = lazy.PasswordGenerator.generatePassword({ + inputMaxLength, + }); + } + + // Add these observers when a password is assigned. + if (!gGeneratedPasswordObserver.addedObserver) { + Services.obs.addObserver( + gGeneratedPasswordObserver, + "passwordmgr-autosaved-login-merged" + ); + Services.obs.addObserver( + gGeneratedPasswordObserver, + "passwordmgr-storage-changed" + ); + Services.obs.addObserver( + gGeneratedPasswordObserver, + "last-pb-context-exited" + ); + gGeneratedPasswordObserver.addedObserver = true; + } + + gGeneratedPasswordsByPrincipalOrigin.set(framePrincipalOrigin, generatedPW); + return generatedPW.value; + } + + maybeRecordPasswordGenerationShownTelemetryEvent(autocompleteResults) { + if (!autocompleteResults.some(r => r.style == "generatedPassword")) { + return; + } + + let browsingContext = this.getBrowsingContextToUse(); + + let framePrincipalOrigin = + browsingContext.currentWindowGlobal.documentPrincipal.origin; + let generatedPW = + gGeneratedPasswordsByPrincipalOrigin.get(framePrincipalOrigin); + + // We only want to record the first time it was shown for an origin + if (generatedPW.autocompleteShown) { + return; + } + + generatedPW.autocompleteShown = true; + + Services.telemetry.recordEvent( + "pwmgr", + "autocomplete_shown", + "generatedpassword" + ); + } + + /** + * Used for stubbing by tests. + */ + _getPrompter() { + return lazy.prompterSvc; + } + + // Look for an existing login that matches the form login. + #findSameLogin(logins, formLogin) { + return logins.find(login => { + let same; + + // If one login has a username but the other doesn't, ignore + // the username when comparing and only match if they have the + // same password. Otherwise, compare the logins and match even + // if the passwords differ. + if (!login.username && formLogin.username) { + let restoreMe = formLogin.username; + formLogin.username = ""; + same = lazy.LoginHelper.doLoginsMatch(formLogin, login, { + ignorePassword: false, + ignoreSchemes: lazy.LoginHelper.schemeUpgrades, + }); + formLogin.username = restoreMe; + } else if (!formLogin.username && login.username) { + formLogin.username = login.username; + same = lazy.LoginHelper.doLoginsMatch(formLogin, login, { + ignorePassword: false, + ignoreSchemes: lazy.LoginHelper.schemeUpgrades, + }); + formLogin.username = ""; // we know it's always blank. + } else { + same = lazy.LoginHelper.doLoginsMatch(formLogin, login, { + ignorePassword: true, + ignoreSchemes: lazy.LoginHelper.schemeUpgrades, + }); + } + + return same; + }); + } + + async showDoorhanger( + browser, + formOrigin, + { + browsingContextId, + formActionOrigin, + autoFilledLoginGuid, + usernameField, + newPasswordField, + oldPasswordField, + dismissedPrompt, + } + ) { + function recordLoginUse(login) { + Services.logins.recordPasswordUse( + login, + browser && lazy.PrivateBrowsingUtils.isBrowserPrivate(browser), + login.username ? "form_login" : "form_password", + !!autoFilledLoginGuid + ); + } + + // If password storage is disabled, bail out. + if (!lazy.LoginHelper.storageEnabled) { + return; + } + + if (!Services.logins.getLoginSavingEnabled(formOrigin)) { + lazy.log( + `Form submission ignored because saving is disabled for origin: ${formOrigin}.` + ); + return; + } + + let browsingContext = BrowsingContext.get(browsingContextId); + let framePrincipalOrigin = + browsingContext.currentWindowGlobal.documentPrincipal.origin; + + let formLogin = new LoginInfo( + formOrigin, + formActionOrigin, + null, + usernameField?.value ?? "", + newPasswordField.value, + usernameField?.name ?? "", + newPasswordField.name + ); + // we don't auto-save logins on form submit + let notifySaved = false; + + if (autoFilledLoginGuid) { + let loginsForGuid = await Services.logins.searchLoginsAsync({ + guid: autoFilledLoginGuid, + origin: formOrigin, // Ignored outside of GV. + }); + if ( + loginsForGuid.length == 1 && + loginsForGuid[0].password == formLogin.password && + (!formLogin.username || // Also cover cases where only the password is requested. + loginsForGuid[0].username == formLogin.username) + ) { + lazy.log( + "The filled login matches the form submission. Nothing to change." + ); + recordLoginUse(loginsForGuid[0]); + return; + } + } + + let existingLogin = null; + let canMatchExistingLogin = true; + // Below here we have one login per hostPort + action + username with the + // matching scheme being preferred. + const logins = await LoginManagerParent.searchAndDedupeLogins(formOrigin, { + formActionOrigin, + }); + + const generatedPW = + gGeneratedPasswordsByPrincipalOrigin.get(framePrincipalOrigin); + const autoSavedStorageGUID = generatedPW?.storageGUID ?? ""; + + // If we didn't find a username field, but seem to be changing a + // password, allow the user to select from a list of applicable + // logins to update the password for. + if (!usernameField && oldPasswordField && logins.length) { + if (logins.length == 1) { + existingLogin = logins[0]; + + if (existingLogin.password == formLogin.password) { + recordLoginUse(existingLogin); + lazy.log( + "Not prompting to save/change since we have no username and the only saved password matches the new password." + ); + return; + } + + formLogin.username = existingLogin.username; + formLogin.usernameField = existingLogin.usernameField; + } else if (!generatedPW || generatedPW.value != newPasswordField.value) { + // Note: It's possible that that we already have the correct u+p saved + // but since we don't have the username, we don't know if the user is + // changing a second account to the new password so we ask anyways. + canMatchExistingLogin = false; + } + } + + if (canMatchExistingLogin && !existingLogin) { + existingLogin = this.#findSameLogin(logins, formLogin); + } + + const promptBrowser = lazy.LoginHelper.getBrowserForPrompt(browser); + const prompter = this._getPrompter(browser); + + if (!canMatchExistingLogin) { + prompter.promptToChangePasswordWithUsernames( + promptBrowser, + logins, + formLogin + ); + return; + } + + if (existingLogin) { + lazy.log("Found an existing login matching this form submission."); + + // Change password if needed. + if (existingLogin.password != formLogin.password) { + lazy.log("Passwords differ, prompting to change."); + prompter.promptToChangePassword( + promptBrowser, + existingLogin, + formLogin, + dismissedPrompt, + notifySaved, + autoSavedStorageGUID, + autoFilledLoginGuid, + this.possibleValues + ); + } else if (!existingLogin.username && formLogin.username) { + lazy.log("Empty username update, prompting to change."); + prompter.promptToChangePassword( + promptBrowser, + existingLogin, + formLogin, + dismissedPrompt, + notifySaved, + autoSavedStorageGUID, + autoFilledLoginGuid, + this.possibleValues + ); + } else { + recordLoginUse(existingLogin); + } + + return; + } + + // Prompt user to save login (via dialog or notification bar) + prompter.promptToSavePassword( + promptBrowser, + formLogin, + dismissedPrompt, + notifySaved, + autoFilledLoginGuid, + this.possibleValues + ); + } + + /** + * Performs validation of inputs against already-saved logins in order to determine whether and + * how these inputs can be stored. Depending on validation, will either no-op or show a 'save' + * or 'update' dialog to the user. + * + * This is called after any of the following: + * - The user edits a password + * - A generated password is filled + * - The user edits a username (when a matching password field has already been filled) + * + * @param {Element} browser + * @param {string} formOrigin + * @param {string} options.formActionOrigin + * @param {string?} options.autoFilledLoginGuid + * @param {Object} options.newPasswordField + * @param {Object?} options.usernameField + * @param {Element?} options.oldPasswordField + * @param {boolean} [options.triggeredByFillingGenerated = false] + */ + /* eslint-disable-next-line complexity */ + async _onPasswordEditedOrGenerated( + browser, + formOrigin, + { + formActionOrigin, + autoFilledLoginGuid, + newPasswordField, + usernameField = null, + oldPasswordField, + triggeredByFillingGenerated = false, + } + ) { + lazy.log( + `_onPasswordEditedOrGenerated: triggeredByFillingGenerated: ${triggeredByFillingGenerated}.` + ); + + // If password storage is disabled, bail out. + if (!lazy.LoginHelper.storageEnabled) { + return; + } + + if (!Services.logins.getLoginSavingEnabled(formOrigin)) { + // No UI should be shown to offer generation in this case but a user may + // disable saving for the site after already filling one and they may then + // edit it. + lazy.log(`Saving is disabled for origin: ${formOrigin}.`); + return; + } + + if (!newPasswordField.value) { + lazy.log("The password field is empty."); + return; + } + + if (!browser) { + lazy.log("The browser is gone."); + return; + } + + let browsingContext = this.getBrowsingContextToUse(); + if (!browsingContext) { + return; + } + + if (!triggeredByFillingGenerated && !Services.logins.isLoggedIn) { + // Don't show the dismissed doorhanger on "input" or "change" events + // when the Primary Password is locked + lazy.log( + "Edited field is not a generated password field, and Primary Password is locked." + ); + return; + } + + let framePrincipalOrigin = + browsingContext.currentWindowGlobal.documentPrincipal.origin; + + lazy.log("Got framePrincipalOrigin: ", framePrincipalOrigin); + + let formLogin = new LoginInfo( + formOrigin, + formActionOrigin, + null, + usernameField?.value ?? "", + newPasswordField.value, + usernameField?.name ?? "", + newPasswordField.name + ); + let existingLogin = null; + let canMatchExistingLogin = true; + let shouldAutoSaveLogin = triggeredByFillingGenerated; + let autoSavedLogin = null; + let notifySaved = false; + + if (autoFilledLoginGuid) { + let [matchedLogin] = await Services.logins.searchLoginsAsync({ + guid: autoFilledLoginGuid, + origin: formOrigin, // Ignored outside of GV. + }); + if ( + matchedLogin && + matchedLogin.password == formLogin.password && + (!formLogin.username || // Also cover cases where only the password is requested. + matchedLogin.username == formLogin.username) + ) { + lazy.log( + "The filled login matches the changed fields. Nothing to change." + ); + // We may want to update an existing doorhanger + existingLogin = matchedLogin; + } + } + + let generatedPW = + gGeneratedPasswordsByPrincipalOrigin.get(framePrincipalOrigin); + + // Below here we have one login per hostPort + action + username with the + // matching scheme being preferred. + let logins = await LoginManagerParent.searchAndDedupeLogins(formOrigin, { + formActionOrigin, + }); + // only used in the generated pw case where we auto-save + let formLoginWithoutUsername; + + if (triggeredByFillingGenerated && generatedPW) { + lazy.log("Got cached generatedPW."); + formLoginWithoutUsername = new LoginInfo( + formOrigin, + formActionOrigin, + null, + "", + newPasswordField.value + ); + + if (newPasswordField.value != generatedPW.value) { + // The user edited the field after generation to a non-empty value. + lazy.log("The field containing the generated password has changed."); + + // Record telemetry for the first edit + if (!generatedPW.edited) { + Services.telemetry.recordEvent( + "pwmgr", + "filled_field_edited", + "generatedpassword" + ); + lazy.log("filled_field_edited telemetry event recorded."); + generatedPW.edited = true; + } + } + + // This will throw if we can't look up the entry in the password/origin map + if (!generatedPW.filled) { + if (generatedPW.storageGUID) { + throw new Error( + "Generated password was saved in storage without being filled first" + ); + } + // record first use of this generated password + Services.telemetry.recordEvent( + "pwmgr", + "autocomplete_field", + "generatedpassword" + ); + lazy.log("autocomplete_field telemetry event recorded."); + generatedPW.filled = true; + } + + // We may have already autosaved this login + // Note that it could have been saved in a totally different tab in the session. + if (generatedPW.storageGUID) { + [autoSavedLogin] = await Services.logins.searchLoginsAsync({ + guid: generatedPW.storageGUID, + origin: formOrigin, // Ignored outside of GV. + }); + + if (autoSavedLogin) { + lazy.log("login to change is the auto-saved login."); + existingLogin = autoSavedLogin; + } + // The generated password login may have been deleted in the meantime. + // Proceed to maybe save a new login below. + } + generatedPW.value = newPasswordField.value; + + if (!existingLogin) { + lazy.log("Did not match generated-password login."); + + // Check if we already have a login saved for this site since we don't want to overwrite it in + // case the user still needs their old password to successfully complete a password change. + let matchedLogin = logins.find(login => + formLoginWithoutUsername.matches(login, true) + ); + if (matchedLogin) { + shouldAutoSaveLogin = false; + if (matchedLogin.password == formLoginWithoutUsername.password) { + // This login is already saved so show no new UI. + // We may want to update an existing doorhanger though... + lazy.log("Matching login already saved."); + existingLogin = matchedLogin; + } + lazy.log( + "_onPasswordEditedOrGenerated: Login with empty username already saved for this site." + ); + } + } + } + + // If we didn't find a username field, but seem to be changing a + // password, use the first match if there is only one + // If there's more than one we'll prompt to save with the initial formLogin + // and let the doorhanger code resolve this + if ( + !triggeredByFillingGenerated && + !existingLogin && + !usernameField && + oldPasswordField && + logins.length + ) { + if (logins.length == 1) { + existingLogin = logins[0]; + + if (existingLogin.password == formLogin.password) { + lazy.log( + "Not prompting to save/change since we have no username and the " + + "only saved password matches the new password." + ); + return; + } + + formLogin.username = existingLogin.username; + formLogin.usernameField = existingLogin.usernameField; + } else if (!generatedPW || generatedPW.value != newPasswordField.value) { + // Note: It's possible that that we already have the correct u+p saved + // but since we don't have the username, we don't know if the user is + // changing a second account to the new password so we ask anyways. + canMatchExistingLogin = false; + } + } + + if (canMatchExistingLogin && !existingLogin) { + existingLogin = this.#findSameLogin(logins, formLogin); + if (existingLogin) { + lazy.log("Matched saved login."); + } + } + + if (shouldAutoSaveLogin) { + if ( + existingLogin && + existingLogin == autoSavedLogin && + existingLogin.password !== formLogin.password + ) { + lazy.log("Updating auto-saved login."); + + Services.logins.modifyLogin( + existingLogin, + lazy.LoginHelper.newPropertyBag({ + password: formLogin.password, + }) + ); + notifySaved = true; + // Update `existingLogin` with the new password if modifyLogin didn't + // throw so that the prompts later uses the new password. + existingLogin.password = formLogin.password; + } else if (!autoSavedLogin) { + lazy.log("Auto-saving new login with empty username."); + existingLogin = await Services.logins.addLoginAsync( + formLoginWithoutUsername + ); + // Remember the GUID where we saved the generated password so we can update + // the login if the user later edits the generated password. + generatedPW.storageGUID = existingLogin.guid; + notifySaved = true; + } + } else { + lazy.log("Not auto-saving this login."); + } + + const prompter = this._getPrompter(browser); + const promptBrowser = lazy.LoginHelper.getBrowserForPrompt(browser); + + if (existingLogin) { + // Show a change doorhanger to allow modifying an already-saved login + // e.g. to add a username or update the password. + let autoSavedStorageGUID = ""; + if ( + generatedPW && + generatedPW.value == existingLogin.password && + generatedPW.storageGUID == existingLogin.guid + ) { + autoSavedStorageGUID = generatedPW.storageGUID; + } + + // Change password if needed. + if ( + (shouldAutoSaveLogin && !formLogin.username) || + existingLogin.password != formLogin.password + ) { + lazy.log( + `promptToChangePassword with autoSavedStorageGUID: ${autoSavedStorageGUID}` + ); + prompter.promptToChangePassword( + promptBrowser, + existingLogin, + formLogin, + true, // dismissed prompt + notifySaved, + autoSavedStorageGUID, // autoSavedLoginGuid + autoFilledLoginGuid, + this.possibleValues + ); + } else if (!existingLogin.username && formLogin.username) { + lazy.log("Empty username update, prompting to change."); + prompter.promptToChangePassword( + promptBrowser, + existingLogin, + formLogin, + true, // dismissed prompt + notifySaved, + autoSavedStorageGUID, // autoSavedLoginGuid + autoFilledLoginGuid, + this.possibleValues + ); + } else { + lazy.log("No change to existing login."); + // is there a doorhanger we should update? + let popupNotifications = promptBrowser.ownerGlobal.PopupNotifications; + let notif = popupNotifications.getNotification("password", browser); + lazy.log( + `_onPasswordEditedOrGenerated: Has doorhanger? ${ + notif && notif.dismissed + }` + ); + if (notif && notif.dismissed) { + prompter.promptToChangePassword( + promptBrowser, + existingLogin, + formLogin, + true, // dismissed prompt + notifySaved, + autoSavedStorageGUID, // autoSavedLoginGuid + autoFilledLoginGuid, + this.possibleValues + ); + } + } + return; + } + lazy.log("No matching login to save/update."); + prompter.promptToSavePassword( + promptBrowser, + formLogin, + true, // dismissed prompt + notifySaved, + autoFilledLoginGuid, + this.possibleValues + ); + } + + static get recipeParentPromise() { + if (!gRecipeManager) { + const { LoginRecipesParent } = ChromeUtils.importESModule( + "resource://gre/modules/LoginRecipes.sys.mjs" + ); + gRecipeManager = new LoginRecipesParent({ + defaults: Services.prefs.getStringPref("signon.recipes.path"), + }); + } + + return gRecipeManager.initializationPromise; + } +} + +LoginManagerParent.SUGGEST_IMPORT_DEBOUNCE_MS = 10000; + +XPCOMUtils.defineLazyPreferenceGetter( + LoginManagerParent, + "_repromptTimeout", + "signon.masterPasswordReprompt.timeout_ms", + 900000 +); // 15 Minutes diff --git a/toolkit/components/passwordmgr/LoginManagerPrompter.sys.mjs b/toolkit/components/passwordmgr/LoginManagerPrompter.sys.mjs new file mode 100644 index 0000000000..e1b1a85c75 --- /dev/null +++ b/toolkit/components/passwordmgr/LoginManagerPrompter.sys.mjs @@ -0,0 +1,1116 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +import { PrivateBrowsingUtils } from "resource://gre/modules/PrivateBrowsingUtils.sys.mjs"; +import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs"; + +const lazy = {}; + +/* eslint-disable block-scoped-var, no-var */ + +ChromeUtils.defineESModuleGetters(lazy, { + LoginHelper: "resource://gre/modules/LoginHelper.sys.mjs", +}); + +XPCOMUtils.defineLazyServiceGetter( + lazy, + "usernameAutocompleteSearch", + "@mozilla.org/autocomplete/search;1?name=login-doorhanger-username", + "nsIAutoCompleteSimpleSearch" +); + +XPCOMUtils.defineLazyGetter(lazy, "strBundle", () => { + return Services.strings.createBundle( + "chrome://passwordmgr/locale/passwordmgr.properties" + ); +}); + +const LoginInfo = Components.Constructor( + "@mozilla.org/login-manager/loginInfo;1", + "nsILoginInfo", + "init" +); + +/** + * The maximum age of the password in ms (using `timePasswordChanged`) whereby + * a user can toggle the password visibility in a doorhanger to add a username to + * a saved login. + */ +const VISIBILITY_TOGGLE_MAX_PW_AGE_MS = 2 * 60 * 1000; // 2 minutes + +/** + * Constants for password prompt telemetry. + */ +const PROMPT_DISPLAYED = 0; +const PROMPT_ADD_OR_UPDATE = 1; +const PROMPT_NOTNOW_OR_DONTUPDATE = 2; +const PROMPT_NEVER = 3; +const PROMPT_DELETE = 3; + +/** + * The minimum age of a doorhanger in ms before it will get removed after a locationchange + */ +const NOTIFICATION_TIMEOUT_MS = 10 * 1000; // 10 seconds + +/** + * The minimum age of an attention-requiring dismissed doorhanger in ms + * before it will get removed after a locationchange + */ +const ATTENTION_NOTIFICATION_TIMEOUT_MS = 60 * 1000; // 1 minute + +function autocompleteSelected(popup) { + let doc = popup.ownerDocument; + let nameField = doc.getElementById("password-notification-username"); + let passwordField = doc.getElementById("password-notification-password"); + + let activeElement = nameField.ownerDocument.activeElement; + if (activeElement == nameField) { + popup.onUsernameSelect(); + } else if (activeElement == passwordField) { + popup.onPasswordSelect(); + } +} + +const observer = { + QueryInterface: ChromeUtils.generateQI(["nsIObserver"]), + + // nsIObserver + observe(subject, topic, data) { + switch (topic) { + case "autocomplete-did-enter-text": { + let input = subject.QueryInterface(Ci.nsIAutoCompleteInput); + autocompleteSelected(input.popupElement); + break; + } + } + }, +}; + +/** + * Implements interfaces for prompting the user to enter/save/change login info + * found in HTML forms. + */ +export class LoginManagerPrompter { + get classID() { + return Components.ID("{c47ff942-9678-44a5-bc9b-05e0d676c79c}"); + } + + get QueryInterface() { + return ChromeUtils.generateQI(["nsILoginManagerPrompter"]); + } + + /** + * Called when we detect a password or username that is not yet saved as + * an existing login. + * + * @param {Element} aBrowser + * The browser element that the request came from. + * @param {nsILoginInfo} aLogin + * The new login from the page form. + * @param {boolean} [dismissed = false] + * If the prompt should be automatically dismissed on being shown. + * @param {boolean} [notifySaved = false] + * Whether the notification should indicate that a login has been saved + * @param {string} [autoSavedLoginGuid = ""] + * A guid value for the old login to be removed if the changes match it + * to a different login + * @param {object?} possibleValues + * Contains values from anything that we think, but are not sure, might be + * a username or password. Has two properties, 'usernames' and 'passwords'. + * @param {Set<String>} possibleValues.usernames + * @param {Set<String>} possibleValues.passwords + */ + promptToSavePassword( + aBrowser, + aLogin, + dismissed = false, + notifySaved = false, + autoFilledLoginGuid = "", + possibleValues = undefined + ) { + lazy.log.debug("Prompting user to save login."); + let inPrivateBrowsing = PrivateBrowsingUtils.isBrowserPrivate(aBrowser); + let notification = LoginManagerPrompter._showLoginCaptureDoorhanger( + aBrowser, + aLogin, + "password-save", + { + dismissed: inPrivateBrowsing || dismissed, + extraAttr: notifySaved ? "attention" : "", + }, + possibleValues, + { + notifySaved, + autoFilledLoginGuid, + } + ); + Services.obs.notifyObservers(aLogin, "passwordmgr-prompt-save"); + + return { + dismiss() { + let { PopupNotifications } = aBrowser.ownerGlobal.wrappedJSObject; + PopupNotifications.remove(notification); + }, + }; + } + + /** + * Displays the PopupNotifications.sys.mjs doorhanger for password save or change. + * + * @param {Element} browser + * The browser to show the doorhanger on. + * @param {nsILoginInfo} login + * Login to save or change. For changes, this login should contain the + * new password and/or username + * @param {string} type + * This is "password-save" or "password-change" depending on the + * original notification type. This is used for telemetry and tests. + * @param {object} showOptions + * Options to pass along to PopupNotifications.show(). + * @param {bool} [options.notifySaved = false] + * Whether to indicate to the user that the login was already saved. + * @param {string} [options.messageStringID = undefined] + * An optional string ID to override the default message. + * @param {string} [options.autoSavedLoginGuid = ""] + * A string guid value for the auto-saved login to be removed if the changes + * match it to a different login + * @param {string} [options.autoFilledLoginGuid = ""] + * A string guid value for the autofilled login + * @param {object?} possibleValues + * Contains values from anything that we think, but are not sure, might be + * a username or password. Has two properties, 'usernames' and 'passwords'. + * @param {Set<String>} possibleValues.usernames + * @param {Set<String>} possibleValues.passwords + */ + static _showLoginCaptureDoorhanger( + browser, + login, + type, + showOptions = {}, + possibleValues = undefined, + { + notifySaved = false, + messageStringID, + autoSavedLoginGuid = "", + autoFilledLoginGuid = "", + } = {} + ) { + lazy.log.debug( + `Got autoSavedLoginGuid: ${autoSavedLoginGuid} and autoFilledLoginGuid ${autoFilledLoginGuid}.` + ); + + let saveMsgNames = { + prompt: login.username === "" ? "saveLoginMsgNoUser2" : "saveLoginMsg2", + buttonLabel: "saveLoginButtonAllow.label", + buttonAccessKey: "saveLoginButtonAllow.accesskey", + secondaryButtonLabel: "saveLoginButtonDeny.label", + secondaryButtonAccessKey: "saveLoginButtonDeny.accesskey", + }; + + let changeMsgNames = { + prompt: + login.username === "" ? "updateLoginMsgNoUser3" : "updateLoginMsg3", + buttonLabel: "updateLoginButtonText", + buttonAccessKey: "updateLoginButtonAccessKey", + secondaryButtonLabel: "updateLoginButtonDeny.label", + secondaryButtonAccessKey: "updateLoginButtonDeny.accesskey", + }; + + let initialMsgNames = + type == "password-save" ? saveMsgNames : changeMsgNames; + + if (messageStringID) { + changeMsgNames.prompt = messageStringID; + } + + let host = this._getShortDisplayHost(login.origin); + let promptMsg = + type == "password-save" + ? this._getLocalizedString(saveMsgNames.prompt, [host]) + : this._getLocalizedString(changeMsgNames.prompt, [host]); + + let histogramName = + type == "password-save" + ? "PWMGR_PROMPT_REMEMBER_ACTION" + : "PWMGR_PROMPT_UPDATE_ACTION"; + let histogram = Services.telemetry.getHistogramById(histogramName); + + let chromeDoc = browser.ownerDocument; + let currentNotification; + + let wasModifiedEvent = { + // Values are mutated + did_edit_un: "false", + did_select_un: "false", + did_edit_pw: "false", + did_select_pw: "false", + }; + + let updateButtonStatus = element => { + let mainActionButton = element.button; + // Disable the main button inside the menu-button if the password field is empty. + if (!login.password.length) { + mainActionButton.setAttribute("disabled", true); + chromeDoc + .getElementById("password-notification-password") + .classList.add("popup-notification-invalid-input"); + } else { + mainActionButton.removeAttribute("disabled"); + chromeDoc + .getElementById("password-notification-password") + .classList.remove("popup-notification-invalid-input"); + } + }; + + let updateButtonLabel = () => { + if (!currentNotification) { + console.error("updateButtonLabel, no currentNotification"); + } + let foundLogins = lazy.LoginHelper.searchLoginsWithObject({ + formActionOrigin: login.formActionOrigin, + origin: login.origin, + httpRealm: login.httpRealm, + schemeUpgrades: lazy.LoginHelper.schemeUpgrades, + }); + + let logins = this._filterUpdatableLogins( + login, + foundLogins, + autoSavedLoginGuid + ); + let msgNames = !logins.length ? saveMsgNames : changeMsgNames; + + // Update the label based on whether this will be a new login or not. + let label = this._getLocalizedString(msgNames.buttonLabel); + let accessKey = this._getLocalizedString(msgNames.buttonAccessKey); + + // Update the labels for the next time the panel is opened. + currentNotification.mainAction.label = label; + currentNotification.mainAction.accessKey = accessKey; + + // Update the labels in real time if the notification is displayed. + let element = [...currentNotification.owner.panel.childNodes].find( + n => n.notification == currentNotification + ); + if (element) { + element.setAttribute("buttonlabel", label); + element.setAttribute("buttonaccesskey", accessKey); + updateButtonStatus(element); + } + }; + + let writeDataToUI = () => { + let nameField = chromeDoc.getElementById( + "password-notification-username" + ); + + nameField.placeholder = usernamePlaceholder; + nameField.value = login.username; + + let toggleCheckbox = chromeDoc.getElementById( + "password-notification-visibilityToggle" + ); + toggleCheckbox.removeAttribute("checked"); + let passwordField = chromeDoc.getElementById( + "password-notification-password" + ); + // Ensure the type is reset so the field is masked. + passwordField.type = "password"; + passwordField.value = login.password; + + updateButtonLabel(); + }; + + let readDataFromUI = () => { + login.username = chromeDoc.getElementById( + "password-notification-username" + ).value; + login.password = chromeDoc.getElementById( + "password-notification-password" + ).value; + }; + + let onInput = () => { + readDataFromUI(); + updateButtonLabel(); + }; + + let onUsernameInput = () => { + wasModifiedEvent.did_edit_un = "true"; + wasModifiedEvent.did_select_un = "false"; + onInput(); + }; + + let onUsernameSelect = () => { + wasModifiedEvent.did_edit_un = "false"; + wasModifiedEvent.did_select_un = "true"; + }; + + let onPasswordInput = () => { + wasModifiedEvent.did_edit_pw = "true"; + wasModifiedEvent.did_select_pw = "false"; + onInput(); + }; + + let onPasswordSelect = () => { + wasModifiedEvent.did_edit_pw = "false"; + wasModifiedEvent.did_select_pw = "true"; + }; + + let onKeyUp = e => { + if (e.key == "Enter") { + e.target.closest("popupnotification").button.doCommand(); + } + }; + + let onVisibilityToggle = commandEvent => { + let passwordField = chromeDoc.getElementById( + "password-notification-password" + ); + // Gets the caret position before changing the type of the textbox + let selectionStart = passwordField.selectionStart; + let selectionEnd = passwordField.selectionEnd; + passwordField.setAttribute( + "type", + commandEvent.target.checked ? "" : "password" + ); + if (!passwordField.hasAttribute("focused")) { + return; + } + passwordField.selectionStart = selectionStart; + passwordField.selectionEnd = selectionEnd; + }; + + let togglePopup = event => { + event.target.parentElement + .getElementsByClassName("ac-has-end-icon")[0] + .toggleHistoryPopup(); + }; + + let persistData = () => { + let foundLogins = lazy.LoginHelper.searchLoginsWithObject({ + formActionOrigin: login.formActionOrigin, + origin: login.origin, + httpRealm: login.httpRealm, + schemeUpgrades: lazy.LoginHelper.schemeUpgrades, + }); + + let logins = this._filterUpdatableLogins( + login, + foundLogins, + autoSavedLoginGuid + ); + let resolveBy = ["scheme", "timePasswordChanged"]; + logins = lazy.LoginHelper.dedupeLogins( + logins, + ["username"], + resolveBy, + login.origin + ); + // sort exact username matches to the top + logins.sort(l => (l.username == login.username ? -1 : 1)); + + lazy.log.debug(`Matched ${logins.length} logins.`); + + let loginToRemove; + let loginToUpdate = logins.shift(); + + if (logins.length && logins[0].guid == autoSavedLoginGuid) { + loginToRemove = logins.shift(); + } + if (logins.length) { + lazy.log.warn( + "persistData:", + logins.length, + "other updatable logins!", + logins.map(l => l.guid), + "loginToUpdate:", + loginToUpdate && loginToUpdate.guid, + "loginToRemove:", + loginToRemove && loginToRemove.guid + ); + // Proceed with updating the login with the best username match rather + // than returning and losing the edit. + } + + if (!loginToUpdate) { + // Create a new login, don't update an original. + // The original login we have been provided with might have its own + // metadata, but we don't want it propagated to the newly created one. + Services.logins.addLogin( + new LoginInfo( + login.origin, + login.formActionOrigin, + login.httpRealm, + login.username, + login.password, + login.usernameField, + login.passwordField + ) + ); + } else if ( + loginToUpdate.password == login.password && + loginToUpdate.username == login.username + ) { + // We only want to touch the login's use count and last used time. + lazy.log.debug(`Touch matched login: ${loginToUpdate.guid}.`); + Services.logins.recordPasswordUse( + loginToUpdate, + PrivateBrowsingUtils.isBrowserPrivate(browser), + loginToUpdate.username ? "form_password" : "form_login", + !!autoFilledLoginGuid + ); + } else { + lazy.log.debug(`Update matched login: ${loginToUpdate.guid}.`); + this._updateLogin(loginToUpdate, login); + // notify that this auto-saved login has been merged + if (loginToRemove && loginToRemove.guid == autoSavedLoginGuid) { + Services.obs.notifyObservers( + loginToRemove, + "passwordmgr-autosaved-login-merged" + ); + } + } + + if (loginToRemove) { + lazy.log.debug(`Removing login ${loginToRemove.guid}.`); + Services.logins.removeLogin(loginToRemove); + } + }; + + // The main action is the "Save" or "Update" button. + let mainAction = { + label: this._getLocalizedString(initialMsgNames.buttonLabel), + accessKey: this._getLocalizedString(initialMsgNames.buttonAccessKey), + callback: () => { + readDataFromUI(); + if ( + type == "password-save" && + !Services.policies.isAllowed("removeMasterPassword") + ) { + if (!lazy.LoginHelper.isPrimaryPasswordSet()) { + browser.ownerGlobal.openDialog( + "chrome://mozapps/content/preferences/changemp.xhtml", + "", + "centerscreen,chrome,modal,titlebar" + ); + if (!lazy.LoginHelper.isPrimaryPasswordSet()) { + return; + } + } + } + histogram.add(PROMPT_ADD_OR_UPDATE); + if (histogramName == "PWMGR_PROMPT_REMEMBER_ACTION") { + Services.obs.notifyObservers(browser, "LoginStats:NewSavedPassword"); + } else if (histogramName == "PWMGR_PROMPT_UPDATE_ACTION") { + Services.obs.notifyObservers(browser, "LoginStats:LoginUpdateSaved"); + } else { + throw new Error("Unknown histogram"); + } + + let eventObject; + if (type == "password-change") { + eventObject = "update"; + } else if (type == "password-save") { + eventObject = "save"; + } else { + throw new Error( + `Unexpected doorhanger type. Expected either 'password-save' or 'password-change', got ${type}` + ); + } + + Services.telemetry.recordEvent( + "pwmgr", + "doorhanger_submitted", + eventObject, + null, + wasModifiedEvent + ); + + persistData(); + Services.obs.notifyObservers( + null, + "weave:telemetry:histogram", + histogramName + ); + browser.focus(); + }, + }; + + let secondaryActions = [ + { + label: this._getLocalizedString(initialMsgNames.secondaryButtonLabel), + accessKey: this._getLocalizedString( + initialMsgNames.secondaryButtonAccessKey + ), + callback: () => { + histogram.add(PROMPT_NOTNOW_OR_DONTUPDATE); + Services.obs.notifyObservers( + null, + "weave:telemetry:histogram", + histogramName + ); + browser.focus(); + }, + }, + ]; + // Include a "Never for this site" button when saving a new password. + if (type == "password-save") { + secondaryActions.push({ + label: this._getLocalizedString("saveLoginButtonNever.label"), + accessKey: this._getLocalizedString("saveLoginButtonNever.accesskey"), + callback: () => { + histogram.add(PROMPT_NEVER); + Services.obs.notifyObservers( + null, + "weave:telemetry:histogram", + histogramName + ); + Services.logins.setLoginSavingEnabled(login.origin, false); + browser.focus(); + }, + }); + } + + // Include a "Delete this login" button when updating an existing password + if (type == "password-change") { + secondaryActions.push({ + label: this._getLocalizedString("updateLoginButtonDelete.label"), + accessKey: this._getLocalizedString( + "updateLoginButtonDelete.accesskey" + ), + callback: async () => { + histogram.add(PROMPT_DELETE); + Services.obs.notifyObservers( + null, + "weave:telemetry:histogram", + histogramName + ); + const matchingLogins = await Services.logins.searchLoginsAsync({ + guid: login.guid, + origin: login.origin, + }); + Services.logins.removeLogin(matchingLogins[0]); + browser.focus(); + // The "password-notification-icon" and "notification-icon-box" are hidden + // at this point, so approximate the location with the next closest, + // visible icon as the anchor. + const anchor = browser.ownerDocument.getElementById("identity-icon"); + lazy.log.debug("Showing the ConfirmationHint"); + anchor.ownerGlobal.ConfirmationHint.show( + anchor, + "confirmation-hint-login-removed" + ); + }, + }); + } + + let usernamePlaceholder = this._getLocalizedString("noUsernamePlaceholder"); + let togglePasswordLabel = this._getLocalizedString("togglePasswordLabel"); + let togglePasswordAccessKey = this._getLocalizedString( + "togglePasswordAccessKey2" + ); + + // .wrappedJSObject needed here -- see bug 422974 comment 5. + let { PopupNotifications } = browser.ownerGlobal.wrappedJSObject; + + let notificationID = "password"; + // keep attention notifications around for longer after a locationchange + const timeoutMs = + showOptions.dismissed && showOptions.extraAttr == "attention" + ? ATTENTION_NOTIFICATION_TIMEOUT_MS + : NOTIFICATION_TIMEOUT_MS; + + let options = Object.assign( + { + timeout: Date.now() + timeoutMs, + persistWhileVisible: true, + passwordNotificationType: type, + hideClose: true, + eventCallback(topic) { + switch (topic) { + case "showing": + lazy.log.debug("showing"); + currentNotification = this; + + // Record the first time this instance of the doorhanger is shown. + if (!this.timeShown) { + histogram.add(PROMPT_DISPLAYED); + Services.obs.notifyObservers( + null, + "weave:telemetry:histogram", + histogramName + ); + } + + chromeDoc + .getElementById("password-notification-password") + .removeAttribute("focused"); + chromeDoc + .getElementById("password-notification-username") + .removeAttribute("focused"); + chromeDoc + .getElementById("password-notification-username") + .addEventListener("input", onUsernameInput); + chromeDoc + .getElementById("password-notification-username") + .addEventListener("keyup", onKeyUp); + chromeDoc + .getElementById("password-notification-password") + .addEventListener("keyup", onKeyUp); + chromeDoc + .getElementById("password-notification-password") + .addEventListener("input", onPasswordInput); + chromeDoc + .getElementById("password-notification-username-dropmarker") + .addEventListener("click", togglePopup); + + LoginManagerPrompter._getUsernameSuggestions( + login, + possibleValues?.usernames + ).then(usernameSuggestions => { + let dropmarker = chromeDoc?.getElementById( + "password-notification-username-dropmarker" + ); + if (dropmarker) { + dropmarker.hidden = !usernameSuggestions.length; + } + + let usernameField = chromeDoc?.getElementById( + "password-notification-username" + ); + if (usernameField) { + usernameField.classList.toggle( + "ac-has-end-icon", + !!usernameSuggestions.length + ); + } + }); + + let toggleBtn = chromeDoc.getElementById( + "password-notification-visibilityToggle" + ); + + if ( + Services.prefs.getBoolPref( + "signon.rememberSignons.visibilityToggle" + ) + ) { + toggleBtn.addEventListener("command", onVisibilityToggle); + toggleBtn.setAttribute("label", togglePasswordLabel); + toggleBtn.setAttribute("accesskey", togglePasswordAccessKey); + + let hideToggle = + lazy.LoginHelper.isPrimaryPasswordSet() || + // Don't show the toggle when the login was autofilled + !!autoFilledLoginGuid || + // Dismissed-by-default prompts should still show the toggle. + (this.timeShown && this.wasDismissed) || + // If we are only adding a username then the password is + // one that is already saved and we don't want to reveal + // it as the submitter of this form may not be the account + // owner, they may just be using the saved password. + (messageStringID == "updateLoginMsgAddUsername2" && + login.timePasswordChanged < + Date.now() - VISIBILITY_TOGGLE_MAX_PW_AGE_MS); + toggleBtn.hidden = hideToggle; + } + + let popup = chromeDoc.getElementById("PopupAutoComplete"); + popup.onUsernameSelect = onUsernameSelect; + popup.onPasswordSelect = onPasswordSelect; + + LoginManagerPrompter._setUsernameAutocomplete( + login, + possibleValues?.usernames + ); + + break; + case "shown": { + lazy.log.debug("shown"); + writeDataToUI(); + let anchorIcon = this.anchorElement; + if (anchorIcon && this.options.extraAttr == "attention") { + anchorIcon.removeAttribute("extraAttr"); + delete this.options.extraAttr; + } + break; + } + case "dismissed": + // Note that this can run after `showing` but before `shown` upon tab switch. + this.wasDismissed = true; + // Fall through. + case "removed": { + // Note that this can run after `showing` and `shown` for the + // notification it's replacing. + lazy.log.debug(topic); + currentNotification = null; + + let usernameField = chromeDoc.getElementById( + "password-notification-username" + ); + usernameField.removeEventListener("input", onUsernameInput); + usernameField.removeEventListener("keyup", onKeyUp); + let passwordField = chromeDoc.getElementById( + "password-notification-password" + ); + passwordField.removeEventListener("input", onPasswordInput); + passwordField.removeEventListener("keyup", onKeyUp); + passwordField.removeEventListener("command", onVisibilityToggle); + chromeDoc + .getElementById("password-notification-username-dropmarker") + .removeEventListener("click", togglePopup); + break; + } + } + return false; + }, + }, + showOptions + ); + + let notification = PopupNotifications.show( + browser, + notificationID, + promptMsg, + "password-notification-icon", + mainAction, + secondaryActions, + options + ); + + if (notifySaved) { + let anchor = notification.anchorElement; + lazy.log.debug("Showing the ConfirmationHint."); + anchor.ownerGlobal.ConfirmationHint.show( + anchor, + "confirmation-hint-password-saved" + ); + } + + return notification; + } + + /** + * Called when we think we detect a password or username change for + * an existing login, when the form being submitted contains multiple + * password fields. + * + * @param {Element} aBrowser + * The browser element that the request came from. + * @param {nsILoginInfo} aOldLogin + * The old login we may want to update. + * @param {nsILoginInfo} aNewLogin + * The new login from the page form. + * @param {boolean} [dismissed = false] + * If the prompt should be automatically dismissed on being shown. + * @param {boolean} [notifySaved = false] + * Whether the notification should indicate that a login has been saved + * @param {string} [autoSavedLoginGuid = ""] + * A guid value for the old login to be removed if the changes match it + * to a different login + * @param {object?} possibleValues + * Contains values from anything that we think, but are not sure, might be + * a username or password. Has two properties, 'usernames' and 'passwords'. + * @param {Set<String>} possibleValues.usernames + * @param {Set<String>} possibleValues.passwords + */ + promptToChangePassword( + aBrowser, + aOldLogin, + aNewLogin, + dismissed = false, + notifySaved = false, + autoSavedLoginGuid = "", + autoFilledLoginGuid = "", + possibleValues = undefined + ) { + let login = aOldLogin.clone(); + login.origin = aNewLogin.origin; + login.formActionOrigin = aNewLogin.formActionOrigin; + login.password = aNewLogin.password; + login.username = aNewLogin.username; + + let messageStringID; + if ( + aOldLogin.username === "" && + login.username !== "" && + login.password == aOldLogin.password + ) { + // If the saved password matches the password we're prompting with then we + // are only prompting to let the user add a username since there was one in + // the form. Change the message so the purpose of the prompt is clearer. + messageStringID = "updateLoginMsgAddUsername2"; + } + + let notification = LoginManagerPrompter._showLoginCaptureDoorhanger( + aBrowser, + login, + "password-change", + { + dismissed, + extraAttr: notifySaved ? "attention" : "", + }, + possibleValues, + { + notifySaved, + messageStringID, + autoSavedLoginGuid, + autoFilledLoginGuid, + } + ); + + let oldGUID = aOldLogin.QueryInterface(Ci.nsILoginMetaInfo).guid; + Services.obs.notifyObservers( + aNewLogin, + "passwordmgr-prompt-change", + oldGUID + ); + + return { + dismiss() { + let { PopupNotifications } = aBrowser.ownerGlobal.wrappedJSObject; + PopupNotifications.remove(notification); + }, + }; + } + + /** + * Called when we detect a password change in a form submission, but we + * don't know which existing login (username) it's for. Asks the user + * to select a username and confirm the password change. + * + * Note: The caller doesn't know the username for aNewLogin, so this + * function fills in .username and .usernameField with the values + * from the login selected by the user. + */ + promptToChangePasswordWithUsernames(browser, logins, aNewLogin) { + lazy.log.debug( + `Prompting user to change passowrd for username with count: ${logins.length}.` + ); + + var usernames = logins.map( + l => l.username || LoginManagerPrompter._getLocalizedString("noUsername") + ); + var dialogText = + LoginManagerPrompter._getLocalizedString("userSelectText2"); + var dialogTitle = LoginManagerPrompter._getLocalizedString( + "passwordChangeTitle" + ); + var selectedIndex = { value: null }; + + // If user selects ok, outparam.value is set to the index + // of the selected username. + var ok = Services.prompt.select( + browser.ownerGlobal, + dialogTitle, + dialogText, + usernames, + selectedIndex + ); + if (ok) { + // Now that we know which login to use, modify its password. + var selectedLogin = logins[selectedIndex.value]; + lazy.log.debug(`Updating password for origin: ${aNewLogin.origin}.`); + var newLoginWithUsername = Cc[ + "@mozilla.org/login-manager/loginInfo;1" + ].createInstance(Ci.nsILoginInfo); + newLoginWithUsername.init( + aNewLogin.origin, + aNewLogin.formActionOrigin, + aNewLogin.httpRealm, + selectedLogin.username, + aNewLogin.password, + selectedLogin.usernameField, + aNewLogin.passwordField + ); + LoginManagerPrompter._updateLogin(selectedLogin, newLoginWithUsername); + } + } + + /* ---------- Internal Methods ---------- */ + + /** + * Helper method to update and persist an existing nsILoginInfo object with new property values. + */ + static _updateLogin(login, aNewLogin) { + var now = Date.now(); + var propBag = Cc["@mozilla.org/hash-property-bag;1"].createInstance( + Ci.nsIWritablePropertyBag + ); + propBag.setProperty("formActionOrigin", aNewLogin.formActionOrigin); + propBag.setProperty("origin", aNewLogin.origin); + propBag.setProperty("password", aNewLogin.password); + propBag.setProperty("username", aNewLogin.username); + // Explicitly set the password change time here (even though it would + // be changed automatically), to ensure that it's exactly the same + // value as timeLastUsed. + propBag.setProperty("timePasswordChanged", now); + propBag.setProperty("timeLastUsed", now); + propBag.setProperty("timesUsedIncrement", 1); + // Note that we don't call `recordPasswordUse` so telemetry won't record a + // use in this case though that is normally correct since we would instead + // record the save/update in a separate probe and recording it in both would + // be wrong. + Services.logins.modifyLogin(login, propBag); + } + + /** + * Can be called as: + * _getLocalizedString("key1"); + * _getLocalizedString("key2", ["arg1"]); + * _getLocalizedString("key3", ["arg1", "arg2"]); + * (etc) + * + * Returns the localized string for the specified key, + * formatted if required. + * + */ + static _getLocalizedString(key, formatArgs) { + if (formatArgs) { + return lazy.strBundle.formatStringFromName(key, formatArgs); + } + return lazy.strBundle.GetStringFromName(key); + } + + /** + * Converts a login's origin field to a short string for + * prompting purposes. Eg, "http://foo.com" --> "foo.com", or + * "ftp://www.site.co.uk" --> "site.co.uk". + */ + static _getShortDisplayHost(aURIString) { + var displayHost; + + var idnService = Cc["@mozilla.org/network/idn-service;1"].getService( + Ci.nsIIDNService + ); + try { + var uri = Services.io.newURI(aURIString); + var baseDomain = Services.eTLD.getBaseDomain(uri); + displayHost = idnService.convertToDisplayIDN(baseDomain, {}); + } catch (e) { + lazy.log.warn(`Couldn't process supplied URIString: ${aURIString}`); + } + + if (!displayHost) { + displayHost = aURIString; + } + + return displayHost; + } + + /** + * This function looks for existing logins that can be updated + * to match a submitted login, instead of creating a new one. + * + * Given a login and a loginList, it filters the login list + * to find every login with either: + * - the same username as aLogin + * - the same password as aLogin and an empty username + * so the user can add a username. + * - the same guid as the given login when it has an empty username + * + * @param {nsILoginInfo} aLogin + * login to use as filter. + * @param {nsILoginInfo[]} aLoginList + * Array of logins to filter. + * @param {String} includeGUID + * guid value for login that not be filtered out + * @returns {nsILoginInfo[]} the filtered array of logins. + */ + static _filterUpdatableLogins(aLogin, aLoginList, includeGUID) { + return aLoginList.filter( + l => + l.username == aLogin.username || + (l.password == aLogin.password && !l.username) || + (includeGUID && includeGUID == l.guid) + ); + } + + /** + * Set the values that will be used the next time the username autocomplete popup is opened. + * + * @param {nsILoginInfo} login - used only for its information about the current domain. + * @param {Set<String>?} possibleUsernames - values that we believe may be new/changed login usernames. + */ + static async _setUsernameAutocomplete(login, possibleUsernames = new Set()) { + let result = Cc["@mozilla.org/autocomplete/simple-result;1"].createInstance( + Ci.nsIAutoCompleteSimpleResult + ); + result.setDefaultIndex(0); + + let usernames = await this._getUsernameSuggestions( + login, + possibleUsernames + ); + for (let { text, style } of usernames) { + let value = text; + let comment = ""; + let image = ""; + let _style = style; + result.appendMatch(value, comment, image, _style); + } + + if (usernames.length) { + result.setSearchResult(Ci.nsIAutoCompleteResult.RESULT_SUCCESS); + } else { + result.setSearchResult(Ci.nsIAutoCompleteResult.RESULT_NOMATCH); + } + + lazy.usernameAutocompleteSearch.overrideNextResult(result); + } + + /** + * @param {nsILoginInfo} login - used only for its information about the current domain. + * @param {Set<String>?} possibleUsernames - values that we believe may be new/changed login usernames. + * + * @returns {object[]} an ordered list of usernames to be used the next time the username autocomplete popup is opened. + */ + static async _getUsernameSuggestions(login, possibleUsernames = new Set()) { + if (!Services.prefs.getBoolPref("signon.capture.inputChanges.enabled")) { + return []; + } + + // Don't reprompt for Primary Password, as we already prompted at least once + // to show the doorhanger if it is locked + if (!Services.logins.isLoggedIn) { + return []; + } + + let baseDomainLogins = await Services.logins.searchLoginsAsync({ + origin: login.origin, + schemeUpgrades: lazy.LoginHelper.schemeUpgrades, + acceptDifferentSubdomains: true, + }); + + let saved = baseDomainLogins.map(login => { + return { text: login.username, style: "login" }; + }); + let possible = [...possibleUsernames].map(username => { + return { text: username, style: "possible-username" }; + }); + + return possible + .concat(saved) + .reduce((acc, next) => { + let alreadyInAcc = + acc.findIndex(entry => entry.text == next.text) != -1; + if (!alreadyInAcc) { + acc.push(next); + } else if (next.style == "possible-username") { + let existingIndex = acc.findIndex(entry => entry.text == next.text); + acc[existingIndex] = next; + } + return acc; + }, []) + .filter(suggestion => !!suggestion.text); + } +} + +// Add this observer once for the process. +Services.obs.addObserver(observer, "autocomplete-did-enter-text"); + +XPCOMUtils.defineLazyGetter(lazy, "log", () => { + return lazy.LoginHelper.createLogger("LoginManagerPrompter"); +}); diff --git a/toolkit/components/passwordmgr/LoginRecipes.sys.mjs b/toolkit/components/passwordmgr/LoginRecipes.sys.mjs new file mode 100644 index 0000000000..148729d060 --- /dev/null +++ b/toolkit/components/passwordmgr/LoginRecipes.sys.mjs @@ -0,0 +1,383 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +const REQUIRED_KEYS = ["hosts"]; +const OPTIONAL_KEYS = [ + "description", + "notPasswordSelector", + "notUsernameSelector", + "passwordSelector", + "pathRegex", + "usernameSelector", + "schema", + "id", + "last_modified", +]; +const SUPPORTED_KEYS = REQUIRED_KEYS.concat(OPTIONAL_KEYS); + +import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs"; + +const lazy = {}; + +ChromeUtils.defineESModuleGetters(lazy, { + LoginHelper: "resource://gre/modules/LoginHelper.sys.mjs", + RemoteSettings: "resource://services-settings/remote-settings.sys.mjs", +}); + +XPCOMUtils.defineLazyGetter(lazy, "log", () => + lazy.LoginHelper.createLogger("LoginRecipes") +); + +/** + * Create an instance of the object to manage recipes in the parent process. + * Consumers should wait until {@link initializationPromise} resolves before + * calling methods on the object. + * + * @constructor + * @param {String} [aOptions.defaults=null] the URI to load the recipes from. + * If it's null, nothing is loaded. + * + */ +export function LoginRecipesParent(aOptions = { defaults: null }) { + if (Services.appinfo.processType != Ci.nsIXULRuntime.PROCESS_TYPE_DEFAULT) { + throw new Error( + "LoginRecipesParent should only be used from the main process" + ); + } + this._defaults = aOptions.defaults; + this.reset(); +} + +LoginRecipesParent.prototype = { + /** + * Promise resolved with an instance of itself when the module is ready. + * + * @type {Promise} + */ + initializationPromise: null, + + /** + * @type {bool} Whether default recipes were loaded at construction time. + */ + _defaults: null, + + /** + * @type {Map} Map of hosts (including non-default port numbers) to Sets of recipes. + * e.g. "example.com:8080" => Set({...}) + */ + _recipesByHost: null, + + /** + * @type {Object} Instance of Remote Settings client that has access to the + * "password-recipes" collection + */ + _rsClient: null, + + /** + * @param {Object} aRecipes an object containing recipes to load for use. The object + * should be compatible with JSON (e.g. no RegExp). + * @return {Promise} resolving when the recipes are loaded + */ + load(aRecipes) { + let recipeErrors = 0; + for (let rawRecipe of aRecipes.siteRecipes) { + try { + rawRecipe.pathRegex = rawRecipe.pathRegex + ? new RegExp(rawRecipe.pathRegex) + : undefined; + this.add(rawRecipe); + } catch (e) { + recipeErrors++; + lazy.log.error("Error loading recipe.", rawRecipe, e); + } + } + if (recipeErrors) { + return Promise.reject(`There were ${recipeErrors} recipe error(s)`); + } + return Promise.resolve(); + }, + + /** + * Reset the set of recipes to the ones from the time of construction. + */ + reset() { + lazy.log.debug("Resetting recipes with defaults:", this._defaults); + this._recipesByHost = new Map(); + if (this._defaults) { + let initPromise; + /** + * Both branches rely on a JSON dump of the Remote Settings collection, packaged both in Desktop and Android. + * The «legacy» mode will read the dump directly from the packaged resources. + * With Remote Settings, the dump is used to initialize the local database without network, + * and the list of password recipes can be refreshed without restarting and without software update. + */ + if (lazy.LoginHelper.remoteRecipesEnabled) { + if (!this._rsClient) { + this._rsClient = lazy.RemoteSettings( + lazy.LoginHelper.remoteRecipesCollection + ); + // Set up sync observer to update local recipes from Remote Settings recipes + this._rsClient.on("sync", event => this.onRemoteSettingsSync(event)); + } + initPromise = this._rsClient.get(); + } else if (this._defaults.startsWith("resource://")) { + initPromise = fetch(this._defaults) + .then(resp => resp.json()) + .then(({ data }) => data); + } else { + lazy.log.error( + "Invalid recipe path found, setting empty recipes list!" + ); + initPromise = new Promise(() => []); + } + this.initializationPromise = initPromise.then(async siteRecipes => { + Services.ppmm.broadcastAsyncMessage("clearRecipeCache"); + await this.load({ siteRecipes }); + return this; + }); + } else { + this.initializationPromise = Promise.resolve(this); + } + }, + + /** + * Validate the recipe is sane and then add it to the set of recipes. + * + * @param {Object} recipe + */ + add(recipe) { + let recipeKeys = Object.keys(recipe); + let unknownKeys = recipeKeys.filter(key => !SUPPORTED_KEYS.includes(key)); + if (unknownKeys.length) { + throw new Error( + "The following recipe keys aren't supported: " + unknownKeys.join(", ") + ); + } + + let missingRequiredKeys = REQUIRED_KEYS.filter( + key => !recipeKeys.includes(key) + ); + if (missingRequiredKeys.length) { + throw new Error( + "The following required recipe keys are missing: " + + missingRequiredKeys.join(", ") + ); + } + + if (!Array.isArray(recipe.hosts)) { + throw new Error("'hosts' must be a array"); + } + + if (!recipe.hosts.length) { + throw new Error("'hosts' must be a non-empty array"); + } + + if (recipe.pathRegex && recipe.pathRegex.constructor.name != "RegExp") { + throw new Error("'pathRegex' must be a regular expression"); + } + + const OPTIONAL_STRING_PROPS = [ + "description", + "passwordSelector", + "usernameSelector", + ]; + for (let prop of OPTIONAL_STRING_PROPS) { + if (recipe[prop] && typeof recipe[prop] != "string") { + throw new Error(`'${prop}' must be a string`); + } + } + + // Add the recipe to the map for each host + for (let host of recipe.hosts) { + if (!this._recipesByHost.has(host)) { + this._recipesByHost.set(host, new Set()); + } + this._recipesByHost.get(host).add(recipe); + } + }, + + /** + * Currently only exact host matches are returned but this will eventually handle parent domains. + * + * @param {String} aHost (e.g. example.com:8080 [non-default port] or sub.example.com) + * @return {Set} of recipes that apply to the host ordered by host priority + */ + getRecipesForHost(aHost) { + let hostRecipes = this._recipesByHost.get(aHost); + if (!hostRecipes) { + return new Set(); + } + + return hostRecipes; + }, + + /** + * Handles the Remote Settings sync event for the "password-recipes" collection. + * + * @param {Object} aEvent + * @param {Array} event.current Records in the "password-recipes" collection after the sync event + * @param {Array} event.created Records that were created with this particular sync + * @param {Array} event.updated Records that were updated with this particular sync + * @param {Array} event.deleted Records that were deleted with this particular sync + */ + onRemoteSettingsSync(aEvent) { + this._recipesByHost = new Map(); + let { + data: { current }, + } = aEvent; + let recipes = { + siteRecipes: current, + }; + Services.ppmm.broadcastAsyncMessage("clearRecipeCache"); + this.load(recipes); + }, +}; + +export const LoginRecipesContent = { + _recipeCache: new WeakMap(), + + _clearRecipeCache() { + lazy.log.debug("Clearing recipe cache."); + this._recipeCache = new WeakMap(); + }, + + /** + * Locally caches recipes for a given host. + * + * @param {String} aHost (e.g. example.com:8080 [non-default port] or sub.example.com) + * @param {Object} win - the window of the host + * @param {Set} recipes - recipes that apply to the host + */ + cacheRecipes(aHost, win, recipes) { + let recipeMap = this._recipeCache.get(win); + + if (!recipeMap) { + recipeMap = new Map(); + this._recipeCache.set(win, recipeMap); + } + + recipeMap.set(aHost, recipes); + }, + + /** + * Tries to fetch recipes for a given host, using a local cache if possible. + * Otherwise, the recipes are cached for later use. + * + * @param {String} aHost (e.g. example.com:8080 [non-default port] or sub.example.com) + * @param {Object} win - the window of the host + * @return {Set} of recipes that apply to the host + */ + getRecipes(aHost, win) { + let recipes; + const recipeMap = this._recipeCache.get(win); + + if (recipeMap) { + recipes = recipeMap.get(aHost); + + if (recipes) { + return recipes; + } + } + + if (!Cu.isInAutomation) { + // this is a blocking call we expect in tests and rarely expect in + // production, for example when Remote Settings are updated. + lazy.log.warn(`Falling back to a synchronous message for: ${aHost}.`); + } + recipes = Services.cpmm.sendSyncMessage("PasswordManager:findRecipes", { + formOrigin: aHost, + })[0]; + this.cacheRecipes(aHost, win, recipes); + + return recipes; + }, + + /** + * @param {Set} aRecipes - Possible recipes that could apply to the form + * @param {FormLike} aForm - We use a form instead of just a URL so we can later apply + * tests to the page contents. + * @return {Set} a subset of recipes that apply to the form with the order preserved + */ + _filterRecipesForForm(aRecipes, aForm) { + let formDocURL = aForm.ownerDocument.location; + let hostRecipes = aRecipes; + let recipes = new Set(); + if (!hostRecipes) { + return recipes; + } + + for (let hostRecipe of hostRecipes) { + if ( + hostRecipe.pathRegex && + !hostRecipe.pathRegex.test(formDocURL.pathname) + ) { + continue; + } + recipes.add(hostRecipe); + } + + return recipes; + }, + + /** + * Given a set of recipes that apply to the host, choose the one most applicable for + * overriding login fields in the form. + * + * @param {Set} aRecipes The set of recipes to consider for the form + * @param {FormLike} aForm The form where login fields exist. + * @return {Object} The recipe that is most applicable for the form. + */ + getFieldOverrides(aRecipes, aForm) { + let recipes = this._filterRecipesForForm(aRecipes, aForm); + lazy.log.debug(`Filtered recipes size: ${recipes.size}.`); + if (!recipes.size) { + return null; + } + + let chosenRecipe = null; + // Find the first (most-specific recipe that involves field overrides). + for (let recipe of recipes) { + if ( + !recipe.usernameSelector && + !recipe.passwordSelector && + !recipe.notUsernameSelector && + !recipe.notPasswordSelector + ) { + continue; + } + + chosenRecipe = recipe; + break; + } + + return chosenRecipe; + }, + + /** + * @param {HTMLElement} aParent the element to query for the selector from. + * @param {CSSSelector} aSelector the CSS selector to query for the login field. + * @return {HTMLElement|null} + */ + queryLoginField(aParent, aSelector) { + if (!aSelector) { + return null; + } + let field = aParent.ownerDocument.querySelector(aSelector); + if (!field) { + lazy.log.debug(`Login field selector wasn't matched: ${aSelector}.`); + return null; + } + // ownerGlobal doesn't exist in content privileged windows. + if ( + // eslint-disable-next-line mozilla/use-ownerGlobal + !aParent.ownerDocument.defaultView.HTMLInputElement.isInstance(field) + ) { + lazy.log.warn( + `Login field with selector ${aSelector} isn't an <input> so ignoring it.` + ); + return null; + } + return field; + }, +}; diff --git a/toolkit/components/passwordmgr/LoginRelatedRealms.sys.mjs b/toolkit/components/passwordmgr/LoginRelatedRealms.sys.mjs new file mode 100644 index 0000000000..bcfd675b4b --- /dev/null +++ b/toolkit/components/passwordmgr/LoginRelatedRealms.sys.mjs @@ -0,0 +1,110 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs"; + +const lazy = {}; + +ChromeUtils.defineESModuleGetters(lazy, { + LoginHelper: "resource://gre/modules/LoginHelper.sys.mjs", + RemoteSettings: "resource://services-settings/remote-settings.sys.mjs", +}); + +XPCOMUtils.defineLazyGetter(lazy, "log", () => { + let logger = lazy.LoginHelper.createLogger("LoginRelatedRealms"); + return logger; +}); + +export class LoginRelatedRealmsParent extends JSWindowActorParent { + /** + * @type RemoteSettingsClient + * + * @memberof LoginRelatedRealmsParent + */ + _sharedCredentialsClient = null; + /** + * @type string[][] + * + * @memberof LoginRelatedRealmsParent + */ + _relatedDomainsList = [[]]; + + /** + * Handles the Remote Settings sync event + * + * @param {Object} aEvent + * @param {Array} aEvent.current Records that are currently in the collection after the sync event + * @param {Array} aEvent.created Records that were created + * @param {Array} aEvent.updated Records that were updated + * @param {Array} aEvent.deleted Records that were deleted + * @memberof LoginRelatedRealmsParent + */ + onRemoteSettingsSync(aEvent) { + let { + data: { current }, + } = aEvent; + this._relatedDomainsList = current; + } + + async getSharedCredentialsCollection() { + if (!this._sharedCredentialsClient) { + this._sharedCredentialsClient = lazy.RemoteSettings( + lazy.LoginHelper.relatedRealmsCollection + ); + this._sharedCredentialsClient.on("sync", event => + this.onRemoteSettingsSync(event) + ); + this._relatedDomainsList = await this._sharedCredentialsClient.get(); + } + return this._relatedDomainsList; + } + + /** + * Determine if there are any related realms of this `formOrigin` using the related realms collection + * @param {string} formOrigin A form origin + * @return {string[]} filteredRealms An array of domains related to the `formOrigin` + * @async + * @memberof LoginRelatedRealmsParent + */ + async findRelatedRealms(formOrigin) { + try { + let formOriginURI = Services.io.newURI(formOrigin); + let originDomain = formOriginURI.host; + let [{ relatedRealms } = {}] = + await this.getSharedCredentialsCollection(); + if (!relatedRealms) { + return []; + } + let filterOriginIndex; + let shouldInclude = false; + let filteredRealms = relatedRealms.filter(_realms => { + for (let relatedOrigin of _realms) { + // We can't have an origin that matches multiple entries in our related realms collection + // so we exit the loop early + if (shouldInclude) { + return false; + } + if (Services.eTLD.hasRootDomain(originDomain, relatedOrigin)) { + shouldInclude = true; + break; + } + } + return shouldInclude; + }); + // * Filtered realms is a nested array due to its structure in Remote Settings + filteredRealms = filteredRealms.flat(); + + filterOriginIndex = filteredRealms.indexOf(originDomain); + // Removing the current formOrigin match if it exists in the related realms + // so that we don't return duplicates when we search for logins + if (filterOriginIndex !== -1) { + filteredRealms.splice(filterOriginIndex, 1); + } + return filteredRealms; + } catch (e) { + lazy.log.error(e); + return []; + } + } +} diff --git a/toolkit/components/passwordmgr/LoginStore.sys.mjs b/toolkit/components/passwordmgr/LoginStore.sys.mjs new file mode 100644 index 0000000000..acb5a6365c --- /dev/null +++ b/toolkit/components/passwordmgr/LoginStore.sys.mjs @@ -0,0 +1,182 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/** + * Handles serialization of the data and persistence into a file. + * + * The file is stored in JSON format, without indentation, using UTF-8 encoding. + * With indentation applied, the file would look like this: + * + * { + * "logins": [ + * { + * "id": 2, + * "hostname": "http://www.example.com", + * "httpRealm": null, + * "formSubmitURL": "http://www.example.com", + * "usernameField": "username_field", + * "passwordField": "password_field", + * "encryptedUsername": "...", + * "encryptedPassword": "...", + * "guid": "...", + * "encType": 1, + * "timeCreated": 1262304000000, + * "timeLastUsed": 1262304000000, + * "timePasswordChanged": 1262476800000, + * "timesUsed": 1 + * // only present if other clients had fields we didn't know about + * "encryptedUnknownFields: "...", + * }, + * { + * "id": 4, + * (...) + * } + * ], + * "nextId": 10, + * "version": 1 + * } + */ + +// Globals + +import { JSONFile } from "resource://gre/modules/JSONFile.sys.mjs"; +import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs"; + +const lazy = {}; + +XPCOMUtils.defineLazyModuleGetters(lazy, { + FXA_PWDMGR_HOST: "resource://gre/modules/FxAccountsCommon.js", + FXA_PWDMGR_REALM: "resource://gre/modules/FxAccountsCommon.js", +}); + +/** + * Current data version assigned by the code that last touched the data. + * + * This number should be updated only when it is important to understand whether + * an old version of the code has touched the data, for example to execute an + * update logic. In most cases, this number should not be changed, in + * particular when no special one-time update logic is needed. + * + * For example, this number should NOT be changed when a new optional field is + * added to a login entry. + */ +const kDataVersion = 3; + +const MAX_DATE_MS = 8640000000000000; + +// LoginStore + +/** + * Inherits from JSONFile and handles serialization of login-related data and + * persistence into a file. + * + * @param aPath + * String containing the file path where data should be saved. + */ +export function LoginStore(aPath, aBackupPath = "") { + JSONFile.call(this, { + path: aPath, + dataPostProcessor: this._dataPostProcessor.bind(this), + backupTo: aBackupPath, + }); +} + +LoginStore.prototype = Object.create(JSONFile.prototype); +LoginStore.prototype.constructor = LoginStore; + +LoginStore.prototype._save = async function () { + await JSONFile.prototype._save.call(this); + // Notify tests that writes to the login store is complete. + Services.obs.notifyObservers(null, "password-storage-updated"); + + if (this._options.backupTo) { + await this._backupHandler(); + } +}; + +/** + * Delete logins backup file if the last saved login was removed using + * removeLogin() or if all logins were removed at once using removeAllUserFacingLogins(). + * Note that if the user has a fxa key stored as a login, we just update the + * backup to only store the key when the last saved user facing login is removed. + */ +LoginStore.prototype._backupHandler = async function () { + const logins = this._data.logins; + // Return early if more than one login is stored because the backup won't need + // updating in this case. + if (logins.length > 1) { + return; + } + + // If one login is stored and it's a fxa sync key, we update the backup to store the + // key only. + if ( + logins.length && + logins[0].hostname == lazy.FXA_PWDMGR_HOST && + logins[0].httpRealm == lazy.FXA_PWDMGR_REALM + ) { + try { + await IOUtils.copy(this.path, this._options.backupTo); + + // This notification is specifically sent out for a test. + Services.obs.notifyObservers(null, "logins-backup-updated"); + } catch (ex) { + console.error(ex); + } + } else if (!logins.length) { + // If no logins are stored anymore, delete backup. + await IOUtils.remove(this._options.backupTo, { + ignoreAbsent: true, + }); + } +}; + +/** + * Synchronously work on the data just loaded into memory. + */ +LoginStore.prototype._dataPostProcessor = function (data) { + if (data.nextId === undefined) { + data.nextId = 1; + } + + // Create any arrays that are not present in the saved file. + if (!data.logins) { + data.logins = []; + } + + if (!data.potentiallyVulnerablePasswords) { + data.potentiallyVulnerablePasswords = []; + } + + if (!data.dismissedBreachAlertsByLoginGUID) { + data.dismissedBreachAlertsByLoginGUID = {}; + } + + // sanitize dates in logins + if (!("version" in data) || data.version < 3) { + let dateProperties = ["timeCreated", "timeLastUsed", "timePasswordChanged"]; + let now = Date.now(); + function getEarliestDate(login, defaultDate) { + let earliestDate = dateProperties.reduce((earliest, pname) => { + let ts = login[pname]; + return !ts ? earliest : Math.min(ts, earliest); + }, defaultDate); + return earliestDate; + } + for (let login of data.logins) { + for (let pname of dateProperties) { + let earliestDate; + if (!login[pname] || login[pname] > MAX_DATE_MS) { + login[pname] = + earliestDate || (earliestDate = getEarliestDate(login, now)); + } + } + } + } + + // Indicate that the current version of the code has touched the file. + data.version = kDataVersion; + + return data; +}; diff --git a/toolkit/components/passwordmgr/NewPasswordModel.sys.mjs b/toolkit/components/passwordmgr/NewPasswordModel.sys.mjs new file mode 100644 index 0000000000..142b2e1662 --- /dev/null +++ b/toolkit/components/passwordmgr/NewPasswordModel.sys.mjs @@ -0,0 +1,681 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/** + * Machine learning model for identifying new password input elements + * using Fathom. + */ + +import { + dom, + element, + out, + rule, + ruleset, + score, + type, + utils, + clusters, +} from "resource://gre/modules/third_party/fathom/fathom.mjs"; + +let { identity, isVisible, min, setDefault } = utils; +let { euclidean } = clusters; + +/** + * ----- Start of model ----- + * + * Everything below this comment up to the "End of model" comment is copied from: + * https://github.com/mozilla-services/fathom-login-forms/blob/78d4bf8f301b5aa6d62c06b45e826a0dd9df1afa/new-password/rulesets.js#L14-L613 + * Deviations from that file: + * - Remove import statements, instead using ``ChromeUtils.defineModuleGetter`` and destructuring assignments above. + * - Set ``DEVELOPMENT`` constant to ``false``. + */ + +// Whether this is running in the Vectorizer, rather than in-application, in a +// privileged Chrome context +const DEVELOPMENT = false; + +// Run me with confidence cutoff = 0.75. +const coefficients = { + new: [ + ["hasNewLabel", 2.9195094108581543], + ["hasConfirmLabel", 2.1672143936157227], + ["hasCurrentLabel", -2.1813206672668457], + ["closestLabelMatchesNew", 2.965045213699341], + ["closestLabelMatchesConfirm", 2.698647975921631], + ["closestLabelMatchesCurrent", -2.147423505783081], + ["hasNewAriaLabel", 2.8312134742736816], + ["hasConfirmAriaLabel", 1.5153108835220337], + ["hasCurrentAriaLabel", -4.368860244750977], + ["hasNewPlaceholder", 1.4374250173568726], + ["hasConfirmPlaceholder", 1.717592477798462], + ["hasCurrentPlaceholder", -1.9401700496673584], + ["forgotPasswordInFormLinkTextContent", -0.6736700534820557], + ["forgotPasswordInFormLinkHref", -1.3025357723236084], + ["forgotPasswordInFormLinkTitle", -2.9019577503204346], + ["forgotInFormLinkTextContent", -1.2455425262451172], + ["forgotInFormLinkHref", 0.4884686768054962], + ["forgotPasswordInFormButtonTextContent", -0.8015769720077515], + ["forgotPasswordOnPageLinkTextContent", 0.04422328248620033], + ["forgotPasswordOnPageLinkHref", -1.0331494808197021], + ["forgotPasswordOnPageLinkTitle", -0.08798415213823318], + ["forgotPasswordOnPageButtonTextContent", -1.5396910905838013], + ["elementAttrsMatchNew", 2.8492355346679688], + ["elementAttrsMatchConfirm", 1.9043376445770264], + ["elementAttrsMatchCurrent", -2.056903839111328], + ["elementAttrsMatchPassword1", 1.5833512544631958], + ["elementAttrsMatchPassword2", 1.3928000926971436], + ["elementAttrsMatchLogin", 1.738782525062561], + ["formAttrsMatchRegister", 2.1345033645629883], + ["formHasRegisterAction", 1.9337323904037476], + ["formButtonIsRegister", 3.0930404663085938], + ["formAttrsMatchLogin", -0.5816961526870728], + ["formHasLoginAction", -0.18886367976665497], + ["formButtonIsLogin", -2.332860231399536], + ["hasAutocompleteCurrentPassword", -0.029974736273288727], + ["formHasRememberMeCheckbox", 0.8600837588310242], + ["formHasRememberMeLabel", 0.06663893908262253], + ["formHasNewsletterCheckbox", -1.4851698875427246], + ["formHasNewsletterLabel", 2.416919231414795], + ["closestHeaderAboveIsLoginy", -2.0047383308410645], + ["closestHeaderAboveIsRegistery", 2.19451642036438], + ["nextInputIsConfirmy", 2.5344431400299072], + ["formHasMultipleVisibleInput", 2.81270694732666], + ["firstFieldInFormWithThreePasswordFields", -2.8964080810546875], + ], +}; + +const biases = [["new", -1.3525885343551636]]; + +const passwordStringRegex = + /password|passwort|رمز عبور|mot de passe|パスワード|비밀번호|암호|wachtwoord|senha|Пароль|parol|密码|contraseña|heslo|كلمة السر|kodeord|Κωδικός|pass code|Kata sandi|hasło|รหัสผ่าน|Şifre/i; +const passwordAttrRegex = /pw|pwd|passwd|pass/i; +const newStringRegex = + /new|erstellen|create|choose|設定|신규|Créer|Nouveau|baru|nouă|nieuw/i; +const newAttrRegex = /new/i; +const confirmStringRegex = + /wiederholen|wiederholung|confirm|repeat|confirmation|verify|retype|repite|確認|の確認|تکرار|re-enter|확인|bevestigen|confirme|Повторите|tassyklamak|再次输入|ještě jednou|gentag|re-type|confirmar|Répéter|conferma|Repetaţi|again|reenter|再入力|재입력|Ulangi|Bekræft/i; +const confirmAttrRegex = /confirm|retype/i; +const currentAttrAndStringRegex = + /current|old|aktuelles|derzeitiges|当前|Atual|actuel|curentă|sekarang/i; +const forgotStringRegex = + /vergessen|vergeten|forgot|oublié|dimenticata|Esqueceu|esqueci|Забыли|忘记|找回|Zapomenuté|lost|忘れた|忘れられた|忘れの方|재설정|찾기|help|فراموشی| را فراموش کرده اید|Восстановить|Unuttu|perdus|重新設定|reset|recover|change|remind|find|request|restore|trouble/i; +const forgotHrefRegex = + /forgot|reset|recover|change|lost|remind|find|request|restore/i; +const password1Regex = + /pw1|pwd1|pass1|passwd1|password1|pwone|pwdone|passone|passwdone|passwordone|pwfirst|pwdfirst|passfirst|passwdfirst|passwordfirst/i; +const password2Regex = + /pw2|pwd2|pass2|passwd2|password2|pwtwo|pwdtwo|passtwo|passwdtwo|passwordtwo|pwsecond|pwdsecond|passsecond|passwdsecond|passwordsecond/i; +const loginRegex = + /login|log in|log on|log-on|Войти|sign in|sigin|sign\/in|sign-in|sign on|sign-on|ورود|登录|Přihlásit se|Přihlaste|Авторизоваться|Авторизация|entrar|ログイン|로그인|inloggen|Συνδέσου|accedi|ログオン|Giriş Yap|登入|connecter|connectez-vous|Connexion|Вход/i; +const loginFormAttrRegex = + /login|log in|log on|log-on|sign in|sigin|sign\/in|sign-in|sign on|sign-on/i; +const registerStringRegex = + /create[a-zA-Z\s]+account|activate[a-zA-Z\s]+account|Zugang anlegen|Angaben prüfen|Konto erstellen|register|sign up|ثبت نام|登録|注册|cadastr|Зарегистрироваться|Регистрация|Bellige alynmak|تسجيل|ΕΓΓΡΑΦΗΣ|Εγγραφή|Créer mon compte|Créer un compte|Mendaftar|가입하기|inschrijving|Zarejestruj się|Deschideți un cont|Создать аккаунт|ร่วม|Üye Ol|registr|new account|ساخت حساب کاربری|Schrijf je|S'inscrire/i; +const registerActionRegex = + /register|signup|sign-up|create-account|account\/create|join|new_account|user\/create|sign\/up|membership\/create/i; +const registerFormAttrRegex = + /signup|join|register|regform|registration|new_user|AccountCreate|create_customer|CreateAccount|CreateAcct|create-account|reg-form|newuser|new-reg|new-form|new_membership/i; +const rememberMeAttrRegex = + /remember|auto_login|auto-login|save_mail|save-mail|ricordami|manter|mantenha|savelogin|auto login/i; +const rememberMeStringRegex = + /remember me|keep me logged in|keep me signed in|save email address|save id|stay signed in|ricordami|次回からログオンIDの入力を省略する|メールアドレスを保存する|を保存|아이디저장|아이디 저장|로그인 상태 유지|lembrar|manter conectado|mantenha-me conectado|Запомни меня|запомнить меня|Запомните меня|Не спрашивать в следующий раз|下次自动登录|记住我/i; +const newsletterStringRegex = /newsletter|ニュースレター/i; +const passwordStringAndAttrRegex = new RegExp( + passwordStringRegex.source + "|" + passwordAttrRegex.source, + "i" +); + +function makeRuleset(coeffs, biases) { + // HTMLElement => (selector => Array<HTMLElement>) nested map to cache querySelectorAll calls. + let elementToSelectors; + // We want to clear the cache each time the model is executed to get the latest DOM snapshot + // for each classification. + function clearCache() { + // WeakMaps do not have a clear method + elementToSelectors = new WeakMap(); + } + + function hasLabelMatchingRegex(element, regex) { + // Check element.labels + const labels = element.labels; + // TODO: Should I be concerned with multiple labels? + if (labels !== null && labels.length) { + return regex.test(labels[0].textContent); + } + + // Check element.aria-labelledby + let labelledBy = element.getAttribute("aria-labelledby"); + if (labelledBy !== null) { + labelledBy = labelledBy + .split(" ") + .map(id => element.getRootNode().getElementById(id)) + .filter(el => el); + if (labelledBy.length === 1) { + return regex.test(labelledBy[0].textContent); + } else if (labelledBy.length > 1) { + return regex.test( + min(labelledBy, node => euclidean(node, element)).textContent + ); + } + } + + const parentElement = element.parentElement; + // Bug 1634819: element.parentElement is null if element.parentNode is a ShadowRoot + if (!parentElement) { + return false; + } + // Check if the input is in a <td>, and, if so, check the textContent of the containing <tr> + if (parentElement.tagName === "TD" && parentElement.parentElement) { + // TODO: How bad is the assumption that the <tr> won't be the parent of the <td>? + return regex.test(parentElement.parentElement.textContent); + } + + // Check if the input is in a <dd>, and, if so, check the textContent of the preceding <dt> + if ( + parentElement.tagName === "DD" && + // previousElementSibling can be null + parentElement.previousElementSibling + ) { + return regex.test(parentElement.previousElementSibling.textContent); + } + return false; + } + + function closestLabelMatchesRegex(element, regex) { + const previousElementSibling = element.previousElementSibling; + if ( + previousElementSibling !== null && + previousElementSibling.tagName === "LABEL" + ) { + return regex.test(previousElementSibling.textContent); + } + + const nextElementSibling = element.nextElementSibling; + if (nextElementSibling !== null && nextElementSibling.tagName === "LABEL") { + return regex.test(nextElementSibling.textContent); + } + + const closestLabelWithinForm = closestSelectorElementWithinElement( + element, + element.form, + "label" + ); + return containsRegex( + regex, + closestLabelWithinForm, + closestLabelWithinForm => closestLabelWithinForm.textContent + ); + } + + function containsRegex(regex, thingOrNull, thingToString = identity) { + return thingOrNull !== null && regex.test(thingToString(thingOrNull)); + } + + function closestSelectorElementWithinElement( + toElement, + withinElement, + querySelector + ) { + if (withinElement !== null) { + let nodeList = Array.from(withinElement.querySelectorAll(querySelector)); + if (nodeList.length) { + return min(nodeList, node => euclidean(node, toElement)); + } + } + return null; + } + + function hasAriaLabelMatchingRegex(element, regex) { + return containsRegex(regex, element.getAttribute("aria-label")); + } + + function hasPlaceholderMatchingRegex(element, regex) { + return containsRegex(regex, element.getAttribute("placeholder")); + } + + function testRegexesAgainstAnchorPropertyWithinElement( + property, + element, + ...regexes + ) { + return hasSomeMatchingPredicateForSelectorWithinElement( + element, + "a", + anchor => { + const propertyValue = anchor[property]; + return regexes.every(regex => regex.test(propertyValue)); + } + ); + } + + function testFormButtonsAgainst(element, stringRegex) { + const form = element.form; + if (form !== null) { + let inputs = Array.from( + form.querySelectorAll("input[type=submit],input[type=button]") + ); + inputs = inputs.filter(input => { + return stringRegex.test(input.value); + }); + if (inputs.length) { + return true; + } + + return hasSomeMatchingPredicateForSelectorWithinElement( + form, + "button", + button => { + return ( + stringRegex.test(button.value) || + stringRegex.test(button.textContent) || + stringRegex.test(button.id) || + stringRegex.test(button.title) + ); + } + ); + } + return false; + } + + function hasAutocompleteCurrentPassword(fnode) { + return fnode.element.autocomplete === "current-password"; + } + + // Check cache before calling querySelectorAll on element + function getElementDescendants(element, selector) { + // Use the element to look up the selector map: + const selectorToDescendants = setDefault( + elementToSelectors, + element, + () => new Map() + ); + + // Use the selector to grab the descendants: + return setDefault(selectorToDescendants, selector, () => + Array.from(element.querySelectorAll(selector)) + ); + } + + /** + * Return whether the form element directly after this one looks like a + * confirm-password input. + */ + function nextInputIsConfirmy(fnode) { + const form = fnode.element.form; + const me = fnode.element; + if (form !== null) { + let afterMe = false; + for (const formEl of form.elements) { + if (formEl === me) { + afterMe = true; + } else if (afterMe) { + if ( + formEl.type === "password" && + !formEl.disabled && + formEl.getAttribute("aria-hidden") !== "true" + ) { + // Now we're looking at a passwordy, visible input[type=password] + // directly after me. + return elementAttrsMatchRegex(formEl, confirmAttrRegex); + // We could check other confirmy smells as well. Balance accuracy + // against time and complexity. + } + // We look only at the very next element, so we may be thrown off by + // Hide buttons and such. + break; + } + } + } + return false; + } + + /** + * Returns true when the number of visible input found in the form is over + * the given threshold. + * + * Since the idea in the signal is based on the fact that registration pages + * often have multiple inputs, this rule only selects inputs whose type is + * either email, password, text, tel or empty, which are more likely a input + * field for users to fill their information. + */ + function formHasMultipleVisibleInput(element, selector, threshold) { + let form = element.form; + if (!form) { + // For password fields that don't have an associated form, we apply a heuristic + // to find a "form" for it. The heuristic works as follow: + // 1. Locate the closest preceding input. + // 2. Find the lowest common ancestor of the password field and the closet + // preceding input. + // 3. Assume the common ancestor is the "form" of the password input. + const previous = closestElementAbove(element, selector); + if (!previous) { + return false; + } + form = findLowestCommonAncestor(previous, element); + if (!form) { + return false; + } + } + const inputs = Array.from(form.querySelectorAll(selector)); + for (const input of inputs) { + // don't need to check visibility for the element we're testing against + if (element === input || isVisible(input)) { + threshold--; + if (threshold === 0) { + return true; + } + } + } + return false; + } + + /** + * Returns true when there are three password fields in the form and the passed + * element is the first one. + * + * The signal is based on that change-password forms with 3 password fields often + * have the "current password", "new password", and "confirm password" pattern. + */ + function firstFieldInFormWithThreePasswordFields(fnode) { + const element = fnode.element; + const form = element.form; + if (form) { + let elements = form.querySelectorAll( + "input[type=password]:not([disabled], [aria-hidden=true])" + ); + // Only care forms with three password fields. If there are more than three password + // fields found, probably we include some hidden fields, so just ignore it. + if (elements.length == 3 && elements[0] == element) { + return true; + } + } + return false; + } + + function hasSomeMatchingPredicateForSelectorWithinElement( + element, + selector, + matchingPredicate + ) { + if (element === null) { + return false; + } + const elements = getElementDescendants(element, selector); + return elements.some(matchingPredicate); + } + + function textContentMatchesRegexes(element, ...regexes) { + const textContent = element.textContent; + return regexes.every(regex => regex.test(textContent)); + } + + function closestHeaderAboveMatchesRegex(element, regex) { + const closestHeader = closestElementAbove( + element, + "h1,h2,h3,h4,h5,h6,div[class*=heading],div[class*=header],div[class*=title],legend" + ); + if (closestHeader !== null) { + return regex.test(closestHeader.textContent); + } + return false; + } + + function closestElementAbove(element, selector) { + let elements = Array.from(element.ownerDocument.querySelectorAll(selector)); + for (let i = elements.length - 1; i >= 0; --i) { + if ( + element.compareDocumentPosition(elements[i]) & + Node.DOCUMENT_POSITION_PRECEDING + ) { + return elements[i]; + } + } + return null; + } + + function findLowestCommonAncestor(elementA, elementB) { + // Walk up the ancestor chain of both elements and compare whether the + // ancestors in the depth are the same. If they are not the same, the + // ancestor in the previous run is the lowest common ancestor. + function getAncestorChain(element) { + let ancestors = []; + let p = element.parentNode; + while (p) { + ancestors.push(p); + p = p.parentNode; + } + return ancestors; + } + + let aAncestors = getAncestorChain(elementA); + let bAncestors = getAncestorChain(elementB); + let posA = aAncestors.length - 1; + let posB = bAncestors.length - 1; + for (; posA >= 0 && posB >= 0; posA--, posB--) { + if (aAncestors[posA] != bAncestors[posB]) { + return aAncestors[posA + 1]; + } + } + return null; + } + + function elementAttrsMatchRegex(element, regex) { + if (element !== null) { + return ( + regex.test(element.id) || + regex.test(element.name) || + regex.test(element.className) + ); + } + return false; + } + + /** + * Let us compactly represent a collection of rules that all take a single + * type with no .when() clause and have only a score() call on the right-hand + * side. + */ + function* simpleScoringRulesTakingType(inType, ruleMap) { + for (const [name, scoringCallback] of Object.entries(ruleMap)) { + yield rule(type(inType), score(scoringCallback), { name }); + } + } + + return ruleset( + [ + rule( + DEVELOPMENT + ? dom( + "input[type=password]:not([disabled], [aria-hidden=true])" + ).when(isVisible) + : element("input"), + type("new").note(clearCache) + ), + ...simpleScoringRulesTakingType("new", { + hasNewLabel: fnode => + hasLabelMatchingRegex(fnode.element, newStringRegex), + hasConfirmLabel: fnode => + hasLabelMatchingRegex(fnode.element, confirmStringRegex), + hasCurrentLabel: fnode => + hasLabelMatchingRegex(fnode.element, currentAttrAndStringRegex), + closestLabelMatchesNew: fnode => + closestLabelMatchesRegex(fnode.element, newStringRegex), + closestLabelMatchesConfirm: fnode => + closestLabelMatchesRegex(fnode.element, confirmStringRegex), + closestLabelMatchesCurrent: fnode => + closestLabelMatchesRegex(fnode.element, currentAttrAndStringRegex), + hasNewAriaLabel: fnode => + hasAriaLabelMatchingRegex(fnode.element, newStringRegex), + hasConfirmAriaLabel: fnode => + hasAriaLabelMatchingRegex(fnode.element, confirmStringRegex), + hasCurrentAriaLabel: fnode => + hasAriaLabelMatchingRegex(fnode.element, currentAttrAndStringRegex), + hasNewPlaceholder: fnode => + hasPlaceholderMatchingRegex(fnode.element, newStringRegex), + hasConfirmPlaceholder: fnode => + hasPlaceholderMatchingRegex(fnode.element, confirmStringRegex), + hasCurrentPlaceholder: fnode => + hasPlaceholderMatchingRegex(fnode.element, currentAttrAndStringRegex), + forgotPasswordInFormLinkTextContent: fnode => + testRegexesAgainstAnchorPropertyWithinElement( + "textContent", + fnode.element.form, + passwordStringRegex, + forgotStringRegex + ), + forgotPasswordInFormLinkHref: fnode => + testRegexesAgainstAnchorPropertyWithinElement( + "href", + fnode.element.form, + passwordStringAndAttrRegex, + forgotHrefRegex + ), + forgotPasswordInFormLinkTitle: fnode => + testRegexesAgainstAnchorPropertyWithinElement( + "title", + fnode.element.form, + passwordStringRegex, + forgotStringRegex + ), + forgotInFormLinkTextContent: fnode => + testRegexesAgainstAnchorPropertyWithinElement( + "textContent", + fnode.element.form, + forgotStringRegex + ), + forgotInFormLinkHref: fnode => + testRegexesAgainstAnchorPropertyWithinElement( + "href", + fnode.element.form, + forgotHrefRegex + ), + forgotPasswordInFormButtonTextContent: fnode => + hasSomeMatchingPredicateForSelectorWithinElement( + fnode.element.form, + "button", + button => + textContentMatchesRegexes( + button, + passwordStringRegex, + forgotStringRegex + ) + ), + forgotPasswordOnPageLinkTextContent: fnode => + testRegexesAgainstAnchorPropertyWithinElement( + "textContent", + fnode.element.ownerDocument, + passwordStringRegex, + forgotStringRegex + ), + forgotPasswordOnPageLinkHref: fnode => + testRegexesAgainstAnchorPropertyWithinElement( + "href", + fnode.element.ownerDocument, + passwordStringAndAttrRegex, + forgotHrefRegex + ), + forgotPasswordOnPageLinkTitle: fnode => + testRegexesAgainstAnchorPropertyWithinElement( + "title", + fnode.element.ownerDocument, + passwordStringRegex, + forgotStringRegex + ), + forgotPasswordOnPageButtonTextContent: fnode => + hasSomeMatchingPredicateForSelectorWithinElement( + fnode.element.ownerDocument, + "button", + button => + textContentMatchesRegexes( + button, + passwordStringRegex, + forgotStringRegex + ) + ), + elementAttrsMatchNew: fnode => + elementAttrsMatchRegex(fnode.element, newAttrRegex), + elementAttrsMatchConfirm: fnode => + elementAttrsMatchRegex(fnode.element, confirmAttrRegex), + elementAttrsMatchCurrent: fnode => + elementAttrsMatchRegex(fnode.element, currentAttrAndStringRegex), + elementAttrsMatchPassword1: fnode => + elementAttrsMatchRegex(fnode.element, password1Regex), + elementAttrsMatchPassword2: fnode => + elementAttrsMatchRegex(fnode.element, password2Regex), + elementAttrsMatchLogin: fnode => + elementAttrsMatchRegex(fnode.element, loginRegex), + formAttrsMatchRegister: fnode => + elementAttrsMatchRegex(fnode.element.form, registerFormAttrRegex), + formHasRegisterAction: fnode => + containsRegex( + registerActionRegex, + fnode.element.form, + form => form.action + ), + formButtonIsRegister: fnode => + testFormButtonsAgainst(fnode.element, registerStringRegex), + formAttrsMatchLogin: fnode => + elementAttrsMatchRegex(fnode.element.form, loginFormAttrRegex), + formHasLoginAction: fnode => + containsRegex(loginRegex, fnode.element.form, form => form.action), + formButtonIsLogin: fnode => + testFormButtonsAgainst(fnode.element, loginRegex), + hasAutocompleteCurrentPassword, + formHasRememberMeCheckbox: fnode => + hasSomeMatchingPredicateForSelectorWithinElement( + fnode.element.form, + "input[type=checkbox]", + checkbox => + rememberMeAttrRegex.test(checkbox.id) || + rememberMeAttrRegex.test(checkbox.name) + ), + formHasRememberMeLabel: fnode => + hasSomeMatchingPredicateForSelectorWithinElement( + fnode.element.form, + "label", + label => rememberMeStringRegex.test(label.textContent) + ), + formHasNewsletterCheckbox: fnode => + hasSomeMatchingPredicateForSelectorWithinElement( + fnode.element.form, + "input[type=checkbox]", + checkbox => + checkbox.id.includes("newsletter") || + checkbox.name.includes("newsletter") + ), + formHasNewsletterLabel: fnode => + hasSomeMatchingPredicateForSelectorWithinElement( + fnode.element.form, + "label", + label => newsletterStringRegex.test(label.textContent) + ), + closestHeaderAboveIsLoginy: fnode => + closestHeaderAboveMatchesRegex(fnode.element, loginRegex), + closestHeaderAboveIsRegistery: fnode => + closestHeaderAboveMatchesRegex(fnode.element, registerStringRegex), + nextInputIsConfirmy, + formHasMultipleVisibleInput: fnode => + formHasMultipleVisibleInput( + fnode.element, + "input[type=email],input[type=password],input[type=text],input[type=tel]", + 3 + ), + firstFieldInFormWithThreePasswordFields, + }), + rule(type("new"), out("new")), + ], + coeffs, + biases + ); +} + +/* + * ----- End of model ----- + */ + +export const NewPasswordModel = { + type: "new", + rules: makeRuleset([...coefficients.new], biases), +}; diff --git a/toolkit/components/passwordmgr/OSCrypto_win.sys.mjs b/toolkit/components/passwordmgr/OSCrypto_win.sys.mjs new file mode 100644 index 0000000000..5b3f1d7929 --- /dev/null +++ b/toolkit/components/passwordmgr/OSCrypto_win.sys.mjs @@ -0,0 +1,284 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +import { ctypes } from "resource://gre/modules/ctypes.sys.mjs"; + +const FLAGS_NOT_SET = 0; + +const wintypes = { + BOOL: ctypes.bool, + BYTE: ctypes.uint8_t, + DWORD: ctypes.uint32_t, + PBYTE: ctypes.unsigned_char.ptr, + PCHAR: ctypes.char.ptr, + PDWORD: ctypes.uint32_t.ptr, + PVOID: ctypes.voidptr_t, + WORD: ctypes.uint16_t, +}; + +export function OSCrypto() { + this._structs = {}; + this._functions = new Map(); + this._libs = new Map(); + this._structs.DATA_BLOB = new ctypes.StructType("DATA_BLOB", [ + { cbData: wintypes.DWORD }, + { pbData: wintypes.PVOID }, + ]); + + try { + this._libs.set("crypt32", ctypes.open("Crypt32")); + this._libs.set("kernel32", ctypes.open("Kernel32")); + + this._functions.set( + "CryptProtectData", + this._libs + .get("crypt32") + .declare( + "CryptProtectData", + ctypes.winapi_abi, + wintypes.DWORD, + this._structs.DATA_BLOB.ptr, + wintypes.PVOID, + wintypes.PVOID, + wintypes.PVOID, + wintypes.PVOID, + wintypes.DWORD, + this._structs.DATA_BLOB.ptr + ) + ); + this._functions.set( + "CryptUnprotectData", + this._libs + .get("crypt32") + .declare( + "CryptUnprotectData", + ctypes.winapi_abi, + wintypes.DWORD, + this._structs.DATA_BLOB.ptr, + wintypes.PVOID, + wintypes.PVOID, + wintypes.PVOID, + wintypes.PVOID, + wintypes.DWORD, + this._structs.DATA_BLOB.ptr + ) + ); + this._functions.set( + "LocalFree", + this._libs + .get("kernel32") + .declare("LocalFree", ctypes.winapi_abi, wintypes.DWORD, wintypes.PVOID) + ); + } catch (ex) { + console.error(ex); + this.finalize(); + throw ex; + } +} + +OSCrypto.prototype = { + /** + * Convert an array containing only two bytes unsigned numbers to a string. + * @param {number[]} arr - the array that needs to be converted. + * @returns {string} the string representation of the array. + */ + arrayToString(arr) { + let str = ""; + for (let i = 0; i < arr.length; i++) { + str += String.fromCharCode(arr[i]); + } + return str; + }, + + /** + * Convert a string to an array. + * @param {string} str - the string that needs to be converted. + * @returns {number[]} the array representation of the string. + */ + stringToArray(str) { + let arr = []; + for (let i = 0; i < str.length; i++) { + arr.push(str.charCodeAt(i)); + } + return arr; + }, + + /** + * Calculate the hash value used by IE as the name of the registry value where login details are + * stored. + * @param {string} data - the string value that needs to be hashed. + * @returns {string} the hash value of the string. + */ + getIELoginHash(data) { + // return the two-digit hexadecimal code for a byte + function toHexString(charCode) { + return ("00" + charCode.toString(16)).slice(-2); + } + + // the data needs to be encoded in null terminated UTF-16 + data += "\0"; + + // dataArray is an array of bytes + let dataArray = new Array(data.length * 2); + for (let i = 0; i < data.length; i++) { + let c = data.charCodeAt(i); + let lo = c & 0xff; + let hi = (c & 0xff00) >> 8; + dataArray[i * 2] = lo; + dataArray[i * 2 + 1] = hi; + } + + // calculation of SHA1 hash value + let cryptoHash = Cc["@mozilla.org/security/hash;1"].createInstance( + Ci.nsICryptoHash + ); + cryptoHash.init(cryptoHash.SHA1); + cryptoHash.update(dataArray, dataArray.length); + let hash = cryptoHash.finish(false); + + let tail = 0; // variable to calculate value for the last 2 bytes + // convert to a character string in hexadecimal notation + for (let c of hash) { + tail += c.charCodeAt(0); + } + hash += String.fromCharCode(tail % 256); + + // convert the binary hash data to a hex string. + let hashStr = Array.from(hash, (c, i) => + toHexString(hash.charCodeAt(i)) + ).join(""); + return hashStr.toUpperCase(); + }, + + _getEntropyParam(entropy) { + if (!entropy) { + return null; + } + let entropyArray = this.stringToArray(entropy); + entropyArray.push(0); // Null-terminate the data. + let entropyData = wintypes.WORD.array(entropyArray.length)(entropyArray); + let optionalEntropy = new this._structs.DATA_BLOB( + entropyData.length * wintypes.WORD.size, + entropyData + ); + return optionalEntropy.address(); + }, + + _convertWinArrayToJSArray(dataBlob) { + // Convert DATA_BLOB to JS accessible array + return ctypes.cast( + dataBlob.pbData, + wintypes.BYTE.array(dataBlob.cbData).ptr + ).contents; + }, + + /** + * Decrypt a string using the windows CryptUnprotectData API. + * @param {string} data - the encrypted string that needs to be decrypted. + * @param {?string} entropy - the entropy value of the decryption (could be null). Its value must + * be the same as the one used when the data was encrypted. + * @param {?string} output - how to return the decrypted data default string + * @returns {string|Uint8Array} the decryption of the string. + */ + decryptData(data, entropy = null, output = "string") { + let array = this.stringToArray(data); + let encryptedData = wintypes.BYTE.array(array.length)(array); + let inData = new this._structs.DATA_BLOB( + encryptedData.length, + encryptedData + ); + let outData = new this._structs.DATA_BLOB(); + let entropyParam = this._getEntropyParam(entropy); + + try { + let status = this._functions.get("CryptUnprotectData")( + inData.address(), + null, + entropyParam, + null, + null, + FLAGS_NOT_SET, + outData.address() + ); + if (status === 0) { + throw new Error("decryptData failed: " + ctypes.winLastError); + } + + let decrypted = this._convertWinArrayToJSArray(outData); + + // Return raw bytes to handle non-string results + const bytes = new Uint8Array(decrypted); + if (output === "bytes") { + return bytes; + } + + // Output that may include characters outside of the 0-255 (byte) range needs to use TextDecoder. + return new TextDecoder().decode(bytes); + } finally { + if (outData.pbData) { + this._functions.get("LocalFree")(outData.pbData); + } + } + }, + + /** + * Encrypt a string using the windows CryptProtectData API. + * @param {string} data - the string that is going to be encrypted. + * @param {?string} entropy - the entropy value of the encryption (could be null). Its value must + * be the same as the one that is going to be used for the decryption. + * @returns {string} the encrypted string. + */ + encryptData(data, entropy = null) { + // Input that may include characters outside of the 0-255 (byte) range needs to use TextEncoder. + let decryptedByteData = [...new TextEncoder().encode(data)]; + let decryptedData = wintypes.BYTE.array(decryptedByteData.length)( + decryptedByteData + ); + + let inData = new this._structs.DATA_BLOB( + decryptedData.length, + decryptedData + ); + let outData = new this._structs.DATA_BLOB(); + let entropyParam = this._getEntropyParam(entropy); + + try { + let status = this._functions.get("CryptProtectData")( + inData.address(), + null, + entropyParam, + null, + null, + FLAGS_NOT_SET, + outData.address() + ); + if (status === 0) { + throw new Error("encryptData failed: " + ctypes.winLastError); + } + + let encrypted = this._convertWinArrayToJSArray(outData); + return this.arrayToString(encrypted); + } finally { + if (outData.pbData) { + this._functions.get("LocalFree")(outData.pbData); + } + } + }, + + /** + * Must be invoked once after last use of any of the provided helpers. + */ + finalize() { + this._structs = {}; + this._functions.clear(); + for (let lib of this._libs.values()) { + try { + lib.close(); + } catch (ex) { + console.error(ex); + } + } + this._libs.clear(); + }, +}; diff --git a/toolkit/components/passwordmgr/PasswordGenerator.sys.mjs b/toolkit/components/passwordmgr/PasswordGenerator.sys.mjs new file mode 100644 index 0000000000..0f2a407cea --- /dev/null +++ b/toolkit/components/passwordmgr/PasswordGenerator.sys.mjs @@ -0,0 +1,229 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this file, + * You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/** + * This file is a port of a subset of Chromium's implementation from + * https://cs.chromium.org/chromium/src/components/password_manager/core/browser/generation/password_generator.cc?l=93&rcl=a896a3ac4ea731b5ab3d2ab5bd76a139885d5c4f + * which is Copyright 2018 The Chromium Authors. All rights reserved. + */ + +const DEFAULT_PASSWORD_LENGTH = 15; +const MAX_UINT8 = Math.pow(2, 8) - 1; +const MAX_UINT32 = Math.pow(2, 32) - 1; + +// Some characters are removed due to visual similarity: +const LOWER_CASE_ALPHA = "abcdefghijkmnpqrstuvwxyz"; // no 'l' or 'o' +const UPPER_CASE_ALPHA = "ABCDEFGHJKLMNPQRSTUVWXYZ"; // no 'I' or 'O' +const DIGITS = "23456789"; // no '1' or '0' +const SPECIAL_CHARACTERS = "-~!@#$%^&*_+=)}:;\"'>,.?]"; + +const REQUIRED_CHARACTER_CLASSES = [ + LOWER_CASE_ALPHA, + UPPER_CASE_ALPHA, + DIGITS, + SPECIAL_CHARACTERS, +]; + +// Consts for different password rules +const REQUIRED = "required"; +const MAX_LENGTH = "maxlength"; +const MIN_LENGTH = "minlength"; +const MAX_CONSECUTIVE = "max-consecutive"; +const UPPER = "upper"; +const LOWER = "lower"; +const DIGIT = "digit"; +const SPECIAL = "special"; + +// Default password rules +const DEFAULT_RULES = new Map(); +DEFAULT_RULES.set(MIN_LENGTH, REQUIRED_CHARACTER_CLASSES.length); +DEFAULT_RULES.set(MAX_LENGTH, MAX_UINT8); +DEFAULT_RULES.set(REQUIRED, [UPPER, LOWER, DIGIT, SPECIAL]); + +export const PasswordGenerator = { + /** + * @param {Object} options + * @param {number} options.length - length of the generated password if there are no rules that override the length + * @param {Map} options.rules - map of password rules + * @returns {string} password that was generated + * @throws Error if `length` is invalid + * @copyright 2018 The Chromium Authors. All rights reserved. + * @see https://cs.chromium.org/chromium/src/components/password_manager/core/browser/generation/password_generator.cc?l=93&rcl=a896a3ac4ea731b5ab3d2ab5bd76a139885d5c4f + */ + generatePassword({ + length = DEFAULT_PASSWORD_LENGTH, + rules = DEFAULT_RULES, + inputMaxLength, + }) { + rules = new Map([...DEFAULT_RULES, ...rules]); + if (rules.get(MIN_LENGTH) > length) { + length = rules.get(MIN_LENGTH); + } + if (rules.get(MAX_LENGTH) < length) { + length = rules.get(MAX_LENGTH); + } + if (inputMaxLength > 0 && inputMaxLength < length) { + length = inputMaxLength; + } + + let password = ""; + let requiredClasses = []; + let allRequiredCharacters = ""; + + // Generate one character of each required class and/or required character list from the rules + this._addRequiredClassesAndCharacters(rules, requiredClasses); + + // Generate one of each required class + for (const charClassString of requiredClasses) { + password += + charClassString[this._randomUInt8Index(charClassString.length)]; + if (Array.isArray(charClassString)) { + // Convert array into single string so that commas aren't + // concatenated with each character in the arbitrary character array. + allRequiredCharacters += charClassString.join(""); + } else { + allRequiredCharacters += charClassString; + } + } + + // Now fill the rest of the password with random characters. + while (password.length < length) { + password += + allRequiredCharacters[ + this._randomUInt8Index(allRequiredCharacters.length) + ]; + } + + // So far the password contains the minimally required characters at the + // the beginning. Therefore, we create a random permutation. + password = this._shuffleString(password); + + // Make sure the password passes the "max-consecutive" rule, if the rule exists + if (rules.has(MAX_CONSECUTIVE)) { + // Ensures that a password isn't shuffled an infinite number of times. + const DEFAULT_NUMBER_OF_SHUFFLES = 15; + let shuffleCount = 0; + let consecutiveFlag = this._checkConsecutiveCharacters( + password, + rules.get(MAX_CONSECUTIVE) + ); + while (!consecutiveFlag) { + password = this._shuffleString(password); + consecutiveFlag = this._checkConsecutiveCharacters( + password, + rules.get(MAX_CONSECUTIVE) + ); + ++shuffleCount; + if (shuffleCount === DEFAULT_NUMBER_OF_SHUFFLES) { + consecutiveFlag = true; + } + } + } + + return password; + }, + + /** + * Adds special characters and/or other required characters to the requiredCharacters array. + * @param {Map} rules + * @param {string[]} requiredClasses + */ + _addRequiredClassesAndCharacters(rules, requiredClasses) { + for (const charClass of rules.get(REQUIRED)) { + if (charClass === UPPER) { + requiredClasses.push(UPPER_CASE_ALPHA); + } else if (charClass === LOWER) { + requiredClasses.push(LOWER_CASE_ALPHA); + } else if (charClass === DIGIT) { + requiredClasses.push(DIGITS); + } else if (charClass === SPECIAL) { + requiredClasses.push(SPECIAL_CHARACTERS); + } else { + requiredClasses.push(charClass); + } + } + }, + + /** + * @param range to generate the number in + * @returns a random number in range [0, range). + * @copyright 2018 The Chromium Authors. All rights reserved. + * @see https://cs.chromium.org/chromium/src/base/rand_util.cc?l=58&rcl=648a59893e4ed5303b5c381b03ce0c75e4165617 + */ + _randomUInt8Index(range) { + if (range > MAX_UINT8) { + throw new Error("`range` cannot fit into uint8"); + } + // We must discard random results above this number, as they would + // make the random generator non-uniform (consider e.g. if + // MAX_UINT64 was 7 and |range| was 5, then a result of 1 would be twice + // as likely as a result of 3 or 4). + // See https://en.wikipedia.org/wiki/Fisher%E2%80%93Yates_shuffle#Modulo_bias + const MAX_ACCEPTABLE_VALUE = Math.floor(MAX_UINT8 / range) * range - 1; + + const randomValueArr = new Uint8Array(1); + do { + crypto.getRandomValues(randomValueArr); + } while (randomValueArr[0] > MAX_ACCEPTABLE_VALUE); + return randomValueArr[0] % range; + }, + + /** + * Shuffle the order of characters in a string. + * @param {string} str to shuffle + * @returns {string} shuffled string + */ + _shuffleString(str) { + let arr = Array.from(str); + // Generate all the random numbers that will be needed. + const randomValues = new Uint32Array(arr.length - 1); + crypto.getRandomValues(randomValues); + + // Fisher-Yates Shuffle + // https://en.wikipedia.org/wiki/Fisher%E2%80%93Yates_shuffle + for (let i = arr.length - 1; i > 0; i--) { + const j = Math.floor((randomValues[i - 1] / MAX_UINT32) * (i + 1)); + [arr[i], arr[j]] = [arr[j], arr[i]]; + } + return arr.join(""); + }, + + /** + * Determine the number of consecutive characters in a string. + * This is primarily used to validate the "max-consecutive" rule + * of a generated password. + * @param {string} generatedPassword + * @param {number} value the number of consecutive characters allowed + * @return {boolean} `true` if the generatePassword has less than the value argument number of characters, `false` otherwise + */ + _checkConsecutiveCharacters(generatedPassword, value) { + let max = 0; + for (let start = 0, end = 1; end < generatedPassword.length; ) { + if (generatedPassword[end] === generatedPassword[start]) { + if (max < end - start + 1) { + max = end - start + 1; + if (max > value) { + return false; + } + } + end++; + } else { + start = end++; + } + } + return true; + }, + _getUpperCaseCharacters() { + return UPPER_CASE_ALPHA; + }, + _getLowerCaseCharacters() { + return LOWER_CASE_ALPHA; + }, + _getDigits() { + return DIGITS; + }, + _getSpecialCharacters() { + return SPECIAL_CHARACTERS; + }, +}; diff --git a/toolkit/components/passwordmgr/PasswordRulesManager.sys.mjs b/toolkit/components/passwordmgr/PasswordRulesManager.sys.mjs new file mode 100644 index 0000000000..e80fb51962 --- /dev/null +++ b/toolkit/components/passwordmgr/PasswordRulesManager.sys.mjs @@ -0,0 +1,130 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this file, + * You can obtain one at http://mozilla.org/MPL/2.0/. */ + +import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs"; + +const lazy = {}; + +ChromeUtils.defineESModuleGetters(lazy, { + LoginHelper: "resource://gre/modules/LoginHelper.sys.mjs", + PasswordGenerator: "resource://gre/modules/PasswordGenerator.sys.mjs", + PasswordRulesParser: "resource://gre/modules/PasswordRulesParser.sys.mjs", + RemoteSettings: "resource://services-settings/remote-settings.sys.mjs", +}); + +XPCOMUtils.defineLazyGetter(lazy, "log", () => { + let logger = lazy.LoginHelper.createLogger("PasswordRulesManager"); + return logger.log.bind(logger); +}); + +const IMPROVED_PASSWORD_GENERATION_HISTOGRAM = + "PWMGR_NUM_IMPROVED_GENERATED_PASSWORDS"; + +/** + * Handles interactions between PasswordRulesParser and the "password-rules" Remote Settings collection + * + * @class PasswordRulesManagerParent + * @extends {JSWindowActorParent} + */ +export class PasswordRulesManagerParent extends JSWindowActorParent { + /** + * @type RemoteSettingsClient + * + * @memberof PasswordRulesManagerParent + */ + _passwordRulesClient = null; + + async initPasswordRulesCollection() { + if (!this._passwordRulesClient) { + this._passwordRulesClient = lazy.RemoteSettings( + lazy.LoginHelper.improvedPasswordRulesCollection + ); + } + } + /** + * Transforms the parsed rules returned from PasswordRulesParser into a Map for easier access. + * The returned Map could have the following keys: "allowed", "required", "maxlength", "minlength", and "max-consecutive" + * @example + * // Returns a Map with a key-value pair of "allowed": "ascii-printable" + * _transformRulesToMap([{ _name: "allowed", value: [{ _name: "ascii-printable" }] }]) + * @param {Object[]} rules rules from PasswordRulesParser.parsePasswordRules + * @return {Map} mapped rules + * @memberof PasswordRulesManagerParent + */ + _transformRulesToMap(rules) { + let map = new Map(); + for (let rule of rules) { + let { _name, value } = rule; + if ( + _name === "minlength" || + _name === "maxlength" || + _name === "max-consecutive" + ) { + map.set(_name, value); + } else { + let _value = []; + if (map.get(_name)) { + _value = map.get(_name); + } + for (let _class of value) { + let { _name: _className } = _class; + if (_className) { + _value.push(_className); + } else { + let { _characters } = _class; + _value.push(_characters); + } + } + map.set(_name, _value); + } + } + return map; + } + + /** + * Generates a password based on rules from the origin parameters. + * @param {nsIURI} uri + * @return {string} password + * @memberof PasswordRulesManagerParent + */ + async generatePassword(uri, { inputMaxLength } = {}) { + await this.initPasswordRulesCollection(); + let originDisplayHost = uri.displayHost; + let records = await this._passwordRulesClient.get(); + let currentRecord; + for (let record of records) { + if (Services.eTLD.hasRootDomain(originDisplayHost, record.Domain)) { + currentRecord = record; + break; + } + } + let isCustomRule = false; + // If we found a matching result, use that to generate a stronger password. + // Otherwise, generate a password using the default rules set. + if (currentRecord?.Domain) { + isCustomRule = true; + lazy.log( + `Password rules for ${currentRecord.Domain}: ${currentRecord["password-rules"]}.` + ); + let currentRules = lazy.PasswordRulesParser.parsePasswordRules( + currentRecord["password-rules"] + ); + let mapOfRules = this._transformRulesToMap(currentRules); + Services.telemetry + .getHistogramById(IMPROVED_PASSWORD_GENERATION_HISTOGRAM) + .add(isCustomRule); + return lazy.PasswordGenerator.generatePassword({ + rules: mapOfRules, + inputMaxLength, + }); + } + lazy.log( + `No password rules for specified origin, generating standard password.` + ); + Services.telemetry + .getHistogramById(IMPROVED_PASSWORD_GENERATION_HISTOGRAM) + .add(isCustomRule); + return lazy.PasswordGenerator.generatePassword({ inputMaxLength }); + } +} diff --git a/toolkit/components/passwordmgr/PasswordRulesParser.sys.mjs b/toolkit/components/passwordmgr/PasswordRulesParser.sys.mjs new file mode 100644 index 0000000000..8ce7cba990 --- /dev/null +++ b/toolkit/components/passwordmgr/PasswordRulesParser.sys.mjs @@ -0,0 +1,695 @@ +// Sourced from https://github.com/apple/password-manager-resources/blob/5f6da89483e75cdc4165a6fc4756796e0ced7a21/tools/PasswordRulesParser.js +// Copyright (c) 2019 - 2020 Apple Inc. Licensed under MIT License. + +export const PasswordRulesParser = { + parsePasswordRules, +}; + +const Identifier = { + ASCII_PRINTABLE: "ascii-printable", + DIGIT: "digit", + LOWER: "lower", + SPECIAL: "special", + UNICODE: "unicode", + UPPER: "upper", +}; + +const RuleName = { + ALLOWED: "allowed", + MAX_CONSECUTIVE: "max-consecutive", + REQUIRED: "required", + MIN_LENGTH: "minlength", + MAX_LENGTH: "maxlength", +}; + +const CHARACTER_CLASS_START_SENTINEL = "["; +const CHARACTER_CLASS_END_SENTINEL = "]"; +const PROPERTY_VALUE_SEPARATOR = ","; +const PROPERTY_SEPARATOR = ";"; +const PROPERTY_VALUE_START_SENTINEL = ":"; + +const SPACE_CODE_POINT = " ".codePointAt(0); + +const SHOULD_NOT_BE_REACHED = "Should not be reached"; + +class Rule { + constructor(name, value) { + this._name = name; + this.value = value; + } + get name() { + return this._name; + } + toString() { + return JSON.stringify(this); + } +} + +class NamedCharacterClass { + constructor(name) { + console.assert(_isValidRequiredOrAllowedPropertyValueIdentifier(name)); + this._name = name; + } + get name() { + return this._name.toLowerCase(); + } + toString() { + return this._name; + } + toHTMLString() { + return this._name; + } +} + +class CustomCharacterClass { + constructor(characters) { + console.assert(characters instanceof Array); + this._characters = characters; + } + get characters() { + return this._characters; + } + toString() { + return `[${this._characters.join("")}]`; + } + toHTMLString() { + return `[${this._characters.join("").replace('"', """)}]`; + } +} + +// MARK: Lexer functions + +function _isIdentifierCharacter(c) { + console.assert(c.length === 1); + return (c >= "a" && c <= "z") || (c >= "A" && c <= "Z") || c === "-"; +} + +function _isASCIIDigit(c) { + console.assert(c.length === 1); + return c >= "0" && c <= "9"; +} + +function _isASCIIPrintableCharacter(c) { + console.assert(c.length === 1); + return c >= " " && c <= "~"; +} + +function _isASCIIWhitespace(c) { + console.assert(c.length === 1); + return c === " " || c === "\f" || c === "\n" || c === "\r" || c === "\t"; +} + +// MARK: ASCII printable character bit set and canonicalization functions + +function _bitSetIndexForCharacter(c) { + console.assert(c.length == 1); + return c.codePointAt(0) - SPACE_CODE_POINT; +} + +function _characterAtBitSetIndex(index) { + return String.fromCodePoint(index + SPACE_CODE_POINT); +} + +function _markBitsForNamedCharacterClass(bitSet, namedCharacterClass) { + console.assert(bitSet instanceof Array); + console.assert(namedCharacterClass.name !== Identifier.UNICODE); + console.assert(namedCharacterClass.name !== Identifier.ASCII_PRINTABLE); + if (namedCharacterClass.name === Identifier.UPPER) { + bitSet.fill( + true, + _bitSetIndexForCharacter("A"), + _bitSetIndexForCharacter("Z") + 1 + ); + } else if (namedCharacterClass.name === Identifier.LOWER) { + bitSet.fill( + true, + _bitSetIndexForCharacter("a"), + _bitSetIndexForCharacter("z") + 1 + ); + } else if (namedCharacterClass.name === Identifier.DIGIT) { + bitSet.fill( + true, + _bitSetIndexForCharacter("0"), + _bitSetIndexForCharacter("9") + 1 + ); + } else if (namedCharacterClass.name === Identifier.SPECIAL) { + bitSet.fill( + true, + _bitSetIndexForCharacter(" "), + _bitSetIndexForCharacter("/") + 1 + ); + bitSet.fill( + true, + _bitSetIndexForCharacter(":"), + _bitSetIndexForCharacter("@") + 1 + ); + bitSet.fill( + true, + _bitSetIndexForCharacter("["), + _bitSetIndexForCharacter("`") + 1 + ); + bitSet.fill( + true, + _bitSetIndexForCharacter("{"), + _bitSetIndexForCharacter("~") + 1 + ); + } else { + console.assert(false, SHOULD_NOT_BE_REACHED, namedCharacterClass); + } +} + +function _markBitsForCustomCharacterClass(bitSet, customCharacterClass) { + for (let character of customCharacterClass.characters) { + bitSet[_bitSetIndexForCharacter(character)] = true; + } +} + +function _canonicalizedPropertyValues( + propertyValues, + keepCustomCharacterClassFormatCompliant +) { + let asciiPrintableBitSet = new Array( + "~".codePointAt(0) - " ".codePointAt(0) + 1 + ); + + for (let propertyValue of propertyValues) { + if (propertyValue instanceof NamedCharacterClass) { + if (propertyValue.name === Identifier.UNICODE) { + return [new NamedCharacterClass(Identifier.UNICODE)]; + } + + if (propertyValue.name === Identifier.ASCII_PRINTABLE) { + return [new NamedCharacterClass(Identifier.ASCII_PRINTABLE)]; + } + + _markBitsForNamedCharacterClass(asciiPrintableBitSet, propertyValue); + } else if (propertyValue instanceof CustomCharacterClass) { + _markBitsForCustomCharacterClass(asciiPrintableBitSet, propertyValue); + } + } + + let charactersSeen = []; + + function checkRange(start, end) { + let temp = []; + for ( + let i = _bitSetIndexForCharacter(start); + i <= _bitSetIndexForCharacter(end); + ++i + ) { + if (asciiPrintableBitSet[i]) { + temp.push(_characterAtBitSetIndex(i)); + } + } + + let result = + temp.length === + _bitSetIndexForCharacter(end) - _bitSetIndexForCharacter(start) + 1; + if (!result) { + charactersSeen = charactersSeen.concat(temp); + } + return result; + } + + let hasAllUpper = checkRange("A", "Z"); + let hasAllLower = checkRange("a", "z"); + let hasAllDigits = checkRange("0", "9"); + + // Check for special characters, accounting for characters that are given special treatment (i.e. '-' and ']') + let hasAllSpecial = false; + let hasDash = false; + let hasRightSquareBracket = false; + let temp = []; + for ( + let i = _bitSetIndexForCharacter(" "); + i <= _bitSetIndexForCharacter("/"); + ++i + ) { + if (!asciiPrintableBitSet[i]) { + continue; + } + + let character = _characterAtBitSetIndex(i); + if (keepCustomCharacterClassFormatCompliant && character === "-") { + hasDash = true; + } else { + temp.push(character); + } + } + for ( + let i = _bitSetIndexForCharacter(":"); + i <= _bitSetIndexForCharacter("@"); + ++i + ) { + if (asciiPrintableBitSet[i]) { + temp.push(_characterAtBitSetIndex(i)); + } + } + for ( + let i = _bitSetIndexForCharacter("["); + i <= _bitSetIndexForCharacter("`"); + ++i + ) { + if (!asciiPrintableBitSet[i]) { + continue; + } + + let character = _characterAtBitSetIndex(i); + if (keepCustomCharacterClassFormatCompliant && character === "]") { + hasRightSquareBracket = true; + } else { + temp.push(character); + } + } + for ( + let i = _bitSetIndexForCharacter("{"); + i <= _bitSetIndexForCharacter("~"); + ++i + ) { + if (asciiPrintableBitSet[i]) { + temp.push(_characterAtBitSetIndex(i)); + } + } + + if (hasDash) { + temp.unshift("-"); + } + if (hasRightSquareBracket) { + temp.push("]"); + } + + let numberOfSpecialCharacters = + _bitSetIndexForCharacter("/") - + _bitSetIndexForCharacter(" ") + + 1 + + (_bitSetIndexForCharacter("@") - _bitSetIndexForCharacter(":") + 1) + + (_bitSetIndexForCharacter("`") - _bitSetIndexForCharacter("[") + 1) + + (_bitSetIndexForCharacter("~") - _bitSetIndexForCharacter("{") + 1); + hasAllSpecial = temp.length === numberOfSpecialCharacters; + if (!hasAllSpecial) { + charactersSeen = charactersSeen.concat(temp); + } + + let result = []; + if (hasAllUpper && hasAllLower && hasAllDigits && hasAllSpecial) { + return [new NamedCharacterClass(Identifier.ASCII_PRINTABLE)]; + } + if (hasAllUpper) { + result.push(new NamedCharacterClass(Identifier.UPPER)); + } + if (hasAllLower) { + result.push(new NamedCharacterClass(Identifier.LOWER)); + } + if (hasAllDigits) { + result.push(new NamedCharacterClass(Identifier.DIGIT)); + } + if (hasAllSpecial) { + result.push(new NamedCharacterClass(Identifier.SPECIAL)); + } + if (charactersSeen.length) { + result.push(new CustomCharacterClass(charactersSeen)); + } + return result; +} + +// MARK: Parser functions + +function _indexOfNonWhitespaceCharacter(input, position = 0) { + console.assert(position >= 0); + console.assert(position <= input.length); + + let length = input.length; + while (position < length && _isASCIIWhitespace(input[position])) { + ++position; + } + + return position; +} + +function _parseIdentifier(input, position) { + console.assert(position >= 0); + console.assert(position < input.length); + console.assert(_isIdentifierCharacter(input[position])); + + let length = input.length; + let seenIdentifiers = []; + do { + let c = input[position]; + if (!_isIdentifierCharacter(c)) { + break; + } + + seenIdentifiers.push(c); + ++position; + } while (position < length); + + return [seenIdentifiers.join(""), position]; +} + +function _isValidRequiredOrAllowedPropertyValueIdentifier(identifier) { + return ( + identifier && Object.values(Identifier).includes(identifier.toLowerCase()) + ); +} + +function _parseCustomCharacterClass(input, position) { + console.assert(position >= 0); + console.assert(position < input.length); + console.assert(input[position] === CHARACTER_CLASS_START_SENTINEL); + + let length = input.length; + ++position; + if (position >= length) { + console.error("Found end-of-line instead of character class character"); + return [null, position]; + } + + let initialPosition = position; + let result = []; + do { + let c = input[position]; + if (!_isASCIIPrintableCharacter(c)) { + ++position; + continue; + } + + if (c === "-" && position - initialPosition > 0) { + // FIXME: Should this be an error? + console.warn( + "Ignoring '-'; a '-' may only appear as the first character in a character class" + ); + ++position; + continue; + } + + result.push(c); + ++position; + if (c === CHARACTER_CLASS_END_SENTINEL) { + break; + } + } while (position < length); + + if ( + (position < length && input[position] !== CHARACTER_CLASS_END_SENTINEL) || + (position == length && input[position - 1] == CHARACTER_CLASS_END_SENTINEL) + ) { + // Fix up result; we over consumed. + result.pop(); + return [result, position]; + } + + if (position < length && input[position] == CHARACTER_CLASS_END_SENTINEL) { + return [result, position + 1]; + } + + console.error("Found end-of-line instead of end of character class"); + return [null, position]; +} + +function _parsePasswordRequiredOrAllowedPropertyValue(input, position) { + console.assert(position >= 0); + console.assert(position < input.length); + + let length = input.length; + let propertyValues = []; + while (true) { + if (_isIdentifierCharacter(input[position])) { + let identifierStartPosition = position; + var [propertyValue, position] = _parseIdentifier(input, position); + if (!_isValidRequiredOrAllowedPropertyValueIdentifier(propertyValue)) { + console.error( + "Unrecognized property value identifier: " + propertyValue + ); + return [null, identifierStartPosition]; + } + propertyValues.push(new NamedCharacterClass(propertyValue)); + } else if (input[position] == CHARACTER_CLASS_START_SENTINEL) { + var [propertyValue, position] = _parseCustomCharacterClass( + input, + position + ); + if (propertyValue && propertyValue.length) { + propertyValues.push(new CustomCharacterClass(propertyValue)); + } + } else { + console.error( + "Failed to find start of property value: " + input.substr(position) + ); + return [null, position]; + } + + position = _indexOfNonWhitespaceCharacter(input, position); + if (position >= length || input[position] === PROPERTY_SEPARATOR) { + break; + } + + if (input[position] === PROPERTY_VALUE_SEPARATOR) { + position = _indexOfNonWhitespaceCharacter(input, position + 1); + if (position >= length) { + console.error( + "Found end-of-line instead of start of next property value" + ); + return [null, position]; + } + continue; + } + + console.error( + "Failed to find start of next property or property value: " + + input.substr(position) + ); + return [null, position]; + } + return [propertyValues, position]; +} + +function _parsePasswordRule(input, position) { + console.assert(position >= 0); + console.assert(position < input.length); + console.assert(_isIdentifierCharacter(input[position])); + + let length = input.length; + + let mayBeIdentifierStartPosition = position; + var [identifier, position] = _parseIdentifier(input, position); + if (!Object.values(RuleName).includes(identifier)) { + console.error("Unrecognized property name: " + identifier); + return [null, mayBeIdentifierStartPosition]; + } + + if (position >= length) { + console.error("Found end-of-line instead of start of property value"); + return [null, position]; + } + + if (input[position] !== PROPERTY_VALUE_START_SENTINEL) { + console.error( + "Failed to find start of property value: " + input.substr(position) + ); + return [null, position]; + } + + let property = { name: identifier, value: null }; + + position = _indexOfNonWhitespaceCharacter(input, position + 1); + // Empty value + if (position >= length || input[position] === PROPERTY_SEPARATOR) { + return [new Rule(property.name, property.value), position]; + } + + switch (identifier) { + case RuleName.ALLOWED: + case RuleName.REQUIRED: { + var [ + propertyValue, + position, + ] = _parsePasswordRequiredOrAllowedPropertyValue(input, position); + if (propertyValue) { + property.value = propertyValue; + } + return [new Rule(property.name, property.value), position]; + } + case RuleName.MAX_CONSECUTIVE: { + var [propertyValue, position] = _parseMaxConsecutivePropertyValue( + input, + position + ); + if (propertyValue) { + property.value = propertyValue; + } + return [new Rule(property.name, property.value), position]; + } + case RuleName.MIN_LENGTH: + case RuleName.MAX_LENGTH: { + var [propertyValue, position] = _parseMinLengthMaxLengthPropertyValue( + input, + position + ); + if (propertyValue) { + property.value = propertyValue; + } + return [new Rule(property.name, property.value), position]; + } + } + console.assert(false, SHOULD_NOT_BE_REACHED); +} + +function _parseMinLengthMaxLengthPropertyValue(input, position) { + return _parseInteger(input, position); +} + +function _parseMaxConsecutivePropertyValue(input, position) { + return _parseInteger(input, position); +} + +function _parseInteger(input, position) { + console.assert(position >= 0); + console.assert(position < input.length); + + if (!_isASCIIDigit(input[position])) { + console.error( + "Failed to parse value of type integer; not a number: " + + input.substr(position) + ); + return [null, position]; + } + + let length = input.length; + let initialPosition = position; + let result = 0; + do { + result = 10 * result + parseInt(input[position], 10); + ++position; + } while ( + position < length && + input[position] !== PROPERTY_SEPARATOR && + _isASCIIDigit(input[position]) + ); + + if (position >= length || input[position] === PROPERTY_SEPARATOR) { + return [result, position]; + } + + console.error( + "Failed to parse value of type integer; not a number: " + + input.substr(initialPosition) + ); + return [null, position]; +} + +function _parsePasswordRulesInternal(input) { + let parsedProperties = []; + let length = input.length; + + var position = _indexOfNonWhitespaceCharacter(input); + while (position < length) { + if (!_isIdentifierCharacter(input[position])) { + console.warn( + "Failed to find start of property: " + input.substr(position) + ); + return parsedProperties; + } + + var [parsedProperty, position] = _parsePasswordRule(input, position); + if (parsedProperty && parsedProperty.value) { + parsedProperties.push(parsedProperty); + } + + position = _indexOfNonWhitespaceCharacter(input, position); + if (position >= length) { + break; + } + + if (input[position] === PROPERTY_SEPARATOR) { + position = _indexOfNonWhitespaceCharacter(input, position + 1); + if (position >= length) { + return parsedProperties; + } + + continue; + } + + console.error( + "Failed to find start of next property: " + input.substr(position) + ); + return null; + } + + return parsedProperties; +} + +function parsePasswordRules(input, formatRulesForMinifiedVersion) { + let passwordRules = _parsePasswordRulesInternal(input) || []; + + // When formatting rules for minified version, we should keep the formatted rules + // as similar to the input as possible. Avoid copying required rules to allowed rules. + let suppressCopyingRequiredToAllowed = formatRulesForMinifiedVersion; + + let newPasswordRules = []; + let newAllowedValues = []; + let minimumMaximumConsecutiveCharacters = null; + let maximumMinLength = 0; + let minimumMaxLength = null; + + for (let rule of passwordRules) { + switch (rule.name) { + case RuleName.MAX_CONSECUTIVE: + minimumMaximumConsecutiveCharacters = minimumMaximumConsecutiveCharacters + ? Math.min(rule.value, minimumMaximumConsecutiveCharacters) + : rule.value; + break; + + case RuleName.MIN_LENGTH: + maximumMinLength = Math.max(rule.value, maximumMinLength); + break; + + case RuleName.MAX_LENGTH: + minimumMaxLength = minimumMaxLength + ? Math.min(rule.value, minimumMaxLength) + : rule.value; + break; + + case RuleName.REQUIRED: + rule.value = _canonicalizedPropertyValues( + rule.value, + formatRulesForMinifiedVersion + ); + newPasswordRules.push(rule); + if (!suppressCopyingRequiredToAllowed) { + newAllowedValues = newAllowedValues.concat(rule.value); + } + break; + + case RuleName.ALLOWED: + newAllowedValues = newAllowedValues.concat(rule.value); + break; + } + } + + newAllowedValues = _canonicalizedPropertyValues( + newAllowedValues, + suppressCopyingRequiredToAllowed + ); + if (!suppressCopyingRequiredToAllowed && !newAllowedValues.length) { + newAllowedValues = [new NamedCharacterClass(Identifier.ASCII_PRINTABLE)]; + } + if (newAllowedValues.length) { + newPasswordRules.push(new Rule(RuleName.ALLOWED, newAllowedValues)); + } + + if (minimumMaximumConsecutiveCharacters !== null) { + newPasswordRules.push( + new Rule(RuleName.MAX_CONSECUTIVE, minimumMaximumConsecutiveCharacters) + ); + } + + if (maximumMinLength > 0) { + newPasswordRules.push(new Rule(RuleName.MIN_LENGTH, maximumMinLength)); + } + + if (minimumMaxLength !== null) { + newPasswordRules.push(new Rule(RuleName.MAX_LENGTH, minimumMaxLength)); + } + + return newPasswordRules; +} diff --git a/toolkit/components/passwordmgr/SignUpFormRuleset.sys.mjs b/toolkit/components/passwordmgr/SignUpFormRuleset.sys.mjs new file mode 100644 index 0000000000..711bb9a6cb --- /dev/null +++ b/toolkit/components/passwordmgr/SignUpFormRuleset.sys.mjs @@ -0,0 +1,579 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/** + * Fathom ML model for identifying sign up <forms> + * + * This is developed out-of-tree at https://github.com/mozilla-services/fathom-login-forms, + * where there is also over a GB of training, validation, and + * testing data. To make changes, do your edits there (whether adding new + * training pages, adding new rules, or both), retrain and evaluate as + * documented at https://mozilla.github.io/fathom/training.html, paste the + * coefficients emitted by the trainer into the ruleset, and finally copy the + * ruleset's "CODE TO COPY INTO PRODUCTION" section to this file's "CODE FROM + * TRAINING REPOSITORY" section. + */ + +import { + dom, + out, + rule, + ruleset, + score, + type, + element, + utils, +} from "resource://gre/modules/third_party/fathom/fathom.mjs"; + +let { isVisible, attributesMatch, setDefault } = utils; + +const DEVELOPMENT = false; + +/** + * --- START OF RULESET --- + */ +const coefficients = { + form: new Map([ + ["formAttributesMatchRegisterRegex", 0.4614015519618988], + ["formAttributesMatchLoginRegex", -2.608457326889038], + ["formAttributesMatchSubscriptionRegex", -3.253319501876831], + ["formAttributesMatchLoginAndRegisterRegex", 3.6423728466033936], + ["formHasAcNewPassword", 2.214113473892212], + ["formHasAcCurrentPassword", -0.43707895278930664], + ["formHasEmailField", 1.760241150856018], + ["formHasUsernameField", 1.1527059078216553], + ["formHasPasswordField", 1.6670876741409302], + ["formHasFirstOrLastNameField", 0.9517516493797302], + ["formHasRegisterButton", 1.574048638343811], + ["formHasLoginButton", -1.1688978672027588], + ["formHasSubscribeButton", -0.26299405097961426], + ["formHasContinueButton", 2.3797709941864014], + ["formHasTermsAndConditionsHyperlink", 1.764896035194397], + ["formHasPasswordForgottenHyperlink", -0.32138824462890625], + ["formHasAlreadySignedUpHyperlink", 3.160510301589966], + ["closestElementIsEmailLabelLike", 1.0336143970489502], + ["formHasRememberMeCheckbox", -1.2176686525344849], + ["formHasSubcriptionCheckbox", 0.6100747585296631], + ["docTitleMatchesRegisterRegex", 0.680654764175415], + ["docTitleMatchesEditProfileRegex", -4.104133605957031], + ["closestHeaderMatchesRegisterRegex", 1.3462989330291748], + ["closestHeaderMatchesLoginRegex", -0.1804502159357071], + ["closestHeaderMatchesSubscriptionRegex", -1.3057124614715576], + ]), +}; + +const biases = [["form", -4.402400970458984]]; + +const loginRegex = + /login|log-in|log_in|log in|signon|sign-on|sign_on|sign on|signin|sign-in|sign_in|sign in|einloggen|anmelden|logon|log-on|log_on|log on|Войти|ورود|登录|Přihlásit se|Přihlaste|Авторизоваться|Авторизация|entrar|ログイン|로그인|inloggen|Συνδέσου|accedi|ログオン|Giriş Yap|登入|connecter|connectez-vous|Connexion|Вход|inicia/i; +const registerRegex = + /regist|sign up|signup|sign-up|sign_up|join|new|登録|neu|erstellen|設定|신규|Créer|Nouveau|baru|nouă|nieuw|create[a-zA-Z\s]+account|create[a-zA-Z\s]+profile|activate[a-zA-Z\s]+account|Zugang anlegen|Angaben prüfen|Konto erstellen|ثبت نام|登録|注册|cadastr|Зарегистрироваться|Регистрация|Bellige alynmak|تسجيل|ΕΓΓΡΑΦΗΣ|Εγγραφή|Créer mon compte|Créer un compte|Mendaftar|가입하기|inschrijving|Zarejestruj się|Deschideți un cont|Создать аккаунт|ร่วม|Üye Ol|ساخت حساب کاربری|Schrijf je|S'inscrire/i; +const emailRegex = /mail/i; +const usernameRegex = /user|member/i; +const nameRegex = /first|last|middle/i; +const subscriptionRegex = + /subscri|trial|offer|information|angebote|probe|ニュースレター|abonn|promotion|news/i; +const termsAndConditionsRegex = + /terms|condition|rules|policy|privacy|nutzungsbedingungen|AGB|richtlinien|datenschutz|términos|condiciones/i; +const pwForgottenRegex = + /forgot|reset|set password|vergessen|vergeten|oublié|dimenticata|Esqueceu|esqueci|Забыли|忘记|找回|Zapomenuté|lost|忘れた|忘れられた|忘れの方|재설정|찾기|help|فراموشی| را فراموش کرده اید|Восстановить|Unuttu|perdus|重新設定|recover|remind|request|restore|trouble|olvidada/i; +const continueRegex = + /continue|go on|weiter|fortfahren|ga verder|next|continuar/i; +const rememberMeRegex = + /remember|stay|speichern|merken|bleiben|auto_login|auto-login|auto login|ricordami|manter|mantenha|savelogin|keep me logged in|keep me signed in|save email address|save id|stay signed in|次回からログオンIDの入力を省略する|メールアドレスを保存する|を保存|아이디저장|아이디 저장|로그인 상태 유지|lembrar|mantenha-me conectado|Запомни меня|запомнить меня|Запомните меня|Не спрашивать в следующий раз|下次自动登录|记住我|recordar|angemeldet bleiben/i; +const alreadySignedUpRegex = /already|bereits|schon|ya tienes cuenta/i; +const editProfile = /edit/i; + +function createRuleset(coeffs, biases) { + let elementToSelectors; + + /** + * Check document characteristics + */ + function docTitleMatchesRegisterRegex(fnode) { + const docTitle = fnode.element.ownerDocument.title; + return checkValueAgainstRegex(docTitle, registerRegex); + } + function docTitleMatchesEditProfileRegex(fnode) { + const docTitle = fnode.element.ownerDocument.title; + return checkValueAgainstRegex(docTitle, editProfile); + } + + /** + * Check header + */ + function closestHeaderMatchesLoginRegex(fnode) { + return closestHeaderMatchesPredicate(fnode.element, header => + checkValueAgainstRegex(header.innerText, loginRegex) + ); + } + function closestHeaderMatchesRegisterRegex(fnode) { + return closestHeaderMatchesPredicate(fnode.element, header => + checkValueAgainstRegex(header.innerText, registerRegex) + ); + } + function closestHeaderMatchesSubscriptionRegex(fnode) { + return closestHeaderMatchesPredicate(fnode.element, header => + checkValueAgainstRegex(header.innerText, subscriptionRegex) + ); + } + + /** + * Check checkboxes + */ + function formHasRememberMeCheckbox(fnode) { + return elementHasRegexMatchingCheckbox(fnode.element, rememberMeRegex); + } + function formHasSubcriptionCheckbox(fnode) { + return elementHasRegexMatchingCheckbox(fnode.element, subscriptionRegex); + } + + /** + * Check input fields + */ + function formHasFirstOrLastNameField(fnode) { + const acValues = ["name", "given-name", "family-name"]; + return elementHasPredicateMatchingInput( + fnode.element, + elem => + atLeastOne(acValues.filter(ac => elem.autocomplete == ac)) || + inputFieldMatchesPredicate(elem, attr => + checkValueAgainstRegex(attr, nameRegex) + ) + ); + } + function formHasEmailField(fnode) { + return elementHasPredicateMatchingInput( + fnode.element, + elem => + elem.autocomplete == "email" || + elem.type == "email" || + inputFieldMatchesPredicate(elem, attr => + checkValueAgainstRegex(attr, emailRegex) + ) + ); + } + function formHasUsernameField(fnode) { + return elementHasPredicateMatchingInput( + fnode.element, + elem => + elem.autocomplete == "username" || + inputFieldMatchesPredicate(elem, attr => + checkValueAgainstRegex(attr, usernameRegex) + ) + ); + } + function formHasPasswordField(fnode) { + const acValues = ["current-password", "new-password"]; + return elementHasPredicateMatchingInput( + fnode.element, + elem => + atLeastOne(acValues.filter(ac => elem.autocomplete == ac)) || + elem.type == "password" + ); + } + + /** + * Check autocomplete values + */ + function formHasAcCurrentPassword(fnode) { + return inputFieldMatchesSelector( + fnode.element, + "autocomplete=current-password" + ); + } + function formHasAcNewPassword(fnode) { + return inputFieldMatchesSelector( + fnode.element, + "autocomplete=new-password" + ); + } + + /** + * Check hyperlinks within form + */ + function formHasTermsAndConditionsHyperlink(fnode) { + return elementHasPredicateMatchingHyperlink( + fnode.element, + termsAndConditionsRegex + ); + } + function formHasPasswordForgottenHyperlink(fnode) { + return elementHasPredicateMatchingHyperlink( + fnode.element, + pwForgottenRegex + ); + } + function formHasAlreadySignedUpHyperlink(fnode) { + return elementHasPredicateMatchingHyperlink( + fnode.element, + alreadySignedUpRegex + ); + } + + /** + * Check labels + */ + function closestElementIsEmailLabelLike(fnode) { + return elementHasPredicateMatchingInput(fnode.element, elem => + previousSiblingLabelMatchesRegex(elem, emailRegex) + ); + } + + /** + * Check buttons + */ + function formHasRegisterButton(fnode) { + return elementHasPredicateMatchingButton( + fnode.element, + button => + checkValueAgainstRegex(button.innerText, registerRegex) || + buttonMatchesPredicate(button, attr => + checkValueAgainstRegex(attr, registerRegex) + ) + ); + } + function formHasLoginButton(fnode) { + return elementHasPredicateMatchingButton( + fnode.element, + button => + checkValueAgainstRegex(button.innerText, loginRegex) || + buttonMatchesPredicate(button, attr => + checkValueAgainstRegex(attr, loginRegex) + ) + ); + } + function formHasContinueButton(fnode) { + return elementHasPredicateMatchingButton( + fnode.element, + button => + checkValueAgainstRegex(button.innerText, continueRegex) || + buttonMatchesPredicate(button, attr => + checkValueAgainstRegex(attr, continueRegex) + ) + ); + } + function formHasSubscribeButton(fnode) { + return elementHasPredicateMatchingButton( + fnode.element, + button => + checkValueAgainstRegex(button.innerText, subscriptionRegex) || + buttonMatchesPredicate(button, attr => + checkValueAgainstRegex(attr, subscriptionRegex) + ) + ); + } + + /** + * Check form attributes + */ + function formAttributesMatchRegisterRegex(fnode) { + return formMatchesPredicate(fnode.element, attr => + checkValueAgainstRegex(attr, registerRegex) + ); + } + function formAttributesMatchLoginRegex(fnode) { + return formMatchesPredicate(fnode.element, attr => + checkValueAgainstRegex(attr, loginRegex) + ); + } + function formAttributesMatchSubscriptionRegex(fnode) { + return formMatchesPredicate(fnode.element, attr => + checkValueAgainstRegex(attr, subscriptionRegex) + ); + } + function formAttributesMatchLoginAndRegisterRegex(fnode) { + return formMatchesPredicate(fnode.element, attr => + checkValueAgainstAllRegex(attr, [registerRegex, loginRegex]) + ); + } + + /** + * HELPER FUNCTIONS + */ + function elementMatchesPredicate(element, predicate, additional = []) { + return attributesMatch( + element, + predicate, + ["id", "name", "className"].concat(additional) + ); + } + function formMatchesPredicate(element, predicate) { + return elementMatchesPredicate(element, predicate, ["action"]); + } + function inputFieldMatchesPredicate(element, predicate) { + return elementMatchesPredicate(element, predicate, ["placeholder"]); + } + function inputFieldMatchesSelector(element, selector) { + return atLeastOne(getElementDescendants(element, `input[${selector}]`)); + } + function buttonMatchesPredicate(element, predicate) { + return elementMatchesPredicate(element, predicate, [ + "value", + "id", + "title", + ]); + } + /** + * ELEMENT HAS PREDICATE MATCHING X FUNCTIONS + */ + function elementHasPredicateMatchingDescendant(element, selector, predicate) { + const matchingElements = getElementDescendants(element, selector); + return matchingElements.some(predicate); + } + function elementHasPredicateMatchingHeader(element, predicate) { + return ( + elementHasPredicateMatchingDescendant( + element, + "h1,h2,h3,h4,h5,h6", + predicate + ) || + elementHasPredicateMatchingDescendant( + element, + "div[class*=heading],div[class*=header],div[class*=title],header", + predicate + ) + ); + } + function elementHasPredicateMatchingButton(element, predicate) { + return elementHasPredicateMatchingDescendant( + element, + "button,input[type=submit],input[type=button]", + predicate + ); + } + function elementHasPredicateMatchingInput(element, predicate) { + return elementHasPredicateMatchingDescendant(element, "input", predicate); + } + function elementHasPredicateMatchingHyperlink(element, regexExp) { + return elementHasPredicateMatchingDescendant( + element, + "a", + link => + previousSiblingLabelMatchesRegex(link, regexExp) || + checkValueAgainstRegex(link.innerText, regexExp) || + elementMatchesPredicate( + link, + attr => checkValueAgainstRegex(attr, regexExp), + ["href"] + ) || + nextSiblingLabelMatchesRegex(link, regexExp) + ); + } + function elementHasRegexMatchingCheckbox(element, regexExp) { + return elementHasPredicateMatchingDescendant( + element, + "input[type=checkbox], div[class*=checkbox]", + box => + elementMatchesPredicate(box, attr => + checkValueAgainstRegex(attr, regexExp) + ) || nextSiblingLabelMatchesRegex(box, regexExp) + ); + } + + function nextSiblingLabelMatchesRegex(element, regexExp) { + let nextElem = element.nextElementSibling; + if (nextElem && nextElem.tagName == "LABEL") { + return checkValueAgainstRegex(nextElem.innerText, regexExp); + } + let closestElem = closestElementFollowing(element, "label"); + return closestElem + ? checkValueAgainstRegex(closestElem.innerText, regexExp) + : false; + } + + function previousSiblingLabelMatchesRegex(element, regexExp) { + let previousElem = element.previousElementSibling; + if (previousElem && previousElem.tagName == "LABEL") { + return checkValueAgainstRegex(previousElem.innerText, regexExp); + } + let closestElem = closestElementAbove(element, "label"); + return closestElem + ? checkValueAgainstRegex(closestElem.innerText, regexExp) + : false; + } + function getElementDescendants(element, selector) { + const selectorToDescendants = setDefault( + elementToSelectors, + element, + () => new Map() + ); + + return setDefault( + selectorToDescendants, // prettier-ignore + selector, + () => Array.from(element.querySelectorAll(selector)) + ); + } + function clearCache() { + elementToSelectors = new WeakMap(); + } + function closestHeaderMatchesPredicate(element, predicate) { + return ( + elementHasPredicateMatchingHeader(element, predicate) || + closestHeaderAboveMatchesPredicate(element, predicate) + ); + } + function closestHeaderAboveMatchesPredicate(element, predicate) { + let closestHeader = closestElementAbove(element, "h1,h2,h3,h4,h5,h6"); + + if (closestHeader !== null) { + if (predicate(closestHeader)) { + return true; + } + } + closestHeader = closestElementAbove( + element, + "div[class*=heading],div[class*=header],div[class*=title],header" + ); + return closestHeader ? predicate(closestHeader) : false; + } + function closestElementAbove(element, selector) { + let elements = Array.from( + getElementDescendants(element.ownerDocument, selector) + ); + for (let i = elements.length - 1; i >= 0; --i) { + if ( + element.compareDocumentPosition(elements[i]) & + Node.DOCUMENT_POSITION_PRECEDING + ) { + return elements[i]; + } + } + return null; + } + function closestElementFollowing(element, selector) { + let elements = Array.from( + getElementDescendants(element.ownerDocument, selector) + ); + for (let i = 0; i < elements.length; ++i) { + if ( + element.compareDocumentPosition(elements[i]) & + Node.DOCUMENT_POSITION_FOLLOWING + ) { + return elements[i]; + } + } + return null; + } + function checkValueAgainstAllRegex(value, regexExp = []) { + return regexExp.every(reg => checkValueAgainstRegex(value, reg)); + } + + function checkValueAgainstRegex(value, regexExp) { + return value ? regexExp.test(value) : false; + } + function atLeastOne(iter) { + return iter.length >= 1; + } + + /** + * CREATION OF RULESET + */ + const rules = ruleset( + [ + rule( + DEVELOPMENT ? dom("form").when(isVisible) : element("form"), + type("form").note(clearCache) + ), + // Check form attributes + rule(type("form"), score(formAttributesMatchRegisterRegex), { + name: "formAttributesMatchRegisterRegex", + }), + rule(type("form"), score(formAttributesMatchLoginRegex), { + name: "formAttributesMatchLoginRegex", + }), + rule(type("form"), score(formAttributesMatchSubscriptionRegex), { + name: "formAttributesMatchSubscriptionRegex", + }), + rule(type("form"), score(formAttributesMatchLoginAndRegisterRegex), { + name: "formAttributesMatchLoginAndRegisterRegex", + }), + // Check autocomplete attributes + rule(type("form"), score(formHasAcCurrentPassword), { + name: "formHasAcCurrentPassword", + }), + rule(type("form"), score(formHasAcNewPassword), { + name: "formHasAcNewPassword", + }), + // Check input fields + rule(type("form"), score(formHasEmailField), { + name: "formHasEmailField", + }), + rule(type("form"), score(formHasUsernameField), { + name: "formHasUsernameField", + }), + rule(type("form"), score(formHasPasswordField), { + name: "formHasPasswordField", + }), + rule(type("form"), score(formHasFirstOrLastNameField), { + name: "formHasFirstOrLastNameField", + }), + // Check buttons + rule(type("form"), score(formHasRegisterButton), { + name: "formHasRegisterButton", + }), + rule(type("form"), score(formHasLoginButton), { + name: "formHasLoginButton", + }), + rule(type("form"), score(formHasContinueButton), { + name: "formHasContinueButton", + }), + rule(type("form"), score(formHasSubscribeButton), { + name: "formHasSubscribeButton", + }), + // Check hyperlinks + rule(type("form"), score(formHasTermsAndConditionsHyperlink), { + name: "formHasTermsAndConditionsHyperlink", + }), + rule(type("form"), score(formHasPasswordForgottenHyperlink), { + name: "formHasPasswordForgottenHyperlink", + }), + rule(type("form"), score(formHasAlreadySignedUpHyperlink), { + name: "formHasAlreadySignedUpHyperlink", + }), + // Check labels + rule(type("form"), score(closestElementIsEmailLabelLike), { + name: "closestElementIsEmailLabelLike", + }), + // Check checkboxes + rule(type("form"), score(formHasRememberMeCheckbox), { + name: "formHasRememberMeCheckbox", + }), + rule(type("form"), score(formHasSubcriptionCheckbox), { + name: "formHasSubcriptionCheckbox", + }), + // Check header + rule(type("form"), score(closestHeaderMatchesRegisterRegex), { + name: "closestHeaderMatchesRegisterRegex", + }), + rule(type("form"), score(closestHeaderMatchesLoginRegex), { + name: "closestHeaderMatchesLoginRegex", + }), + rule(type("form"), score(closestHeaderMatchesSubscriptionRegex), { + name: "closestHeaderMatchesSubscriptionRegex", + }), + // Check doc title + rule(type("form"), score(docTitleMatchesRegisterRegex), { + name: "docTitleMatchesRegisterRegex", + }), + rule(type("form"), score(docTitleMatchesEditProfileRegex), { + name: "docTitleMatchesEditProfileRegex", + }), + rule(type("form"), out("form")), + ], + coeffs, + biases + ); + return rules; +} + +/** + * --- END OF RULESET --- + */ + +export const SignUpFormRuleset = { + type: "form", + rules: createRuleset([...coefficients.form], biases), +}; diff --git a/toolkit/components/passwordmgr/components.conf b/toolkit/components/passwordmgr/components.conf new file mode 100644 index 0000000000..9be23b98f5 --- /dev/null +++ b/toolkit/components/passwordmgr/components.conf @@ -0,0 +1,86 @@ +# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*- +# vim: set filetype=python: +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +Classes = [ + { + 'js_name': 'logins', + 'cid': '{cb9e0de8-3598-4ed7-857b-827f011ad5d8}', + 'contract_ids': ['@mozilla.org/login-manager;1'], + 'interfaces': ['nsILoginManager'], + 'esModule': 'resource://gre/modules/LoginManager.sys.mjs', + 'constructor': 'LoginManager', + }, + { + 'cid': '{749e62f4-60ae-4569-a8a2-de78b649660e}', + 'contract_ids': ['@mozilla.org/passwordmanager/authpromptfactory;1'], + 'esModule': 'resource://gre/modules/LoginManagerAuthPrompter.sys.mjs', + 'constructor': 'LoginManagerAuthPromptFactory', + }, + { + 'cid': '{2bdac17c-53f1-4896-a521-682ccdeef3a8}', + 'contract_ids': ['@mozilla.org/login-manager/autocompletesearch;1'], + 'esModule': 'resource://gre/modules/LoginAutoComplete.sys.mjs', + 'constructor': 'LoginAutoComplete', + }, + { + 'cid': '{8aa66d77-1bbb-45a6-991e-b8f47751c291}', + 'contract_ids': ['@mozilla.org/login-manager/authprompter;1'], + 'esModule': 'resource://gre/modules/LoginManagerAuthPrompter.sys.mjs', + 'constructor': 'LoginManagerAuthPrompter', + }, + { + 'cid': '{0f2f347c-1e4f-40cc-8efd-792dea70a85e}', + 'contract_ids': ['@mozilla.org/login-manager/loginInfo;1'], + 'esModule': 'resource://gre/modules/LoginInfo.sys.mjs', + 'constructor': 'nsLoginInfo', + }, + { + 'cid': '{dc6c2976-0f73-4f1f-b9ff-3d72b4e28309}', + 'contract_ids': ['@mozilla.org/login-manager/crypto/SDR;1'], + 'esModule': 'resource://gre/modules/crypto-SDR.sys.mjs', + 'constructor': 'LoginManagerCrypto_SDR', + }, +] + +if buildconfig.substs['OS_TARGET'] == 'Android': + Classes += [ + { + 'cid': '{337f317f-f713-452a-962d-db831c785fec}', + 'contract_ids': [ + '@mozilla.org/login-manager/storage/geckoview;1', + '@mozilla.org/login-manager/storage/default;1', + ], + 'esModule': 'resource://gre/modules/storage-geckoview.sys.mjs', + 'constructor': 'LoginManagerStorage_geckoview', + }, + ] +else: + Classes += [ + { + 'cid': '{c00c432d-a0c9-46d7-bef6-9c45b4d07341}', + 'contract_ids': [ + '@mozilla.org/login-manager/storage/json;1', + '@mozilla.org/login-manager/storage/default;1', + ], + 'esModule': 'resource://gre/modules/storage-json.sys.mjs', + 'constructor': 'LoginManagerStorage_json', + }, + { + 'cid': '{c47ff942-9678-44a5-bc9b-05e0d676c79c}', + 'contract_ids': ['@mozilla.org/login-manager/prompter;1'], + 'esModule': 'resource://gre/modules/LoginManagerPrompter.sys.mjs', + 'constructor': 'LoginManagerPrompter', + }, + { + 'cid': '{dc185a77-ba88-4caa-8f16-465253f7599a}', + 'contract_ids': [ + '@mozilla.org/autocomplete/search;1?name=login-doorhanger-username', + '@mozilla.org/autocomplete/search;1?name=login-doorhanger-password' + ], + 'esModule': 'resource://gre/modules/AutoCompleteSimpleSearch.sys.mjs', + 'constructor': 'AutoCompleteSimpleSearch', + }, + ] diff --git a/toolkit/components/passwordmgr/crypto-SDR.sys.mjs b/toolkit/components/passwordmgr/crypto-SDR.sys.mjs new file mode 100644 index 0000000000..da3ffe9b58 --- /dev/null +++ b/toolkit/components/passwordmgr/crypto-SDR.sys.mjs @@ -0,0 +1,309 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs"; + +const lazy = {}; + +ChromeUtils.defineESModuleGetters(lazy, { + LoginHelper: "resource://gre/modules/LoginHelper.sys.mjs", +}); + +export function LoginManagerCrypto_SDR() { + this.init(); +} + +LoginManagerCrypto_SDR.prototype = { + classID: Components.ID("{dc6c2976-0f73-4f1f-b9ff-3d72b4e28309}"), + QueryInterface: ChromeUtils.generateQI(["nsILoginManagerCrypto"]), + + __decoderRing: null, // nsSecretDecoderRing service + get _decoderRing() { + if (!this.__decoderRing) { + this.__decoderRing = Cc["@mozilla.org/security/sdr;1"].getService( + Ci.nsISecretDecoderRing + ); + } + return this.__decoderRing; + }, + + __utfConverter: null, // UCS2 <--> UTF8 string conversion + get _utfConverter() { + if (!this.__utfConverter) { + this.__utfConverter = Cc[ + "@mozilla.org/intl/scriptableunicodeconverter" + ].createInstance(Ci.nsIScriptableUnicodeConverter); + this.__utfConverter.charset = "UTF-8"; + } + return this.__utfConverter; + }, + + _utfConverterReset() { + this.__utfConverter = null; + }, + + _uiBusy: false, + + init() { + // Check to see if the internal PKCS#11 token has been initialized. + // If not, set a blank password. + let tokenDB = Cc["@mozilla.org/security/pk11tokendb;1"].getService( + Ci.nsIPK11TokenDB + ); + + let token = tokenDB.getInternalKeyToken(); + if (token.needsUserInit) { + this.log("Initializing key3.db with default blank password."); + token.initPassword(""); + } + }, + + /* + * encrypt + * + * Encrypts the specified string, using the SecretDecoderRing. + * + * Returns the encrypted string, or throws an exception if there was a + * problem. + */ + encrypt(plainText) { + let cipherText = null; + + let wasLoggedIn = this.isLoggedIn; + let canceledMP = false; + + this._uiBusy = !wasLoggedIn; + try { + let plainOctet = this._utfConverter.ConvertFromUnicode(plainText); + plainOctet += this._utfConverter.Finish(); + cipherText = this._decoderRing.encryptString(plainOctet); + } catch (e) { + this.log(`Failed to encrypt string with error ${e.name}.`); + // If the user clicks Cancel, we get NS_ERROR_FAILURE. + // (unlike decrypting, which gets NS_ERROR_NOT_AVAILABLE). + if (e.result == Cr.NS_ERROR_FAILURE) { + canceledMP = true; + throw Components.Exception( + "User canceled primary password entry", + Cr.NS_ERROR_ABORT + ); + } else { + throw Components.Exception( + "Couldn't encrypt string", + Cr.NS_ERROR_FAILURE + ); + } + } finally { + this._uiBusy = false; + // If we triggered a primary password prompt, notify observers. + if (!wasLoggedIn && this.isLoggedIn) { + this._notifyObservers("passwordmgr-crypto-login"); + } else if (canceledMP) { + this._notifyObservers("passwordmgr-crypto-loginCanceled"); + } + } + return cipherText; + }, + + /* + * encryptMany + * + * Encrypts the specified strings, using the SecretDecoderRing. + * + * Returns a promise which resolves with the the encrypted strings, + * or throws/rejects with an error if there was a problem. + */ + async encryptMany(plaintexts) { + if (!Array.isArray(plaintexts) || !plaintexts.length) { + throw Components.Exception( + "Need at least one plaintext to encrypt", + Cr.NS_ERROR_INVALID_ARG + ); + } + + let cipherTexts; + + let wasLoggedIn = this.isLoggedIn; + let canceledMP = false; + + this._uiBusy = !wasLoggedIn; + try { + cipherTexts = await this._decoderRing.asyncEncryptStrings(plaintexts); + } catch (e) { + this.log(`Failed to encrypt strings with error ${e.name}.`); + // If the user clicks Cancel, we get NS_ERROR_FAILURE. + // (unlike decrypting, which gets NS_ERROR_NOT_AVAILABLE). + if (e.result == Cr.NS_ERROR_FAILURE) { + canceledMP = true; + throw Components.Exception( + "User canceled primary password entry", + Cr.NS_ERROR_ABORT + ); + } else { + throw Components.Exception( + "Couldn't encrypt strings", + Cr.NS_ERROR_FAILURE + ); + } + } finally { + this._uiBusy = false; + // If we triggered a primary password prompt, notify observers. + if (!wasLoggedIn && this.isLoggedIn) { + this._notifyObservers("passwordmgr-crypto-login"); + } else if (canceledMP) { + this._notifyObservers("passwordmgr-crypto-loginCanceled"); + } + } + return cipherTexts; + }, + + /* + * decrypt + * + * Decrypts the specified string, using the SecretDecoderRing. + * + * Returns the decrypted string, or throws an exception if there was a + * problem. + */ + decrypt(cipherText) { + let plainText = null; + + let wasLoggedIn = this.isLoggedIn; + let canceledMP = false; + + this._uiBusy = !wasLoggedIn; + try { + let plainOctet; + plainOctet = this._decoderRing.decryptString(cipherText); + plainText = this._utfConverter.ConvertToUnicode(plainOctet); + } catch (e) { + this.log( + `Failed to decrypt cipher text of length ${cipherText.length} with error ${e.name}.` + ); + + // In the unlikely event the converter threw, reset it. + this._utfConverterReset(); + + // If the user clicks Cancel, we get NS_ERROR_NOT_AVAILABLE. + // If the cipherText is bad / wrong key, we get NS_ERROR_FAILURE + // Wrong passwords are handled by the decoderRing reprompting; + // we get no notification. + if (e.result == Cr.NS_ERROR_NOT_AVAILABLE) { + canceledMP = true; + throw Components.Exception( + "User canceled primary password entry", + Cr.NS_ERROR_ABORT + ); + } else { + throw Components.Exception( + "Couldn't decrypt string", + Cr.NS_ERROR_FAILURE + ); + } + } finally { + this._uiBusy = false; + // If we triggered a primary password prompt, notify observers. + if (!wasLoggedIn && this.isLoggedIn) { + this._notifyObservers("passwordmgr-crypto-login"); + } else if (canceledMP) { + this._notifyObservers("passwordmgr-crypto-loginCanceled"); + } + } + + return plainText; + }, + + /** + * Decrypts the specified strings, using the SecretDecoderRing. + * + * @resolve {string[]} The decrypted strings. If a string cannot + * be decrypted, the empty string is returned for that instance. + * Callers will need to use decrypt() to determine if the encrypted + * string is invalid or intentionally empty. Throws/reject with + * an error if there was a problem. + */ + async decryptMany(cipherTexts) { + if (!Array.isArray(cipherTexts) || !cipherTexts.length) { + throw Components.Exception( + "Need at least one ciphertext to decrypt", + Cr.NS_ERROR_INVALID_ARG + ); + } + + let plainTexts = []; + + let wasLoggedIn = this.isLoggedIn; + let canceledMP = false; + + this._uiBusy = !wasLoggedIn; + try { + plainTexts = await this._decoderRing.asyncDecryptStrings(cipherTexts); + } catch (e) { + this.log(`Failed to decrypt strings with error ${e.name}.`); + // If the user clicks Cancel, we get NS_ERROR_NOT_AVAILABLE. + // If the cipherText is bad / wrong key, we get NS_ERROR_FAILURE + // Wrong passwords are handled by the decoderRing reprompting; + // we get no notification. + if (e.result == Cr.NS_ERROR_NOT_AVAILABLE) { + canceledMP = true; + throw Components.Exception( + "User canceled primary password entry", + Cr.NS_ERROR_ABORT + ); + } else { + throw Components.Exception( + "Couldn't decrypt strings: " + e.result, + Cr.NS_ERROR_FAILURE + ); + } + } finally { + this._uiBusy = false; + // If we triggered a primary password prompt, notify observers. + if (!wasLoggedIn && this.isLoggedIn) { + this._notifyObservers("passwordmgr-crypto-login"); + } else if (canceledMP) { + this._notifyObservers("passwordmgr-crypto-loginCanceled"); + } + } + return plainTexts; + }, + + /* + * uiBusy + */ + get uiBusy() { + return this._uiBusy; + }, + + /* + * isLoggedIn + */ + get isLoggedIn() { + let tokenDB = Cc["@mozilla.org/security/pk11tokendb;1"].getService( + Ci.nsIPK11TokenDB + ); + let token = tokenDB.getInternalKeyToken(); + return !token.hasPassword || token.isLoggedIn(); + }, + + /* + * defaultEncType + */ + get defaultEncType() { + return Ci.nsILoginManagerCrypto.ENCTYPE_SDR; + }, + + /* + * _notifyObservers + */ + _notifyObservers(topic) { + this.log(`Prompted for a primary password, notifying for ${topic}`); + Services.obs.notifyObservers(null, topic); + }, +}; // end of nsLoginManagerCrypto_SDR implementation + +XPCOMUtils.defineLazyGetter(LoginManagerCrypto_SDR.prototype, "log", () => { + let logger = lazy.LoginHelper.createLogger("Login crypto"); + return logger.log.bind(logger); +}); diff --git a/toolkit/components/passwordmgr/jar.mn b/toolkit/components/passwordmgr/jar.mn new file mode 100644 index 0000000000..89b96a3869 --- /dev/null +++ b/toolkit/components/passwordmgr/jar.mn @@ -0,0 +1,6 @@ +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +toolkit.jar: +% content passwordmgr %content/passwordmgr/ diff --git a/toolkit/components/passwordmgr/moz.build b/toolkit/components/passwordmgr/moz.build new file mode 100644 index 0000000000..537fe23868 --- /dev/null +++ b/toolkit/components/passwordmgr/moz.build @@ -0,0 +1,86 @@ +# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*- +# vim: set filetype=python: +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +if CONFIG["MOZ_BUILD_APP"] == "browser": + DEFINES["MOZ_BUILD_APP_IS_BROWSER"] = True + +MOCHITEST_MANIFESTS += ["test/mochitest/mochitest.ini"] +BROWSER_CHROME_MANIFESTS += ["test/browser/browser.ini"] +XPCSHELL_TESTS_MANIFESTS += ["test/unit/xpcshell.ini"] + +TESTING_JS_MODULES += [ + "test/LoginTestUtils.sys.mjs", +] + +XPIDL_SOURCES += [ + "nsILoginAutoCompleteSearch.idl", + "nsILoginInfo.idl", + "nsILoginManager.idl", + "nsILoginManagerAuthPrompter.idl", + "nsILoginManagerCrypto.idl", + "nsILoginManagerPrompter.idl", + "nsILoginManagerStorage.idl", + "nsILoginMetaInfo.idl", + "nsIPromptInstance.idl", +] + +XPIDL_MODULE = "loginmgr" + +EXTRA_JS_MODULES += [ + "crypto-SDR.sys.mjs", + "FirefoxRelay.sys.mjs", + "FirefoxRelayTelemetry.mjs", + "InsecurePasswordUtils.sys.mjs", + "LoginAutoComplete.sys.mjs", + "LoginFormFactory.sys.mjs", + "LoginHelper.sys.mjs", + "LoginInfo.sys.mjs", + "LoginManager.shared.mjs", + "LoginManager.sys.mjs", + "LoginManagerAuthPrompter.sys.mjs", + "LoginManagerChild.sys.mjs", + "LoginManagerParent.sys.mjs", + "LoginManagerPrompter.sys.mjs", + "LoginRecipes.sys.mjs", + "LoginRelatedRealms.sys.mjs", + "NewPasswordModel.sys.mjs", + "PasswordGenerator.sys.mjs", + "PasswordRulesManager.sys.mjs", + "PasswordRulesParser.sys.mjs", + "SignUpFormRuleset.sys.mjs", + "storage-json.sys.mjs", +] + +if CONFIG["OS_TARGET"] == "Android": + EXTRA_JS_MODULES += [ + "storage-geckoview.sys.mjs", + ] +else: + EXTRA_JS_MODULES += [ + "CSV.sys.mjs", + "LoginCSVImport.sys.mjs", + "LoginExport.sys.mjs", + "LoginStore.sys.mjs", + ] + +if CONFIG["OS_TARGET"] == "WINNT": + EXTRA_JS_MODULES += [ + "OSCrypto_win.sys.mjs", + ] + +if CONFIG["MOZ_BUILD_APP"] == "browser" or CONFIG["MOZ_SUITE"]: + EXTRA_JS_MODULES += [ + "LoginManagerContextMenu.sys.mjs", + ] + +XPCOM_MANIFESTS += [ + "components.conf", +] + +JAR_MANIFESTS += ["jar.mn"] + +with Files("**"): + BUG_COMPONENT = ("Toolkit", "Password Manager") diff --git a/toolkit/components/passwordmgr/nsILoginAutoCompleteSearch.idl b/toolkit/components/passwordmgr/nsILoginAutoCompleteSearch.idl new file mode 100644 index 0000000000..6c0e94b445 --- /dev/null +++ b/toolkit/components/passwordmgr/nsILoginAutoCompleteSearch.idl @@ -0,0 +1,31 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "nsISupports.idl" + +interface nsIAutoCompleteResult; +interface nsIFormAutoCompleteObserver; + +webidl HTMLInputElement; + +[scriptable, uuid(2bdac17c-53f1-4896-a521-682ccdeef3a8)] +interface nsILoginAutoCompleteSearch : nsISupports { + /** + * Generate results for a login field autocomplete menu. + * + * NOTE: This interface is provided for use only by the FormFillController, + * which calls it directly. This isn't really ideal, it should + * probably be callback registered through the FFC. + * NOTE: This API is different than nsIAutoCompleteSearch. + */ + void startSearch(in AString aSearchString, + in nsIAutoCompleteResult aPreviousResult, + in HTMLInputElement aElement, + in nsIFormAutoCompleteObserver aListener); + + /** + * Stop a previously-started search. + */ + void stopSearch(); +}; diff --git a/toolkit/components/passwordmgr/nsILoginInfo.idl b/toolkit/components/passwordmgr/nsILoginInfo.idl new file mode 100644 index 0000000000..030ed3dbdb --- /dev/null +++ b/toolkit/components/passwordmgr/nsILoginInfo.idl @@ -0,0 +1,149 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + + +#include "nsISupports.idl" + +/** + * An object containing information for a login stored by the + * password manager. + */ +[scriptable, uuid(c41b7dff-6b9b-42fe-b78d-113051facb05)] +interface nsILoginInfo : nsISupports { + /** + * A string to display to the user for the origin which includes the httpRealm, + * where applicable. + * e.g. "site.com", "site.com:1234", or "site.com (My Secure Realm)" + */ + readonly attribute AString displayOrigin; + + /** + * The origin the login applies to. + * + * For example, + * "https://site.com", "http://site.com:1234", "ftp://ftp.site.com", + * "moz-proxy://127.0.0.1:8888, "chrome://FirefoxAccounts", "file://". + */ + attribute AString origin; + + /** + * The origin the login applies to, incorrectly called a hostname. + * @deprecated in favor of `origin` + */ + attribute AString hostname; + + /** + * The origin a form-based login was submitted to. + * + * For logins obtained from HTML forms, this field is the origin of the |action| + * attribute from the |form| element. For + * example "http://www.site.com". [Forms with no |action| attribute + * default to submitting to their origin URL, so we store that.] + * + * For logins obtained from a HTTP or FTP protocol authentication, + * this field is NULL. + */ + attribute AString formActionOrigin; + + /** + * The origin a form-based login was submitted to, incorrectly referred to as a URL. + * @deprecated in favor of `formActionOrigin` + */ + attribute AString formSubmitURL; + + /** + * The HTTP Realm a login was requested for. + * + * When an HTTP server sends a 401 result, the WWW-Authenticate + * header includes a realm to identify the "protection space." See + * RFC2617. If the response sent has a missing or blank realm, the + * hostname is used instead. + * + * For logins obtained from HTML forms, this field is NULL. + */ + attribute AString httpRealm; + + /** + * The username for the login. + */ + attribute AString username; + + /** + * The |name| attribute for the username input field. + * + * For logins obtained from a HTTP or FTP protocol authentication, + * this field is an empty string. + * + * @note This attribute is currently saved but not used. + */ + attribute AString usernameField; + + /** + * The password for the login. + */ + attribute AString password; + + /** + * The |name| attribute for the password input field. + * + * For logins obtained from a HTTP or FTP protocol authentication, + * this field is an empty string. + * + * @note This attribute is currently saved but not used. + */ + attribute AString passwordField; + + /** + * Unknown fields this client doesn't know about but will be roundtripped + * for other clients to prevent data loss + */ + attribute AString unknownFields; + + /** + * Initialize a newly created nsLoginInfo object. + * + * The arguments are the fields for the new object. + */ + void init(in AString aOrigin, + in AString aFormActionOrigin, in AString aHttpRealm, + in AString aUsername, in AString aPassword, + [optional] in AString aUsernameField, [optional] in AString aPasswordField); + + /** + * Test for strict equality with another nsILoginInfo object. + * + * @param aLoginInfo + * The other object to test. + */ + boolean equals(in nsILoginInfo aLoginInfo); + + /** + * Test for loose equivalency with another nsILoginInfo object. The + * passwordField and usernameField values are ignored, and the password + * values may be optionally ignored. If one login's formSubmitURL is an + * empty string (but not null), it will be treated as a wildcard. [The + * blank value indicates the login was stored before bug 360493 was fixed.] + * + * @param aLoginInfo + * The other object to test. + * @param ignorePassword + * If true, ignore the password when checking for match. + */ + boolean matches(in nsILoginInfo aLoginInfo, in boolean ignorePassword); + + /** + * Create an identical copy of the login, duplicating all of the login's + * nsILoginInfo and nsILoginMetaInfo properties. + * + * This allows code to be forwards-compatible, when additional properties + * are added to nsILoginMetaInfo (or nsILoginInfo) in the future. + */ + nsILoginInfo clone(); +}; + +%{C++ + +#define NS_LOGININFO_CONTRACTID "@mozilla.org/login-manager/loginInfo;1" + +%} diff --git a/toolkit/components/passwordmgr/nsILoginManager.idl b/toolkit/components/passwordmgr/nsILoginManager.idl new file mode 100644 index 0000000000..69e6521ff5 --- /dev/null +++ b/toolkit/components/passwordmgr/nsILoginManager.idl @@ -0,0 +1,334 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "nsISupports.idl" + +interface nsILoginInfo; +interface nsIPropertyBag; + +[scriptable, uuid(43429075-ede6-41eb-ac69-a8cd4376b041)] +interface nsILoginSearchCallback : nsISupports +{ + /** + * Called when a search is complete and the results are ready. + * + * @param aLogins + * Logins found in the search. + */ + void onSearchComplete(in Array<nsILoginInfo> aLogins); +}; + +[scriptable, uuid(38c7f6af-7df9-49c7-b558-2776b24e6cc1)] +interface nsILoginManager : nsISupports { + /** + * This promise is resolved when initialization is complete, and is rejected + * in case initialization failed. This includes the initial loading of the + * login data as well as any migration from previous versions. + * + * Calling any method of nsILoginManager before this promise is resolved + * might trigger the synchronous initialization fallback. + */ + readonly attribute Promise initializationPromise; + + /** + * Store a new login in the login manager. + * + * @param aLogin + * The login to be added. + * @return a clone of the login info with the guid set (even if it was not provided) + * + * Default values for the login's nsILoginMetaInfo properties will be + * created. However, if the caller specifies non-default values, they will + * be used instead. + */ + nsILoginInfo addLogin(in nsILoginInfo aLogin); + + /** + * Like addLogin, but asynchronous. + * + * @param aLogin + * The login to be added. + * @return A promise which resolves with a cloned login with the guid set. + * + * Default values for each login's nsILoginMetaInfo properties will be + * created. However, if the caller specifies non-default values, they will + * be used instead. + */ + Promise addLoginAsync(in nsILoginInfo aLogin); + + /** + * Like addLogin, but asynchronous and for many logins. + * + * @param aLogins + * A JS Array of nsILoginInfos to add. + * @return A promise which resolves with a JS Array of cloned logins with + * the guids set. + * + * Default values for each login's nsILoginMetaInfo properties will be + * created. However, if the caller specifies non-default values, they will + * be used instead. + */ + Promise addLogins(in jsval aLogins); + + /** + * Remove a login from the login manager. + * + * @param aLogin + * The login to be removed. + * + * The specified login must exactly match a stored login. However, the + * values of any nsILoginMetaInfo properties are ignored. + */ + void removeLogin(in nsILoginInfo aLogin); + + /** + * Modify an existing login in the login manager. + * + * @param oldLogin + * The login to be modified. + * @param newLoginData + * The new login values (either a nsILoginInfo or nsIProperyBag) + * + * If newLoginData is a nsILoginInfo, all of the old login's nsILoginInfo + * properties are changed to the values from newLoginData (but the old + * login's nsILoginMetaInfo properties are unmodified). + * + * If newLoginData is a nsIPropertyBag, only the specified properties + * will be changed. The nsILoginMetaInfo properties of oldLogin can be + * changed in this manner. + * + * If the propertybag contains an item named "timesUsedIncrement", the + * login's timesUsed property will be incremented by the item's value. + */ + void modifyLogin(in nsILoginInfo oldLogin, in nsISupports newLoginData); + + /** + * Record that the password of a saved login was used (e.g. submitted or copied). + * + * @param {nsILoginInfo} aLogin + * The login record of the password that was used. + * @param {boolean} aPrivateContextWithoutExplicitConsent + * If the use was in private browsing AND without the user explicitly choosing to save/update. + * Login use metadata will not be updated in this case but it will stil be counted for telemetry. + * @param {AString} aLoginType + * One of "form_login", "form_password", "auth_login", or "prompt_login". + * See saved_login_used in Events.yaml. + * Don't assume that an auth. login is never used in a form and vice-versa. This argument + * indicates the context of how it was used. + * @param {boolean} aFilled + * Whether the login was filled, rather than being typed manually. + * + * If only the username was used, this method shouldn't be called as we don't + * want to double-count the use if both the username and password are copied. + * Copying of the username normally precedes the copying of the password anyways. + */ + void recordPasswordUse(in nsILoginInfo aLogin, in boolean aPrivateContextWithoutExplicitConsent, in AString aLoginType, in boolean aFilled); + + /** + * Remove all stored user facing logins. + * + * This will remove all the logins that a user can access through about:logins. + * This will not remove the FxA Sync key which is stored with the rest of a user's logins + * but is not accessible through about:logins + * + * The browser sanitization feature allows the user to clear any stored + * passwords. This interface allows that to be done without getting each + * login first. + * + */ + void removeAllUserFacingLogins(); + + /** + * Completely remove all logins, including the user's FxA Sync key. + * + */ + void removeAllLogins(); + + /** + * Fetch all logins in the login manager. An array is always returned; + * if there are no logins the array is empty. + * + * @deprecated Use `getAllLoginsAsync` instead. + * + * @return An array of nsILoginInfo objects. + */ + Array<nsILoginInfo> getAllLogins(); + + /** + * Like getAllLogins, but asynchronous. This method is faster when large + * amounts of logins are present since it will handle decryption in one batch. + * + * @return A promise which resolves with a JS Array of nsILoginInfo objects. + */ + Promise getAllLoginsAsync(); + + /** + * Like getAllLoginsAsync, but with a callback returning the search results. + * + * @param {nsILoginSearchCallback} aCallback + * The interface to notify when the search is complete. + * + */ + void getAllLoginsWithCallbackAsync(in nsILoginSearchCallback aCallback); + + /** + * Obtain a list of all origins for which password saving is disabled. + * + * @return An array of origin strings. For example: ["https://www.site.com"]. + */ + Array<AString> getAllDisabledHosts(); + + /** + * Check to see if saving logins has been disabled for an origin. + * + * @param aHost + * The origin to check. For example: "http://foo.com". + */ + boolean getLoginSavingEnabled(in AString aHost); + + /** + * Disable (or enable) storing logins for the specified origin. When + * disabled, the login manager will not prompt to store logins for + * that origin. Existing logins are not affected. + * + * @param aHost + * The origin to set. For example: "http://foo.com". + * @param isEnabled + * Specify if saving logins should be enabled (true) or + * disabled (false) + */ + void setLoginSavingEnabled(in AString aHost, in boolean isEnabled); + + /** + * Search for logins matching the specified criteria. Called when looking + * for logins that might be applicable to a form or authentication request. + * + * @deprecated Use `searchLoginsAsync` instead. + * + * @param aOrigin + * The origin to restrict searches to. For example: "http://www.site.com". + * To find logins for a given nsIURI, you would typically pass in + * its prePath (excluding userPass). + * @param aActionOrigin + * For form logins, this argument should be the origin to which the + * form will be submitted, not the whole URL. + * For HTTP auth. logins, specify null. + * An empty string ("") will match any value (except null). + * @param aHttpRealm + * For HTTP auth. logins, this argument should be the HTTP Realm + * for which the login applies. This is obtained from the + * WWW-Authenticate header. See RFC2617. For form logins, + * specify null. + * An empty string ("") will match any value (except null). + * @return An array of nsILoginInfo objects. + */ + Array<nsILoginInfo> findLogins(in AString aOrigin, in AString aActionOrigin, + in AString aHttpRealm); + + /** + * Search for logins matching the specified criteria, as with + * findLogins(). This interface only returns the number of matching + * logins (and not the logins themselves), which allows a caller to + * check for logins without causing the user to be prompted for a primary + * password to decrypt the logins. + * + * @param aOrigin + * The origin to restrict searches to. Specify an empty string + * to match all origins. A null value will not match any logins, and + * will thus always return a count of 0. + * @param aActionOrigin + * The origin to which a form login will be submitted. To match any + * form login, specify an empty string. To not match any form + * login, specify null. + * @param aHttpRealm + * The HTTP Realm for which the login applies. To match logins for + * any realm, specify an empty string. To not match logins for any + * realm, specify null. + */ + unsigned long countLogins(in AString aOrigin, in AString aActionOrigin, + in AString aHttpRealm); + + /** + * Asynchonously search for logins in the login manager. The Promise always + * resolves to an array; if there are no logins the array is empty. + * + * @param {object} matchData + * The data used to search as a JS object. This does not follow the same + * requirements as findLogins for those fields. Wildcard matches are + * simply not specified. If a `guid` is specified then no other properties + * are used (outside of GeckoView). + * @return A promise resolving to an array of nsILoginInfo objects. + */ + Promise searchLoginsAsync(in jsval matchData); + + /** + * Search for logins in the login manager. An array is always returned; + * if there are no logins the array is empty. + * @deprecated New code should use `searchLoginsAsync`. + * Only autocomplete, prompt, and test code still use this. + * + * @param matchData + * The data used to search. This does not follow the same + * requirements as findLogins for those fields. Wildcard matches are + * simply not specified. If a `guid` is specified then no other properties + * are used (outside of GeckoView). + * @return An array of nsILoginInfo objects. + */ + Array<nsILoginInfo> searchLogins(in nsIPropertyBag matchData); + + /** + * Returns the "sync id" used by Sync to know whether the store is current with + * respect to the sync servers. + * + * Returns null if the data doesn't exist or if the data can't be + * decrypted (including if the primary-password prompt is cancelled). This is + * OK for Sync as it can't even begin syncing if the primary-password is + * locked as the sync encrytion keys are stored in this login manager. + */ + Promise getSyncID(); + + /** + * Sets the "sync id" used by Sync to know whether the store is current with + * respect to the sync servers. May be set to null. + * + * Throws if the data can't be encrypted (including if the primary-password + * prompt is cancelled) + */ + Promise setSyncID(in AString syncID); + + /** + * Returns the timestamp of the last sync as a double (in seconds since Epoch + * rounded to two decimal places), or 0.0 if the data doesn't exist. + */ + Promise getLastSync(); + + /** + * Sets the timestamp of the last sync. + */ + Promise setLastSync(in double timestamp); + + /** + * Ensures that the local sync ID for the engine matches the sync ID for + * the collection on the server. If they don't match, then we set + * the local sync ID to newSyncID and reset the last sync timestamp. + */ + Promise ensureCurrentSyncID(in AString newSyncID); + + /** + * True when a primary password prompt is being displayed. + */ + readonly attribute boolean uiBusy; + + /** + * True when the primary password has already been entered, and so a caller + * can ask for decrypted logins without triggering a prompt. + */ + readonly attribute boolean isLoggedIn; +}; + +%{C++ + +#define NS_LOGINMANAGER_CONTRACTID "@mozilla.org/login-manager;1" + +%} diff --git a/toolkit/components/passwordmgr/nsILoginManagerAuthPrompter.idl b/toolkit/components/passwordmgr/nsILoginManagerAuthPrompter.idl new file mode 100644 index 0000000000..422981a0a3 --- /dev/null +++ b/toolkit/components/passwordmgr/nsILoginManagerAuthPrompter.idl @@ -0,0 +1,44 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + + +#include "nsISupports.idl" + +interface nsILoginInfo; +interface nsIDOMWindow; + +webidl Element; + +[scriptable, uuid(425f73b9-b2db-4e8a-88c5-9ac2512934ce)] +interface nsILoginManagerAuthPrompter : nsISupports { + /** + * Initialize the prompter. Must be called before using other interfaces. + * + * @param aWindow + * The window in which the user is doing some login-related action that's + * resulting in a need to prompt them for something. The prompt + * will be associated with this window (or, if a notification bar + * is being used, topmost opener in some cases). + * + * aWindow can be null if there is no associated window, e.g. in a JSM + * or Sandbox. In this case there will be no checkbox to save the login + * since the window is needed to know if this is a private context. + * + * If this window is a content window, the corresponding window and browser + * elements will be calculated. If this window is a chrome window, the + * corresponding browser element needs to be set using setBrowser. + */ + void init(in nsIDOMWindow aWindow); + + /** + * The browser this prompter is being created for. + * This is required if the init function received a chrome window as argument. + */ + attribute Element browser; +}; +%{C++ + +#define NS_LOGINMANAGERAUTHPROMPTER_CONTRACTID "@mozilla.org/login-manager/authprompter/;1" + +%} diff --git a/toolkit/components/passwordmgr/nsILoginManagerCrypto.idl b/toolkit/components/passwordmgr/nsILoginManagerCrypto.idl new file mode 100644 index 0000000000..936228548a --- /dev/null +++ b/toolkit/components/passwordmgr/nsILoginManagerCrypto.idl @@ -0,0 +1,89 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + + +#include "nsISupports.idl" + +[scriptable, uuid(2030770e-542e-40cd-8061-cd9d4ad4227f)] +interface nsILoginManagerCrypto : nsISupports { + + const unsigned long ENCTYPE_BASE64 = 0; // obsolete + const unsigned long ENCTYPE_SDR = 1; + + /** + * encrypt + * + * @param plainText + * The string to be encrypted. + * + * Encrypts the specified string, returning the ciphertext value. + * + * NOTE: The current implemention of this inferface simply uses NSS/PSM's + * "Secret Decoder Ring" service. It is not recommended for general + * purpose encryption/decryption. + * + * Can throw if the user cancels entry of their primary password. + */ + AString encrypt(in AString plainText); + + /* + * encryptMany + * + * @param plainTexts + * The strings to be encrypted. + * + * Encrypts the specified strings, similar to encrypt, but returning a promise + * which resolves with the the encrypted strings. + */ + Promise encryptMany(in jsval plainTexts); + + /** + * decrypt + * + * @param cipherText + * The string to be decrypted. + * + * Decrypts the specified string, returning the plaintext value. + * + * Can throw if the user cancels entry of their primary password, or if the + * cipherText value can not be successfully decrypted (eg, if it was + * encrypted with some other key). + */ + AString decrypt(in AString cipherText); + + /** + * @param cipherTexts + * The strings to be decrypted. + * + * Decrypts the specified strings, returning the plaintext values. + * + * Can throw if the user cancels entry of their primary password, or if the + * cipherText value can not be successfully decrypted (eg, if it was + * encrypted with some other key). + */ + Promise decryptMany(in jsval cipherTexts); + + /** + * uiBusy + * + * True when a primary password prompt is being displayed. + */ + readonly attribute boolean uiBusy; + + /** + * isLoggedIn + * + * Current login state of the token used for encryption. If the user is + * not logged in, performing a crypto operation will result in a primary + * password prompt. + */ + readonly attribute boolean isLoggedIn; + + /** + * defaultEncType + * + * Default encryption type used by an implementation of this interface. + */ + readonly attribute unsigned long defaultEncType; +}; diff --git a/toolkit/components/passwordmgr/nsILoginManagerPrompter.idl b/toolkit/components/passwordmgr/nsILoginManagerPrompter.idl new file mode 100644 index 0000000000..4f244258c0 --- /dev/null +++ b/toolkit/components/passwordmgr/nsILoginManagerPrompter.idl @@ -0,0 +1,103 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + + +#include "nsISupports.idl" +#include "nsIPromptInstance.idl" + +interface nsILoginInfo; +interface nsIDOMWindow; + +webidl Element; + +[scriptable, uuid(c47ff942-9678-44a5-bc9b-05e0d676c79c)] +interface nsILoginManagerPrompter : nsISupports { + + /** + * Ask the user if they want to save a login (Yes, Never, Not Now) + * + * @param aBrowser + * The browser of the webpage request that triggered the prompt. + * @param aLogin + * The login to be saved. + * @param dismissed + * A boolean value indicating whether the save logins doorhanger should + * be dismissed automatically when shown. + * @param notifySaved + * A boolean value indicating whether the notification should indicate that + * a login has been saved + * @param autoFilledLoginGuid + * A string guid value for the login which was autofilled into the form + * @param possibleValues + * Contains values from anything that we think, but are not sure, might be + * a username or password. Has two properties, 'usernames' and 'passwords'. + */ + nsIPromptInstance promptToSavePassword( + in Element aBrowser, + in nsILoginInfo aLogin, + [optional] in boolean dismissed, + [optional] in boolean notifySaved, + [optional] in AString autoFilledLoginGuid, + [optional] in jsval possibleValues); + + /** + * Ask the user if they want to change a login's password or username. + * If the user consents, modifyLogin() will be called. + * + * @param aBrowser + * The browser of the webpage request that triggered the prompt. + * @param aOldLogin + * The existing login (with the old password). + * @param aNewLogin + * The new login. + * @param dismissed + * A boolean value indicating whether the save logins doorhanger should + * be dismissed automatically when shown. + * @param autoSavedLoginGuid + * A string guid value for the old login to be removed if the changes + * match it to a different login + * @param autoFilledLoginGuid + * A string guid value for the login which was autofilled into the form + * @param possibleValues + * Contains values from anything that we think, but are not sure, might be + * a username or password. Has two properties, 'usernames' and 'passwords'. + */ + nsIPromptInstance promptToChangePassword( + in Element aBrowser, + in nsILoginInfo aOldLogin, + in nsILoginInfo aNewLogin, + [optional] in boolean dismissed, + [optional] in boolean notifySaved, + [optional] in AString autoSavedLoginGuid, + [optional] in AString autoFilledLoginGuid, + [optional] in jsval possibleValues); + + /** + * Ask the user if they want to change the password for one of + * multiple logins, when the caller can't determine exactly which + * login should be changed. If the user consents, modifyLogin() will + * be called. + * + * @param aBrowser + * The browser of the webpage request that triggered the prompt. + * @param logins + * An array of existing logins. + * @param aNewLogin + * The new login. + * + * Note: Because the caller does not know the username of the login + * to be changed, aNewLogin.username and aNewLogin.usernameField + * will be set (using the user's selection) before modifyLogin() + * is called. + */ + nsIPromptInstance promptToChangePasswordWithUsernames( + in Element aBrowser, + in Array<nsILoginInfo> logins, + in nsILoginInfo aNewLogin); +}; +%{C++ + +#define NS_LOGINMANAGERPROMPTER_CONTRACTID "@mozilla.org/login-manager/prompter/;1" + +%} diff --git a/toolkit/components/passwordmgr/nsILoginManagerStorage.idl b/toolkit/components/passwordmgr/nsILoginManagerStorage.idl new file mode 100644 index 0000000000..8792b144ec --- /dev/null +++ b/toolkit/components/passwordmgr/nsILoginManagerStorage.idl @@ -0,0 +1,258 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + + +#include "nsISupports.idl" + +interface nsIFile; +interface nsILoginInfo; +interface nsIPropertyBag; + +/** + * NOTE: This interface is intended to be implemented by modules + * providing storage mechanisms for the login manager. + * Other code should use the login manager's interfaces + * (nsILoginManager), and should not call storage modules + * directly. + */ +[scriptable, uuid(5df81a93-25e6-4b45-a696-089479e15c7d)] +interface nsILoginManagerStorage : nsISupports { + /** + * Initialize the component. + * + * At present, other methods of this interface may be called before the + * returned promise is resolved or rejected. + * + * @return {Promise} + * @resolves When initialization is complete. + * @rejects JavaScript exception. + */ + Promise initialize(); + + /** + * Ensures that all data has been written to disk and all files are closed. + * + * At present, this method is called by regression tests only. Finalization + * on shutdown is done by observers within the component. + * + * @return {Promise} + * @resolves When finalization is complete. + * @rejects JavaScript exception. + */ + Promise terminate(); + + /** + * Store a new login in the storage module. + * + * @param aLogin + * The login to be added. + * @param aPreEncrypted + * Whether the login was already encrypted or not. + * @param aPlaintextUsername + * The plaintext username, if the login was already encrypted. + * @param aPlaintextPassword + * The plaintext password, if the login was already encrypted. + * @return a clone of the login info with the guid set (even if it was not provided). + * + * Default values for the login's nsILoginMetaInfo properties will be + * created. However, if the caller specifies non-default values, they will + * be used instead. + */ + nsILoginInfo addLogin(in nsILoginInfo aLogin, [optional] in boolean aPreEncrypted, [optional] in jsval aPlaintextUsername, [optional] in jsval aPlaintextPassword); + + /** + * Remove a login from the storage module. + * + * @param aLogin + * The login to be removed. + * + * The specified login must exactly match a stored login. However, the + * values of any nsILoginMetaInfo properties are ignored. + */ + void removeLogin(in nsILoginInfo aLogin); + + /** + * Modify an existing login in the storage module. + * + * @param oldLogin + * The login to be modified. + * @param newLoginData + * The new login values (either a nsILoginInfo or nsIProperyBag) + * + * If newLoginData is a nsILoginInfo, all of the old login's nsILoginInfo + * properties are changed to the values from newLoginData (but the old + * login's nsILoginMetaInfo properties are unmodified). + * + * If newLoginData is a nsIPropertyBag, only the specified properties + * will be changed. The nsILoginMetaInfo properties of oldLogin can be + * changed in this manner. + * + * If the propertybag contains an item named "timesUsedIncrement", the + * login's timesUsed property will be incremented by the item's value. + */ + void modifyLogin(in nsILoginInfo oldLogin, in nsISupports newLoginData); + + /** + * Record that the password of a saved login was used (e.g. submitted or copied). + * + * @param nsILoginInfo aLogin + * The login record of the password that was used. + * + * If only the username was used, this method shouldn't be called as we don't + * want to double-count the use if both the username and password are copied. + * Copying of the username normally precedes the copying of the password anyways. + */ + void recordPasswordUse(in nsILoginInfo aLogin); + + /** + * Remove all stored user facing logins. + * + * This will remove all the logins that a user can access through about:logins. + * This will not remove the FxA Sync key which is stored with the rest of a user's logins + * but is not accessible through about:logins + * + * The browser sanitization feature allows the user to clear any stored + * passwords. This interface allows that to be done without getting each + * login first. + * + */ + void removeAllUserFacingLogins(); + + /** + * Completely remove all logins, including the user's FxA key. + * + */ + void removeAllLogins(); + + /** + * Fetch all logins in the login manager. An array is always returned; + * if there are no logins the array is empty. + * + * @deprecated Use `getAllLoginsAsync` instead. + * + * @return An array of nsILoginInfo objects. + */ + Array<nsILoginInfo> getAllLogins(); + + /** + * Fetch all logins in the login manager. An array is always returned; + * if there are no logins the array is empty. + * + * @return An array of nsILoginInfo objects. + */ + Promise getAllLoginsAsync(); + + /** + * Asynchonously search for logins in the login manager. The Promise always + * resolves to an array; if there are no logins the array is empty. + * + * @param {object} matchData + * The data used to search as a JS object. This does not follow the same + * requirements as findLogins for those fields. Wildcard matches are + * simply not specified. + * @return A promise resolving to an array of nsILoginInfo objects. + */ + Promise searchLoginsAsync(in jsval matchData); + + /** + * Search for logins in the login manager. An array is always returned; + * if there are no logins the array is empty. + * + * @deprecated New code should use `searchLoginsAsync`. + * Only autocomplete, prompt, and test code still use this. + * + * @param matchData + * The data used to search. This does not follow the same + * requirements as findLogins for those fields. Wildcard matches are + * simply not specified. + * @return An array of nsILoginInfo objects. + */ + Array<nsILoginInfo> searchLogins(in nsIPropertyBag matchData); + + /** + * Search for logins matching the specified criteria. Called when looking + * for logins that might be applicable to a form or authentication request. + * + * @deprecated Use `searchLoginsAsync` instead. + * + * @param aOrigin + * The origin to restrict searches to. For example: "http://www.site.com". + * @param aActionURL + * For form logins, this argument should be the origin to which the + * form will be submitted. For HTTP auth. logins, specify null. + * @param aHttpRealm + * For protocol logins, this argument should be the HTTP Realm + * for which the login applies. This is obtained from the + * WWW-Authenticate header. See RFC2617. For form logins, + * specify null. + * @return An array of nsILoginInfo objects. + */ + Array<nsILoginInfo> findLogins(in AString aOrigin, in AString aActionOrigin, + in AString aHttpRealm); + + /** + * Search for logins matching the specified criteria, as with + * findLogins(). This interface only returns the number of matching + * logins (and not the logins themselves), which allows a caller to + * check for logins without causing the user to be prompted for a primary + * password to decrypt the logins. + * + * @param aOrigin + * The origin to restrict searches to. Specify an empty string + * to match all origins. A null value will not match any logins, and + * will thus always return a count of 0. + * @param aActionOrigin + * The origin to which a form login will be submitted. To match any + * form login, specify an empty string. To not match any form + * login, specify null. + * @param aHttpRealm + * The HTTP Realm for which the login applies. To match logins for + * any realm, specify an empty string. To not match logins for any + * realm, specify null. + */ + unsigned long countLogins(in AString aOrigin, in AString aActionOrigin, + in AString aHttpRealm); + + /** + * Returns the "sync id" used by Sync to know whether the store is current with + * respect to the sync servers. + * + * Returns null if the data doesn't exist or if the data can't be + * decrypted (including if the primary-password prompt is cancelled). This is + * OK for Sync as it can't even begin syncing if the primary-password is + * locked as the sync encrytion keys are stored in this login manager. + */ + Promise getSyncID(); + + /** + * Sets the "sync id" used by Sync to know whether the store is current with + * respect to the sync servers. May be set to null. + * + * Throws if the data can't be encrypted (including if the primary-password + * prompt is cancelled) + */ + Promise setSyncID(in AString syncID); + + /** + * Returns the timestamp of the last sync as a double (in seconds since Epoch + * rounded to two decimal places), or 0.0 if the data doesn't exist. + */ + Promise getLastSync(); + + /** + * Sets the timestamp of the last sync. + */ + Promise setLastSync(in double timestamp); + + /** + * True when a primary password prompt is being shown. + */ + readonly attribute boolean uiBusy; + + /** + * True when the primary password has already been entered, and so a caller + * can ask for decrypted logins without triggering a prompt. + */ + readonly attribute boolean isLoggedIn; +}; diff --git a/toolkit/components/passwordmgr/nsILoginMetaInfo.idl b/toolkit/components/passwordmgr/nsILoginMetaInfo.idl new file mode 100644 index 0000000000..0d0c3ec0ea --- /dev/null +++ b/toolkit/components/passwordmgr/nsILoginMetaInfo.idl @@ -0,0 +1,54 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + + +#include "nsISupports.idl" + +/** + * An object containing metainfo for a login stored by the login manager. + * + * Code using login manager can generally ignore this interface. When adding + * logins, default value will be created. When modifying logins, these + * properties will be unchanged unless a change is explicitly requested [by + * using modifyLogin() with a nsIPropertyBag]. When deleting a login or + * comparing logins, these properties are ignored. + */ +[scriptable, uuid(20d8eb40-c494-497f-b2a6-aaa32f807ebd)] +interface nsILoginMetaInfo : nsISupports { + /** + * The GUID to uniquely identify the login. This can be any arbitrary + * string, but a format as created by nsIUUIDGenerator is recommended. + * For example, "{d4e1a1f6-5ea0-40ee-bff5-da57982f21cf}" + * + * addLogin will generate a random value unless a value is provided. + * + * addLogin and modifyLogin will throw if the GUID already exists. + */ + attribute AString guid; + + /** + * The time, in Unix Epoch milliseconds, when the login was first created. + */ + attribute unsigned long long timeCreated; + + /** + * The time, in Unix Epoch milliseconds, when the login was last submitted + * in a form or used to begin an HTTP auth session. + */ + attribute unsigned long long timeLastUsed; + + /** + * The time, in Unix Epoch milliseconds, when the login was last modified. + * + * Contrary to what the name may suggest, this attribute takes into account + * not only the password but also the username attribute. + */ + attribute unsigned long long timePasswordChanged; + + /** + * The number of times the login was submitted in a form or used to begin + * an HTTP auth session. + */ + attribute unsigned long timesUsed; +}; diff --git a/toolkit/components/passwordmgr/nsIPromptInstance.idl b/toolkit/components/passwordmgr/nsIPromptInstance.idl new file mode 100644 index 0000000000..04cf5c98cd --- /dev/null +++ b/toolkit/components/passwordmgr/nsIPromptInstance.idl @@ -0,0 +1,17 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + + +#include "nsISupports.idl" + +/** + * An object representing a prompt or doorhanger. + */ +[scriptable, uuid(889842e9-052c-46c9-99f3-f4a426571e38)] +interface nsIPromptInstance : nsISupports { + /** + * Dismiss this prompt (e.g. because it's not relevant anymore). + */ + void dismiss(); +}; diff --git a/toolkit/components/passwordmgr/storage-geckoview.sys.mjs b/toolkit/components/passwordmgr/storage-geckoview.sys.mjs new file mode 100644 index 0000000000..6be2b3ed16 --- /dev/null +++ b/toolkit/components/passwordmgr/storage-geckoview.sys.mjs @@ -0,0 +1,256 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/** + * nsILoginManagerStorage implementation for GeckoView + */ + +import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs"; + +import { LoginManagerStorage_json } from "resource://gre/modules/storage-json.sys.mjs"; + +const lazy = {}; + +ChromeUtils.defineESModuleGetters(lazy, { + LoginHelper: "resource://gre/modules/LoginHelper.sys.mjs", +}); + +XPCOMUtils.defineLazyModuleGetters(lazy, { + GeckoViewAutocomplete: "resource://gre/modules/GeckoViewAutocomplete.jsm", + LoginEntry: "resource://gre/modules/GeckoViewAutocomplete.jsm", +}); + +export class LoginManagerStorage_geckoview extends LoginManagerStorage_json { + get classID() { + return Components.ID("{337f317f-f713-452a-962d-db831c785fec}"); + } + get QueryInterface() { + return ChromeUtils.generateQI(["nsILoginManagerStorage"]); + } + + get _crypto() { + throw Components.Exception("", Cr.NS_ERROR_NOT_IMPLEMENTED); + } + + initialize() { + try { + return Promise.resolve(); + } catch (e) { + this.log("Initialization failed:", e); + throw new Error("Initialization failed"); + } + } + + /** + * Internal method used by regression tests only. It is called before + * replacing this storage module with a new instance. + */ + terminate() {} + + addLogin( + login, + preEncrypted = false, + plaintextUsername = null, + plaintextPassword = null + ) { + throw Components.Exception("", Cr.NS_ERROR_NOT_IMPLEMENTED); + } + + removeLogin(login) { + throw Components.Exception("", Cr.NS_ERROR_NOT_IMPLEMENTED); + } + + modifyLogin(oldLogin, newLoginData) { + throw Components.Exception("", Cr.NS_ERROR_NOT_IMPLEMENTED); + } + + recordPasswordUse(login) { + lazy.GeckoViewAutocomplete.onLoginPasswordUsed( + lazy.LoginEntry.fromLoginInfo(login) + ); + } + + getAllLogins() { + throw Components.Exception("", Cr.NS_ERROR_NOT_IMPLEMENTED); + } + + /** + * Returns an array of all saved logins that can be decrypted. + * + * @resolve {nsILoginInfo[]} + */ + async getAllLoginsAsync() { + return this._getLoginsAsync({}); + } + + async searchLoginsAsync(matchData) { + this.log( + `Searching for matching saved logins for origin: ${matchData.origin}` + ); + return this._getLoginsAsync(matchData); + } + + _baseHostnameFromOrigin(origin) { + if (!origin) { + return null; + } + + let originURI = Services.io.newURI(origin); + try { + return Services.eTLD.getBaseDomain(originURI); + } catch (ex) { + if (ex.result == Cr.NS_ERROR_HOST_IS_IP_ADDRESS) { + // `getBaseDomain` cannot handle IP addresses and `nsIURI` cannot return + // IPv6 hostnames with the square brackets so use `URL.hostname`. + return new URL(origin).hostname; + } else if (ex.result == Cr.NS_ERROR_INSUFFICIENT_DOMAIN_LEVELS) { + return originURI.asciiHost; + } + throw ex; + } + } + + async _getLoginsAsync(matchData) { + let baseHostname = this._baseHostnameFromOrigin(matchData.origin); + + // Query all logins for the eTLD+1 and then filter the logins in _searchLogins + // so that we can handle the logic for scheme upgrades, subdomains, etc. + // Convert from the new shape to one which supports the legacy getters used + // by _searchLogins. + let candidateLogins = await lazy.GeckoViewAutocomplete.fetchLogins( + baseHostname + ).catch(_ => { + // No GV delegate is attached. + }); + + if (!candidateLogins) { + // May be undefined if there is no delegate attached to handle the request. + // Ignore the request. + return []; + } + + let realMatchData = {}; + let options = {}; + + if (matchData.guid) { + // Enforce GUID-based filtering when available, since the origin of the + // login may not match the origin of the form in the case of scheme + // upgrades. + realMatchData = { guid: matchData.guid }; + } else { + for (let [name, value] of Object.entries(matchData)) { + switch (name) { + // Some property names aren't field names but are special options to + // affect the search. + case "acceptDifferentSubdomains": + case "schemeUpgrades": { + options[name] = value; + break; + } + default: { + realMatchData[name] = value; + break; + } + } + } + } + + const [logins] = this._searchLogins( + realMatchData, + options, + candidateLogins.map(this._vanillaLoginToStorageLogin) + ); + return logins; + } + + /** + * Convert a modern decrypted vanilla login object to one expected from logins.json. + * + * The storage login is usually encrypted but not in this case, this aligns + * with the `_decryptLogins` method being a no-op. + * + * @param {object} vanillaLogin using `origin`/`formActionOrigin`/`username` properties. + * @returns {object} a vanilla login for logins.json using + * `hostname`/`formSubmitURL`/`encryptedUsername`. + */ + _vanillaLoginToStorageLogin(vanillaLogin) { + return { + ...vanillaLogin, + hostname: vanillaLogin.origin, + formSubmitURL: vanillaLogin.formActionOrigin, + encryptedUsername: vanillaLogin.username, + encryptedPassword: vanillaLogin.password, + }; + } + + /** + * Use `searchLoginsAsync` instead. + */ + searchLogins(matchData) { + throw Components.Exception("", Cr.NS_ERROR_NOT_IMPLEMENTED); + } + + /** + * Removes all logins from storage. + */ + removeAllLogins() { + throw Components.Exception("", Cr.NS_ERROR_NOT_IMPLEMENTED); + } + + countLogins(origin, formActionOrigin, httpRealm) { + throw Components.Exception("", Cr.NS_ERROR_NOT_IMPLEMENTED); + } + + get uiBusy() { + return false; + } + + get isLoggedIn() { + return true; + } + + /** + * GeckoView will encrypt the login itself. + */ + _encryptLogin(login) { + return login; + } + + /** + * GeckoView logins are already decrypted before this component receives them + * so this method is a no-op for this backend. + * @see _vanillaLoginToStorageLogin + */ + _decryptLogins(logins) { + return logins; + } + + /** + * Sync metadata, which isn't supported by GeckoView. + */ + async getSyncID() { + throw Components.Exception("", Cr.NS_ERROR_NOT_IMPLEMENTED); + } + + async setSyncID(syncID) { + throw Components.Exception("", Cr.NS_ERROR_NOT_IMPLEMENTED); + } + + async getLastSync() { + throw Components.Exception("", Cr.NS_ERROR_NOT_IMPLEMENTED); + } + + async setLastSync(timestamp) { + throw Components.Exception("", Cr.NS_ERROR_NOT_IMPLEMENTED); + } +} + +XPCOMUtils.defineLazyGetter( + LoginManagerStorage_geckoview.prototype, + "log", + () => { + let logger = lazy.LoginHelper.createLogger("Login storage"); + return logger.log.bind(logger); + } +); diff --git a/toolkit/components/passwordmgr/storage-json.sys.mjs b/toolkit/components/passwordmgr/storage-json.sys.mjs new file mode 100644 index 0000000000..2345ed8dc9 --- /dev/null +++ b/toolkit/components/passwordmgr/storage-json.sys.mjs @@ -0,0 +1,879 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/** + * nsILoginManagerStorage implementation for the JSON back-end. + */ + +import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs"; + +const lazy = {}; + +ChromeUtils.defineESModuleGetters(lazy, { + LoginHelper: "resource://gre/modules/LoginHelper.sys.mjs", + LoginStore: "resource://gre/modules/LoginStore.sys.mjs", +}); + +XPCOMUtils.defineLazyModuleGetters(lazy, { + FXA_PWDMGR_HOST: "resource://gre/modules/FxAccountsCommon.js", + FXA_PWDMGR_REALM: "resource://gre/modules/FxAccountsCommon.js", +}); + +export class LoginManagerStorage_json { + constructor() { + this.__crypto = null; // nsILoginManagerCrypto service + this.__decryptedPotentiallyVulnerablePasswords = null; + } + + get classID() { + return Components.ID("{c00c432d-a0c9-46d7-bef6-9c45b4d07341}"); + } + + get QueryInterface() { + return ChromeUtils.generateQI(["nsILoginManagerStorage"]); + } + + get _crypto() { + if (!this.__crypto) { + this.__crypto = Cc["@mozilla.org/login-manager/crypto/SDR;1"].getService( + Ci.nsILoginManagerCrypto + ); + } + return this.__crypto; + } + + get _decryptedPotentiallyVulnerablePasswords() { + if (!this.__decryptedPotentiallyVulnerablePasswords) { + this._store.ensureDataReady(); + this.__decryptedPotentiallyVulnerablePasswords = []; + for (const potentiallyVulnerablePassword of this._store.data + .potentiallyVulnerablePasswords) { + const decryptedPotentiallyVulnerablePassword = this._crypto.decrypt( + potentiallyVulnerablePassword.encryptedPassword + ); + this.__decryptedPotentiallyVulnerablePasswords.push( + decryptedPotentiallyVulnerablePassword + ); + } + } + return this.__decryptedPotentiallyVulnerablePasswords; + } + + initialize() { + try { + // Force initialization of the crypto module. + // See bug 717490 comment 17. + this._crypto; + + let profileDir = Services.dirsvc.get("ProfD", Ci.nsIFile).path; + + // Set the reference to LoginStore synchronously. + let jsonPath = PathUtils.join(profileDir, "logins.json"); + let backupPath = ""; + let loginsBackupEnabled = Services.prefs.getBoolPref( + "signon.backup.enabled" + ); + if (loginsBackupEnabled) { + backupPath = PathUtils.join(profileDir, "logins-backup.json"); + } + this._store = new lazy.LoginStore(jsonPath, backupPath); + + return (async () => { + // Load the data asynchronously. + this.log(`Opening database at ${this._store.path}.`); + await this._store.load(); + })().catch(console.error); + } catch (e) { + this.log(`Initialization failed ${e.name}.`); + throw new Error("Initialization failed"); + } + } + + /** + * Internal method used by regression tests only. It is called before + * replacing this storage module with a new instance. + */ + terminate() { + this._store._saver.disarm(); + return this._store._save(); + } + + /** + * Returns the "sync id" used by Sync to know whether the store is current with + * respect to the sync servers. It is stored encrypted, but only so we + * can detect failure to decrypt (for example, a "reset" of the primary + * password will leave all logins alone, but they will fail to decrypt. We + * also want this metadata to be unavailable in that scenario) + * + * Returns null if the data doesn't exist or if the data can't be + * decrypted (including if the primary-password prompt is cancelled). This is + * OK for Sync as it can't even begin syncing if the primary-password is + * locked as the sync encrytion keys are stored in this login manager. + */ + async getSyncID() { + await this._store.load(); + if (!this._store.data.sync) { + return null; + } + let raw = this._store.data.sync.syncID; + try { + return raw ? this._crypto.decrypt(raw) : null; + } catch (e) { + if (e.result == Cr.NS_ERROR_FAILURE) { + this.log("Could not decrypt the syncID - returning null."); + return null; + } + // any other errors get re-thrown. + throw e; + } + } + + async setSyncID(syncID) { + await this._store.load(); + if (!this._store.data.sync) { + this._store.data.sync = {}; + } + this._store.data.sync.syncID = syncID ? this._crypto.encrypt(syncID) : null; + this._store.saveSoon(); + } + + async getLastSync() { + await this._store.load(); + if (!this._store.data.sync) { + return 0; + } + return this._store.data.sync.lastSync || 0.0; + } + + async setLastSync(timestamp) { + await this._store.load(); + if (!this._store.data.sync) { + this._store.data.sync = {}; + } + this._store.data.sync.lastSync = timestamp; + this._store.saveSoon(); + } + + addLogin( + login, + preEncrypted = false, + plaintextUsername = null, + plaintextPassword = null + ) { + if ( + preEncrypted && + (typeof plaintextUsername != "string" || + typeof plaintextPassword != "string") + ) { + throw new Error( + "plaintextUsername and plaintextPassword are required when preEncrypted is true" + ); + } + + this._store.ensureDataReady(); + + // Throws if there are bogus values. + lazy.LoginHelper.checkLoginValues(login); + + let [encUsername, encPassword, encType, encUnknownFields] = preEncrypted + ? [ + login.username, + login.password, + this._crypto.defaultEncType, + login.unknownFields, + ] + : this._encryptLogin(login); + + // Reset the username and password to keep the same guarantees for preEncrypted + if (preEncrypted) { + login.username = plaintextUsername; + login.password = plaintextPassword; + } + + // Clone the login, so we don't modify the caller's object. + let loginClone = login.clone(); + + // Initialize the nsILoginMetaInfo fields, unless the caller gave us values + loginClone.QueryInterface(Ci.nsILoginMetaInfo); + if (loginClone.guid) { + let guid = loginClone.guid; + if (!this._isGuidUnique(guid)) { + // We have an existing GUID, but it's possible that entry is unable + // to be decrypted - if that's the case we remove the existing one + // and allow this one to be added. + let existing = this._searchLogins({ guid })[0]; + if (this._decryptLogins(existing).length) { + // Existing item is good, so it's an error to try and re-add it. + throw new Error("specified GUID already exists"); + } + // find and remove the existing bad entry. + let foundIndex = this._store.data.logins.findIndex(l => l.guid == guid); + if (foundIndex == -1) { + throw new Error("can't find a matching GUID to remove"); + } + this._store.data.logins.splice(foundIndex, 1); + } + } else { + loginClone.guid = Services.uuid.generateUUID().toString(); + } + + // Set timestamps + let currentTime = Date.now(); + if (!loginClone.timeCreated) { + loginClone.timeCreated = currentTime; + } + if (!loginClone.timeLastUsed) { + loginClone.timeLastUsed = currentTime; + } + if (!loginClone.timePasswordChanged) { + loginClone.timePasswordChanged = currentTime; + } + if (!loginClone.timesUsed) { + loginClone.timesUsed = 1; + } + + this._store.data.logins.push({ + id: this._store.data.nextId++, + hostname: loginClone.origin, + httpRealm: loginClone.httpRealm, + formSubmitURL: loginClone.formActionOrigin, + usernameField: loginClone.usernameField, + passwordField: loginClone.passwordField, + encryptedUsername: encUsername, + encryptedPassword: encPassword, + guid: loginClone.guid, + encType, + timeCreated: loginClone.timeCreated, + timeLastUsed: loginClone.timeLastUsed, + timePasswordChanged: loginClone.timePasswordChanged, + timesUsed: loginClone.timesUsed, + encryptedUnknownFields: encUnknownFields, + }); + this._store.saveSoon(); + + // Send a notification that a login was added. + lazy.LoginHelper.notifyStorageChanged("addLogin", loginClone); + return loginClone; + } + + removeLogin(login) { + this._store.ensureDataReady(); + + let [idToDelete, storedLogin] = this._getIdForLogin(login); + if (!idToDelete) { + throw new Error("No matching logins"); + } + + let foundIndex = this._store.data.logins.findIndex(l => l.id == idToDelete); + if (foundIndex != -1) { + this._store.data.logins.splice(foundIndex, 1); + this._store.saveSoon(); + } + + lazy.LoginHelper.notifyStorageChanged("removeLogin", storedLogin); + } + + modifyLogin(oldLogin, newLoginData) { + this._store.ensureDataReady(); + + let [idToModify, oldStoredLogin] = this._getIdForLogin(oldLogin); + if (!idToModify) { + throw new Error("No matching logins"); + } + + let newLogin = lazy.LoginHelper.buildModifiedLogin( + oldStoredLogin, + newLoginData + ); + + // Check if the new GUID is duplicate. + if ( + newLogin.guid != oldStoredLogin.guid && + !this._isGuidUnique(newLogin.guid) + ) { + throw new Error("specified GUID already exists"); + } + + // Look for an existing entry in case key properties changed. + if (!newLogin.matches(oldLogin, true)) { + let logins = this.findLogins( + newLogin.origin, + newLogin.formActionOrigin, + newLogin.httpRealm + ); + + let matchingLogin = logins.find(login => newLogin.matches(login, true)); + if (matchingLogin) { + throw lazy.LoginHelper.createLoginAlreadyExistsError( + matchingLogin.guid + ); + } + } + + // Get the encrypted value of the username and password. + let [encUsername, encPassword, encType, encUnknownFields] = + this._encryptLogin(newLogin); + + for (let loginItem of this._store.data.logins) { + if (loginItem.id == idToModify) { + loginItem.hostname = newLogin.origin; + loginItem.httpRealm = newLogin.httpRealm; + loginItem.formSubmitURL = newLogin.formActionOrigin; + loginItem.usernameField = newLogin.usernameField; + loginItem.passwordField = newLogin.passwordField; + loginItem.encryptedUsername = encUsername; + loginItem.encryptedPassword = encPassword; + loginItem.guid = newLogin.guid; + loginItem.encType = encType; + loginItem.timeCreated = newLogin.timeCreated; + loginItem.timeLastUsed = newLogin.timeLastUsed; + loginItem.timePasswordChanged = newLogin.timePasswordChanged; + loginItem.timesUsed = newLogin.timesUsed; + loginItem.encryptedUnknownFields = encUnknownFields; + this._store.saveSoon(); + break; + } + } + + lazy.LoginHelper.notifyStorageChanged("modifyLogin", [ + oldStoredLogin, + newLogin, + ]); + } + + recordPasswordUse(login) { + // Update the lastUsed timestamp and increment the use count. + let propBag = Cc["@mozilla.org/hash-property-bag;1"].createInstance( + Ci.nsIWritablePropertyBag + ); + propBag.setProperty("timeLastUsed", Date.now()); + propBag.setProperty("timesUsedIncrement", 1); + this.modifyLogin(login, propBag); + } + + async recordBreachAlertDismissal(loginGUID) { + this._store.ensureDataReady(); + const dismissedBreachAlertsByLoginGUID = + this._store._data.dismissedBreachAlertsByLoginGUID; + + dismissedBreachAlertsByLoginGUID[loginGUID] = { + timeBreachAlertDismissed: new Date().getTime(), + }; + + return this._store.saveSoon(); + } + + getBreachAlertDismissalsByLoginGUID() { + this._store.ensureDataReady(); + return this._store._data.dismissedBreachAlertsByLoginGUID; + } + + /** + * @return {nsILoginInfo[]} + */ + getAllLogins() { + this._store.ensureDataReady(); + + let [logins] = this._searchLogins({}); + + // decrypt entries for caller. + logins = this._decryptLogins(logins); + + this.log(`Returning ${logins.length} logins.`); + return logins; + } + + /** + * Returns an array of nsILoginInfo. If decryption of a login + * fails due to a corrupt entry, the login is not included in + * the resulting array. + * + * @resolve {nsILoginInfo[]} + */ + async getAllLoginsAsync() { + this._store.ensureDataReady(); + + let [logins] = this._searchLogins({}); + if (!logins.length) { + return []; + } + let ciphertexts = logins + .map(l => l.username) + .concat(logins.map(l => l.password)); + let plaintexts = await this._crypto.decryptMany(ciphertexts); + let usernames = plaintexts.slice(0, logins.length); + let passwords = plaintexts.slice(logins.length); + + let result = []; + for (let i = 0; i < logins.length; i++) { + if (!usernames[i] || !passwords[i]) { + // If the username or password is blank it means that decryption may have + // failed during decryptMany but we can't differentiate an empty string + // value from a failure so we attempt to decrypt again and check the + // result. + let login = logins[i]; + try { + this._crypto.decrypt(login.username); + this._crypto.decrypt(login.password); + } catch (e) { + // If decryption failed (corrupt entry?), just skip it. + // Rethrow other errors (like canceling entry of a primary pw) + if (e.result == Cr.NS_ERROR_FAILURE) { + this.log( + `Could not decrypt login: ${ + login.QueryInterface(Ci.nsILoginMetaInfo).guid + }.` + ); + continue; + } + throw e; + } + } + + logins[i].username = usernames[i]; + logins[i].password = passwords[i]; + result.push(logins[i]); + } + + return result; + } + + async searchLoginsAsync(matchData) { + this.log(`Searching for matching logins for origin ${matchData.origin}.`); + let result = this.searchLogins(lazy.LoginHelper.newPropertyBag(matchData)); + // Emulate being async: + return Promise.resolve(result); + } + + /** + * Public wrapper around _searchLogins to convert the nsIPropertyBag to a + * JavaScript object and decrypt the results. + * + * @return {nsILoginInfo[]} which are decrypted. + */ + searchLogins(matchData) { + this._store.ensureDataReady(); + + let realMatchData = {}; + let options = {}; + + matchData.QueryInterface(Ci.nsIPropertyBag2); + if (matchData.hasKey("guid")) { + // Enforce GUID-based filtering when available, since the origin of the + // login may not match the origin of the form in the case of scheme + // upgrades. + realMatchData = { guid: matchData.getProperty("guid") }; + } else { + // Convert nsIPropertyBag to normal JS object. + for (let prop of matchData.enumerator) { + switch (prop.name) { + // Some property names aren't field names but are special options to + // affect the search. + case "acceptDifferentSubdomains": + case "schemeUpgrades": + case "acceptRelatedRealms": + case "relatedRealms": { + options[prop.name] = prop.value; + break; + } + default: { + realMatchData[prop.name] = prop.value; + break; + } + } + } + } + + let [logins] = this._searchLogins(realMatchData, options); + + // Decrypt entries found for the caller. + logins = this._decryptLogins(logins); + + return logins; + } + + /** + * Private method to perform arbitrary searches on any field. Decryption is + * left to the caller. + * + * Returns [logins, ids] for logins that match the arguments, where logins + * is an array of encrypted nsLoginInfo and ids is an array of associated + * ids in the database. + */ + _searchLogins( + matchData, + aOptions = { + schemeUpgrades: false, + acceptDifferentSubdomains: false, + acceptRelatedRealms: false, + relatedRealms: [], + }, + candidateLogins = this._store.data.logins + ) { + if ( + "formActionOrigin" in matchData && + matchData.formActionOrigin === "" && + // Carve an exception out for a unit test in test_legacy_empty_formSubmitURL.js + Object.keys(matchData).length != 1 + ) { + throw new Error( + "Searching with an empty `formActionOrigin` doesn't do a wildcard search" + ); + } + + function match(aLoginItem) { + for (let field in matchData) { + let wantedValue = matchData[field]; + + // Override the storage field name for some fields due to backwards + // compatibility with Sync/storage. + let storageFieldName = field; + switch (field) { + case "formActionOrigin": { + storageFieldName = "formSubmitURL"; + break; + } + case "origin": { + storageFieldName = "hostname"; + break; + } + } + + switch (field) { + case "formActionOrigin": + if (wantedValue != null) { + // Historical compatibility requires this special case + if (aLoginItem.formSubmitURL == "") { + break; + } + if ( + !lazy.LoginHelper.isOriginMatching( + aLoginItem[storageFieldName], + wantedValue, + aOptions + ) + ) { + return false; + } + break; + } + // fall through + case "origin": + if (wantedValue != null) { + // needed for formActionOrigin fall through + if ( + !lazy.LoginHelper.isOriginMatching( + aLoginItem[storageFieldName], + wantedValue, + aOptions + ) + ) { + return false; + } + break; + } + // Normal cases. + // fall through + case "httpRealm": + case "id": + case "usernameField": + case "passwordField": + case "encryptedUsername": + case "encryptedPassword": + case "guid": + case "encType": + case "timeCreated": + case "timeLastUsed": + case "timePasswordChanged": + case "timesUsed": + if (wantedValue == null && aLoginItem[storageFieldName]) { + return false; + } else if (aLoginItem[storageFieldName] != wantedValue) { + return false; + } + break; + // Fail if caller requests an unknown property. + default: + throw new Error("Unexpected field: " + field); + } + } + return true; + } + + let foundLogins = [], + foundIds = []; + for (let loginItem of candidateLogins) { + if (match(loginItem)) { + // Create the new nsLoginInfo object, push to array + let login = Cc["@mozilla.org/login-manager/loginInfo;1"].createInstance( + Ci.nsILoginInfo + ); + login.init( + loginItem.hostname, + loginItem.formSubmitURL, + loginItem.httpRealm, + loginItem.encryptedUsername, + loginItem.encryptedPassword, + loginItem.usernameField, + loginItem.passwordField + ); + // set nsILoginMetaInfo values + login.QueryInterface(Ci.nsILoginMetaInfo); + login.guid = loginItem.guid; + login.timeCreated = loginItem.timeCreated; + login.timeLastUsed = loginItem.timeLastUsed; + login.timePasswordChanged = loginItem.timePasswordChanged; + login.timesUsed = loginItem.timesUsed; + + // Any unknown fields along for the ride + login.unknownFields = loginItem.encryptedUnknownFields; + foundLogins.push(login); + foundIds.push(loginItem.id); + } + } + + this.log( + `Returning ${foundLogins.length} logins for specified origin with options ${aOptions}` + ); + return [foundLogins, foundIds]; + } + + /** + * Removes all logins from local storage, including FxA Sync key. + * + * NOTE: You probably want removeAllUserFacingLogins instead of this function. + * + */ + removeAllLogins() { + this._store.ensureDataReady(); + this._store.data.logins = []; + this._store.data.potentiallyVulnerablePasswords = []; + this.__decryptedPotentiallyVulnerablePasswords = null; + this._store.data.dismissedBreachAlertsByLoginGUID = {}; + this._store.saveSoon(); + + lazy.LoginHelper.notifyStorageChanged("removeAllLogins", []); + } + + /** + * Removes all user facing logins from storage. e.g. all logins except the FxA Sync key + * + * If you need to remove the FxA key, use `removeAllLogins` instead + */ + removeAllUserFacingLogins() { + this._store.ensureDataReady(); + this.log("Removing all logins."); + + let [allLogins] = this._searchLogins({}); + + let fxaKey = this._store.data.logins.find( + login => + login.hostname == lazy.FXA_PWDMGR_HOST && + login.httpRealm == lazy.FXA_PWDMGR_REALM + ); + if (fxaKey) { + this._store.data.logins = [fxaKey]; + allLogins = allLogins.filter(item => item != fxaKey); + } else { + this._store.data.logins = []; + } + + this._store.data.potentiallyVulnerablePasswords = []; + this.__decryptedPotentiallyVulnerablePasswords = null; + this._store.data.dismissedBreachAlertsByLoginGUID = {}; + this._store.saveSoon(); + + lazy.LoginHelper.notifyStorageChanged("removeAllLogins", allLogins); + } + + findLogins(origin, formActionOrigin, httpRealm) { + this._store.ensureDataReady(); + + let loginData = { + origin, + formActionOrigin, + httpRealm, + }; + let matchData = {}; + for (let field of ["origin", "formActionOrigin", "httpRealm"]) { + if (loginData[field] != "") { + matchData[field] = loginData[field]; + } + } + let [logins] = this._searchLogins(matchData); + + // Decrypt entries found for the caller. + logins = this._decryptLogins(logins); + + this.log(`Returning ${logins.length} logins.`); + return logins; + } + + countLogins(origin, formActionOrigin, httpRealm) { + this._store.ensureDataReady(); + + let loginData = { + origin, + formActionOrigin, + httpRealm, + }; + let matchData = {}; + for (let field of ["origin", "formActionOrigin", "httpRealm"]) { + if (loginData[field] != "") { + matchData[field] = loginData[field]; + } + } + let [logins] = this._searchLogins(matchData); + + this.log(`Counted ${logins.length} logins.`); + return logins.length; + } + + addPotentiallyVulnerablePassword(login) { + this._store.ensureDataReady(); + // this breached password is already stored + if (this.isPotentiallyVulnerablePassword(login)) { + return; + } + this.__decryptedPotentiallyVulnerablePasswords.push(login.password); + + this._store.data.potentiallyVulnerablePasswords.push({ + encryptedPassword: this._crypto.encrypt(login.password), + }); + this._store.saveSoon(); + } + + isPotentiallyVulnerablePassword(login) { + return this._decryptedPotentiallyVulnerablePasswords.includes( + login.password + ); + } + + clearAllPotentiallyVulnerablePasswords() { + this._store.ensureDataReady(); + if (!this._store.data.potentiallyVulnerablePasswords.length) { + // No need to write to disk + return; + } + this._store.data.potentiallyVulnerablePasswords = []; + this._store.saveSoon(); + this.__decryptedPotentiallyVulnerablePasswords = null; + } + + get uiBusy() { + return this._crypto.uiBusy; + } + + get isLoggedIn() { + return this._crypto.isLoggedIn; + } + + /** + * Returns an array with two items: [id, login]. If the login was not + * found, both items will be null. The returned login contains the actual + * stored login (useful for looking at the actual nsILoginMetaInfo values). + */ + _getIdForLogin(login) { + this._store.ensureDataReady(); + + let matchData = {}; + for (let field of ["origin", "formActionOrigin", "httpRealm"]) { + if (login[field] != "") { + matchData[field] = login[field]; + } + } + let [logins, ids] = this._searchLogins(matchData); + + let id = null; + let foundLogin = null; + + // The specified login isn't encrypted, so we need to ensure + // the logins we're comparing with are decrypted. We decrypt one entry + // at a time, lest _decryptLogins return fewer entries and screw up + // indices between the two. + for (let i = 0; i < logins.length; i++) { + let [decryptedLogin] = this._decryptLogins([logins[i]]); + + if (!decryptedLogin || !decryptedLogin.equals(login)) { + continue; + } + + // We've found a match, set id and break + foundLogin = decryptedLogin; + id = ids[i]; + break; + } + + return [id, foundLogin]; + } + + /** + * Checks to see if the specified GUID already exists. + */ + _isGuidUnique(guid) { + this._store.ensureDataReady(); + + return this._store.data.logins.every(l => l.guid != guid); + } + + /** + * Returns the encrypted username, password, and encrypton type for the specified + * login. Can throw if the user cancels a primary password entry. + */ + _encryptLogin(login) { + let encUsername = this._crypto.encrypt(login.username); + let encPassword = this._crypto.encrypt(login.password); + + // Unknown fields should be encrypted since we can't know whether new fields + // from other clients will contain sensitive data or not + let encUnknownFields = null; + if (login.unknownFields) { + encUnknownFields = this._crypto.encrypt(login.unknownFields); + } + let encType = this._crypto.defaultEncType; + + return [encUsername, encPassword, encType, encUnknownFields]; + } + + /** + * Decrypts username and password fields in the provided array of + * logins. + * + * The entries specified by the array will be decrypted, if possible. + * An array of successfully decrypted logins will be returned. The return + * value should be given to external callers (since still-encrypted + * entries are useless), whereas internal callers generally don't want + * to lose unencrypted entries (eg, because the user clicked Cancel + * instead of entering their primary password) + */ + _decryptLogins(logins) { + let result = []; + + for (let login of logins) { + try { + login.username = this._crypto.decrypt(login.username); + login.password = this._crypto.decrypt(login.password); + // Verify unknownFields actually has a value + if (login.unknownFields) { + login.unknownFields = this._crypto.decrypt(login.unknownFields); + } + } catch (e) { + // If decryption failed (corrupt entry?), just skip it. + // Rethrow other errors (like canceling entry of a primary pw) + if (e.result == Cr.NS_ERROR_FAILURE) { + continue; + } + throw e; + } + result.push(login); + } + + return result; + } +} + +XPCOMUtils.defineLazyGetter(LoginManagerStorage_json.prototype, "log", () => { + let logger = lazy.LoginHelper.createLogger("Login storage"); + return logger.log.bind(logger); +}); diff --git a/toolkit/components/passwordmgr/test/LoginTestUtils.sys.mjs b/toolkit/components/passwordmgr/test/LoginTestUtils.sys.mjs new file mode 100644 index 0000000000..7a7e3835f0 --- /dev/null +++ b/toolkit/components/passwordmgr/test/LoginTestUtils.sys.mjs @@ -0,0 +1,654 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +/** + * Shared functions generally available for testing login components. + */ + +const lazy = {}; + +ChromeUtils.defineESModuleGetters(lazy, { + RemoteSettings: "resource://services-settings/remote-settings.sys.mjs", +}); + +import { Assert as AssertCls } from "resource://testing-common/Assert.sys.mjs"; + +let Assert = AssertCls; + +import { TestUtils } from "resource://testing-common/TestUtils.sys.mjs"; +import { setTimeout } from "resource://gre/modules/Timer.sys.mjs"; +import { FileTestUtils } from "resource://testing-common/FileTestUtils.sys.mjs"; + +const LoginInfo = Components.Constructor( + "@mozilla.org/login-manager/loginInfo;1", + "nsILoginInfo", + "init" +); + +export const LoginTestUtils = { + setAssertReporter(reporterFunc) { + Assert = new AssertCls(Cu.waiveXrays(reporterFunc)); + }, + + /** + * Forces the storage module to save all data, and the Login Manager service + * to replace the storage module with a newly initialized instance. + */ + async reloadData() { + Services.obs.notifyObservers(null, "passwordmgr-storage-replace"); + await TestUtils.topicObserved("passwordmgr-storage-replace-complete"); + }, + + /** + * Erases all the data stored by the Login Manager service. + */ + clearData() { + Services.logins.removeAllUserFacingLogins(); + for (let origin of Services.logins.getAllDisabledHosts()) { + Services.logins.setLoginSavingEnabled(origin, true); + } + }, + + /** + * Add a new login to the store + */ + async addLogin({ + username, + password, + origin = "https://example.com", + formActionOrigin, + }) { + const login = LoginTestUtils.testData.formLogin({ + origin, + formActionOrigin: formActionOrigin || origin, + username, + password, + }); + return Services.logins.addLoginAsync(login); + }, + + async modifyLogin(oldLogin, newLogin) { + const storageChangedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "modifyLogin" + ); + Services.logins.modifyLogin(oldLogin, newLogin); + await storageChangedPromise; + }, + + resetGeneratedPasswordsCache() { + let { LoginManagerParent } = ChromeUtils.importESModule( + "resource://gre/modules/LoginManagerParent.sys.mjs" + ); + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().clear(); + }, + + /** + * Checks that the currently stored list of nsILoginInfo matches the provided + * array. If no `checkFn` is provided, the comparison uses the "equals" + * method of nsILoginInfo, that does not include nsILoginMetaInfo properties in the test. + */ + checkLogins(expectedLogins, msg = "checkLogins", checkFn = undefined) { + this.assertLoginListsEqual( + Services.logins.getAllLogins(), + expectedLogins, + msg, + checkFn + ); + }, + + /** + * Checks that the two provided arrays of nsILoginInfo have the same length, + * and every login in "expected" is also found in "actual". If no `checkFn` + * is provided, the comparison uses the "equals" method of nsILoginInfo, that + * does not include nsILoginMetaInfo properties in the test. + */ + assertLoginListsEqual( + actual, + expected, + msg = "assertLoginListsEqual", + checkFn = undefined + ) { + Assert.equal(expected.length, actual.length, msg); + Assert.ok( + expected.every(e => + actual.some(a => { + return checkFn ? checkFn(a, e) : a.equals(e); + }) + ), + msg + ); + }, + + /** + * Checks that the two provided arrays of strings contain the same values, + * maybe in a different order, case-sensitively. + */ + assertDisabledHostsEqual(actual, expected) { + Assert.deepEqual(actual.sort(), expected.sort()); + }, + + /** + * Checks whether the given time, expressed as the number of milliseconds + * since January 1, 1970, 00:00:00 UTC, falls within 30 seconds of now. + */ + assertTimeIsAboutNow(timeMs) { + Assert.ok(Math.abs(timeMs - Date.now()) < 30000); + }, +}; + +/** + * This object contains functions that return new instances of nsILoginInfo for + * every call. The returned instances can be compared using their "equals" or + * "matches" methods, or modified for the needs of the specific test being run. + * + * Any modification to the test data requires updating the tests accordingly, in + * particular the search tests. + */ +LoginTestUtils.testData = { + /** + * Returns a new nsILoginInfo for use with form submits. + * + * @param modifications + * Each property of this object replaces the property of the same name + * in the returned nsILoginInfo or nsILoginMetaInfo. + */ + formLogin(modifications) { + let loginInfo = new LoginInfo( + "http://www3.example.com", + "http://www.example.com", + null, + "the username", + "the password", + "form_field_username", + "form_field_password" + ); + loginInfo.QueryInterface(Ci.nsILoginMetaInfo); + if (modifications) { + for (let [name, value] of Object.entries(modifications)) { + if (name == "httpRealm" && value !== null) { + throw new Error("httpRealm not supported for form logins"); + } + loginInfo[name] = value; + } + } + return loginInfo; + }, + + /** + * Returns a new nsILoginInfo for use with HTTP authentication. + * + * @param modifications + * Each property of this object replaces the property of the same name + * in the returned nsILoginInfo or nsILoginMetaInfo. + */ + authLogin(modifications) { + let loginInfo = new LoginInfo( + "http://www.example.org", + null, + "The HTTP Realm", + "the username", + "the password" + ); + loginInfo.QueryInterface(Ci.nsILoginMetaInfo); + if (modifications) { + for (let [name, value] of Object.entries(modifications)) { + if (name == "formActionOrigin" && value !== null) { + throw new Error( + "formActionOrigin not supported for HTTP auth. logins" + ); + } + loginInfo[name] = value; + } + } + return loginInfo; + }, + + /** + * Returns an array of typical nsILoginInfo that could be stored in the + * database. + */ + loginList() { + return [ + // --- Examples of form logins (subdomains of example.com) --- + + // Simple form login with named fields for username and password. + new LoginInfo( + "http://www.example.com", + "http://www.example.com", + null, + "the username", + "the password for www.example.com", + "form_field_username", + "form_field_password" + ), + + // Different schemes are treated as completely different sites. + new LoginInfo( + "https://www.example.com", + "https://www.example.com", + null, + "the username", + "the password for https", + "form_field_username", + "form_field_password" + ), + + // Subdomains can be treated as completely different sites depending on the UI invoked. + new LoginInfo( + "https://example.com", + "https://example.com", + null, + "the username", + "the password for example.com", + "form_field_username", + "form_field_password" + ), + + // Forms found on the same origin, but with different origins in the + // "action" attribute, are handled independently. + new LoginInfo( + "http://www3.example.com", + "http://www.example.com", + null, + "the username", + "the password", + "form_field_username", + "form_field_password" + ), + new LoginInfo( + "http://www3.example.com", + "https://www.example.com", + null, + "the username", + "the password", + "form_field_username", + "form_field_password" + ), + new LoginInfo( + "http://www3.example.com", + "http://example.com", + null, + "the username", + "the password", + "form_field_username", + "form_field_password" + ), + + // It is not possible to store multiple passwords for the same username, + // however multiple passwords can be stored when the usernames differ. + // An empty username is a valid case and different from the others. + new LoginInfo( + "http://www4.example.com", + "http://www4.example.com", + null, + "username one", + "password one", + "form_field_username", + "form_field_password" + ), + new LoginInfo( + "http://www4.example.com", + "http://www4.example.com", + null, + "username two", + "password two", + "form_field_username", + "form_field_password" + ), + new LoginInfo( + "http://www4.example.com", + "http://www4.example.com", + null, + "", + "password three", + "form_field_username", + "form_field_password" + ), + + // Username and passwords fields in forms may have no "name" attribute. + new LoginInfo( + "http://www5.example.com", + "http://www5.example.com", + null, + "multi username", + "multi password", + "", + "" + ), + + // Forms with PIN-type authentication will typically have no username. + new LoginInfo( + "http://www6.example.com", + "http://www6.example.com", + null, + "", + "12345", + "", + "form_field_password" + ), + + // Logins can be saved on non-default ports + new LoginInfo( + "https://www7.example.com:8080", + "https://www7.example.com:8080", + null, + "8080_username", + "8080_pass" + ), + + new LoginInfo( + "https://www7.example.com:8080", + null, + "My dev server", + "8080_username2", + "8080_pass2" + ), + + // --- Examples of authentication logins (subdomains of example.org) --- + + // Simple HTTP authentication login. + new LoginInfo( + "http://www.example.org", + null, + "The HTTP Realm", + "the username", + "the password" + ), + + // Simple FTP authentication login. + new LoginInfo( + "ftp://ftp.example.org", + null, + "ftp://ftp.example.org", + "the username", + "the password" + ), + + // Multiple HTTP authentication logins can be stored for different realms. + new LoginInfo( + "http://www2.example.org", + null, + "The HTTP Realm", + "the username", + "the password" + ), + new LoginInfo( + "http://www2.example.org", + null, + "The HTTP Realm Other", + "the username other", + "the password other" + ), + + // --- Both form and authentication logins (example.net) --- + + new LoginInfo( + "http://example.net", + "http://example.net", + null, + "the username", + "the password", + "form_field_username", + "form_field_password" + ), + new LoginInfo( + "http://example.net", + "http://www.example.net", + null, + "the username", + "the password", + "form_field_username", + "form_field_password" + ), + new LoginInfo( + "http://example.net", + "http://www.example.net", + null, + "username two", + "the password", + "form_field_username", + "form_field_password" + ), + new LoginInfo( + "http://example.net", + null, + "The HTTP Realm", + "the username", + "the password" + ), + new LoginInfo( + "http://example.net", + null, + "The HTTP Realm Other", + "username two", + "the password" + ), + new LoginInfo( + "ftp://example.net", + null, + "ftp://example.net", + "the username", + "the password" + ), + + // --- Examples of logins added by extensions (chrome scheme) --- + + new LoginInfo( + "chrome://example_extension", + null, + "Example Login One", + "the username", + "the password one", + "", + "" + ), + new LoginInfo( + "chrome://example_extension", + null, + "Example Login Two", + "the username", + "the password two" + ), + + // -- file:// URIs throw accessing nsIURI.host + + new LoginInfo( + "file://", + "file://", + null, + "file: username", + "file: password" + ), + + // -- javascript: URIs throw accessing nsIURI.host. + // They should only be used for the formActionOrigin. + new LoginInfo( + "https://js.example.com", + "javascript:", + null, + "javascript: username", + "javascript: password" + ), + ]; + }, +}; + +LoginTestUtils.recipes = { + getRecipeParent() { + let { LoginManagerParent } = ChromeUtils.importESModule( + "resource://gre/modules/LoginManagerParent.sys.mjs" + ); + if (!LoginManagerParent.recipeParentPromise) { + return null; + } + return LoginManagerParent.recipeParentPromise.then(recipeParent => { + return recipeParent; + }); + }, +}; + +LoginTestUtils.primaryPassword = { + primaryPassword: "omgsecret!", + + _set(enable, stayLoggedIn) { + let oldPW, newPW; + if (enable) { + oldPW = ""; + newPW = this.primaryPassword; + } else { + oldPW = this.primaryPassword; + newPW = ""; + } + try { + let pk11db = Cc["@mozilla.org/security/pk11tokendb;1"].getService( + Ci.nsIPK11TokenDB + ); + let token = pk11db.getInternalKeyToken(); + if (token.needsUserInit) { + dump("MP initialized to " + newPW + "\n"); + token.initPassword(newPW); + } else { + token.checkPassword(oldPW); + dump("MP change from " + oldPW + " to " + newPW + "\n"); + token.changePassword(oldPW, newPW); + if (!stayLoggedIn) { + token.logoutSimple(); + } + } + } catch (e) { + dump( + "Tried to enable an already enabled primary password or disable an already disabled primary password!" + ); + } + }, + + enable(stayLoggedIn = false) { + this._set(true, stayLoggedIn); + }, + + disable() { + this._set(false); + }, +}; + +/** + * Utilities related to interacting with login fields in content. + */ +LoginTestUtils.loginField = { + checkPasswordMasked(field, expected, msg) { + let { editor } = field; + let valueLength = field.value.length; + Assert.equal( + editor.autoMaskingEnabled, + expected, + `Check autoMaskingEnabled: ${msg}` + ); + Assert.equal(editor.unmaskedStart, 0, `unmaskedStart is 0: ${msg}`); + if (expected) { + Assert.equal(editor.unmaskedEnd, 0, `Password is masked: ${msg}`); + } else { + Assert.equal( + editor.unmaskedEnd, + valueLength, + `Unmasked to the end: ${msg}` + ); + } + }, +}; + +LoginTestUtils.generation = { + LENGTH: 15, + REGEX: /^[a-km-np-zA-HJ-NP-Z2-9-~!@#$%^&*_+=)}:;"'>,.?\]]{15}$/, +}; + +LoginTestUtils.telemetry = { + async waitForEventCount( + count, + process = "content", + category = "pwmgr", + method = undefined + ) { + // The test is already unreliable (see bug 1627419 and 1605494) and relied on + // the implicit 100ms initial timer of waitForCondition that bug 1596165 removed. + await new Promise(resolve => setTimeout(resolve, 100)); + let events = await TestUtils.waitForCondition(() => { + let events = Services.telemetry.snapshotEvents( + Ci.nsITelemetry.DATASET_PRERELEASE_CHANNELS, + false + )[process]; + + if (!events) { + return null; + } + + events = events.filter( + e => e[1] == category && (!method || e[2] == method) + ); + dump(`Waiting for ${count} events, got ${events.length}\n`); + return events.length == count ? events : null; + }, "waiting for telemetry event count of: " + count); + Assert.equal(events.length, count, "waiting for telemetry event count"); + return events; + }, +}; + +LoginTestUtils.file = { + /** + * Given an array of strings it creates a temporary CSV file that has them as content. + * + * @param {string[]} csvLines + * The lines that make up the CSV file. + * @param {string} extension + * Optional parameter. Either 'csv' or 'tsv'. Default is 'csv'. + * @returns {window.File} The File to the CSV file that was created. + */ + async setupCsvFileWithLines(csvLines, extension = "csv") { + let tmpFile = FileTestUtils.getTempFile(`firefox_logins.${extension}`); + await IOUtils.writeUTF8(tmpFile.path, csvLines.join("\r\n")); + return tmpFile; + }, +}; + +LoginTestUtils.remoteSettings = { + relatedRealmsCollection: "websites-with-shared-credential-backends", + async setupWebsitesWithSharedCredentials( + relatedRealms = [["other-example.com", "example.com", "example.co.uk"]] + ) { + let db = lazy.RemoteSettings(this.relatedRealmsCollection).db; + await db.clear(); + await db.create({ + id: "some-fake-ID-abc", + relatedRealms, + }); + await db.importChanges({}, Date.now()); + }, + async cleanWebsitesWithSharedCredentials() { + let db = lazy.RemoteSettings(this.relatedRealmsCollection).db; + await db.importChanges({}, Date.now(), [], { clear: true }); + }, + improvedPasswordRulesCollection: "password-rules", + + async setupImprovedPasswordRules( + origin = "example.com", + rules = "minlength: 6; maxlength: 16; required: lower, upper; required: digit; required: [&<>'\"!#$%(),:;=?[^`{|}~]]; max-consecutive: 2;" + ) { + let db = lazy.RemoteSettings(this.improvedPasswordRulesCollection).db; + await db.clear(); + await db.create({ + id: "some-fake-ID", + Domain: origin, + "password-rules": rules, + }); + await db.create({ + id: "some-fake-ID-2", + Domain: origin, + "password-rules": rules, + }); + await db.importChanges({}, Date.now()); + }, + async cleanImprovedPasswordRules() { + let db = lazy.RemoteSettings(this.improvedPasswordRulesCollection).db; + await db.importChanges({}, Date.now(), [], { clear: true }); + }, +}; diff --git a/toolkit/components/passwordmgr/test/authenticate.sjs b/toolkit/components/passwordmgr/test/authenticate.sjs new file mode 100644 index 0000000000..5d73dfef4c --- /dev/null +++ b/toolkit/components/passwordmgr/test/authenticate.sjs @@ -0,0 +1,229 @@ +"use strict"; + +function handleRequest(request, response) { + try { + reallyHandleRequest(request, response); + } catch (e) { + response.setStatusLine("1.0", 200, "AlmostOK"); + response.write("Error handling request: " + e); + } +} + +function reallyHandleRequest(request, response) { + let match; + let requestAuth = true, + requestProxyAuth = true; + + // Allow the caller to drive how authentication is processed via the query. + // Eg, http://localhost:8888/authenticate.sjs?user=foo&realm=bar + // The extra ? allows the user/pass/realm checks to succeed if the name is + // at the beginning of the query string. + let query = "?" + request.queryString; + + let expected_user = "", + expected_pass = "", + realm = "mochitest"; + let proxy_expected_user = "", + proxy_expected_pass = "", + proxy_realm = "mochi-proxy"; + let huge = false, + plugin = false, + anonymous = false, + formauth = false; + let authHeaderCount = 1; + // user=xxx + match = /[^_]user=([^&]*)/.exec(query); + if (match) { + expected_user = match[1]; + } + + // pass=xxx + match = /[^_]pass=([^&]*)/.exec(query); + if (match) { + expected_pass = match[1]; + } + + // realm=xxx + match = /[^_]realm=([^&]*)/.exec(query); + if (match) { + realm = match[1]; + } + + // proxy_user=xxx + match = /proxy_user=([^&]*)/.exec(query); + if (match) { + proxy_expected_user = match[1]; + } + + // proxy_pass=xxx + match = /proxy_pass=([^&]*)/.exec(query); + if (match) { + proxy_expected_pass = match[1]; + } + + // proxy_realm=xxx + match = /proxy_realm=([^&]*)/.exec(query); + if (match) { + proxy_realm = match[1]; + } + + // huge=1 + match = /huge=1/.exec(query); + if (match) { + huge = true; + } + + // plugin=1 + match = /plugin=1/.exec(query); + if (match) { + plugin = true; + } + + // multiple=1 + match = /multiple=([^&]*)/.exec(query); + if (match) { + authHeaderCount = match[1] + 0; + } + + // anonymous=1 + match = /anonymous=1/.exec(query); + if (match) { + anonymous = true; + } + + // formauth=1 + match = /formauth=1/.exec(query); + if (match) { + formauth = true; + } + + // Look for an authentication header, if any, in the request. + // + // EG: Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ== + // + // This test only supports Basic auth. The value sent by the client is + // "username:password", obscured with base64 encoding. + + let actual_user = "", + actual_pass = "", + authHeader, + authPresent = false; + if (request.hasHeader("Authorization")) { + authPresent = true; + authHeader = request.getHeader("Authorization"); + match = /Basic (.+)/.exec(authHeader); + if (match.length != 2) { + throw new Error("Couldn't parse auth header: " + authHeader); + } + + let userpass = atob(match[1]); + match = /(.*):(.*)/.exec(userpass); + if (match.length != 3) { + throw new Error("Couldn't decode auth header: " + userpass); + } + actual_user = match[1]; + actual_pass = match[2]; + } + + let proxy_actual_user = "", + proxy_actual_pass = ""; + if (request.hasHeader("Proxy-Authorization")) { + authHeader = request.getHeader("Proxy-Authorization"); + match = /Basic (.+)/.exec(authHeader); + if (match.length != 2) { + throw new Error("Couldn't parse auth header: " + authHeader); + } + + let userpass = atob(match[1]); + match = /(.*):(.*)/.exec(userpass); + if (match.length != 3) { + throw new Error("Couldn't decode auth header: " + userpass); + } + proxy_actual_user = match[1]; + proxy_actual_pass = match[2]; + } + + // Don't request authentication if the credentials we got were what we + // expected. + if (expected_user == actual_user && expected_pass == actual_pass) { + requestAuth = false; + } + if ( + proxy_expected_user == proxy_actual_user && + proxy_expected_pass == proxy_actual_pass + ) { + requestProxyAuth = false; + } + + if (anonymous) { + if (authPresent) { + response.setStatusLine( + "1.0", + 400, + "Unexpected authorization header found" + ); + } else { + response.setStatusLine("1.0", 200, "Authorization header not found"); + } + } else if (requestProxyAuth) { + response.setStatusLine("1.0", 407, "Proxy authentication required"); + for (let i = 0; i < authHeaderCount; ++i) { + response.setHeader( + "Proxy-Authenticate", + 'basic realm="' + proxy_realm + '"', + true + ); + } + } else if (requestAuth) { + if (formauth && authPresent) { + response.setStatusLine("1.0", 403, "Form authentication required"); + } else { + response.setStatusLine("1.0", 401, "Authentication required"); + } + for (let i = 0; i < authHeaderCount; ++i) { + response.setHeader( + "WWW-Authenticate", + 'basic realm="' + realm + '"', + true + ); + } + } else { + response.setStatusLine("1.0", 200, "OK"); + } + + response.setHeader("Content-Type", "application/xhtml+xml", false); + response.write("<html xmlns='http://www.w3.org/1999/xhtml'>"); + response.write( + "<p>Login: <span id='ok'>" + + (requestAuth ? "FAIL" : "PASS") + + "</span></p>\n" + ); + response.write( + "<p>Proxy: <span id='proxy'>" + + (requestProxyAuth ? "FAIL" : "PASS") + + "</span></p>\n" + ); + response.write("<p>Auth: <span id='auth'>" + authHeader + "</span></p>\n"); + response.write("<p>User: <span id='user'>" + actual_user + "</span></p>\n"); + response.write("<p>Pass: <span id='pass'>" + actual_pass + "</span></p>\n"); + + if (huge) { + response.write("<div style='display: none'>"); + for (let i = 0; i < 100000; i++) { + response.write("123456789\n"); + } + response.write("</div>"); + response.write( + "<span id='footnote'>This is a footnote after the huge content fill</span>" + ); + } + + if (plugin) { + response.write( + "<embed id='embedtest' style='width: 400px; height: 100px;' " + + "type='application/x-test'></embed>\n" + ); + } + + response.write("</html>"); +} diff --git a/toolkit/components/passwordmgr/test/blank.html b/toolkit/components/passwordmgr/test/blank.html new file mode 100644 index 0000000000..81ddc2235b --- /dev/null +++ b/toolkit/components/passwordmgr/test/blank.html @@ -0,0 +1,8 @@ +<!DOCTYPE html> +<html> + <head> + <meta charset="utf-8"> + </head> + <body> + </body> +</html> diff --git a/toolkit/components/passwordmgr/test/browser/.eslintrc.js b/toolkit/components/passwordmgr/test/browser/.eslintrc.js new file mode 100644 index 0000000000..000a981cbe --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/.eslintrc.js @@ -0,0 +1,7 @@ +"use strict"; + +module.exports = { + rules: { + "no-var": "off", + }, +}; diff --git a/toolkit/components/passwordmgr/test/browser/authenticate.sjs b/toolkit/components/passwordmgr/test/browser/authenticate.sjs new file mode 100644 index 0000000000..8f463dda6f --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/authenticate.sjs @@ -0,0 +1,84 @@ +function handleRequest(request, response) { + var match; + var requestAuth = true; + + // Allow the caller to drive how authentication is processed via the query. + // Eg, http://localhost:8888/authenticate.sjs?user=foo&realm=bar + // The extra ? allows the user/pass/realm checks to succeed if the name is + // at the beginning of the query string. + var query = "?" + request.queryString; + + var expected_user = "test", + expected_pass = "testpass", + realm = "mochitest"; + + // user=xxx + match = /[^_]user=([^&]*)/.exec(query); + if (match) { + expected_user = match[1]; + } + + // pass=xxx + match = /[^_]pass=([^&]*)/.exec(query); + if (match) { + expected_pass = match[1]; + } + + // realm=xxx + match = /[^_]realm=([^&]*)/.exec(query); + if (match) { + realm = match[1]; + } + + // Look for an authentication header, if any, in the request. + // + // EG: Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ== + // + // This test only supports Basic auth. The value sent by the client is + // "username:password", obscured with base64 encoding. + + var actual_user = "", + actual_pass = "", + authHeader; + + if (request.hasHeader("Authorization")) { + authHeader = request.getHeader("Authorization"); + match = /Basic (.+)/.exec(authHeader); + if (match.length != 2) { + throw new Error("Couldn't parse auth header: " + authHeader); + } + + var userpass = atob(match[1]); + match = /(.*):(.*)/.exec(userpass); + if (match.length != 3) { + throw new Error("Couldn't decode auth header: " + userpass); + } + actual_user = match[1]; + actual_pass = match[2]; + } + + // Don't request authentication if the credentials we got were what we + // expected. + if (expected_user == actual_user && expected_pass == actual_pass) { + requestAuth = false; + } + + if (requestAuth) { + response.setStatusLine("1.0", 401, "Authentication required"); + response.setHeader("WWW-Authenticate", 'basic realm="' + realm + '"', true); + } else { + response.setStatusLine("1.0", 200, "OK"); + } + + response.setHeader("Content-Type", "application/xhtml+xml", false); + response.write("<html xmlns='http://www.w3.org/1999/xhtml'>"); + response.write( + "<p>Login: <span id='ok'>" + + (requestAuth ? "FAIL" : "PASS") + + "</span></p>\n" + ); + response.write("<p>Auth: <span id='auth'>" + authHeader + "</span></p>\n"); + response.write("<p>User: <span id='user'>" + actual_user + "</span></p>\n"); + response.write("<p>Pass: <span id='pass'>" + actual_pass + "</span></p>\n"); + response.write("</html>"); +} diff --git a/toolkit/components/passwordmgr/test/browser/browser.ini b/toolkit/components/passwordmgr/test/browser/browser.ini new file mode 100644 index 0000000000..ae41ef2c47 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser.ini @@ -0,0 +1,162 @@ +[DEFAULT] +support-files = + ../formsubmit.sjs + authenticate.sjs + empty.html + form_basic.html + form_basic_iframe.html + form_basic_login.html + form_basic_signup.html + form_basic_no_username.html + formless_basic.html + form_multipage.html + form_same_origin_action.html + form_cross_origin_secure_action.html + form_cross_origin_insecure_action.html + form_expanded.html + insecure_test_subframe.html + head.js + multiple_forms.html + ../../../../../browser/components/aboutlogins/tests/browser/head.js + + +[browser_DOMFormHasPassword.js] +[browser_DOMFormHasPossibleUsername.js] +[browser_DOMInputPasswordAdded.js] +skip-if = (os == "linux") || (os == "mac") # Bug 1337606 +[browser_autocomplete_autofocus_with_frame.js] +support-files = + form_autofocus_frame.html +[browser_autocomplete_disabled_readonly_passwordField.js] +support-files = + form_disabled_readonly_passwordField.html +[browser_autocomplete_footer.js] +skip-if = + !debug && os == "linux" && bits == 64 && os_version == "18.04" # Bug 1591126 + os == "win" && os_version == "6.1" # Skip on Azure - frequent failure +[browser_autocomplete_generated_password_private_window.js] +[browser_autocomplete_import.js] +https_first_disabled = true +skip-if = + os == "mac" # Bug 1775902 + os == "win" && !debug # Bug 1775902 +[browser_autocomplete_insecure_warning.js] +[browser_autocomplete_primary_password.js] +[browser_autofill_hidden_document.js] +skip-if = + (os == "win" && os_version == "10.0" && debug) # bug 1530935 + apple_catalina && fission && !debug # high frequency intermittent, Bug 1716486 + +[browser_autofill_http.js] +https_first_disabled = true +skip-if = verify +[browser_autofill_track_filled_logins.js] +[browser_basicAuth_multiTab.js] +skip-if = os == "android" +[browser_basicAuth_rateLimit.js] +[browser_basicAuth_switchTab.js] +skip-if = (debug && os == "mac") # Bug 1530566 +[browser_context_menu.js] +[browser_context_menu_autocomplete_interaction.js] +skip-if = + verify +[browser_context_menu_generated_password.js] +[browser_context_menu_iframe.js] +[browser_crossOriginSubmissionUsesCorrectOrigin.js] +support-files = + form_cross_origin_secure_action.html +[browser_deleteLoginsBackup.js] +skip-if = os == "android" +[browser_doorhanger_autocomplete_values.js] +[browser_doorhanger_autofill_then_save_password.js] +[browser_doorhanger_crossframe.js] +support-files = + form_crossframe.html + form_crossframe_inner.html +skip-if = + os == "win" && os_version == "6.1" # Skip on Azure - frequent failure +[browser_doorhanger_dismissed_for_ccnumber.js] +[browser_doorhanger_empty_password.js] +[browser_doorhanger_form_password_edit.js] +[browser_doorhanger_generated_password.js] +support-files = + form_basic_with_confirm_field.html + form_password_change.html +[browser_doorhanger_httpsUpgrade.js] +support-files = + subtst_notifications_1.html + subtst_notifications_8.html +[browser_doorhanger_multipage_form.js] +[browser_doorhanger_password_edits.js] +[browser_doorhanger_promptToChangePassword.js] +[browser_doorhanger_remembering.js] +[browser_doorhanger_replace_dismissed_with_visible_while_opening.js] +[browser_doorhanger_save_password.js] +[browser_doorhanger_submit_telemetry.js] +skip-if = + tsan # Bug 1661305 + os == "linux" && (debug || asan) # Bug 1658056, asan: 1695395 +[browser_doorhanger_target_blank.js] +support-files = + subtst_notifications_12_target_blank.html +[browser_doorhanger_toggles.js] +[browser_doorhanger_username_edits.js] +[browser_doorhanger_window_open.js] +support-files = + subtst_notifications_11.html + subtst_notifications_11_popup.html +skip-if = os == "linux" # Bug 1312981, bug 1313136 +[browser_entry_point_telemetry.js] +[browser_exceptions_dialog.js] +[browser_fileURIOrigin.js] +[browser_focus_before_first_DOMContentLoaded.js] +support-files = + file_focus_before_DOMContentLoaded.sjs +[browser_form_history_fallback.js] +https_first_disabled = true # TODO remove that line and move test to HTTPS, see Bug 1776350 +skip-if = os == "linux" && debug # Bug 1334336 +support-files = + subtst_notifications_1.html + subtst_notifications_2.html + subtst_notifications_2pw_0un.html + subtst_notifications_2pw_1un_1text.html + subtst_notifications_3.html + subtst_notifications_4.html + subtst_notifications_5.html + subtst_notifications_6.html + subtst_notifications_8.html + subtst_notifications_9.html + subtst_notifications_10.html + subtst_notifications_change_p.html +[browser_formless_submit_chrome.js] +skip-if = tsan # Bug 1683730 +[browser_insecurePasswordConsoleWarning.js] +https_first_disabled = true +skip-if = verify +[browser_isProbablyASignUpForm.js] +support-files = + form_signup_detection.html +[browser_localip_frame.js] +skip-if = + os == 'mac' && bits == 64 # Bug 1683848 + os == 'linux' && !debug && bits == 64 # Bug 1683848 + win10_2004 && !fission # Bug 1723573 +[browser_message_onFormSubmit.js] +[browser_openPasswordManager.js] +[browser_preselect_login.js] +[browser_private_window.js] +support-files = + subtst_privbrowsing_1.html + form_password_change.html +skip-if = + os == 'linux' && bits == 64 && os_version == '18.04' && !debug # Bug 1744976 + os == 'win' && os_version == '10.0' && debug # Bug 1782656 +[browser_proxyAuth_prompt.js] +skip-if = os == "android" +[browser_relay_telemetry.js] +[browser_telemetry_SignUpFormRuleset.js] +[browser_test_changeContentInputValue.js] +[browser_username_only_form_telemetry.js] +[browser_username_select_dialog.js] +support-files = + subtst_notifications_change_p.html
\ No newline at end of file diff --git a/toolkit/components/passwordmgr/test/browser/browser_DOMFormHasPassword.js b/toolkit/components/passwordmgr/test/browser/browser_DOMFormHasPassword.js new file mode 100644 index 0000000000..6d4d333369 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_DOMFormHasPassword.js @@ -0,0 +1,152 @@ +const ids = { + INPUT_ID: "input1", + FORM1_ID: "form1", + FORM2_ID: "form2", + CHANGE_INPUT_ID: "input2", +}; + +function task(contentIds) { + let resolve; + let promise = new Promise(r => { + resolve = r; + }); + + function unexpectedContentEvent(evt) { + Assert.ok(false, "Received a " + evt.type + " event on content"); + } + + var gDoc = null; + + addEventListener("load", tabLoad, true); + + function tabLoad() { + if (content.location.href == "about:blank") { + return; + } + removeEventListener("load", tabLoad, true); + + gDoc = content.document; + gDoc.addEventListener("DOMFormHasPassword", unexpectedContentEvent); + addEventListener("DOMFormHasPassword", unexpectedContentEvent); + gDoc.defaultView.setTimeout(test_inputAdd, 0); + } + + function test_inputAdd() { + addEventListener("DOMFormHasPassword", test_inputAddHandler, { + once: true, + capture: true, + }); + let input = gDoc.createElementNS("http://www.w3.org/1999/xhtml", "input"); + input.setAttribute("type", "password"); + input.setAttribute("id", contentIds.INPUT_ID); + input.setAttribute("data-test", "unique-attribute"); + gDoc.getElementById(contentIds.FORM1_ID).appendChild(input); + } + + function test_inputAddHandler(evt) { + evt.stopPropagation(); + Assert.equal( + evt.target.id, + contentIds.FORM1_ID, + evt.type + " event targets correct form element (added password element)" + ); + gDoc.defaultView.setTimeout(test_inputChangeForm, 0); + } + + function test_inputChangeForm() { + addEventListener("DOMFormHasPassword", test_inputChangeFormHandler, { + once: true, + capture: true, + }); + let input = gDoc.getElementById(contentIds.INPUT_ID); + input.setAttribute("form", contentIds.FORM2_ID); + } + + function test_inputChangeFormHandler(evt) { + evt.stopPropagation(); + Assert.equal( + evt.target.id, + contentIds.FORM2_ID, + evt.type + " event targets correct form element (changed form)" + ); + gDoc.defaultView.setTimeout(test_inputChangesType, 0); + } + + function test_inputChangesType() { + addEventListener("DOMFormHasPassword", test_inputChangesTypeHandler, { + once: true, + capture: true, + }); + let input = gDoc.getElementById(contentIds.CHANGE_INPUT_ID); + input.setAttribute("type", "password"); + } + + function test_inputChangesTypeHandler(evt) { + evt.stopPropagation(); + Assert.equal( + evt.target.id, + contentIds.FORM1_ID, + evt.type + " event targets correct form element (changed type)" + ); + gDoc.defaultView.setTimeout(finish, 0); + } + + function finish() { + removeEventListener("DOMFormHasPassword", unexpectedContentEvent); + gDoc.removeEventListener("DOMFormHasPassword", unexpectedContentEvent); + resolve(); + } + + return promise; +} + +add_task(async function test_disconnectedInputs() { + const tab = (gBrowser.selectedTab = BrowserTestUtils.addTab(gBrowser)); + await ContentTask.spawn(tab.linkedBrowser, [], async () => { + const unexpectedEvent = evt => { + Assert.ok( + false, + `${evt.type} should not be fired for disconnected forms.` + ); + }; + + addEventListener("DOMFormHasPassword", unexpectedEvent); + + const form = content.document.createElement("form"); + const passwordInput = content.document.createElement("input"); + passwordInput.setAttribute("type", "password"); + form.appendChild(passwordInput); + + // Delay the execution for a bit to allow time for any asynchronously + // dispatched 'DOMFormHasPassword' events to be processed. + // This is necessary because such events might not be triggered immediately, + // and we want to ensure that if they are dispatched, they are captured + // before we remove the event listener. + // eslint-disable-next-line mozilla/no-arbitrary-setTimeout + await new Promise(resolve => setTimeout(resolve, 50)); + removeEventListener("DOMFormHasPassword", unexpectedEvent); + }); + + Assert.ok(true, "Test completed"); + gBrowser.removeCurrentTab(); +}); + +add_task(async function () { + let tab = (gBrowser.selectedTab = BrowserTestUtils.addTab(gBrowser)); + + let promise = ContentTask.spawn(tab.linkedBrowser, ids, task); + BrowserTestUtils.loadURIString( + tab.linkedBrowser, + `data:text/html;charset=utf-8, + <html><body> + <form id="${ids.FORM1_ID}"> + <input id="${ids.CHANGE_INPUT_ID}"> + </form> + <form id="${ids.FORM2_ID}"></form> + </body></html>` + ); + await promise; + + Assert.ok(true, "Test completed"); + gBrowser.removeCurrentTab(); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_DOMFormHasPossibleUsername.js b/toolkit/components/passwordmgr/test/browser/browser_DOMFormHasPossibleUsername.js new file mode 100644 index 0000000000..7f39395587 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_DOMFormHasPossibleUsername.js @@ -0,0 +1,254 @@ +const ids = { + INPUT_ID: "input1", + FORM1_ID: "form1", + FORM2_ID: "form2", + CHANGE_INPUT_ID: "input2", + INPUT_TYPE: "", +}; + +function task({ contentIds, expected }) { + let resolve; + let promise = new Promise(r => { + resolve = r; + }); + + function unexpectedContentEvent(evt) { + Assert.ok(false, "Received a " + evt.type + " event on content"); + } + + var gDoc = null; + + addEventListener("load", tabLoad, true); + + function tabLoad() { + if (content.location.href == "about:blank") { + return; + } + removeEventListener("load", tabLoad, true); + + gDoc = content.document; + gDoc.addEventListener("DOMFormHasPossibleUsername", unexpectedContentEvent); + addEventListener("DOMFormHasPossibleUsername", unexpectedContentEvent); + gDoc.defaultView.setTimeout(test_inputAdd, 0); + } + + function test_inputAdd() { + if (expected) { + addEventListener("DOMFormHasPossibleUsername", test_inputAddHandler, { + once: true, + capture: true, + }); + } else { + gDoc.defaultView.setTimeout(test_inputAddHandler, 0); + } + let input = gDoc.createElementNS("http://www.w3.org/1999/xhtml", "input"); + input.setAttribute("type", contentIds.INPUT_TYPE); + input.setAttribute("id", contentIds.INPUT_ID); + input.setAttribute("data-test", "unique-attribute"); + gDoc.getElementById(contentIds.FORM1_ID).appendChild(input); + } + + function test_inputAddHandler(evt) { + if (expected) { + evt.stopPropagation(); + Assert.equal( + evt.target.id, + contentIds.FORM1_ID, + evt.type + + " event targets correct form element (added possible username element)" + ); + } + gDoc.defaultView.setTimeout(test_inputChangeForm, 0); + } + + function test_inputChangeForm() { + if (expected) { + addEventListener( + "DOMFormHasPossibleUsername", + test_inputChangeFormHandler, + { once: true, capture: true } + ); + } else { + gDoc.defaultView.setTimeout(test_inputChangeFormHandler, 0); + } + let input = gDoc.getElementById(contentIds.INPUT_ID); + input.setAttribute("form", contentIds.FORM2_ID); + } + + function test_inputChangeFormHandler(evt) { + if (expected) { + evt.stopPropagation(); + Assert.equal( + evt.target.id, + contentIds.FORM2_ID, + evt.type + " event targets correct form element (changed form)" + ); + } + // TODO(Bug 1864405): Refactor this test to not expect a DOM event + // when the type is set to the same value + const nextTask = + expected && contentIds.INPUT_TYPE === "text" + ? finish + : test_inputChangesType; + gDoc.defaultView.setTimeout(nextTask, 0); + } + + function test_inputChangesType() { + if (expected) { + addEventListener( + "DOMFormHasPossibleUsername", + test_inputChangesTypeHandler, + { once: true, capture: true } + ); + } else { + gDoc.defaultView.setTimeout(test_inputChangesTypeHandler, 0); + } + let input = gDoc.getElementById(contentIds.CHANGE_INPUT_ID); + input.setAttribute("type", contentIds.INPUT_TYPE); + } + + function test_inputChangesTypeHandler(evt) { + if (expected) { + evt.stopPropagation(); + Assert.equal( + evt.target.id, + contentIds.FORM1_ID, + evt.type + " event targets correct form element (changed type)" + ); + } + gDoc.defaultView.setTimeout(finish, 0); + } + + function finish() { + removeEventListener("DOMFormHasPossibleUsername", unexpectedContentEvent); + gDoc.removeEventListener( + "DOMFormHasPossibleUsername", + unexpectedContentEvent + ); + resolve(); + } + + return promise; +} + +add_setup(async function () { + Services.prefs.setBoolPref("signon.usernameOnlyForm.enabled", true); + registerCleanupFunction(() => { + Services.prefs.clearUserPref("signon.usernameOnlyForm.enabled"); + }); +}); + +add_task(async function test_disconnectedInputs() { + const tab = (gBrowser.selectedTab = BrowserTestUtils.addTab(gBrowser)); + await ContentTask.spawn(tab.linkedBrowser, [], async () => { + const unexpectedEvent = evt => { + Assert.ok( + false, + `${evt.type} should not be fired for disconnected forms.` + ); + }; + + addEventListener("DOMFormHasPossibleUsername", unexpectedEvent); + const form = content.document.createElement("form"); + const textInput = content.document.createElement("input"); + textInput.setAttribute("type", "text"); + form.appendChild(textInput); + + // Delay the execution for a bit to allow time for any asynchronously + // dispatched 'DOMFormHasPossibleUsername' events to be processed. + // This is necessary because such events might not be triggered immediately, + // and we want to ensure that if they are dispatched, they are captured + // before we remove the event listener. + // eslint-disable-next-line mozilla/no-arbitrary-setTimeout + await new Promise(resolve => setTimeout(resolve, 50)); + removeEventListener("DOMFormHasPossibleUsername", unexpectedEvent); + }); + + Assert.ok(true, "Test completed"); + gBrowser.removeCurrentTab(); +}); + +add_task(async function test_usernameOnlyForm() { + for (let type of ["text", "email"]) { + let tab = (gBrowser.selectedTab = BrowserTestUtils.addTab(gBrowser)); + + ids.INPUT_TYPE = type; + let promise = ContentTask.spawn( + tab.linkedBrowser, + { contentIds: ids, expected: true }, + task + ); + BrowserTestUtils.loadURIString( + tab.linkedBrowser, + `data:text/html;charset=utf-8, + <html><body> + <form id="${ids.FORM1_ID}"> + <input id="${ids.CHANGE_INPUT_ID}"> + </form> + <form id="${ids.FORM2_ID}"></form> + </body></html>` + ); + await promise; + + Assert.ok(true, "Test completed"); + gBrowser.removeCurrentTab(); + } +}); + +add_task(async function test_nonSupportedInputType() { + for (let type of ["url", "tel", "number"]) { + let tab = (gBrowser.selectedTab = BrowserTestUtils.addTab(gBrowser)); + + ids.INPUT_TYPE = type; + let promise = ContentTask.spawn( + tab.linkedBrowser, + { contentIds: ids, expected: false }, + task + ); + BrowserTestUtils.loadURIString( + tab.linkedBrowser, + `data:text/html;charset=utf-8, + <html><body> + <form id="${ids.FORM1_ID}"> + <input id="${ids.CHANGE_INPUT_ID}"> + </form> + <form id="${ids.FORM2_ID}"></form> + </body></html>` + ); + await promise; + + Assert.ok(true, "Test completed"); + gBrowser.removeCurrentTab(); + } +}); + +add_task(async function test_usernameOnlyFormPrefOff() { + Services.prefs.setBoolPref("signon.usernameOnlyForm.enabled", false); + + for (let type of ["text", "email"]) { + let tab = (gBrowser.selectedTab = BrowserTestUtils.addTab(gBrowser)); + + ids.INPUT_TYPE = type; + let promise = ContentTask.spawn( + tab.linkedBrowser, + { contentIds: ids, expected: false }, + task + ); + BrowserTestUtils.loadURIString( + tab.linkedBrowser, + `data:text/html;charset=utf-8, + <html><body> + <form id="${ids.FORM1_ID}"> + <input id="${ids.CHANGE_INPUT_ID}"> + </form> + <form id="${ids.FORM2_ID}"></form> + </body></html>` + ); + await promise; + + Assert.ok(true, "Test completed"); + gBrowser.removeCurrentTab(); + } + + Services.prefs.clearUserPref("signon.usernameOnlyForm.enabled"); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_DOMInputPasswordAdded.js b/toolkit/components/passwordmgr/test/browser/browser_DOMInputPasswordAdded.js new file mode 100644 index 0000000000..11ca2ac1cd --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_DOMInputPasswordAdded.js @@ -0,0 +1,101 @@ +const consts = { + HTML_NS: "http://www.w3.org/1999/xhtml", + + INPUT_ID: "input1", + FORM1_ID: "form1", + FORM2_ID: "form2", + CHANGE_INPUT_ID: "input2", + BODY_INPUT_ID: "input3", +}; + +function task(contentConsts) { + let resolve; + let promise = new Promise(r => { + resolve = r; + }); + + function unexpectedContentEvent(evt) { + Assert.ok(false, "Received a " + evt.type + " event on content"); + } + + var gDoc = null; + + addEventListener("load", tabLoad, true); + + function tabLoad() { + removeEventListener("load", tabLoad, true); + gDoc = content.document; + // These events shouldn't escape to content. + gDoc.addEventListener("DOMInputPasswordAdded", unexpectedContentEvent); + gDoc.defaultView.setTimeout(test_inputAddOutsideForm, 0); + } + + function test_inputAddOutsideForm() { + addEventListener( + "DOMInputPasswordAdded", + test_inputAddOutsideFormHandler, + false + ); + let input = gDoc.createElementNS(contentConsts.HTML_NS, "input"); + input.setAttribute("type", "password"); + input.setAttribute("id", contentConsts.BODY_INPUT_ID); + input.setAttribute("data-test", "unique-attribute"); + gDoc.body.appendChild(input); + info("Done appending the input element to the body"); + } + + function test_inputAddOutsideFormHandler(evt) { + removeEventListener(evt.type, test_inputAddOutsideFormHandler, false); + Assert.equal( + evt.target.id, + contentConsts.BODY_INPUT_ID, + evt.type + + " event targets correct input element (added password element outside form)" + ); + gDoc.defaultView.setTimeout(test_inputChangesType, 0); + } + + function test_inputChangesType() { + addEventListener( + "DOMInputPasswordAdded", + test_inputChangesTypeHandler, + false + ); + let input = gDoc.getElementById(contentConsts.CHANGE_INPUT_ID); + input.setAttribute("type", "password"); + } + + function test_inputChangesTypeHandler(evt) { + removeEventListener(evt.type, test_inputChangesTypeHandler, false); + Assert.equal( + evt.target.id, + contentConsts.CHANGE_INPUT_ID, + evt.type + " event targets correct input element (changed type)" + ); + gDoc.defaultView.setTimeout(completeTest, 0); + } + + function completeTest() { + Assert.ok(true, "Test completed"); + gDoc.removeEventListener("DOMInputPasswordAdded", unexpectedContentEvent); + resolve(); + } + + return promise; +} + +add_task(async function () { + let tab = (gBrowser.selectedTab = BrowserTestUtils.addTab(gBrowser)); + let promise = ContentTask.spawn(tab.linkedBrowser, consts, task); + BrowserTestUtils.loadURIString( + tab.linkedBrowser, + `data:text/html;charset=utf-8, + <html><body> + <input id="${consts.CHANGE_INPUT_ID}" /> + </body> + </html> + ` + ); + await promise; + gBrowser.removeCurrentTab(); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_autocomplete_autofocus_with_frame.js b/toolkit/components/passwordmgr/test/browser/browser_autocomplete_autofocus_with_frame.js new file mode 100644 index 0000000000..551e1b939a --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_autocomplete_autofocus_with_frame.js @@ -0,0 +1,48 @@ +const TEST_URL_PATH = "https://example.org" + DIRECTORY_PATH; + +add_setup(async function () { + let login = LoginTestUtils.testData.formLogin({ + origin: "https://example.org", + formActionOrigin: "https://example.org", + username: "username1", + password: "password1", + }); + await Services.logins.addLoginAsync(login); + login = LoginTestUtils.testData.formLogin({ + origin: "https://example.org", + formActionOrigin: "https://example.org", + username: "username2", + password: "password2", + }); + await Services.logins.addLoginAsync(login); +}); + +// Verify that the autocomplete popup opens when the username field in autofocused. +add_task(async function test_autofocus_autocomplete() { + let popup = document.getElementById("PopupAutoComplete"); + let popupShown = BrowserTestUtils.waitForEvent(popup, "popupshown"); + + let formFilled = listenForTestNotification("FormProcessed"); + let tab = await BrowserTestUtils.openNewForegroundTab( + gBrowser, + TEST_URL_PATH + "form_autofocus_frame.html" + ); + + await formFilled; + await popupShown; + + Assert.ok(true, "popup opened"); + + let promiseHidden = BrowserTestUtils.waitForEvent(popup, "popuphidden"); + popup.firstChild.getItemAtIndex(0).click(); + await promiseHidden; + + Assert.ok(true, "popup closed"); + + let password = await SpecialPowers.spawn(tab.linkedBrowser, [], () => { + return content.document.getElementById("form-basic-password").value; + }); + Assert.equal(password, "password1", "password filled in"); + + gBrowser.removeTab(tab); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_autocomplete_disabled_readonly_passwordField.js b/toolkit/components/passwordmgr/test/browser/browser_autocomplete_disabled_readonly_passwordField.js new file mode 100644 index 0000000000..f6e0a62678 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_autocomplete_disabled_readonly_passwordField.js @@ -0,0 +1,138 @@ +const TEST_URL_PATH = + "https://example.org" + + DIRECTORY_PATH + + "form_disabled_readonly_passwordField.html"; +const FIRST_ITEM = 0; + +/** + * Add two logins to prevent autofilling, but the AutocompletePopup will be displayed + */ +add_setup(async () => { + let login1 = LoginTestUtils.testData.formLogin({ + origin: "https://example.org", + formActionOrigin: "https://example.org", + username: "username1", + password: "password1", + }); + + let login2 = LoginTestUtils.testData.formLogin({ + origin: "https://example.org", + formActionOrigin: "https://example.org", + username: "username2", + password: "password2", + }); + + await Services.logins.addLogins([login1, login2]); +}); + +add_task( + async function test_autocomplete_for_usernameField_with_disabled_passwordField() { + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_URL_PATH, + }, + async function (browser) { + let popup = document.getElementById("PopupAutoComplete"); + + Assert.ok(popup, "Got Popup"); + + await openACPopup( + popup, + browser, + "#login_form_disabled_password input[name=username]" + ); + + info("Popup opened"); + + let promiseHidden = BrowserTestUtils.waitForEvent(popup, "popuphidden"); + popup.firstChild.getItemAtIndex(FIRST_ITEM).click(); + await promiseHidden; + + info("Popup closed"); + + let [username, password] = await SpecialPowers.spawn( + browser, + [], + async () => { + let doc = content.document; + let contentUsername = doc.querySelector( + "#login_form_disabled_password input[name=username]" + ).value; + let contentPassword = doc.querySelector( + "#login_form_disabled_password input[name=password]" + ).value; + return [contentUsername, contentPassword]; + } + ); + Assert.equal( + username, + "username1", + "Username was autocompleted with correct value." + ); + Assert.equal( + password, + "", + "Password was not autocompleted, because field is disabled." + ); + } + ); + } +); + +add_task( + async function test_autocomplete_for_usernameField_with_readonly_passwordField() { + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_URL_PATH, + }, + async function (browser) { + let popup = document.getElementById("PopupAutoComplete"); + + Assert.ok(popup, "Got Popup"); + + await openACPopup( + popup, + browser, + "#login_form_readonly_password input[name=username]" + ); + + info("Popup opened"); + + let promiseHidden = BrowserTestUtils.waitForEvent(popup, "popuphidden"); + popup.firstChild.getItemAtIndex(FIRST_ITEM).click(); + await promiseHidden; + + info("Popup closed"); + + let [username, password] = await SpecialPowers.spawn( + browser, + [], + async () => { + let doc = content.document; + let contentUsername = doc.querySelector( + "#login_form_readonly_password input[name=username]" + ).value; + info(contentUsername); + let contentPassword = doc.querySelector( + "#login_form_readonly_password input[name=password]" + ).value; + info(contentPassword); + return [contentUsername, contentPassword]; + } + ); + Assert.equal( + username, + "username1", + "Username was autocompleted with correct value." + ); + Assert.equal( + password, + "", + "Password was not autocompleted, because field is readonly." + ); + } + ); + } +); diff --git a/toolkit/components/passwordmgr/test/browser/browser_autocomplete_footer.js b/toolkit/components/passwordmgr/test/browser/browser_autocomplete_footer.js new file mode 100644 index 0000000000..6660daec99 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_autocomplete_footer.js @@ -0,0 +1,125 @@ +"use strict"; + +const TEST_ORIGIN = "https://example.com"; +const BASIC_FORM_PAGE_PATH = DIRECTORY_PATH + "form_basic.html"; + +function loginList() { + return [ + LoginTestUtils.testData.formLogin({ + origin: "https://example.com", + formActionOrigin: "https://example.com", + username: "username", + password: "password", + }), + LoginTestUtils.testData.formLogin({ + origin: "https://example.com", + formActionOrigin: "https://example.com", + username: "username2", + password: "password2", + }), + ]; +} + +/** + * Initialize logins and set prefs needed for the test. + */ +add_task(async function test_initialize() { + Services.prefs.setBoolPref("signon.showAutoCompleteFooter", true); + registerCleanupFunction(() => { + Services.prefs.clearUserPref("signon.showAutoCompleteFooter"); + }); + + await Services.logins.addLogins(loginList()); +}); + +add_task(async function test_autocomplete_footer_onclick() { + let url = TEST_ORIGIN + BASIC_FORM_PAGE_PATH; + await BrowserTestUtils.withNewTab( + { + gBrowser, + url, + }, + async function footer_onclick(browser) { + let popup = document.getElementById("PopupAutoComplete"); + Assert.ok(popup, "Got popup"); + + await openACPopup(popup, browser, "#form-basic-username"); + + let footer = popup.querySelector(`[originaltype="loginsFooter"]`); + Assert.ok(footer, "Got footer richlistitem"); + + await TestUtils.waitForCondition(() => { + return !EventUtils.isHidden(footer); + }, "Waiting for footer to become visible"); + + let openingFunc = () => EventUtils.synthesizeMouseAtCenter(footer, {}); + let passwordManager = await openPasswordManager(openingFunc, false); + + info("Password Manager was opened"); + + Assert.ok( + !passwordManager.filterValue, + "Search string should not be set to filter logins" + ); + + // open_management + await LoginTestUtils.telemetry.waitForEventCount(1); + + // Check event telemetry recorded when opening management UI + TelemetryTestUtils.assertEvents( + [["pwmgr", "open_management", "autocomplete"]], + { category: "pwmgr", method: "open_management" }, + { clear: true, process: "content" } + ); + + await passwordManager.close(); + await closePopup(popup); + } + ); +}); + +add_task(async function test_autocomplete_footer_keydown() { + let url = TEST_ORIGIN + BASIC_FORM_PAGE_PATH; + await BrowserTestUtils.withNewTab( + { + gBrowser, + url, + }, + async function footer_enter_keydown(browser) { + let popup = document.getElementById("PopupAutoComplete"); + Assert.ok(popup, "Got popup"); + + await openACPopup(popup, browser, "#form-basic-username"); + + let footer = popup.querySelector(`[originaltype="loginsFooter"]`); + Assert.ok(footer, "Got footer richlistitem"); + + await TestUtils.waitForCondition(() => { + return !EventUtils.isHidden(footer); + }, "Waiting for footer to become visible"); + + await EventUtils.synthesizeKey("KEY_ArrowDown"); + await EventUtils.synthesizeKey("KEY_ArrowDown"); + await EventUtils.synthesizeKey("KEY_ArrowDown"); + let openingFunc = () => EventUtils.synthesizeKey("KEY_Enter"); + + let passwordManager = await openPasswordManager(openingFunc, false); + info("Login dialog was opened"); + + Assert.ok( + !passwordManager.filterValue, + "Search string should not be set to filter logins" + ); + + // Check event telemetry recorded when opening management UI + TelemetryTestUtils.assertEvents( + [["pwmgr", "open_management", "autocomplete"]], + { category: "pwmgr", method: "open_management" }, + { clear: true, process: "content" } + ); + + await passwordManager.close(); + await closePopup(popup); + } + ); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_autocomplete_generated_password_private_window.js b/toolkit/components/passwordmgr/test/browser/browser_autocomplete_generated_password_private_window.js new file mode 100644 index 0000000000..f28a7a1d52 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_autocomplete_generated_password_private_window.js @@ -0,0 +1,111 @@ +// The origin for the test URIs. +const TEST_ORIGIN = "https://example.com"; +const FORM_PAGE_PATH = + "/browser/toolkit/components/passwordmgr/test/browser/form_basic.html"; +const passwordInputSelector = "#form-basic-password"; + +add_setup(async function () { + Services.telemetry.clearEvents(); + TelemetryTestUtils.assertEvents([], { + category: "pwmgr", + method: "autocomplete_shown", + }); +}); + +add_task(async function test_autocomplete_new_password_popup_item_visible() { + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_ORIGIN, + }, + async function (browser) { + info("Generate and cache a password for a non-private context"); + let lmp = + browser.browsingContext.currentWindowGlobal.getActor("LoginManager"); + await lmp.getGeneratedPassword(); + Assert.equal( + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().size, + 1, + "Non-Private password should be cached" + ); + } + ); + + await LoginTestUtils.addLogin({ username: "username", password: "pass1" }); + const win = await BrowserTestUtils.openNewBrowserWindow({ private: true }); + const doc = win.document; + await BrowserTestUtils.withNewTab( + { + gBrowser: win.gBrowser, + url: TEST_ORIGIN + FORM_PAGE_PATH, + }, + async function (browser) { + await SimpleTest.promiseFocus(browser.ownerGlobal); + await ContentTask.spawn( + browser, + [passwordInputSelector], + function openAutocomplete(sel) { + content.document.querySelector(sel).autocomplete = "new-password"; + } + ); + + let popup = doc.getElementById("PopupAutoComplete"); + Assert.ok(popup, "Got popup"); + await openACPopup(popup, browser, passwordInputSelector); + + let item = popup.querySelector(`[originaltype="generatedPassword"]`); + Assert.ok(item, "Should get 'Generate password' richlistitem"); + + let onPopupClosed = BrowserTestUtils.waitForCondition( + () => !popup.popupOpen, + "Popup should get closed" + ); + + await TestUtils.waitForTick(); + + TelemetryTestUtils.assertEvents( + [["pwmgr", "autocomplete_shown", "generatedpassword"]], + { category: "pwmgr", method: "autocomplete_shown" } + ); + + await closePopup(popup); + await onPopupClosed; + } + ); + + let lastPBContextExitedPromise = TestUtils.topicObserved( + "last-pb-context-exited" + ).then(() => TestUtils.waitForTick()); + await BrowserTestUtils.closeWindow(win); + await lastPBContextExitedPromise; + Assert.equal( + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().size, + 1, + "Only private-context passwords should be cleared" + ); +}); + +add_task(async function test_autocomplete_menu_item_enabled() { + const win = await BrowserTestUtils.openNewBrowserWindow({ private: true }); + const doc = win.document; + await BrowserTestUtils.withNewTab( + { + gBrowser: win.gBrowser, + url: TEST_ORIGIN + FORM_PAGE_PATH, + }, + async function (browser) { + await SimpleTest.promiseFocus(browser); + await openPasswordContextMenu(browser, passwordInputSelector); + let generatedPasswordItem = doc.getElementById( + "fill-login-generated-password" + ); + Assert.equal( + generatedPasswordItem.disabled, + false, + "Generate password context menu item should be enabled in PB mode" + ); + await closePopup(document.getElementById("contentAreaContextMenu")); + } + ); + await BrowserTestUtils.closeWindow(win); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_autocomplete_import.js b/toolkit/components/passwordmgr/test/browser/browser_autocomplete_import.js new file mode 100644 index 0000000000..0be137d88d --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_autocomplete_import.js @@ -0,0 +1,259 @@ +const { ChromeMigrationUtils } = ChromeUtils.importESModule( + "resource:///modules/ChromeMigrationUtils.sys.mjs" +); +const { ExperimentAPI } = ChromeUtils.importESModule( + "resource://nimbus/ExperimentAPI.sys.mjs" +); +const { ExperimentFakes } = ChromeUtils.importESModule( + "resource://testing-common/NimbusTestUtils.sys.mjs" +); +const { sinon } = ChromeUtils.importESModule( + "resource://testing-common/Sinon.sys.mjs" +); + +// Dummy migrator to change and detect importable behavior. +const gTestMigrator = { + profiles: [], + + getSourceProfiles() { + return this.profiles; + }, + + migrate: sinon + .stub() + .callsFake(() => + LoginTestUtils.addLogin({ username: "import", password: "pass" }) + ), +}; + +// Showing importables updates counts delayed, so adjust and cleanup. +add_setup(async function setup() { + const debounce = sinon + .stub(LoginManagerParent, "SUGGEST_IMPORT_DEBOUNCE_MS") + .value(0); + const importable = sinon + .stub(ChromeMigrationUtils, "getImportableLogins") + .resolves(["chrome"]); + const migrator = sinon + .stub(MigrationUtils, "getMigrator") + .resolves(gTestMigrator); + + const doExperimentCleanup = await ExperimentFakes.enrollWithFeatureConfig({ + featureId: "password-autocomplete", + value: { directMigrateSingleProfile: true }, + }); + + // This makes the last autocomplete test *not* show import suggestions. + Services.prefs.setIntPref("signon.suggestImportCount", 3); + + registerCleanupFunction(async () => { + await doExperimentCleanup(); + debounce.restore(); + importable.restore(); + migrator.restore(); + Services.prefs.clearUserPref("signon.suggestImportCount"); + }); +}); + +add_task(async function check_fluent_ids() { + await document.l10n.ready; + MozXULElement.insertFTLIfNeeded("toolkit/main-window/autocomplete.ftl"); + + const host = "testhost.com"; + for (const browser of ChromeMigrationUtils.CONTEXTUAL_LOGIN_IMPORT_BROWSERS) { + const id = `autocomplete-import-logins-${browser}`; + const message = await document.l10n.formatValue(id, { host }); + Assert.ok( + message.includes(`data-l10n-name="line1"`), + `${id} included line1` + ); + Assert.ok( + message.includes(`data-l10n-name="line2"`), + `${id} included line2` + ); + Assert.ok(message.includes(host), `${id} replaced host`); + } +}); + +/** + * Tests that if the user selects the password import suggestion from + * the autocomplete popup, and there is more than one profile available + * to import from, that the migration wizard opens to guide the user + * through importing those logins. + */ +add_task(async function import_suggestion_wizard() { + let wizard; + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: "https://example.com" + DIRECTORY_PATH + "form_basic.html", + }, + async function (browser) { + const popup = document.getElementById("PopupAutoComplete"); + Assert.ok(popup, "Got popup"); + await openACPopup(popup, browser, "#form-basic-username"); + + const importableItem = popup.querySelector( + `[originaltype="importableLogins"]` + ); + Assert.ok(importableItem, "Got importable suggestion richlistitem"); + + await BrowserTestUtils.waitForCondition( + () => !importableItem.collapsed, + "Wait for importable suggestion to show" + ); + + // Pretend there's 2+ profiles to trigger the wizard. + gTestMigrator.profiles.length = 2; + + info("Clicking on importable suggestion"); + const wizardPromise = BrowserTestUtils.waitForMigrationWizard(window); + + // The modal window blocks execution, so avoid calling directly. + executeSoon(() => EventUtils.synthesizeMouseAtCenter(importableItem, {})); + + wizard = await wizardPromise; + Assert.ok(wizard, "Wizard opened"); + Assert.equal( + gTestMigrator.migrate.callCount, + 0, + "Direct migrate not used" + ); + + await closePopup(popup); + } + ); + + // Close the wizard in the end of the test. If we close the wizard when the tab + // is still opened, the username field will be focused again, which triggers another + // importable suggestion. + await BrowserTestUtils.closeMigrationWizard(wizard); +}); + +add_task(async function import_suggestion_learn_more() { + let supportTab; + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: "https://example.com" + DIRECTORY_PATH + "form_basic.html", + }, + async function (browser) { + const popup = document.getElementById("PopupAutoComplete"); + Assert.ok(popup, "Got popup"); + await openACPopup(popup, browser, "#form-basic-username"); + + const learnMoreItem = popup.querySelector(`[type="importableLearnMore"]`); + Assert.ok(learnMoreItem, "Got importable learn more richlistitem"); + + await BrowserTestUtils.waitForCondition( + () => !learnMoreItem.collapsed, + "Wait for importable learn more to show" + ); + + info("Clicking on importable learn more"); + const supportTabPromise = BrowserTestUtils.waitForNewTab( + gBrowser, + Services.urlFormatter.formatURLPref("app.support.baseURL") + + "password-import" + ); + EventUtils.synthesizeMouseAtCenter(learnMoreItem, {}); + supportTab = await supportTabPromise; + Assert.ok(supportTab, "Support tab opened"); + + await closePopup(popup); + } + ); + + // Close the tab in the end of the test to avoid the username field being + // focused again. + await BrowserTestUtils.removeTab(supportTab); +}); + +add_task(async function import_suggestion_migrate() { + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: "https://example.com" + DIRECTORY_PATH + "form_basic.html", + }, + async function (browser) { + const popup = document.getElementById("PopupAutoComplete"); + Assert.ok(popup, "Got popup"); + await openACPopup(popup, browser, "#form-basic-username"); + + const importableItem = popup.querySelector( + `[originaltype="importableLogins"]` + ); + Assert.ok(importableItem, "Got importable suggestion richlistitem"); + + await BrowserTestUtils.waitForCondition( + () => !importableItem.collapsed, + "Wait for importable suggestion to show" + ); + + // Pretend there's 1 profile to trigger migrate. + gTestMigrator.profiles.length = 1; + + info("Clicking on importable suggestion"); + const migratePromise = BrowserTestUtils.waitForCondition( + () => gTestMigrator.migrate.callCount, + "Wait for direct migration attempt" + ); + EventUtils.synthesizeMouseAtCenter(importableItem, {}); + + const callCount = await migratePromise; + Assert.equal(callCount, 1, "Direct migrate used once"); + + const importedItem = await BrowserTestUtils.waitForCondition( + () => popup.querySelector(`[originaltype="loginWithOrigin"]`), + "Wait for imported login to show" + ); + EventUtils.synthesizeMouseAtCenter(importedItem, {}); + + const username = await SpecialPowers.spawn( + browser, + [], + () => content.document.getElementById("form-basic-username").value + ); + Assert.equal(username, "import", "username from import filled in"); + + LoginTestUtils.clearData(); + } + ); +}); + +add_task(async function import_suggestion_not_shown() { + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: "https://example.com" + DIRECTORY_PATH + "form_basic.html", + }, + async function (browser) { + const popup = document.getElementById("PopupAutoComplete"); + Assert.ok(popup, "Got popup"); + let opened = false; + openACPopup(popup, browser, "#form-basic-password").then( + () => (opened = true) + ); + + await TestUtils.waitForCondition(() => { + EventUtils.synthesizeKey("KEY_ArrowDown"); + return opened; + }); + + const footer = popup.querySelector(`[originaltype="loginsFooter"]`); + Assert.ok(footer, "Got footer richlistitem"); + + await TestUtils.waitForCondition(() => { + return !EventUtils.isHidden(footer); + }, "Waiting for footer to become visible"); + + Assert.ok( + !popup.querySelector(`[originaltype="importableLogins"]`), + "No importable suggestion shown" + ); + + await closePopup(popup); + } + ); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_autocomplete_insecure_warning.js b/toolkit/components/passwordmgr/test/browser/browser_autocomplete_insecure_warning.js new file mode 100644 index 0000000000..f00ea80937 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_autocomplete_insecure_warning.js @@ -0,0 +1,44 @@ +"use strict"; + +const EXPECTED_SUPPORT_URL = + Services.urlFormatter.formatURLPref("app.support.baseURL") + + "insecure-password"; + +add_task(async function test_clickInsecureFieldWarning() { + let url = + "https://example.com" + + DIRECTORY_PATH + + "form_cross_origin_insecure_action.html"; + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url, + }, + async function (browser) { + let popup = document.getElementById("PopupAutoComplete"); + Assert.ok(popup, "Got popup"); + await openACPopup(popup, browser, "#form-basic-username"); + await new Promise(requestAnimationFrame); + + let warningItem = popup.querySelector(`[type="insecureWarning"]`); + Assert.ok(warningItem, "Got warning richlistitem"); + + await BrowserTestUtils.waitForCondition( + () => !warningItem.collapsed, + "Wait for warning to show" + ); + + info("Clicking on warning"); + let supportTabPromise = BrowserTestUtils.waitForNewTab( + gBrowser, + EXPECTED_SUPPORT_URL + ); + EventUtils.synthesizeMouseAtCenter(warningItem, {}); + let supportTab = await supportTabPromise; + Assert.ok(supportTab, "Support tab opened"); + await closePopup(popup); + BrowserTestUtils.removeTab(supportTab); + } + ); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_autocomplete_primary_password.js b/toolkit/components/passwordmgr/test/browser/browser_autocomplete_primary_password.js new file mode 100644 index 0000000000..c3152740cd --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_autocomplete_primary_password.js @@ -0,0 +1,121 @@ +/* eslint-disable mozilla/no-arbitrary-setTimeout */ +const HOST = "https://example.com"; +const URL = + HOST + "/browser/toolkit/components/passwordmgr/test/browser/form_basic.html"; +const TIMEOUT_PREF = "signon.masterPasswordReprompt.timeout_ms"; + +const BRAND_BUNDLE = Services.strings.createBundle( + "chrome://branding/locale/brand.properties" +); +const BRAND_FULL_NAME = BRAND_BUNDLE.GetStringFromName("brandFullName"); + +// Waits for the primary password prompt and cancels it when close() is called on the return value. +async function waitForDialog() { + let [subject] = await TestUtils.topicObserved("common-dialog-loaded"); + let dialog = subject.Dialog; + let expected = "Password Required - " + BRAND_FULL_NAME; + Assert.equal(dialog.args.title, expected, "Check common dialog title"); + return { + async close(win = window) { + dialog.ui.button1.click(); + return BrowserTestUtils.waitForEvent(win, "DOMModalDialogClosed"); + }, + }; +} + +add_setup(async function () { + let login = LoginTestUtils.testData.formLogin({ + origin: "https://example.com", + formActionOrigin: "https://example.com", + username: "username", + password: "password", + }); + await Services.logins.addLoginAsync(login); + LoginTestUtils.primaryPassword.enable(); + + registerCleanupFunction(function () { + LoginTestUtils.primaryPassword.disable(); + }); + + // Set primary password prompt timeout to 3s. + // If this test goes intermittent, you likely have to increase this value. + await SpecialPowers.pushPrefEnv({ set: [[TIMEOUT_PREF, 3000]] }); +}); + +// Test that autocomplete does not trigger a primary password prompt +// for a certain time after it was cancelled. +add_task(async function test_mpAutocompleteTimeout() { + // Wait for initial primary password dialog after opening the tab. + let dialogShown = waitForDialog(); + + await BrowserTestUtils.withNewTab(URL, async function (browser) { + (await dialogShown).close(); + + await SpecialPowers.spawn(browser, [], async function () { + // Focus the password field to trigger autocompletion. + content.document.getElementById("form-basic-password").focus(); + }); + + // Wait 4s, dialog should not have been shown + // (otherwise the code below will not work). + await new Promise(c => setTimeout(c, 4000)); + + dialogShown = waitForDialog(); + await SpecialPowers.spawn(browser, [], async function () { + // Re-focus the password field to trigger autocompletion. + content.document.getElementById("form-basic-username").focus(); + content.document.getElementById("form-basic-password").focus(); + }); + (await dialogShown).close(); + closePopup(document.getElementById("PopupAutoComplete")); + }); + + // Wait 4s for the timer to pass again and not interfere with the next test. + await new Promise(c => setTimeout(c, 4000)); +}); + +// Test that autocomplete does not trigger a primary password prompt +// if one is already showing. +add_task(async function test_mpAutocompleteUIBusy() { + // Wait for initial primary password dialog after adding the login. + let dialogShown = waitForDialog(); + + let win = await BrowserTestUtils.openNewBrowserWindow(); + + Services.tm.dispatchToMainThread(async () => { + try { + // Trigger a MP prompt in the new window by saving a login + await Services.logins.addLoginAsync(LoginTestUtils.testData.formLogin()); + } catch (e) { + // Handle throwing from MP cancellation + } + }); + let { close } = await dialogShown; + + let windowGlobal = + gBrowser.selectedBrowser.browsingContext.currentWindowGlobal; + let loginManagerParent = windowGlobal.getActor("LoginManager"); + let origin = "https://www.example.com"; + let data = { + actionOrigin: "", + searchString: "", + previousResult: null, + hasBeenTypePassword: true, + isSecure: false, + isProbablyANewPasswordField: true, + }; + + function dialogObserver(subject, topic, data) { + Assert.ok(false, "A second dialog shouldn't have been shown"); + Services.obs.removeObserver(dialogObserver, topic); + } + Services.obs.addObserver(dialogObserver, "common-dialog-loaded"); + + let results = await loginManagerParent.doAutocompleteSearch(origin, data); + Assert.equal(results.logins.length, 0, "No results since uiBusy is true"); + await close(win); + + await BrowserTestUtils.closeWindow(win); + + Services.obs.removeObserver(dialogObserver, "common-dialog-loaded"); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_autofill_hidden_document.js b/toolkit/components/passwordmgr/test/browser/browser_autofill_hidden_document.js new file mode 100644 index 0000000000..e7af2f8b84 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_autofill_hidden_document.js @@ -0,0 +1,205 @@ +Services.scriptloader.loadSubScript( + "chrome://mochitests/content/browser/browser/components/aboutlogins/tests/browser/head.js", + this +); + +const TEST_URL_PATH = "/browser/toolkit/components/passwordmgr/test/browser/"; +const INITIAL_URL = `about:blank`; +const FORM_URL = `https://example.org${TEST_URL_PATH}form_basic.html`; +const FORMLESS_URL = `https://example.org${TEST_URL_PATH}formless_basic.html`; +const FORM_MULTIPAGE_URL = `https://example.org${TEST_URL_PATH}form_multipage.html`; +const testUrls = [FORM_URL, FORMLESS_URL, FORM_MULTIPAGE_URL]; +const testUrlsWithForm = [FORM_URL, FORM_MULTIPAGE_URL]; +const BRAND_BUNDLE = Services.strings.createBundle( + "chrome://branding/locale/brand.properties" +); +const BRAND_FULL_NAME = BRAND_BUNDLE.GetStringFromName("brandFullName"); + +async function getDocumentVisibilityState(browser) { + let visibility = await SpecialPowers.spawn(browser, [], async function () { + return content.document.visibilityState; + }); + return visibility; +} + +add_setup(async function () { + Services.prefs.setBoolPref("signon.usernameOnlyForm.enabled", true); + registerCleanupFunction(() => { + Services.prefs.clearUserPref("signon.usernameOnlyForm.enabled"); + }); + + Services.logins.removeAllUserFacingLogins(); + let login = LoginTestUtils.testData.formLogin({ + origin: "https://example.org", + formActionOrigin: "https://example.org", + username: "user1", + password: "pass1", + }); + await Services.logins.addLoginAsync(login); +}); + +testUrlsWithForm.forEach(testUrl => { + add_task(async function test_processed_form_fired() { + // Sanity check. If this doesnt work any results for the subsequent tasks are suspect + const tab1 = await BrowserTestUtils.openNewForegroundTab( + gBrowser, + INITIAL_URL + ); + let tab1Visibility = await getDocumentVisibilityState(tab1.linkedBrowser); + Assert.equal( + tab1Visibility, + "visible", + "The first tab should be foreground" + ); + + let formProcessedPromise = listenForTestNotification("FormProcessed"); + BrowserTestUtils.loadURIString(tab1.linkedBrowser, testUrl); + await formProcessedPromise; + gBrowser.removeTab(tab1); + }); +}); + +testUrls.forEach(testUrl => { + add_task(async function test_defer_autofill_until_visible() { + let result, tab1Visibility; + // open 2 tabs + const tab1 = await BrowserTestUtils.openNewForegroundTab( + gBrowser, + INITIAL_URL + ); + const tab2 = await BrowserTestUtils.openNewForegroundTab( + gBrowser, + INITIAL_URL + ); + + // confirm document is hidden + tab1Visibility = await getDocumentVisibilityState(tab1.linkedBrowser); + Assert.equal( + tab1Visibility, + "hidden", + "The first tab should be backgrounded" + ); + + // we shouldn't even try to autofill while hidden, so wait for the document to be in the + // non-visible pending queue instead. + let formFilled = false; + listenForTestNotification("FormProcessed").then(() => { + formFilled = true; + }); + BrowserTestUtils.loadURIString(tab1.linkedBrowser, testUrl); + + await TestUtils.waitForCondition(() => { + let windowGlobal = tab1.linkedBrowser.browsingContext.currentWindowGlobal; + if (!windowGlobal || windowGlobal.documentURI.spec == "about:blank") { + return false; + } + + let actor = windowGlobal.getActor("LoginManager"); + return actor.sendQuery("PasswordManager:formIsPending"); + }); + + Assert.ok( + !formFilled, + "Observer should not be notified when form is loaded into a hidden document" + ); + + // Add the observer before switching tab + let formProcessedPromise = listenForTestNotification("FormProcessed"); + await BrowserTestUtils.switchTab(gBrowser, tab1); + result = await formProcessedPromise; + tab1Visibility = await getDocumentVisibilityState(tab1.linkedBrowser); + Assert.equal( + tab1Visibility, + "visible", + "The first tab should be foreground" + ); + Assert.ok( + result, + "Observer should be notified when input's document becomes visible" + ); + + // the form should have been autofilled with the login + let fieldValues = await SpecialPowers.spawn( + tab1.linkedBrowser, + [], + function () { + let doc = content.document; + return { + username: doc.getElementById("form-basic-username").value, + password: doc.getElementById("form-basic-password")?.value, + }; + } + ); + Assert.equal(fieldValues.username, "user1", "Checking filled username"); + + // skip password test for a username-only form + if (![FORM_MULTIPAGE_URL].includes(testUrl)) { + Assert.equal(fieldValues.password, "pass1", "Checking filled password"); + } + + gBrowser.removeTab(tab1); + gBrowser.removeTab(tab2); + }); +}); + +testUrlsWithForm.forEach(testUrl => { + add_task(async function test_immediate_autofill_with_primarypassword() { + LoginTestUtils.primaryPassword.enable(); + await LoginTestUtils.reloadData(); + info( + `Have enabled primaryPassword, now isLoggedIn? ${Services.logins.isLoggedIn}` + ); + + registerCleanupFunction(async function () { + LoginTestUtils.primaryPassword.disable(); + await LoginTestUtils.reloadData(); + }); + + // open 2 tabs + const tab1 = await BrowserTestUtils.openNewForegroundTab( + gBrowser, + INITIAL_URL + ); + const tab2 = await BrowserTestUtils.openNewForegroundTab( + gBrowser, + INITIAL_URL + ); + + info( + "load a background login form tab with a matching saved login " + + "and wait to see if the primary password dialog is shown" + ); + Assert.equal( + await getDocumentVisibilityState(tab2.linkedBrowser), + "visible", + "The second tab should be visible" + ); + + const tab1Visibility = await getDocumentVisibilityState(tab1.linkedBrowser); + Assert.equal( + tab1Visibility, + "hidden", + "The first tab should be backgrounded" + ); + + const dialogObserved = waitForMPDialog("authenticate", tab1.ownerGlobal); + + // In this case we will try to autofill while hidden, so look for the passwordmgr-processed-form + // to be observed + let formProcessedPromise = listenForTestNotification("FormProcessed"); + BrowserTestUtils.loadURIString(tab1.linkedBrowser, testUrl); + await Promise.all([formProcessedPromise, dialogObserved]); + + Assert.ok( + formProcessedPromise, + "Observer should be notified when form is loaded into a hidden document" + ); + Assert.ok( + dialogObserved, + "MP Dialog should be shown when form is loaded into a hidden document" + ); + + gBrowser.removeTab(tab1); + gBrowser.removeTab(tab2); + }); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_autofill_http.js b/toolkit/components/passwordmgr/test/browser/browser_autofill_http.js new file mode 100644 index 0000000000..df80693673 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_autofill_http.js @@ -0,0 +1,135 @@ +const TEST_URL_PATH = + "://example.org/browser/toolkit/components/passwordmgr/test/browser/"; + +add_setup(async function () { + const login1 = LoginTestUtils.testData.formLogin({ + origin: "http://example.org", + formActionOrigin: "http://example.org", + username: "username", + password: "password", + }); + const login2 = LoginTestUtils.testData.formLogin({ + origin: "http://example.org", + formActionOrigin: "http://example.com", + username: "username", + password: "password", + }); + await Services.logins.addLogins([login1, login2]); + await SpecialPowers.pushPrefEnv({ + set: [["signon.autofillForms.http", false]], + }); +}); + +add_task(async function test_http_autofill() { + for (let scheme of ["http", "https"]) { + let formFilled = listenForTestNotification("FormProcessed"); + + let tab = await BrowserTestUtils.openNewForegroundTab( + gBrowser, + `${scheme}${TEST_URL_PATH}form_basic.html` + ); + + await formFilled; + + let [username, password] = await SpecialPowers.spawn( + gBrowser.selectedBrowser, + [], + async function () { + let doc = content.document; + let contentUsername = doc.getElementById("form-basic-username").value; + let contentPassword = doc.getElementById("form-basic-password").value; + return [contentUsername, contentPassword]; + } + ); + + Assert.equal( + username, + scheme == "http" ? "" : "username", + "Username filled correctly" + ); + Assert.equal( + password, + scheme == "http" ? "" : "password", + "Password filled correctly" + ); + + gBrowser.removeTab(tab); + } +}); + +add_task(async function test_iframe_in_http_autofill() { + for (let scheme of ["http", "https"]) { + // Wait for parent and child iframe to be processed. + let formFilled = listenForTestNotification("FormProcessed", 2); + + let tab = await BrowserTestUtils.openNewForegroundTab( + gBrowser, + `${scheme}${TEST_URL_PATH}form_basic_iframe.html` + ); + + await formFilled; + + let [username, password] = await SpecialPowers.spawn( + gBrowser.selectedBrowser.browsingContext.children[0], + [], + async function () { + let doc = this.content.document; + return [ + doc.getElementById("form-basic-username").value, + doc.getElementById("form-basic-password").value, + ]; + } + ); + + Assert.equal( + username, + scheme == "http" ? "" : "username", + "Username filled correctly" + ); + Assert.equal( + password, + scheme == "http" ? "" : "password", + "Password filled correctly" + ); + + gBrowser.removeTab(tab); + } +}); + +add_task(async function test_http_action_autofill() { + for (let type of ["insecure", "secure"]) { + let formFilled = listenForTestNotification("FormProcessed"); + + let tab = await BrowserTestUtils.openNewForegroundTab( + gBrowser, + `https${TEST_URL_PATH}form_cross_origin_${type}_action.html` + ); + + await formFilled; + + let [username, password] = await SpecialPowers.spawn( + gBrowser.selectedBrowser, + [], + async function () { + let doc = this.content.document; + return [ + doc.getElementById("form-basic-username").value, + doc.getElementById("form-basic-password").value, + ]; + } + ); + + Assert.equal( + username, + type == "insecure" ? "" : "username", + "Username filled correctly" + ); + Assert.equal( + password, + type == "insecure" ? "" : "password", + "Password filled correctly" + ); + + gBrowser.removeTab(tab); + } +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_autofill_track_filled_logins.js b/toolkit/components/passwordmgr/test/browser/browser_autofill_track_filled_logins.js new file mode 100644 index 0000000000..df9580828d --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_autofill_track_filled_logins.js @@ -0,0 +1,111 @@ +"use strict"; + +const TEST_HOSTNAME = "https://example.com"; +const BASIC_FORM_PAGE_PATH = DIRECTORY_PATH + "form_basic.html"; +const BASIC_FORM_NO_USERNAME_PAGE_PATH = + DIRECTORY_PATH + "form_basic_no_username.html"; + +add_task(async function test() { + let nsLoginInfo = new Components.Constructor( + "@mozilla.org/login-manager/loginInfo;1", + Ci.nsILoginInfo, + "init" + ); + for (let usernameRequested of [true, false]) { + info( + "Testing page with " + + (usernameRequested ? "" : "no ") + + "username requested" + ); + let url = usernameRequested + ? TEST_HOSTNAME + BASIC_FORM_PAGE_PATH + : TEST_HOSTNAME + BASIC_FORM_NO_USERNAME_PAGE_PATH; + + // The login here must be a different domain than the page for this testcase. + let login = new nsLoginInfo( + "https://example.org", + "https://example.org", + null, + "bob", + "mypassword", + "form-basic-username", + "form-basic-password" + ); + login = await Services.logins.addLoginAsync(login); + Assert.equal( + login.timesUsed, + 1, + "The timesUsed should be 1 after creation" + ); + + let tab = await BrowserTestUtils.openNewForegroundTab({ + gBrowser, + url, + }); + + // Convert the login object to a plain JS object for passing across process boundaries. + login = LoginHelper.loginToVanillaObject(login); + await SpecialPowers.spawn( + tab.linkedBrowser, + [{ login, usernameRequested }], + async ({ login: addedLogin, usernameRequested: aUsernameRequested }) => { + const { LoginFormFactory } = ChromeUtils.importESModule( + "resource://gre/modules/LoginFormFactory.sys.mjs" + ); + const { LoginManagerChild } = ChromeUtils.importESModule( + "resource://gre/modules/LoginManagerChild.sys.mjs" + ); + const { LoginHelper } = ChromeUtils.importESModule( + "resource://gre/modules/LoginHelper.sys.mjs" + ); + + let password = content.document.querySelector("#form-basic-password"); + let formLike = LoginFormFactory.createFromField(password); + info("Calling _fillForm with FormLike"); + addedLogin = LoginHelper.vanillaObjectToLogin(addedLogin); + LoginManagerChild.forWindow(content)._fillForm( + formLike, + [addedLogin], + null, + { + autofillForm: true, + clobberUsername: true, + clobberPassword: true, + userTriggered: true, + } + ); + + if (aUsernameRequested) { + let username = content.document.querySelector("#form-basic-username"); + Assert.equal(username.value, "bob", "Filled username should match"); + } + Assert.equal( + password.value, + "mypassword", + "Filled password should match" + ); + } + ); + + let processedPromise = listenForTestNotification("ShowDoorhanger"); + SpecialPowers.spawn(tab.linkedBrowser, [], () => { + content.document.getElementById("form-basic").submit(); + }); + await processedPromise; + + let logins = Services.logins.getAllLogins(); + + Assert.equal(logins.length, 1, "There should only be one login saved"); + Assert.equal( + logins[0].guid, + login.guid, + "The saved login should match the one added and used above" + ); + checkOnlyLoginWasUsedTwice({ justChanged: false }); + + BrowserTestUtils.removeTab(tab); + + // Reset all passwords before next iteration. + Services.logins.removeAllUserFacingLogins(); + } +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_basicAuth_multiTab.js b/toolkit/components/passwordmgr/test/browser/browser_basicAuth_multiTab.js new file mode 100644 index 0000000000..68f21d0ea4 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_basicAuth_multiTab.js @@ -0,0 +1,158 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +"use strict"; + +/** + * Tests that can show multiple auth prompts in different tabs and handle them + * correctly. + */ + +const ORIGIN1 = "https://example.com"; +const ORIGIN2 = "https://example.org"; + +const AUTH_PATH = + "/browser/toolkit/components/passwordmgr/test/browser/authenticate.sjs"; + +/** + * Opens a tab and navigates to the auth test path. + * @param {String} origin - Origin to open with test path. + * @param {Object} authOptions - Authentication options to pass to server and + * test for. + * @param {String} authOptions.user - Expected username. + * @param {String} authOptions.pass - Expected password. + * @param {String} authOptions.realm - Realm to return on auth request. + * @returns {Object} - An object containing passed origin and authOptions, + * opened tab, a promise which resolves once the tab loads, a promise which + * resolves once the prompt has been opened. + */ +async function openTabWithAuthPrompt(origin, authOptions) { + let tab = await BrowserTestUtils.openNewForegroundTab( + gBrowser, + "https://example.com" + ); + + let promptPromise = PromptTestUtils.waitForPrompt(tab.linkedBrowser, { + modalType: Services.prompt.MODAL_TYPE_TAB, + promptType: "promptUserAndPass", + }); + let url = new URL(origin + AUTH_PATH); + Object.entries(authOptions).forEach(([key, value]) => + url.searchParams.append(key, value) + ); + let loadPromise = BrowserTestUtils.browserLoaded( + tab.linkedBrowser, + false, + url.toString() + ); + info("Loading " + url.toString()); + BrowserTestUtils.loadURIString(tab.linkedBrowser, url.toString()); + return { origin, tab, authOptions, loadPromise, promptPromise }; +} + +/** + * Waits for tab to load and tests for expected auth state. + * @param {boolean} expectAuthed - true: auth success, false otherwise. + * @param {Object} tabInfo - Information about the tab as generated by + * openTabWithAuthPrompt. + */ +async function testTabAuthed(expectAuthed, { tab, loadPromise, authOptions }) { + // Wait for tab to load after auth. + await loadPromise; + Assert.ok(true, "Tab loads after auth"); + + // Fetch auth results from body (set by authenticate.sjs). + let { loginResult, user, pass } = await SpecialPowers.spawn( + tab.linkedBrowser, + [], + () => { + let result = {}; + result.loginResult = content.document.getElementById("ok").innerText; + result.user = content.document.getElementById("user").innerText; + result.pass = content.document.getElementById("pass").innerText; + return result; + } + ); + + Assert.equal( + loginResult == "PASS", + expectAuthed, + "Site has expected auth state" + ); + Assert.equal(user, expectAuthed ? authOptions.user : "", "Sent correct user"); + Assert.equal( + pass, + expectAuthed ? authOptions.pass : "", + "Sent correct password" + ); +} + +add_setup(async function () { + await SpecialPowers.pushPrefEnv({ + // This test relies on tab auth prompts. + set: [["prompts.modalType.httpAuth", Services.prompt.MODAL_TYPE_TAB]], + }); +}); + +add_task(async function test() { + let tabA = await openTabWithAuthPrompt(ORIGIN1, { + user: "userA", + pass: "passA", + realm: "realmA", + }); + // Tab B and C share realm and credentials. + // However, since the auth happens in separate tabs we should get two prompts. + let tabB = await openTabWithAuthPrompt(ORIGIN2, { + user: "userB", + pass: "passB", + realm: "realmB", + }); + let tabC = await openTabWithAuthPrompt(ORIGIN2, { + user: "userB", + pass: "passB", + realm: "realmB", + }); + let tabs = [tabA, tabB, tabC]; + + info(`Opening ${tabs.length} tabs with auth prompts`); + let prompts = await Promise.all(tabs.map(tab => tab.promptPromise)); + + Assert.equal(prompts.length, tabs.length, "Should have one prompt per tab"); + + for (let i = 0; i < prompts.length; i++) { + let titleEl = prompts[i].ui.prompt.document.querySelector("#titleText"); + Assert.equal( + titleEl.textContent, + new URL(tabs[i].origin).host, + "Prompt matches the tab's host" + ); + } + + // Interact with the prompts. This is deliberately done out of order + // (no FIFO, LIFO). + let [promptA, promptB, promptC] = prompts; + + // Accept prompt B with correct login details. + await PromptTestUtils.handlePrompt(promptB, { + loginInput: tabB.authOptions.user, + passwordInput: tabB.authOptions.pass, + }); + await testTabAuthed(true, tabB); + + // Accept prompt A with correct login details + await PromptTestUtils.handlePrompt(promptA, { + loginInput: tabA.authOptions.user, + passwordInput: tabA.authOptions.pass, + }); + await testTabAuthed(true, tabA); + + // Cancel prompt C + await PromptTestUtils.handlePrompt(promptC, { + buttonNumClick: 1, + }); + await testTabAuthed(false, tabC); + + // Cleanup tabs + tabs.forEach(({ tab }) => BrowserTestUtils.removeTab(tab)); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_basicAuth_rateLimit.js b/toolkit/components/passwordmgr/test/browser/browser_basicAuth_rateLimit.js new file mode 100644 index 0000000000..1da16090c9 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_basicAuth_rateLimit.js @@ -0,0 +1,146 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +// This tests that the basic auth dialog can not be used for DOS attacks +// and that the protections are reset on user-initiated navigation/reload. + +let promptModalType = Services.prefs.getIntPref("prompts.modalType.httpAuth"); + +function promiseAuthWindowShown() { + return PromptTestUtils.handleNextPrompt( + window, + { modalType: promptModalType, promptType: "promptUserAndPass" }, + { buttonNumClick: 1 } + ); +} + +add_task(async function test() { + await BrowserTestUtils.withNewTab( + "https://example.com", + async function (browser) { + let cancelDialogLimit = Services.prefs.getIntPref( + "prompts.authentication_dialog_abuse_limit" + ); + + let authShown = promiseAuthWindowShown(); + let browserLoaded = BrowserTestUtils.browserLoaded(browser); + BrowserTestUtils.loadURIString( + browser, + "https://example.com/browser/toolkit/components/passwordmgr/test/browser/authenticate.sjs" + ); + await authShown; + Assert.ok(true, "Seen dialog number 1"); + await browserLoaded; + Assert.ok(true, "Loaded document number 1"); + + // Reload the document a bit more often than should be allowed. + // As long as we're in the acceptable range we should receive + // auth prompts, otherwise we should not receive them and the + // page should just load. + // We've already seen the dialog once, hence we start the loop at 1. + for (let i = 1; i < cancelDialogLimit + 2; i++) { + if (i < cancelDialogLimit) { + authShown = promiseAuthWindowShown(); + } + browserLoaded = BrowserTestUtils.browserLoaded(browser); + SpecialPowers.spawn(browser, [], function () { + content.document.location.reload(); + }); + if (i < cancelDialogLimit) { + await authShown; + Assert.ok(true, `Seen dialog number ${i + 1}`); + } + await browserLoaded; + Assert.ok(true, `Loaded document number ${i + 1}`); + } + + let reloadButton = document.getElementById("reload-button"); + await TestUtils.waitForCondition( + () => !reloadButton.hasAttribute("disabled") + ); + + // Verify that we can click the reload button to reset the counter. + authShown = promiseAuthWindowShown(); + browserLoaded = BrowserTestUtils.browserLoaded(browser); + reloadButton.click(); + await authShown; + Assert.ok(true, "Seen dialog number 1"); + await browserLoaded; + Assert.ok(true, "Loaded document number 1"); + + // Now check loading subresources with auth on the page. + browserLoaded = BrowserTestUtils.browserLoaded(browser); + BrowserTestUtils.loadURIString(browser, "https://example.com"); + await browserLoaded; + + // We've already seen the dialog once, hence we start the loop at 1. + for (let i = 1; i < cancelDialogLimit + 2; i++) { + if (i < cancelDialogLimit) { + authShown = promiseAuthWindowShown(); + } + + let iframeLoaded = SpecialPowers.spawn(browser, [], async function () { + let doc = content.document; + let iframe = doc.createElement("iframe"); + doc.body.appendChild(iframe); + let loaded = new Promise(resolve => { + iframe.addEventListener( + "load", + function (e) { + resolve(); + }, + { once: true } + ); + }); + iframe.src = + "https://example.com/browser/toolkit/components/passwordmgr/test/browser/authenticate.sjs"; + await loaded; + }); + + if (i < cancelDialogLimit) { + await authShown; + Assert.ok(true, `Seen dialog number ${i + 1}`); + } + + await iframeLoaded; + Assert.ok(true, `Loaded iframe number ${i + 1}`); + } + + // Verify that third party subresources can not spawn new auth dialogs. + let iframeLoaded = SpecialPowers.spawn(browser, [], async function () { + let doc = content.document; + let iframe = doc.createElement("iframe"); + doc.body.appendChild(iframe); + let loaded = new Promise(resolve => { + iframe.addEventListener( + "load", + function (e) { + resolve(); + }, + { once: true } + ); + }); + iframe.src = + "https://example.org/browser/toolkit/components/passwordmgr/test/browser/authenticate.sjs"; + await loaded; + }); + + await iframeLoaded; + Assert.ok( + true, + "Loaded a third party iframe without showing the auth dialog" + ); + + // Verify that pressing enter in the urlbar also resets the counter. + authShown = promiseAuthWindowShown(); + browserLoaded = BrowserTestUtils.browserLoaded(browser); + gURLBar.value = + "https://example.com/browser/toolkit/components/passwordmgr/test/browser/authenticate.sjs"; + gURLBar.focus(); + EventUtils.synthesizeKey("KEY_Enter"); + await authShown; + await browserLoaded; + } + ); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_basicAuth_switchTab.js b/toolkit/components/passwordmgr/test/browser/browser_basicAuth_switchTab.js new file mode 100644 index 0000000000..32bcd13ae4 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_basicAuth_switchTab.js @@ -0,0 +1,34 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +let modalType = Services.prefs.getIntPref("prompts.modalType.httpAuth"); + +add_task(async function test() { + let tab = BrowserTestUtils.addTab(gBrowser); + isnot(tab, gBrowser.selectedTab, "New tab shouldn't be selected"); + + let authPromptShown = PromptTestUtils.waitForPrompt(tab.linkedBrowser, { + modalType, + promptType: "promptUserAndPass", + }); + + let loadPromise = BrowserTestUtils.browserLoaded(tab.linkedBrowser); + BrowserTestUtils.loadURIString( + tab.linkedBrowser, + "https://example.com/browser/toolkit/components/passwordmgr/test/browser/authenticate.sjs" + ); + + // Wait for the basic auth prompt + let dialog = await authPromptShown; + + Assert.equal(gBrowser.selectedTab, tab, "Should have selected the new tab"); + + // Cancel the auth prompt + PromptTestUtils.handlePrompt(dialog, { buttonNumClick: 1 }); + + // After closing the prompt the load should finish + await loadPromise; + + gBrowser.removeTab(tab); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_context_menu.js b/toolkit/components/passwordmgr/test/browser/browser_context_menu.js new file mode 100644 index 0000000000..63e161c003 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_context_menu.js @@ -0,0 +1,678 @@ +/** + * Test the password manager context menu. + */ + +/* eslint no-shadow:"off" */ + +"use strict"; + +// The origin for the test URIs. +const TEST_ORIGIN = "https://example.com"; +const MULTIPLE_FORMS_PAGE_PATH = + "/browser/toolkit/components/passwordmgr/test/browser/multiple_forms.html"; + +const CONTEXT_MENU = document.getElementById("contentAreaContextMenu"); +const POPUP_HEADER = document.getElementById("fill-login"); + +/** + * Initialize logins needed for the tests and disable autofill + * for login forms for easier testing of manual fill. + */ +add_task(async function test_initialize() { + Services.prefs.setBoolPref("signon.autofillForms", false); + Services.prefs.setBoolPref("signon.usernameOnlyForm.enabled", true); + registerCleanupFunction(() => { + Services.prefs.clearUserPref("signon.autofillForms"); + Services.prefs.clearUserPref("signon.schemeUpgrades"); + Services.prefs.clearUserPref("signon.usernameOnlyForm.enabled"); + }); + await Services.logins.addLogins(loginList()); +}); + +/** + * Check if the context menu is populated with the right + * menuitems for the target password input field. + */ +add_task(async function test_context_menu_populate_password_noSchemeUpgrades() { + Services.prefs.setBoolPref("signon.schemeUpgrades", false); + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_ORIGIN + MULTIPLE_FORMS_PAGE_PATH, + }, + async function (browser) { + await openPasswordContextMenu(browser, "#test-password-1"); + + // Check the content of the password manager popup + let popupMenu = document.getElementById("fill-login-popup"); + checkMenu(popupMenu, 2); + + await closePopup(CONTEXT_MENU); + } + ); +}); + +/** + * Check if the context menu is populated with the right + * menuitems for the target password input field. + */ +add_task(async function test_context_menu_populate_password_schemeUpgrades() { + Services.prefs.setBoolPref("signon.schemeUpgrades", true); + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_ORIGIN + MULTIPLE_FORMS_PAGE_PATH, + }, + async function (browser) { + await openPasswordContextMenu(browser, "#test-password-1"); + + // Check the content of the password manager popup + let popupMenu = document.getElementById("fill-login-popup"); + checkMenu(popupMenu, 3); + + await closePopup(CONTEXT_MENU); + } + ); +}); + +/** + * Check if the context menu is populated with the right menuitems + * for the target username field with a password field present. + */ +add_task( + async function test_context_menu_populate_username_with_password_noSchemeUpgrades() { + Services.prefs.setBoolPref("signon.schemeUpgrades", false); + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: + TEST_ORIGIN + + "/browser/toolkit/components/" + + "passwordmgr/test/browser/multiple_forms.html", + }, + async function (browser) { + await openPasswordContextMenu(browser, "#test-username-3"); + + // Check the content of the password manager popup + let popupMenu = document.getElementById("fill-login-popup"); + checkMenu(popupMenu, 2); + + await closePopup(CONTEXT_MENU); + } + ); + } +); +/** + * Check if the context menu is populated with the right menuitems + * for the target username field with a password field present. + */ +add_task( + async function test_context_menu_populate_username_with_password_schemeUpgrades() { + Services.prefs.setBoolPref("signon.schemeUpgrades", true); + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: + TEST_ORIGIN + + "/browser/toolkit/components/" + + "passwordmgr/test/browser/multiple_forms.html", + }, + async function (browser) { + await openPasswordContextMenu(browser, "#test-username-3"); + + // Check the content of the password manager popup + let popupMenu = document.getElementById("fill-login-popup"); + checkMenu(popupMenu, 3); + + await closePopup(CONTEXT_MENU); + } + ); + } +); + +/** + * Check if the context menu is populated with the right menuitems + * for the target username field without a password field present. + */ +add_task( + async function test_context_menu_populate_username_with_password_noSchemeUpgrades() { + Services.prefs.setBoolPref("signon.schemeUpgrades", false); + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: + TEST_ORIGIN + + "/browser/toolkit/components/" + + "passwordmgr/test/browser/multiple_forms.html", + }, + async function (browser) { + await openPasswordContextMenu(browser, "#test-username-1"); + + // Check the content of the password manager popup + let popupMenu = document.getElementById("fill-login-popup"); + checkMenu(popupMenu, 2); + + await closePopup(CONTEXT_MENU); + } + ); + } +); +/** + * Check if the context menu is populated with the right menuitems + * for the target username field without a password field present. + */ +add_task( + async function test_context_menu_populate_username_with_password_schemeUpgrades() { + Services.prefs.setBoolPref("signon.schemeUpgrades", true); + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: + TEST_ORIGIN + + "/browser/toolkit/components/" + + "passwordmgr/test/browser/multiple_forms.html", + }, + async function (browser) { + await openPasswordContextMenu(browser, "#test-username-1"); + + // Check the content of the password manager popup + let popupMenu = document.getElementById("fill-login-popup"); + checkMenu(popupMenu, 3); + + await closePopup(CONTEXT_MENU); + } + ); + } +); + +/** + * Check if the password field is correctly filled when one + * login menuitem is clicked. + */ +add_task(async function test_context_menu_password_fill() { + Services.prefs.setBoolPref("signon.schemeUpgrades", true); + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_ORIGIN + MULTIPLE_FORMS_PAGE_PATH, + }, + async function (browser) { + let formDescriptions = await SpecialPowers.spawn( + browser, + [], + async function () { + let forms = Array.from( + content.document.getElementsByClassName("test-form") + ); + return forms.map(f => f.getAttribute("description")); + } + ); + + for (let description of formDescriptions) { + info("Testing form: " + description); + + let passwordInputIds = await SpecialPowers.spawn( + browser, + [{ description }], + async function ({ description }) { + let formElement = content.document.querySelector( + `[description="${description}"]` + ); + let passwords = Array.from( + formElement.querySelectorAll( + "input[type='password'], input[data-type='password']" + ) + ); + return passwords.map(p => p.id); + } + ); + + for (let inputId of passwordInputIds) { + info("Testing password field: " + inputId); + + // Synthesize a right mouse click over the password input element. + await openPasswordContextMenu( + browser, + "#" + inputId, + async function () { + let inputDisabled = await SpecialPowers.spawn( + browser, + [{ inputId }], + async function ({ inputId }) { + let input = content.document.getElementById(inputId); + return input.disabled || input.readOnly; + } + ); + + // If the password field is disabled or read-only, we want to see + // the disabled Fill Password popup header. + if (inputDisabled) { + Assert.ok(!POPUP_HEADER.hidden, "Popup menu is not hidden."); + Assert.ok(POPUP_HEADER.disabled, "Popup menu is disabled."); + await closePopup(CONTEXT_MENU); + } + Assert.equal( + POPUP_HEADER.getAttribute("data-l10n-id"), + "main-context-menu-use-saved-password", + "top-level label is correct" + ); + + return !inputDisabled; + } + ); + + if (CONTEXT_MENU.state != "open") { + continue; + } + + // The only field affected by the password fill + // should be the target password field itself. + await assertContextMenuFill(browser, description, null, inputId, 1); + await SpecialPowers.spawn( + browser, + [{ inputId }], + async function ({ inputId }) { + let passwordField = content.document.getElementById(inputId); + Assert.equal( + passwordField.value, + "password1", + "Check upgraded login was actually used" + ); + } + ); + + await closePopup(CONTEXT_MENU); + } + } + } + ); +}); + +/** + * Check if the form is correctly filled when one + * username context menu login menuitem is clicked. + */ +add_task(async function test_context_menu_username_login_fill() { + Services.prefs.setBoolPref("signon.schemeUpgrades", true); + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_ORIGIN + MULTIPLE_FORMS_PAGE_PATH, + }, + async function (browser) { + let formDescriptions = await SpecialPowers.spawn( + browser, + [], + async function () { + let forms = Array.from( + content.document.getElementsByClassName("test-form") + ); + return forms.map(f => f.getAttribute("description")); + } + ); + + for (let description of formDescriptions) { + info("Testing form: " + description); + let usernameInputIds = await SpecialPowers.spawn( + browser, + [{ description }], + async function ({ description }) { + let formElement = content.document.querySelector( + `[description="${description}"]` + ); + let inputs = Array.from( + formElement.querySelectorAll( + "input[type='text']:not([data-type='password'])" + ) + ); + return inputs.map(p => p.id); + } + ); + + for (let inputId of usernameInputIds) { + info("Testing username field: " + inputId); + + // Synthesize a right mouse click over the username input element. + await openPasswordContextMenu( + browser, + "#" + inputId, + async function () { + let headerHidden = POPUP_HEADER.hidden; + let headerDisabled = POPUP_HEADER.disabled; + let headerLabelID = POPUP_HEADER.getAttribute("data-l10n-id"); + + let data = { + description, + inputId, + headerHidden, + headerDisabled, + headerLabelID, + }; + let shouldContinue = await SpecialPowers.spawn( + browser, + [data], + async function (data) { + let { + description, + inputId, + headerHidden, + headerDisabled, + headerLabelID, + } = data; + let formElement = content.document.querySelector( + `[description="${description}"]` + ); + let usernameField = content.document.getElementById(inputId); + // We always want to check if the first password field is filled, + // since this is the current behavior from the _fillForm function. + let passwordField = formElement.querySelector( + "input[type='password'], input[data-type='password']" + ); + + // If we don't want to see the actual popup menu, + // check if the popup is hidden or disabled. + if ( + !passwordField || + usernameField.disabled || + usernameField.readOnly || + passwordField.disabled || + passwordField.readOnly + ) { + if (!passwordField) { + // Should show popup for a username-only form. + if (usernameField.autocomplete == "username") { + Assert.ok(!headerHidden, "Popup menu is not hidden."); + } else { + Assert.ok(headerHidden, "Popup menu is hidden."); + } + } else { + Assert.ok(!headerHidden, "Popup menu is not hidden."); + Assert.ok(headerDisabled, "Popup menu is disabled."); + } + return false; + } + Assert.equal( + headerLabelID, + "main-context-menu-use-saved-login", + "top-level label is correct" + ); + return true; + } + ); + + if (!shouldContinue) { + await closePopup(CONTEXT_MENU); + } + + return shouldContinue; + } + ); + + if (CONTEXT_MENU.state != "open") { + continue; + } + + let passwordFieldId = await SpecialPowers.spawn( + browser, + [{ description }], + async function ({ description }) { + let formElement = content.document.querySelector( + `[description="${description}"]` + ); + return formElement.querySelector( + "input[type='password'], input[data-type='password']" + ).id; + } + ); + + // We shouldn't change any field that's not the target username field or the first password field + await assertContextMenuFill( + browser, + description, + inputId, + passwordFieldId, + 1 + ); + + await SpecialPowers.spawn( + browser, + [{ passwordFieldId }], + async function ({ passwordFieldId }) { + let passwordField = + content.document.getElementById(passwordFieldId); + if (!passwordField.hasAttribute("expectedFail")) { + Assert.equal( + passwordField.value, + "password1", + "Check upgraded login was actually used" + ); + } + } + ); + + await closePopup(CONTEXT_MENU); + } + } + } + ); +}); + +/** + * Check event telemetry is correctly recorded when opening the saved logins / management UI + * from the context menu + */ +add_task(async function test_context_menu_open_management() { + Services.prefs.setBoolPref("signon.schemeUpgrades", false); + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_ORIGIN + MULTIPLE_FORMS_PAGE_PATH, + }, + async function (browser) { + await openPasswordContextMenu(browser, "#test-password-1"); + + let openingFunc = () => gContextMenu.openPasswordManager(); + // wait until the management UI opens + let passwordManager = await openPasswordManager(openingFunc); + info("Management UI dialog was opened"); + + TelemetryTestUtils.assertEvents( + [["pwmgr", "open_management", "contextmenu"]], + { category: "pwmgr", method: "open_management" }, + { clear: true, process: "content" } + ); + + await passwordManager.close(); + await closePopup(CONTEXT_MENU); + } + ); +}); + +/** + * Verify that only the expected form fields are filled. + */ +async function assertContextMenuFill( + browser, + formId, + usernameFieldId, + passwordFieldId, + loginIndex +) { + let popupMenu = document.getElementById("fill-login-popup"); + let unchangedSelector = `[description="${formId}"] input:not(#${passwordFieldId})`; + + if (usernameFieldId) { + unchangedSelector += `:not(#${usernameFieldId})`; + } + + await SpecialPowers.spawn( + browser, + [{ unchangedSelector }], + async function ({ unchangedSelector }) { + let unchangedFields = + content.document.querySelectorAll(unchangedSelector); + + // Store the value of fields that should remain unchanged. + if (unchangedFields.length) { + for (let field of unchangedFields) { + field.setAttribute("original-value", field.value); + } + } + } + ); + + // Execute the default command of the specified login menuitem found in the context menu. + let loginItem = + popupMenu.getElementsByClassName("context-login-item")[loginIndex]; + + // Find the used login by it's username (Use only unique usernames in this test). + let { username, password } = getLoginFromUsername(loginItem.label); + + let data = { + username, + password, + usernameFieldId, + passwordFieldId, + formId, + unchangedSelector, + }; + let continuePromise = ContentTask.spawn(browser, data, async function (data) { + let { + username, + password, + usernameFieldId, + passwordFieldId, + formId, + unchangedSelector, + } = data; + let form = content.document.querySelector(`[description="${formId}"]`); + await ContentTaskUtils.waitForEvent( + form, + "input", + "Username input value changed" + ); + + if (usernameFieldId) { + let usernameField = content.document.getElementById(usernameFieldId); + + // If we have an username field, check if it's correctly filled + if (usernameField.getAttribute("expectedFail") == null) { + Assert.equal( + username, + usernameField.value, + "Username filled and correct." + ); + } + } + + if (passwordFieldId) { + let passwordField = content.document.getElementById(passwordFieldId); + + // If we have a password field, check if it's correctly filled + if (passwordField && passwordField.getAttribute("expectedFail") == null) { + Assert.equal( + password, + passwordField.value, + "Password filled and correct." + ); + } + } + + let unchangedFields = content.document.querySelectorAll(unchangedSelector); + + // Check that all fields that should not change have the same value as before. + if (unchangedFields.length) { + Assert.ok(() => { + for (let field of unchangedFields) { + if (field.value != field.getAttribute("original-value")) { + return false; + } + } + return true; + }, "Other fields were not changed."); + } + }); + + loginItem.doCommand(); + + return continuePromise; +} + +/** + * Check if every login that matches the page origin are available at the context menu. + * @param {Element} contextMenu + * @param {Number} expectedCount - Number of logins expected in the context menu. Used to ensure + * we continue testing something useful. + */ +function checkMenu(contextMenu, expectedCount) { + let logins = loginList().filter(login => { + return LoginHelper.isOriginMatching(login.origin, TEST_ORIGIN, { + schemeUpgrades: Services.prefs.getBoolPref("signon.schemeUpgrades"), + }); + }); + // Make an array of menuitems for easier comparison. + let menuitems = [ + ...CONTEXT_MENU.getElementsByClassName("context-login-item"), + ]; + Assert.equal( + menuitems.length, + expectedCount, + "Expected number of menu items" + ); + Assert.ok( + logins.every(l => menuitems.some(m => l.username == m.label)), + "Every login have an item at the menu." + ); +} + +/** + * Search for a login by it's username. + * + * Only unique login/origin combinations should be used at this test. + */ +function getLoginFromUsername(username) { + return loginList().find(login => login.username == username); +} + +/** + * List of logins used for the test. + * + * We should only use unique usernames in this test, + * because we need to search logins by username. There is one duplicate u+p combo + * in order to test de-duping in the menu. + */ +function loginList() { + return [ + LoginTestUtils.testData.formLogin({ + origin: "https://example.com", + formActionOrigin: "https://example.com", + username: "username", + password: "password", + }), + // Same as above but HTTP in order to test de-duping. + LoginTestUtils.testData.formLogin({ + origin: "http://example.com", + formActionOrigin: "http://example.com", + username: "username", + password: "password", + }), + LoginTestUtils.testData.formLogin({ + origin: "http://example.com", + formActionOrigin: "http://example.com", + username: "username1", + password: "password1", + }), + LoginTestUtils.testData.formLogin({ + origin: "https://example.com", + formActionOrigin: "https://example.com", + username: "username2", + password: "password2", + }), + LoginTestUtils.testData.formLogin({ + origin: "http://example.org", + formActionOrigin: "http://example.org", + username: "username-cross-origin", + password: "password-cross-origin", + }), + ]; +} diff --git a/toolkit/components/passwordmgr/test/browser/browser_context_menu_autocomplete_interaction.js b/toolkit/components/passwordmgr/test/browser/browser_context_menu_autocomplete_interaction.js new file mode 100644 index 0000000000..8ffe07a673 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_context_menu_autocomplete_interaction.js @@ -0,0 +1,120 @@ +/* eslint-disable mozilla/no-arbitrary-setTimeout */ +/* + * Test the password manager context menu interaction with autocomplete. + */ + +"use strict"; + +const TEST_ORIGIN = "https://example.com"; +const BASIC_FORM_PAGE_PATH = DIRECTORY_PATH + "form_basic.html"; + +/** + * Initialize logins needed for the tests and disable autofill + * for login forms for easier testing of manual fill. + */ +add_task(async function test_initialize() { + let autocompletePopup = document.getElementById("PopupAutoComplete"); + Services.prefs.setBoolPref("signon.autofillForms", false); + registerCleanupFunction(() => { + Services.prefs.clearUserPref("signon.autofillForms"); + autocompletePopup.removeEventListener( + "popupshowing", + autocompleteUnexpectedPopupShowing + ); + }); + await Services.logins.addLogins(loginList()); + autocompletePopup.addEventListener( + "popupshowing", + autocompleteUnexpectedPopupShowing + ); +}); + +add_task(async function test_context_menu_username() { + let formFilled = listenForTestNotification("FormProcessed"); + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_ORIGIN + BASIC_FORM_PAGE_PATH, + }, + async function (browser) { + await formFilled; + await openContextMenu(browser, "#form-basic-username"); + + let contextMenu = document.getElementById("contentAreaContextMenu"); + Assert.equal(contextMenu.state, "open", "Context menu opened"); + contextMenu.hidePopup(); + } + ); +}); + +add_task(async function test_context_menu_password() { + let formFilled = listenForTestNotification("FormProcessed"); + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_ORIGIN + BASIC_FORM_PAGE_PATH, + }, + async function (browser) { + await formFilled; + await openContextMenu(browser, "#form-basic-password"); + + let contextMenu = document.getElementById("contentAreaContextMenu"); + Assert.equal(contextMenu.state, "open", "Context menu opened"); + contextMenu.hidePopup(); + } + ); +}); + +function autocompleteUnexpectedPopupShowing(event) { + Assert.ok(false, "Autocomplete shouldn't appear"); + event.target.hidePopup(); +} + +/** + * Synthesize mouse clicks to open the context menu popup + * for a target login input element. + */ +async function openContextMenu(browser, loginInput) { + // First synthesize a mousedown. We need this to get the focus event with the "contextmenu" event. + let eventDetails1 = { type: "mousedown", button: 2 }; + await BrowserTestUtils.synthesizeMouseAtCenter( + loginInput, + eventDetails1, + browser + ); + + // Then synthesize the contextmenu click over the input element. + let contextMenuShownPromise = BrowserTestUtils.waitForEvent( + window, + "popupshown" + ); + let eventDetails = { type: "contextmenu", button: 2 }; + await BrowserTestUtils.synthesizeMouseAtCenter( + loginInput, + eventDetails, + browser + ); + await contextMenuShownPromise; + + // Wait to see which popups are shown. + await new Promise(resolve => setTimeout(resolve, 1000)); +} + +function loginList() { + return [ + LoginTestUtils.testData.formLogin({ + origin: "https://example.com", + formActionOrigin: "https://example.com", + username: "username", + password: "password", + }), + LoginTestUtils.testData.formLogin({ + origin: "https://example.com", + formActionOrigin: "https://example.com", + username: "username2", + password: "password2", + }), + ]; +} diff --git a/toolkit/components/passwordmgr/test/browser/browser_context_menu_generated_password.js b/toolkit/components/passwordmgr/test/browser/browser_context_menu_generated_password.js new file mode 100644 index 0000000000..4e4edb7b14 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_context_menu_generated_password.js @@ -0,0 +1,482 @@ +/** + * Test the password manager context menu item can fill password fields with a generated password. + */ + +/* eslint no-shadow:"off" */ + +"use strict"; + +// The origin for the test URIs. +const TEST_ORIGIN = "https://example.com"; +const FORM_PAGE_PATH = + "/browser/toolkit/components/passwordmgr/test/browser/form_basic_login.html"; +const CONTEXT_MENU = document.getElementById("contentAreaContextMenu"); + +const passwordInputSelector = "#form-basic-password"; + +registerCleanupFunction(async function cleanup_resetPrefs() { + await SpecialPowers.popPrefEnv(); +}); + +add_setup(async function () { + await SpecialPowers.pushPrefEnv({ + set: [ + ["signon.generation.available", true], + ["signon.generation.enabled", true], + ], + }); + // assert that there are no logins + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 0, "There are no logins"); +}); + +add_task(async function test_hidden_by_prefs() { + await SpecialPowers.pushPrefEnv({ + set: [ + ["signon.generation.available", true], + ["signon.generation.enabled", false], + ], + }); + + // test that the generated password option is not present when the feature is not enabled + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_ORIGIN + FORM_PAGE_PATH, + }, + async function (browser) { + await SimpleTest.promiseFocus(browser.ownerGlobal); + + await openPasswordContextMenu(browser, passwordInputSelector); + let generatedPasswordItem = document.getElementById( + "fill-login-generated-password" + ); + Assert.ok( + !BrowserTestUtils.is_visible(generatedPasswordItem), + "generated password item is hidden" + ); + + CONTEXT_MENU.hidePopup(); + } + ); + await SpecialPowers.popPrefEnv(); +}); + +add_task(async function test_fill_hidden_by_login_saving_disabled() { + // test that the generated password option is not present when the user + // disabled password saving for the site. + Services.logins.setLoginSavingEnabled(TEST_ORIGIN, false); + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_ORIGIN + FORM_PAGE_PATH, + }, + async function (browser) { + await SimpleTest.promiseFocus(browser.ownerGlobal); + + await openPasswordContextMenu(browser, passwordInputSelector); + let generatedPasswordItem = document.getElementById( + "fill-login-generated-password" + ); + Assert.ok( + !BrowserTestUtils.is_visible(generatedPasswordItem), + "generated password item is hidden" + ); + + CONTEXT_MENU.hidePopup(); + } + ); + + Services.logins.setLoginSavingEnabled(TEST_ORIGIN, true); +}); + +add_task(async function test_fill_hidden_by_locked_primary_password() { + // test that the generated password option is not present when the user + // didn't unlock the primary password. + LoginTestUtils.primaryPassword.enable(); + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_ORIGIN + FORM_PAGE_PATH, + }, + async function (browser) { + await SimpleTest.promiseFocus(browser.ownerGlobal); + + await openPasswordContextMenu( + browser, + passwordInputSelector, + () => false + ); + let generatedPasswordItem = document.getElementById( + "fill-login-generated-password" + ); + Assert.ok( + BrowserTestUtils.is_visible(generatedPasswordItem), + "generated password item is visible" + ); + Assert.ok( + generatedPasswordItem.disabled, + "generated password item is disabled" + ); + + CONTEXT_MENU.hidePopup(); + } + ); + + LoginTestUtils.primaryPassword.disable(); +}); + +add_task(async function fill_generated_password_empty_field() { + // test that we can fill with generated password into an empty password field + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_ORIGIN + FORM_PAGE_PATH, + }, + async function (browser) { + await SimpleTest.promiseFocus(browser.ownerGlobal); + await SpecialPowers.spawn( + browser, + [[passwordInputSelector]], + function checkInitialFieldValue(inputSelector) { + const input = content.document.querySelector(inputSelector); + Assert.equal(input.value.length, 0, "Password field is empty"); + Assert.ok( + !input.matches(":autofill"), + "Password field should not be highlighted" + ); + } + ); + + await doFillGeneratedPasswordContextMenuItem( + browser, + passwordInputSelector + ); + await SpecialPowers.spawn( + browser, + [[passwordInputSelector]], + function checkFinalFieldValue(inputSelector) { + let { LoginTestUtils: LTU } = ChromeUtils.importESModule( + "resource://testing-common/LoginTestUtils.sys.mjs" + ); + const input = content.document.querySelector(inputSelector); + Assert.equal( + input.value.length, + LTU.generation.LENGTH, + "Password field was filled with generated password" + ); + Assert.ok( + input.matches(":autofill"), + "Password field should be highlighted" + ); + LTU.loginField.checkPasswordMasked(input, false, "after fill"); + + info("cleaing the field"); + input.setUserInput(""); + } + ); + + let acPopup = document.getElementById("PopupAutoComplete"); + await openACPopup(acPopup, browser, passwordInputSelector); + + let pwgenItem = acPopup.querySelector( + `[originaltype="generatedPassword"]` + ); + Assert.ok( + !pwgenItem || EventUtils.isHidden(pwgenItem), + "pwgen item should no longer be shown" + ); + + await closePopup(acPopup); + } + ); +}); + +add_task(async function fill_generated_password_nonempty_field() { + // test that we can fill with generated password into an non-empty password field + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_ORIGIN + FORM_PAGE_PATH, + }, + async function (browser) { + await SimpleTest.promiseFocus(browser.ownerGlobal); + await changeContentFormValues(browser, { + [passwordInputSelector]: "aa", + }); + await SpecialPowers.spawn( + browser, + [[passwordInputSelector]], + function checkInitialFieldValue(inputSelector) { + const input = content.document.querySelector(inputSelector); + Assert.ok( + !input.matches(":autofill"), + "Password field should not be highlighted" + ); + } + ); + + await doFillGeneratedPasswordContextMenuItem( + browser, + passwordInputSelector + ); + await SpecialPowers.spawn( + browser, + [[passwordInputSelector]], + function checkFinalFieldValue(inputSelector) { + let { LoginTestUtils: LTU } = ChromeUtils.importESModule( + "resource://testing-common/LoginTestUtils.sys.mjs" + ); + const input = content.document.querySelector(inputSelector); + Assert.equal( + input.value.length, + LTU.generation.LENGTH, + "Password field was filled with generated password" + ); + Assert.ok( + input.matches(":autofill"), + "Password field should be highlighted" + ); + LTU.loginField.checkPasswordMasked(input, false, "after fill"); + } + ); + } + ); + LoginTestUtils.clearData(); + LoginTestUtils.resetGeneratedPasswordsCache(); +}); + +add_task(async function fill_generated_password_with_matching_logins() { + // test that we can fill a generated password when there are matching logins + let login = LoginTestUtils.testData.formLogin({ + origin: "https://example.com", + formActionOrigin: "https://example.com", + username: "username", + password: "pass1", + }); + let storageChangedPromised = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "addLogin" + ); + await Services.logins.addLoginAsync(login); + await storageChangedPromised; + + let formFilled = listenForTestNotification("FormProcessed"); + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_ORIGIN + FORM_PAGE_PATH, + }, + async function (browser) { + await SimpleTest.promiseFocus(browser.ownerGlobal); + await formFilled; + await SpecialPowers.spawn( + browser, + [[passwordInputSelector]], + function checkInitialFieldValue(inputSelector) { + Assert.equal( + content.document.querySelector(inputSelector).value, + "pass1", + "Password field has initial value" + ); + } + ); + + await doFillGeneratedPasswordContextMenuItem( + browser, + passwordInputSelector + ); + await SpecialPowers.spawn( + browser, + [[passwordInputSelector]], + function checkFinalFieldValue(inputSelector) { + let { LoginTestUtils: LTU } = ChromeUtils.importESModule( + "resource://testing-common/LoginTestUtils.sys.mjs" + ); + const input = content.document.querySelector(inputSelector); + Assert.equal( + input.value.length, + LTU.generation.LENGTH, + "Password field was filled with generated password" + ); + Assert.ok( + input.matches(":autofill"), + "Password field should be highlighted" + ); + LTU.loginField.checkPasswordMasked(input, false, "after fill"); + } + ); + + await openPasswordContextMenu(browser, passwordInputSelector); + + // Execute the command of the first login menuitem found at the context menu. + let passwordChangedPromise = ContentTask.spawn( + browser, + null, + async function () { + let passwordInput = content.document.getElementById( + "form-basic-password" + ); + await ContentTaskUtils.waitForEvent(passwordInput, "input"); + } + ); + + let popupMenu = document.getElementById("fill-login-popup"); + let firstLoginItem = + popupMenu.getElementsByClassName("context-login-item")[0]; + firstLoginItem.doCommand(); + + await passwordChangedPromise; + + let contextMenu = document.getElementById("contentAreaContextMenu"); + contextMenu.hidePopup(); + + // Blur the field to trigger a 'change' event. + await BrowserTestUtils.synthesizeKey("KEY_Tab", undefined, browser); + await BrowserTestUtils.synthesizeKey( + "KEY_Tab", + { shiftKey: true }, + browser + ); + + await SpecialPowers.spawn( + browser, + [[passwordInputSelector]], + function checkFieldNotGeneratedPassword(inputSelector) { + let { LoginTestUtils: LTU } = ChromeUtils.importESModule( + "resource://testing-common/LoginTestUtils.sys.mjs" + ); + const input = content.document.querySelector(inputSelector); + Assert.equal( + input.value, + "pass1", + "Password field was filled with the saved password" + ); + LTU.loginField.checkPasswordMasked( + input, + true, + "after fill of a saved login" + ); + } + ); + } + ); + + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 2, "Check 2 logins"); + isnot( + logins[0].password, + logins[1].password, + "Generated password shouldn't have changed to match the filled password" + ); + + Services.logins.removeAllUserFacingLogins(); + LoginTestUtils.resetGeneratedPasswordsCache(); +}); + +add_task(async function test_edited_generated_password_in_new_tab() { + // test that we can fill the generated password into an empty password field, + // edit it, and then fill the edited password. + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_ORIGIN + FORM_PAGE_PATH, + }, + async function (browser) { + await SimpleTest.promiseFocus(browser.ownerGlobal); + await SpecialPowers.spawn( + browser, + [[passwordInputSelector]], + function checkInitialFieldValue(inputSelector) { + const input = content.document.querySelector(inputSelector); + Assert.equal(input.value.length, 0, "Password field is empty"); + Assert.ok( + !input.matches(":autofill"), + "Password field should not be highlighted" + ); + } + ); + + await doFillGeneratedPasswordContextMenuItem( + browser, + passwordInputSelector + ); + await SpecialPowers.spawn( + browser, + [[passwordInputSelector]], + function checkAndEditFieldValue(inputSelector) { + let { LoginTestUtils: LTU } = ChromeUtils.importESModule( + "resource://testing-common/LoginTestUtils.sys.mjs" + ); + const input = content.document.querySelector(inputSelector); + Assert.equal( + input.value.length, + LTU.generation.LENGTH, + "Password field was filled with generated password" + ); + Assert.ok( + input.matches(":autofill"), + "Password field should be highlighted" + ); + LTU.loginField.checkPasswordMasked(input, false, "after fill"); + } + ); + + await BrowserTestUtils.sendChar("!", browser); + await BrowserTestUtils.sendChar("@", browser); + let storageChangedPromised = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "modifyLogin" + ); + await BrowserTestUtils.synthesizeKey("KEY_Tab", undefined, browser); + info("Waiting for storage update"); + await storageChangedPromised; + } + ); + + info("Now fill again in a new tab and ensure the edited password is used"); + + // Disable autofill in the new tab + await SpecialPowers.pushPrefEnv({ + set: [["signon.autofillForms", false]], + }); + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_ORIGIN + FORM_PAGE_PATH, + }, + async function (browser) { + await SimpleTest.promiseFocus(browser.ownerGlobal); + + await doFillGeneratedPasswordContextMenuItem( + browser, + passwordInputSelector + ); + + await SpecialPowers.spawn( + browser, + [[passwordInputSelector]], + function checkAndEditFieldValue(inputSelector) { + let { LoginTestUtils: LTU } = ChromeUtils.importESModule( + "resource://testing-common/LoginTestUtils.sys.mjs" + ); + const input = content.document.querySelector(inputSelector); + Assert.equal( + input.value.length, + LTU.generation.LENGTH + 2, + "Password field was filled with edited generated password" + ); + LTU.loginField.checkPasswordMasked(input, false, "after fill"); + } + ); + } + ); + + LoginTestUtils.clearData(); + LoginTestUtils.resetGeneratedPasswordsCache(); + await SpecialPowers.popPrefEnv(); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_context_menu_iframe.js b/toolkit/components/passwordmgr/test/browser/browser_context_menu_iframe.js new file mode 100644 index 0000000000..2545cdfebe --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_context_menu_iframe.js @@ -0,0 +1,223 @@ +/* + * Test the password manager context menu. + */ + +"use strict"; + +const TEST_ORIGIN = "https://example.com"; + +// Test with a page that only has a form within an iframe, not in the top-level document +const IFRAME_PAGE_PATH = + "/browser/toolkit/components/passwordmgr/test/browser/form_basic_iframe.html"; + +/** + * Initialize logins needed for the tests and disable autofill + * for login forms for easier testing of manual fill. + */ +add_task(async function test_initialize() { + Services.prefs.setBoolPref("signon.autofillForms", false); + Services.prefs.setBoolPref("signon.schemeUpgrades", true); + registerCleanupFunction(() => { + Services.prefs.clearUserPref("signon.autofillForms"); + Services.prefs.clearUserPref("signon.schemeUpgrades"); + }); + await Services.logins.addLogins(loginList()); +}); + +/** + * Check if the password field is correctly filled when it's in an iframe. + */ +add_task(async function test_context_menu_iframe_fill() { + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_ORIGIN + IFRAME_PAGE_PATH, + }, + async function (browser) { + await openPasswordContextMenu( + browser, + "#form-basic-password", + () => true, + browser.browsingContext.children[0], + true + ); + + let popupMenu = document.getElementById("fill-login-popup"); + + // Stores the original value of username + function promiseFrameInputValue(name) { + return SpecialPowers.spawn( + browser.browsingContext.children[0], + [name], + function (inputname) { + return content.document.getElementById(inputname).value; + } + ); + } + let usernameOriginalValue = await promiseFrameInputValue( + "form-basic-username" + ); + + // Execute the command of the first login menuitem found at the context menu. + let firstLoginItem = + popupMenu.getElementsByClassName("context-login-item")[0]; + Assert.ok(firstLoginItem, "Found the first login item"); + + await TestUtils.waitForTick(); + + Assert.ok( + BrowserTestUtils.is_visible(firstLoginItem), + "First login menuitem is visible" + ); + + info("Clicking on the firstLoginItem"); + // click on the login item to fill the password field, triggering an "input" event + popupMenu.activateItem(firstLoginItem); + + let passwordValue = await TestUtils.waitForCondition(async () => { + let value = await promiseFrameInputValue("form-basic-password"); + return value; + }); + + // Find the used login by it's username. + let login = getLoginFromUsername(firstLoginItem.label); + Assert.equal( + login.password, + passwordValue, + "Password filled and correct." + ); + + let usernameNewValue = await promiseFrameInputValue( + "form-basic-username" + ); + Assert.equal( + usernameOriginalValue, + usernameNewValue, + "Username value was not changed." + ); + + let contextMenu = document.getElementById("contentAreaContextMenu"); + contextMenu.hidePopup(); + + await cleanupDoorhanger(); + await cleanupPasswordNotifications(); + } + ); +}); + +/** + * Check that the login context menu items don't appear on an opaque origin. + */ +add_task(async function test_context_menu_iframe_sandbox() { + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_ORIGIN + IFRAME_PAGE_PATH, + }, + async function (browser) { + info("Opening context menu for test_context_menu_iframe_sandbox"); + await openPasswordContextMenu( + browser, + "#form-basic-password", + function checkDisabled() { + info("checkDisabled for test_context_menu_iframe_sandbox"); + let popupHeader = document.getElementById("fill-login"); + Assert.ok( + popupHeader.hidden, + "Check that the Fill Login menu item is hidden" + ); + return false; + }, + browser.browsingContext.children[1] + ); + let contextMenu = document.getElementById("contentAreaContextMenu"); + contextMenu.hidePopup(); + } + ); +}); + +/** + * Check that the login context menu item appears for sandbox="allow-same-origin" + */ +add_task(async function test_context_menu_iframe_sandbox_same_origin() { + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_ORIGIN + IFRAME_PAGE_PATH, + }, + async function (browser) { + await openPasswordContextMenu( + browser, + "#form-basic-password", + function checkDisabled() { + let popupHeader = document.getElementById("fill-login"); + Assert.ok( + !popupHeader.hidden, + "Check that the Fill Login menu item is visible" + ); + Assert.ok( + !popupHeader.disabled, + "Check that the Fill Login menu item is disabled" + ); + return false; + }, + browser.browsingContext.children[2] + ); + + let contextMenu = document.getElementById("contentAreaContextMenu"); + contextMenu.hidePopup(); + } + ); +}); + +/** + * Search for a login by it's username. + * + * Only unique login/origin combinations should be used at this test. + */ +function getLoginFromUsername(username) { + return loginList().find(login => login.username == username); +} + +/** + * List of logins used for the test. + * + * We should only use unique usernames in this test, + * because we need to search logins by username. There is one duplicate u+p combo + * in order to test de-duping in the menu. + */ +function loginList() { + return [ + LoginTestUtils.testData.formLogin({ + origin: "https://example.com", + formActionOrigin: "https://example.com", + username: "username", + password: "password", + }), + // Same as above but HTTP in order to test de-duping. + LoginTestUtils.testData.formLogin({ + origin: "http://example.com", + formActionOrigin: "http://example.com", + username: "username", + password: "password", + }), + LoginTestUtils.testData.formLogin({ + origin: "http://example.com", + formActionOrigin: "http://example.com", + username: "username1", + password: "password1", + }), + LoginTestUtils.testData.formLogin({ + origin: "https://example.com", + formActionOrigin: "https://example.com", + username: "username2", + password: "password2", + }), + LoginTestUtils.testData.formLogin({ + origin: "http://example.org", + formActionOrigin: "http://example.org", + username: "username-cross-origin", + password: "password-cross-origin", + }), + ]; +} diff --git a/toolkit/components/passwordmgr/test/browser/browser_crossOriginSubmissionUsesCorrectOrigin.js b/toolkit/components/passwordmgr/test/browser/browser_crossOriginSubmissionUsesCorrectOrigin.js new file mode 100644 index 0000000000..0aecba63a6 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_crossOriginSubmissionUsesCorrectOrigin.js @@ -0,0 +1,53 @@ +/* Any copyright is dedicated to the Public Domain. + * https://creativecommons.org/publicdomain/zero/1.0/ */ + +"use strict"; + +function getDataFromNextSubmitMessage() { + return new Promise(resolve => { + LoginManagerParent.setListenerForTests((msg, data) => { + if (msg == "ShowDoorhanger") { + resolve(data); + } + }); + }); +} + +add_task(async function testCrossOriginFormUsesCorrectOrigin() { + let dataPromise = getDataFromNextSubmitMessage(); + + let url = + "https://example.com" + + DIRECTORY_PATH + + "form_cross_origin_secure_action.html"; + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url, + }, + async function (browser) { + await SpecialPowers.spawn(browser.browsingContext, [], () => { + let doc = content.document; + doc.getElementById("form-basic-username").setUserInput("username"); + doc.getElementById("form-basic-password").setUserInput("password"); + doc.getElementById("form-basic").submit(); + info("Submitting form"); + }); + } + ); + + let data = await dataPromise; + info("Origin retrieved from message listener"); + + Assert.equal( + data.origin, + "https://example.com", + "Message origin should match form origin" + ); + isnot( + data.origin, + data.data.actionOrigin, + "If origin and actionOrigin match, this test will false positive" + ); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_deleteLoginsBackup.js b/toolkit/components/passwordmgr/test/browser/browser_deleteLoginsBackup.js new file mode 100644 index 0000000000..608329f482 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_deleteLoginsBackup.js @@ -0,0 +1,282 @@ +/** + * Test that logins backup is deleted as expected when logins are deleted. + */ + +XPCOMUtils.defineLazyModuleGetters(this, { + FXA_PWDMGR_HOST: "resource://gre/modules/FxAccountsCommon.js", + FXA_PWDMGR_REALM: "resource://gre/modules/FxAccountsCommon.js", +}); + +const nsLoginInfo = new Components.Constructor( + "@mozilla.org/login-manager/loginInfo;1", + Ci.nsILoginInfo, + "init" +); + +const login1 = new nsLoginInfo( + "https://example.com", + "https://example.com", + null, + "notifyu1", + "notifyp1", + "user", + "pass" +); +const login2 = new nsLoginInfo( + "https://example.com", + "https://example.com", + null, + "", + "notifyp1", + "", + "pass" +); + +const fxaKey = new nsLoginInfo( + FXA_PWDMGR_HOST, + null, + FXA_PWDMGR_REALM, + "foo@bar.com", + "pass2", + "", + "" +); + +const loginStorePath = PathUtils.join(PathUtils.profileDir, "logins.json"); +const loginBackupPath = PathUtils.join( + PathUtils.profileDir, + "logins-backup.json" +); + +async function waitForBackupUpdate() { + return new Promise(resolve => { + Services.obs.addObserver(function observer(subject, topic) { + Services.obs.removeObserver(observer, "logins-backup-updated"); + resolve(); + }, "logins-backup-updated"); + }); +} + +async function loginStoreExists() { + return TestUtils.waitForCondition(() => IOUtils.exists(loginStorePath)); +} + +async function loginBackupExists() { + return TestUtils.waitForCondition(() => IOUtils.exists(loginBackupPath)); +} + +async function loginBackupDeleted() { + return TestUtils.waitForCondition( + async () => !(await IOUtils.exists(loginBackupPath)) + ); +} + +// If a fxa key is stored as a login, test that logins backup is updated to only store +// the fxa key when the last user facing login is deleted. +add_task( + async function test_deleteLoginsBackup_removeAllUserFacingLogins_fxaKey() { + info( + "Testing removeAllUserFacingLogins() case when there is a saved fxa key" + ); + info("Adding two logins: fxa key and one user facing login"); + let storageUpdatePromise = TestUtils.topicObserved( + "password-storage-updated" + ); + await Services.logins.addLoginAsync(login1); + Assert.ok(true, "added login1"); + await loginStoreExists(); + await Services.logins.addLoginAsync(fxaKey); + Assert.ok(true, "added fxaKey"); + await loginBackupExists(); + Assert.ok(true, "logins-backup.json now exists"); + await storageUpdatePromise; + info("Writes to storage are complete for addLogin calls"); + + storageUpdatePromise = TestUtils.topicObserved("password-storage-updated"); + info("Removing all user facing logins"); + Services.logins.removeAllUserFacingLogins(); + await storageUpdatePromise; + info("Writes to storage are complete after removeAllUserFacingLogins call"); + await waitForBackupUpdate(); + Assert.ok( + true, + "logins-backup.json was updated to only store the fxa key, as expected" + ); + + // Clean up. + // Since there is a fxa key left, we need to call removeAllLogins() or removeLogin(fxaKey) + // to remove the fxa key. Otherwise the test will fail in verify mode when trying to add login1 + Services.logins.removeAllLogins(); + await IOUtils.remove(loginStorePath); + } +); + +// Test that logins backup is deleted when Services.logins.removeAllUserFacingLogins() is called. +add_task(async function test_deleteLoginsBackup_removeAllUserFacingLogins() { + // Remove logins.json and logins-backup.json before starting. + info("Testing the removeAllUserFacingLogins() case"); + + await IOUtils.remove(loginStorePath, { ignoreAbsent: true }); + await IOUtils.remove(loginBackupPath, { ignoreAbsent: true }); + + let storageUpdatePromise = TestUtils.topicObserved( + "password-storage-updated" + ); + info("Add a login to create logins.json"); + await Services.logins.addLoginAsync(login1); + await loginStoreExists(); + Assert.ok(true, "logins.json now exists"); + + info("Add a second login to create logins-backup.json"); + await Services.logins.addLoginAsync(login2); + await loginBackupExists(); + info("logins-backup.json now exists"); + + await storageUpdatePromise; + info("Writes to storage are complete for addLogin calls"); + + storageUpdatePromise = TestUtils.topicObserved("password-storage-updated"); + info("Removing all user facing logins"); + Services.logins.removeAllUserFacingLogins(); + + await storageUpdatePromise; + info( + "Writes to storage are complete when removeAllUserFacingLogins() is called" + ); + await loginBackupDeleted(); + info( + "logins-backup.json was deleted as expected when all logins were removed" + ); + + // Clean up. + await IOUtils.remove(loginStorePath); +}); + +// 1. Test that logins backup is deleted when Services.logins.removeAllLogins() is called +// 2. If a FxA key is stored as a login, test that logins backup is deleted when +// Services.logins.removeAllLogins() is called +add_task(async function test_deleteLoginsBackup_removeAllLogins() { + // Remove logins.json and logins-backup.json before starting. + info("Testing the removeAllLogins() case"); + + await IOUtils.remove(loginStorePath, { ignoreAbsent: true }); + await IOUtils.remove(loginBackupPath, { ignoreAbsent: true }); + + let storageUpdatePromise = TestUtils.topicObserved( + "password-storage-updated" + ); + info("Add a login to create logins.json"); + await Services.logins.addLoginAsync(login1); + Assert.ok(true, "added login1"); + await loginStoreExists(); + Assert.ok(true, "logins.json now exists"); + await Services.logins.addLoginAsync(login2); + Assert.ok(true, "added login2"); + await loginBackupExists(); + info("logins-backup.json now exists"); + + await storageUpdatePromise; + info("Writes to storage are complete for addLogin calls"); + + storageUpdatePromise = TestUtils.topicObserved("password-storage-updated"); + info("Removing all logins"); + Services.logins.removeAllLogins(); + + await storageUpdatePromise; + info("Writes to storage are complete when removeAllLogins() is called"); + + await loginBackupDeleted(); + info( + "logins-backup.json was deleted as expected when all logins were removed" + ); + await IOUtils.remove(loginStorePath); + + info("Testing the removeAllLogins() case when FxA key is present"); + storageUpdatePromise = TestUtils.topicObserved("password-storage-updated"); + await Services.logins.addLoginAsync(login1); + await loginStoreExists(); + await Services.logins.addLoginAsync(fxaKey); + await loginBackupExists(); + info("logins-backup.json now exists"); + await storageUpdatePromise; + info("Write to storage are complete for addLogin calls"); + + storageUpdatePromise = TestUtils.topicObserved("password-storage-updated"); + info("Removing all logins, including FxA key"); + Services.logins.removeAllLogins(); + await storageUpdatePromise; + info("Writes to storage are complete after the last removeAllLogins call"); + await loginBackupDeleted(); + info( + "logins-backup.json was deleted when the last logins were removed, as expected" + ); + + // Clean up. + await IOUtils.remove(loginStorePath); +}); + +// 1. Test that logins backup is deleted when the last saved login is removed using +// Services.logins.removeLogin() when no fxa key is saved. +// 2. Test that logins backup is updated when the last saved login is removed using +// Services.logins.removeLogin() when a fxa key is present. +add_task(async function test_deleteLoginsBackup_removeLogin() { + info("Testing the removeLogin() case when there is no saved fxa key"); + info("Adding two logins"); + let storageUpdatePromise = TestUtils.topicObserved( + "password-storage-updated" + ); + await Services.logins.addLoginAsync(login1); + await loginStoreExists(); + await Services.logins.addLoginAsync(login2); + await loginBackupExists(); + info("logins-backup.json now exists"); + + await storageUpdatePromise; + info("Writes to storage are complete for addLogin calls"); + + storageUpdatePromise = TestUtils.topicObserved("password-storage-updated"); + info("Removing one login"); + Services.logins.removeLogin(login1); + await storageUpdatePromise; + info("Writes to storage are complete after one removeLogin call"); + await loginBackupExists(); + + storageUpdatePromise = TestUtils.topicObserved("password-storage-updated"); + info("Removing the last login"); + Services.logins.removeLogin(login2); + await storageUpdatePromise; + info("Writes to storage are complete after the last removeLogin call"); + await loginBackupDeleted(); + info( + "logins-backup.json was deleted as expected when the last saved login was removed" + ); + await IOUtils.remove(loginStorePath); + + info("Testing the removeLogin() case when there is a saved fxa key"); + info("Adding two logins: one user facing and the fxa key"); + storageUpdatePromise = TestUtils.topicObserved("password-storage-updated"); + await Services.logins.addLoginAsync(login1); + await loginStoreExists(); + await Services.logins.addLoginAsync(fxaKey); + await loginBackupExists(); + info("logins-backup.json now exists"); + + await storageUpdatePromise; + info("Writes to storage are complete for addLogin calls"); + + storageUpdatePromise = TestUtils.topicObserved("password-storage-updated"); + let backupUpdate = waitForBackupUpdate(); + Services.logins.removeLogin(login1); + await storageUpdatePromise; + info("Writes to storage are complete after one removeLogin call"); + await backupUpdate; + + await loginBackupExists(); + info("logins-backup.json was updated to contain only the fxa key"); + + // Clean up. + // Since there is a fxa key left, we need to call removeAllLogins() or removeLogin(fxaKey) + // to remove the fxa key. Otherwise the test will fail in verify mode when trying to add login1 + Services.logins.removeAllLogins(); + await IOUtils.remove(loginStorePath); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_doorhanger_autocomplete_values.js b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_autocomplete_values.js new file mode 100644 index 0000000000..3f8bfddaf4 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_autocomplete_values.js @@ -0,0 +1,274 @@ +/** + * Modify page elements and verify that they are found as options in the save/update doorhanger. + */ + +const USERNAME_SELECTOR = "#form-expanded-username"; +const PASSWORD_SELECTOR = "#form-expanded-password"; +const SEARCH_SELECTOR = "#form-expanded-search"; +const CAPTCHA_SELECTOR = "#form-expanded-captcha"; +const NON_FORM_SELECTOR = "#form-expanded-non-form-input"; + +const AUTOCOMPLETE_POPUP_SELECTOR = "#PopupAutoComplete"; +const USERNAME_DROPMARKER_SELECTOR = + "#password-notification-username-dropmarker"; + +const TEST_CASES = [ + { + description: "a modified username should be included in the popup", + modifiedFields: [ + { [USERNAME_SELECTOR]: "new_username" }, + { [PASSWORD_SELECTOR]: "myPassword" }, + ], + expectUsernameDropmarker: true, + expectedValues: ["new_username"], + }, + { + description: + "if no non-password fields are modified, no popup should be available", + modifiedFields: [{ [PASSWORD_SELECTOR]: "myPassword" }], + expectUsernameDropmarker: false, + expectedValues: [], + }, + { + description: "all modified username fields should be included in the popup", + modifiedFields: [ + { [USERNAME_SELECTOR]: "new_username" }, + { [SEARCH_SELECTOR]: "unrelated search query" }, + { [CAPTCHA_SELECTOR]: "someCaptcha" }, + { [PASSWORD_SELECTOR]: "myPassword" }, + ], + expectUsernameDropmarker: true, + expectedValues: ["new_username", "unrelated search query", "someCaptcha"], + }, + { + description: + "any modified fields that don't look like usernames or passwords should not be included in the popup", + modifiedFields: [ + { [PASSWORD_SELECTOR]: "myPassword" }, + { [NON_FORM_SELECTOR]: "I dont even know what this one is" }, + ], + expectUsernameDropmarker: false, + expectedValues: [], + }, + { + description: + "when a field is modified multiple times, all CHANGE event values should be included in the popup", + modifiedFields: [ + { [USERNAME_SELECTOR]: "new_username1" }, + { [USERNAME_SELECTOR]: "new_username2" }, + { [USERNAME_SELECTOR]: "new_username3" }, + { [PASSWORD_SELECTOR]: "myPassword" }, + ], + expectUsernameDropmarker: true, + expectedValues: ["new_username1", "new_username2", "new_username3"], + }, + { + description: "empty strings should not be displayed in popup", + modifiedFields: [ + { [PASSWORD_SELECTOR]: "myPassword" }, + { [USERNAME_SELECTOR]: "new_username" }, + { [USERNAME_SELECTOR]: "" }, + ], + expectUsernameDropmarker: true, + expectedValues: ["new_username"], + }, + { + description: "saved logins should be displayed in popup", + modifiedFields: [ + { [USERNAME_SELECTOR]: "new_username" }, + { [PASSWORD_SELECTOR]: "myPassword" }, + ], + savedLogins: [ + { + username: "savedUn1", + password: "somePass", + }, + { + username: "savedUn2", + password: "otherPass", + }, + ], + expectUsernameDropmarker: true, + expectedValues: ["new_username", "savedUn1", "savedUn2"], + }, + { + description: "duplicated page usernames should only be displayed once", + modifiedFields: [ + { [PASSWORD_SELECTOR]: "myPassword" }, + { [USERNAME_SELECTOR]: "new_username1" }, + { [USERNAME_SELECTOR]: "new_username2" }, + { [USERNAME_SELECTOR]: "new_username1" }, + ], + expectUsernameDropmarker: true, + expectedValues: ["new_username1", "new_username2"], + }, + { + description: "non-un/pw fields also prompt doorhanger updates", + modifiedFields: [ + { [PASSWORD_SELECTOR]: "myPassword" }, + { [USERNAME_SELECTOR]: "new_username1" }, + { [SEARCH_SELECTOR]: "search" }, + { [CAPTCHA_SELECTOR]: "captcha" }, + ], + expectUsernameDropmarker: true, + expectedValues: ["new_username1", "search", "captcha"], + }, + // { + // description: "duplicated saved/page usernames should TODO https://mozilla.invisionapp.com/share/XGXL6WZVKFJ#/screens/420547613/comments", + // }, +]; + +function _validateTestCase(tc) { + if (tc.expectUsernameDropmarker) { + Assert.ok( + !!tc.expectedValues.length, + "Validate test case. A visible dropmarker implies expected values" + ); + } else { + Assert.ok( + !tc.expectedValues.length, + "Validate test case. A hidden dropmarker implies no expected values" + ); + } +} + +async function _setPrefs() { + await SpecialPowers.pushPrefEnv({ + set: [["signon.capture.inputChanges.enabled", true]], + }); +} + +async function _addSavedLogins(logins) { + let loginsData = logins.map(({ username }) => + LoginTestUtils.testData.formLogin({ + origin: "https://example.com", + formActionOrigin: "https://example.com", + username, + password: "Saved login passwords not used in this test", + }) + ); + await Services.logins.addLogins(loginsData); +} + +async function _clickDropmarker(document, notificationElement) { + let acPopup = document.querySelector(AUTOCOMPLETE_POPUP_SELECTOR); + let acPopupShown = BrowserTestUtils.waitForEvent(acPopup, "popupshown"); + + notificationElement.querySelector(USERNAME_DROPMARKER_SELECTOR).click(); + await acPopupShown; +} + +function _getSuggestedValues(document) { + let suggestedValues = []; + let autocompletePopup = document.querySelector(AUTOCOMPLETE_POPUP_SELECTOR); + let numRows = autocompletePopup.view.matchCount; + for (let i = 0; i < numRows; i++) { + suggestedValues.push(autocompletePopup.view.getValueAt(i)); + } + return suggestedValues; +} + +add_task(async function test_edit_password() { + await _setPrefs(); + for (let testCase of TEST_CASES) { + info("Test case: " + JSON.stringify(testCase)); + _validateTestCase(testCase); + + // Clean state before the test case is executed. + await LoginTestUtils.clearData(); + await cleanupDoorhanger(); + await cleanupPasswordNotifications(); + Services.logins.removeAllUserFacingLogins(); + + // Create the pre-existing logins when needed. + if (testCase.savedLogins) { + info("Adding logins " + JSON.stringify(testCase.savedLogins)); + await _addSavedLogins(testCase.savedLogins); + } + + info("Opening tab"); + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: + "https://example.com/browser/toolkit/components/" + + "passwordmgr/test/browser/form_expanded.html", + }, + async function (browser) { + info("Editing the form"); + for (const change of testCase.modifiedFields) { + for (const selector in change) { + let newValue = change[selector]; + info(`Setting field '${selector}' to '${newValue}'`); + await changeContentFormValues(browser, change); + } + } + + let notif = getCaptureDoorhanger("any"); + + let { panel } = PopupNotifications; + + let promiseShown = BrowserTestUtils.waitForEvent(panel, "popupshown"); + + EventUtils.synthesizeMouseAtCenter(notif.anchorElement, {}); + + await promiseShown; + + let notificationElement = panel.childNodes[0]; + + let usernameDropmarker = notificationElement.querySelector( + USERNAME_DROPMARKER_SELECTOR + ); + Assert.ok( + BrowserTestUtils.is_visible(usernameDropmarker) == + testCase.expectUsernameDropmarker, + "Confirm dropmarker visibility" + ); + + if (testCase.expectUsernameDropmarker) { + info("Opening autocomplete popup"); + await _clickDropmarker(document, notificationElement); + } + + let suggestedValues = _getSuggestedValues(document); + + let expectedNotFound = testCase.expectedValues.filter( + expected => !suggestedValues.includes(expected) + ); + let foundNotExpected = suggestedValues.filter( + actual => !testCase.expectedValues.includes(actual) + ); + + // Log expected/actual inconsistencies + Assert.ok( + !expectedNotFound.length, + `All expected values should be found\nCase: "${ + testCase.description + }"\nExpected: ${JSON.stringify( + testCase.expectedValues + )}\nActual: ${JSON.stringify( + suggestedValues + )}\nExpected not found: ${JSON.stringify(expectedNotFound)} + ` + ); + Assert.ok( + !foundNotExpected.length, + `All actual values should be expected\nCase: "${ + testCase.description + }"\nExpected: ${JSON.stringify( + testCase.expectedValues + )}\nActual: ${JSON.stringify( + suggestedValues + )}\nFound not expected: ${JSON.stringify(foundNotExpected)} + ` + ); + + // Clean up state + await cleanupDoorhanger(); + await cleanupPasswordNotifications(); + await clearMessageCache(browser); + Services.logins.removeAllUserFacingLogins(); + } + ); + } +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_doorhanger_autofill_then_save_password.js b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_autofill_then_save_password.js new file mode 100644 index 0000000000..1e62dacc13 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_autofill_then_save_password.js @@ -0,0 +1,181 @@ +/** + * Test that after we autofill, the site makes changes to the login, and then the + * user modifies their login, a save/update doorhanger is shown. + * + * This is a regression test for Bug 1632405. + */ + +const testCases = [ + { + name: "autofill, then delete u/p, then fill new u/p should show 'save'", + oldUsername: "oldUsername", + oldPassword: "oldPassword", + actions: [ + { + setUsername: "newUsername", + }, + { + setPassword: "newPassword", + }, + ], + expectedNotification: "addLogin", + expectedDoorhanger: "password-save", + }, + { + name: "autofill, then delete password, then fill new password should show 'update'", + oldUsername: "oldUsername", + oldPassword: "oldPassword", + actions: [ + { + setPassword: "newPassword", + }, + ], + expectedNotification: "modifyLogin", + expectedDoorhanger: "password-change", + }, +]; + +for (let testData of testCases) { + let tmp = { + async [testData.name]() { + info("testing with: " + JSON.stringify(testData)); + await test_save_change(testData); + }, + }; + add_task(tmp[testData.name]); +} + +async function test_save_change({ + name, + oldUsername, + oldPassword, + actions, + expectedNotification, + expectedDoorhanger, +}) { + let originalPrefValue = await Services.prefs.getBoolPref( + "signon.testOnlyUserHasInteractedByPrefValue" + ); + Services.prefs.setBoolPref( + "signon.testOnlyUserHasInteractedByPrefValue", + false + ); + + info("Starting test: " + name); + + await LoginTestUtils.addLogin({ + username: oldUsername, + password: oldPassword, + origin: "https://example.com", + formActionOrigin: "https://example.com", + }); + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: + "https://example.com/browser/toolkit/components/" + + "passwordmgr/test/browser/form_basic.html", + }, + async function (browser) { + await SimpleTest.promiseFocus(browser.ownerGlobal); + + await ContentTask.spawn( + browser, + { oldUsername, oldPassword }, + async function awaitAutofill({ oldUsername, oldPassword }) { + await ContentTaskUtils.waitForCondition( + () => + content.document.querySelector("#form-basic-username").value == + oldUsername && + content.document.querySelector("#form-basic-password").value == + oldPassword, + "Await and verify autofill" + ); + + info( + "Triggering a page navigation that is not initiated by the user" + ); + content.history.replaceState({}, "", ""); + } + ); + + Services.prefs.setBoolPref( + "signon.testOnlyUserHasInteractedByPrefValue", + true + ); + + for (let action of actions) { + info(`As the user, update form with action: ${JSON.stringify(action)}`); + if (typeof action.setUsername !== "undefined") { + await changeContentFormValues(browser, { + "#form-basic-username": action.setUsername, + }); + } + if (typeof action.setPassword !== "undefined") { + await changeContentFormValues(browser, { + "#form-basic-password": action.setPassword, + }); + } + } + + let expectedUsername = + [...actions] + .reverse() + .map(action => action.setUsername) + .find(username => !!username) ?? oldUsername; + let expectedPassword = + [...actions] + .reverse() + .map(action => action.setPassword) + .find(username => !!username) ?? oldPassword; + + await ContentTask.spawn( + browser, + { expectedUsername, expectedPassword }, + async function awaitAutofill({ expectedUsername, expectedPassword }) { + info("Validating updated fields"); + Assert.equal( + expectedUsername, + content.document.querySelector("#form-basic-username").value, + "Verify username field updated" + ); + Assert.equal( + expectedPassword, + content.document.querySelector("#form-basic-password").value, + "Verify password field updated" + ); + } + ); + + let formSubmittedPromise = listenForTestNotification("ShowDoorhanger"); + await SpecialPowers.spawn(browser, [], async function () { + let doc = this.content.document; + doc.getElementById("form-basic").submit(); + }); + await formSubmittedPromise; + + info("Waiting for doorhanger of type: " + expectedDoorhanger); + let notif = await waitForDoorhanger(browser, expectedDoorhanger); + + await checkDoorhangerUsernamePassword(expectedUsername, expectedPassword); + + let promiseLogin = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == expectedNotification + ); + + await clickDoorhangerButton(notif, REMEMBER_BUTTON); + await promiseLogin; + await cleanupDoorhanger(notif); // clean slate for the next test + + Services.prefs.setBoolPref( + "signon.testOnlyUserHasInteractedByPrefValue", + originalPrefValue + ); + } + ); + + // Clean up the database before the next test case is executed. + Services.logins.removeAllUserFacingLogins(); +} diff --git a/toolkit/components/passwordmgr/test/browser/browser_doorhanger_crossframe.js b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_crossframe.js new file mode 100644 index 0000000000..8c4770d510 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_crossframe.js @@ -0,0 +1,236 @@ +const OUTER_URL = + "https://test1.example.com:443" + DIRECTORY_PATH + "form_crossframe.html"; + +requestLongerTimeout(2); + +async function acceptPasswordSave() { + let notif = await getCaptureDoorhangerThatMayOpen("password-save"); + let promiseNewSavedPassword = TestUtils.topicObserved( + "LoginStats:NewSavedPassword", + (subject, data) => subject == gBrowser.selectedBrowser + ); + clickDoorhangerButton(notif, REMEMBER_BUTTON); + await promiseNewSavedPassword; +} + +function checkFormFields(browsingContext, prefix, username, password) { + return SpecialPowers.spawn( + browsingContext, + [prefix, username, password], + (formPrefix, expectedUsername, expectedPassword) => { + let doc = content.document; + Assert.equal( + doc.getElementById(formPrefix + "-username").value, + expectedUsername, + "username matches" + ); + Assert.equal( + doc.getElementById(formPrefix + "-password").value, + expectedPassword, + "password matches" + ); + } + ); +} + +function listenForNotifications(count, expectedFormOrigin) { + return new Promise(resolve => { + let notifications = []; + LoginManagerParent.setListenerForTests((msg, data) => { + if (msg == "FormProcessed") { + notifications.push("FormProcessed: " + data.browsingContext.id); + } else if (msg == "ShowDoorhanger") { + Assert.equal( + data.origin, + expectedFormOrigin, + "Message origin should match expected" + ); + notifications.push("FormSubmit: " + data.data.usernameField.name); + } + if (notifications.length == count) { + resolve(notifications); + } + }); + }); +} + +async function verifyNotifications(notifyPromise, expected) { + let actual = await notifyPromise; + + Assert.equal(actual.length, expected.length, "Extra notification(s) sent"); + let expectedItem; + while ((expectedItem = expected.pop())) { + let index = actual.indexOf(expectedItem); + if (index >= 0) { + actual.splice(index, 1); + } else { + Assert.ok(false, "Expected notification '" + expectedItem + "' not sent"); + } + } +} + +// Make sure there is an autocomplete result for the frame's saved login and select it. +async function autocompleteLoginInIFrame( + browser, + iframeBrowsingContext, + selector +) { + let popup = document.getElementById("PopupAutoComplete"); + Assert.ok(popup, "Got popup"); + + await openACPopup(popup, browser, selector, iframeBrowsingContext); + + let autocompleteLoginResult = popup.querySelector( + `[originaltype="loginWithOrigin"]` + ); + Assert.ok(autocompleteLoginResult, "Got login richlistitem"); + + let promiseHidden = BrowserTestUtils.waitForEvent(popup, "popuphidden"); + + await EventUtils.synthesizeKey("KEY_ArrowDown"); + await EventUtils.synthesizeKey("KEY_Enter"); + + await promiseHidden; +} + +/* + * In this test, a frame is loaded with a document that contains a username + * and password field. This frame also contains another child iframe that + * itself contains a username and password field. This inner frame is loaded + * from a different domain than the first. + * + * locationMode should be false to submit forms, or true to click a button + * which changes the location instead. The latter should still save the + * username and password. + */ +async function submitSomeCrossSiteFrames(locationMode) { + info("Check with location mode " + locationMode); + let notifyPromise = listenForNotifications(2); + + let firsttab = await BrowserTestUtils.openNewForegroundTab( + gBrowser, + OUTER_URL + ); + + let outerFrameBC = firsttab.linkedBrowser.browsingContext; + let innerFrameBC = outerFrameBC.children[0]; + + await verifyNotifications(notifyPromise, [ + "FormProcessed: " + outerFrameBC.id, + "FormProcessed: " + innerFrameBC.id, + ]); + + // Fill in the username and password for both the outer and inner frame + // and submit the inner frame. + notifyPromise = listenForNotifications(1, "https://test2.example.org"); + info("submit page after changing inner form"); + + await SpecialPowers.spawn(outerFrameBC, [], () => { + let doc = content.document; + doc.getElementById("outer-username").setUserInput("outer"); + doc.getElementById("outer-password").setUserInput("outerpass"); + }); + + await SpecialPowers.spawn(innerFrameBC, [locationMode], doClick => { + let doc = content.document; + doc.getElementById("inner-username").setUserInput("inner"); + doc.getElementById("inner-password").setUserInput("innerpass"); + if (doClick) { + doc.getElementById("inner-gobutton").click(); + } else { + doc.getElementById("inner-form").submit(); + } + }); + + await acceptPasswordSave(); + + await verifyNotifications(notifyPromise, ["FormSubmit: username"]); + + // Next, open a second tab with the same page in it to verify that the data gets filled properly. + notifyPromise = listenForNotifications(2); + let secondtab = await BrowserTestUtils.openNewForegroundTab( + gBrowser, + OUTER_URL + ); + + let outerFrameBC2 = secondtab.linkedBrowser.browsingContext; + let innerFrameBC2 = outerFrameBC2.children[0]; + await verifyNotifications(notifyPromise, [ + "FormProcessed: " + outerFrameBC2.id, + "FormProcessed: " + innerFrameBC2.id, + ]); + + // We don't expect the innerFrame to be autofilled with the saved login, since + // it is cross-origin with the top level frame, so we autocomplete instead. + info("Autocompleting saved login into inner form"); + await autocompleteLoginInIFrame( + secondtab.linkedBrowser, + innerFrameBC2, + "#inner-username" + ); + + await checkFormFields(outerFrameBC2, "outer", "", ""); + await checkFormFields(innerFrameBC2, "inner", "inner", "innerpass"); + + // Next, change the username and password fields in the outer frame and submit. + notifyPromise = listenForNotifications(1, "https://test1.example.com"); + info("submit page after changing outer form"); + + await SpecialPowers.spawn(outerFrameBC2, [locationMode], doClick => { + let doc = content.document; + doc.getElementById("outer-username").setUserInput("outer2"); + doc.getElementById("outer-password").setUserInput("outerpass2"); + if (doClick) { + doc.getElementById("outer-gobutton").click(); + } else { + doc.getElementById("outer-form").submit(); + } + + doc.getElementById("outer-form").submit(); + }); + + await acceptPasswordSave(); + await verifyNotifications(notifyPromise, ["FormSubmit: outer-username"]); + + // Finally, open a third tab with the same page in it to verify that the data gets filled properly. + notifyPromise = listenForNotifications(2); + let thirdtab = await BrowserTestUtils.openNewForegroundTab( + gBrowser, + OUTER_URL + ); + + let outerFrameBC3 = thirdtab.linkedBrowser.browsingContext; + let innerFrameBC3 = outerFrameBC3.children[0]; + await verifyNotifications(notifyPromise, [ + "FormProcessed: " + outerFrameBC3.id, + "FormProcessed: " + innerFrameBC3.id, + ]); + + // We don't expect the innerFrame to be autofilled with the saved login, since + // it is cross-origin with the top level frame, so we autocomplete instead. + info("Autocompleting saved login into inner form"); + await autocompleteLoginInIFrame( + thirdtab.linkedBrowser, + innerFrameBC3, + "#inner-username" + ); + + await checkFormFields(outerFrameBC3, "outer", "outer2", "outerpass2"); + await checkFormFields(innerFrameBC3, "inner", "inner", "innerpass"); + + LoginManagerParent.setListenerForTests(null); + + await BrowserTestUtils.removeTab(firsttab); + await BrowserTestUtils.removeTab(secondtab); + await BrowserTestUtils.removeTab(thirdtab); + + LoginTestUtils.clearData(); +} + +add_task(async function cross_site_frames_submit() { + await submitSomeCrossSiteFrames(false); +}); + +add_task(async function cross_site_frames_changelocation() { + await submitSomeCrossSiteFrames(true); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_doorhanger_dismissed_for_ccnumber.js b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_dismissed_for_ccnumber.js new file mode 100644 index 0000000000..eeaa211da8 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_dismissed_for_ccnumber.js @@ -0,0 +1,202 @@ +"use strict"; + +const TEST_ORIGIN = "https://example.com"; +const BASIC_FORM_PAGE_PATH = DIRECTORY_PATH + "form_basic.html"; + +add_task(async function test_doorhanger_dismissal_un() { + let url = TEST_ORIGIN + BASIC_FORM_PAGE_PATH; + await BrowserTestUtils.withNewTab( + { + gBrowser, + url, + }, + async function test_un_value_as_ccnumber(browser) { + // If the username field has a credit card number and if + // the password field is a three digit numberic value, + // we automatically dismiss the save logins prompt on submission. + + let passwordFilledPromise = listenForTestNotification( + "PasswordEditedOrGenerated" + ); + await changeContentFormValues(browser, { + "#form-basic-password": "123", + // We are interested in the state of the doorhanger created and don't want a + // false positive from the password-edited handling + "#form-basic-username": "4111111111111111", + }); + info("Waiting for passwordFilledPromise"); + await passwordFilledPromise; + // reset doorhanger/notifications, we're only interested in the submit outcome + await cleanupDoorhanger(); + await cleanupPasswordNotifications(); + // reset message cache so we can disambiguate between dismissed doorhanger from + // password edited vs form submitted w. cc number as username + await clearMessageCache(browser); + + let processedPromise = listenForTestNotification("ShowDoorhanger"); + await SpecialPowers.spawn(browser, [], async () => { + content.document.getElementById("form-basic-submit").click(); + }); + info("Waiting for FormSubmit"); + await processedPromise; + + let notif = getCaptureDoorhanger("password-save"); + Assert.ok(notif, "got notification popup"); + Assert.ok( + notif.dismissed, + "notification popup was automatically dismissed" + ); + await cleanupDoorhanger(notif); + } + ); +}); + +add_task(async function test_doorhanger_dismissal_pw() { + let url = TEST_ORIGIN + BASIC_FORM_PAGE_PATH; + await BrowserTestUtils.withNewTab( + { + gBrowser, + url, + }, + async function test_pw_value_as_ccnumber(browser) { + // If the password field has a credit card number and if + // the password field is also tagged autocomplete="cc-number", + // we automatically dismiss the save logins prompt on submission. + + let passwordFilledPromise = listenForTestNotification( + "PasswordEditedOrGenerated" + ); + await changeContentFormValues(browser, { + "#form-basic-password": "4111111111111111", + "#form-basic-username": "aaa", + }); + await SpecialPowers.spawn(browser, [], async () => { + content.document + .getElementById("form-basic-password") + .setAttribute("autocomplete", "cc-number"); + }); + await passwordFilledPromise; + // reset doorhanger/notifications, we're only interested in the submit outcome + await cleanupDoorhanger(); + await cleanupPasswordNotifications(); + // reset message cache so we can disambiguate between dismissed doorhanger from + // password edited vs form submitted w. cc number as password + await clearMessageCache(browser); + + let processedPromise = listenForTestNotification("ShowDoorhanger"); + await SpecialPowers.spawn(browser, [], async () => { + content.document.getElementById("form-basic-submit").click(); + }); + await processedPromise; + + let notif = getCaptureDoorhanger("password-save"); + Assert.ok(notif, "got notification popup"); + Assert.ok( + notif.dismissed, + "notification popup was automatically dismissed" + ); + await cleanupDoorhanger(notif); + } + ); +}); + +add_task(async function test_doorhanger_shown_on_un_with_invalid_ccnumber() { + let url = TEST_ORIGIN + BASIC_FORM_PAGE_PATH; + await BrowserTestUtils.withNewTab( + { + gBrowser, + url, + }, + async function test_un_with_invalid_cc_number(browser) { + // If the username field has a CC number that is invalid, + // we show the doorhanger to save logins like we usually do. + + let passwordFilledPromise = listenForTestNotification( + "PasswordEditedOrGenerated" + ); + await changeContentFormValues(browser, { + "#form-basic-password": "411", + "#form-basic-username": "1234123412341234", + }); + + await passwordFilledPromise; + // reset doorhanger/notifications, we're only interested in the submit outcome + await cleanupDoorhanger(); + await cleanupPasswordNotifications(); + // reset message cache so we can disambiguate between dismissed doorhanger from + // password edited vs form submitted w. cc number as password + await clearMessageCache(browser); + + let processedPromise = listenForTestNotification("ShowDoorhanger"); + await SpecialPowers.spawn(browser, [], async () => { + content.document.getElementById("form-basic-submit").click(); + }); + await processedPromise; + + let notif = await getCaptureDoorhangerThatMayOpen("password-save"); + Assert.ok(notif, "got notification popup"); + Assert.ok( + !notif.dismissed, + "notification popup was not automatically dismissed" + ); + await cleanupDoorhanger(notif); + } + ); +}); + +add_task(async function test_doorhanger_dismissal_on_change() { + let url = TEST_ORIGIN + BASIC_FORM_PAGE_PATH; + await BrowserTestUtils.withNewTab( + { + gBrowser, + url, + }, + async function test_change_in_pw(browser) { + let nsLoginInfo = new Components.Constructor( + "@mozilla.org/login-manager/loginInfo;1", + Ci.nsILoginInfo, + "init" + ); + let login = new nsLoginInfo( + TEST_ORIGIN, + TEST_ORIGIN, + null, + "4111111111111111", + "111", // password looks like a card security code + "form-basic-username", + "form-basic-password" + ); + await Services.logins.addLoginAsync(login); + + let passwordFilledPromise = listenForTestNotification( + "PasswordEditedOrGenerated" + ); + + await changeContentFormValues(browser, { + "#form-basic-password": "222", // password looks like a card security code + "#form-basic-username": "4111111111111111", + }); + await passwordFilledPromise; + // reset doorhanger/notifications, we're only interested in the submit outcome + await cleanupDoorhanger(); + await cleanupPasswordNotifications(); + // reset message cache so we can disambiguate between dismissed doorhanger from + // password edited vs form submitted w. cc number as username + await clearMessageCache(browser); + + let processedPromise = listenForTestNotification("ShowDoorhanger"); + await SpecialPowers.spawn(browser, [], async () => { + content.document.getElementById("form-basic-submit").click(); + }); + await processedPromise; + + let notif = getCaptureDoorhanger("password-change"); + Assert.ok(notif, "got notification popup"); + Assert.ok( + notif.dismissed, + "notification popup was automatically dismissed" + ); + await cleanupDoorhanger(notif); + } + ); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_doorhanger_empty_password.js b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_empty_password.js new file mode 100644 index 0000000000..15c3d52263 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_empty_password.js @@ -0,0 +1,42 @@ +add_setup(async function () { + await SpecialPowers.pushPrefEnv({ + set: [["signon.rememberSignons.visibilityToggle", true]], + }); +}); + +/** + * Test that the doorhanger main action button is disabled + * when the password field is empty. + * + * Also checks that submiting an empty password throws an error. + */ +add_task(async function test_empty_password() { + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: "https://example.com/browser/toolkit/components/passwordmgr/test/browser/form_basic.html", + }, + async function (browser) { + // Submit the form in the content page with the credentials from the test + // case. This will cause the doorhanger notification to be displayed. + await SpecialPowers.spawn(browser, [], async function () { + let doc = content.document; + doc.getElementById("form-basic-username").setUserInput("username"); + doc.getElementById("form-basic-password").setUserInput("pw"); + doc.getElementById("form-basic").submit(); + }); + + await waitForDoorhanger(browser, "password-save"); + // Synthesize input to empty the field + await updateDoorhangerInputValues({ + password: "", + }); + + let notificationElement = PopupNotifications.panel.childNodes[0]; + let mainActionButton = notificationElement.button; + + Assert.ok(mainActionButton.disabled, "Main action button is disabled"); + await hideDoorhangerPopup(); + } + ); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_doorhanger_form_password_edit.js b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_form_password_edit.js new file mode 100644 index 0000000000..75690a25f2 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_form_password_edit.js @@ -0,0 +1,562 @@ +/** + * Test changed (not submitted) passwords produce the right doorhangers/notifications + */ + +/* eslint no-shadow:"off" */ + +"use strict"; + +// The origin for the test URIs. +const TEST_ORIGIN = "https://example.com"; +const BASIC_FORM_PAGE_PATH = DIRECTORY_PATH + "form_basic.html"; +const passwordInputSelector = "#form-basic-password"; +const usernameInputSelector = "#form-basic-username"; + +let testCases = [ + { + name: "Enter password", + prefEnabled: true, + isLoggedIn: true, + logins: [], + formDefaults: {}, + formChanges: { + [passwordInputSelector]: "abcXYZ", + }, + expected: { + initialForm: { + username: "", + password: "", + }, + doorhanger: { + type: "password-save", + dismissed: true, + anchorExtraAttr: "", + username: "", + password: "abcXYZ", + toggle: "visible", + }, + }, + }, + { + name: "Change password", + prefEnabled: true, + isLoggedIn: true, + logins: [], + formDefaults: { + [passwordInputSelector]: "pass1", + }, + formChanges: { + [passwordInputSelector]: "pass-changed", + }, + expected: { + initialForm: { + username: "", + password: "pass1", + }, + doorhanger: { + type: "password-save", + dismissed: true, + anchorExtraAttr: "", + username: "", + password: "pass-changed", + toggle: "visible", + }, + }, + }, + { + name: "Change autofilled password", + prefEnabled: true, + isLoggedIn: true, + logins: [{ username: "user1", password: "autopass" }], + formDefaults: {}, + formChanges: { + [passwordInputSelector]: "autopass-changed", + }, + expected: { + initialForm: { + username: "user1", + password: "autopass", + }, + doorhanger: { + type: "password-change", + dismissed: true, + anchorExtraAttr: "", + username: "user1", + password: "autopass-changed", + }, + }, + }, + { + name: "Change autofilled username and password", + prefEnabled: true, + isLoggedIn: true, + logins: [{ username: "user1", password: "pass1" }], + formDefaults: {}, + formChanges: { + [usernameInputSelector]: "user2", + [passwordInputSelector]: "pass2", + }, + expected: { + initialForm: { + username: "user1", + password: "pass1", + }, + doorhanger: { + type: "password-save", + dismissed: true, + anchorExtraAttr: "", + username: "user2", + password: "pass2", + toggle: "visible", + }, + }, + }, + { + name: "Change password pref disabled", + prefEnabled: false, + isLoggedIn: true, + logins: [], + formDefaults: { + [passwordInputSelector]: "pass1", + }, + formChanges: { + [passwordInputSelector]: "pass-changed", + }, + expected: { + initialForm: { + username: "", + password: "pass1", + }, + doorhanger: null, + }, + }, + { + name: "Change to new username", + prefEnabled: true, + isLoggedIn: true, + logins: [{ username: "user1", password: "pass1" }], + formDefaults: {}, + formChanges: { + [usernameInputSelector]: "user2", + }, + expected: { + initialForm: { + username: "user1", + password: "pass1", + }, + doorhanger: { + type: "password-save", + dismissed: true, + anchorExtraAttr: "", + username: "user2", + password: "pass1", + toggle: "visible", + }, + }, + }, + { + name: "Change to existing username, different password", + prefEnabled: true, + isLoggedIn: true, + logins: [{ username: "user-saved", password: "pass1" }], + formDefaults: { + [usernameInputSelector]: "user-prefilled", + [passwordInputSelector]: "pass2", + }, + formChanges: { + [usernameInputSelector]: "user-saved", + }, + expected: { + initialForm: { + username: "user-prefilled", + password: "pass2", + }, + doorhanger: { + type: "password-change", + dismissed: true, + anchorExtraAttr: "", + username: "user-saved", + password: "pass2", + toggle: "visible", + }, + }, + }, + { + name: "Add username to existing password", + prefEnabled: true, + isLoggedIn: true, + logins: [{ username: "", password: "pass1" }], + formDefaults: {}, + formChanges: { + [usernameInputSelector]: "user1", + }, + expected: { + initialForm: { + username: "", + password: "pass1", + }, + doorhanger: { + type: "password-change", + dismissed: true, + anchorExtraAttr: "", + username: "user1", + password: "pass1", + toggle: "visible", + }, + }, + }, + { + name: "Change to existing username, password", + prefEnabled: true, + isLoggedIn: true, + logins: [{ username: "user1", password: "pass1" }], + formDefaults: { + [usernameInputSelector]: "user", + [passwordInputSelector]: "pass", + }, + formChanges: { + [passwordInputSelector]: "pass1", + [usernameInputSelector]: "user1", + }, + expected: { + initialForm: { + username: "user", + password: "pass", + }, + doorhanger: null, + }, + }, + { + name: "Ensure a dismissed password-save doorhanger appears on an input event when editing an unsaved password", + prefEnabled: true, + isLoggedIn: true, + logins: [], + formDefaults: {}, + formChanges: { + [passwordInputSelector]: "a", + }, + shouldBlur: false, + expected: { + initialForm: { + username: "", + password: "", + }, + doorhanger: { + type: "password-save", + dismissed: true, + anchorExtraAttr: "", + username: "", + password: "a", + toggle: "visible", + }, + }, + }, + { + name: "Ensure a dismissed password-save doorhanger appears with the latest input value upon editing an unsaved password", + prefEnabled: true, + isLoggedIn: true, + logins: [], + formDefaults: {}, + formChanges: { + [passwordInputSelector]: "a", + [passwordInputSelector]: "ab", + [passwordInputSelector]: "abc", + }, + shouldBlur: false, + expected: { + initialForm: { + username: "", + password: "", + }, + doorhanger: { + type: "password-save", + dismissed: true, + anchorExtraAttr: "", + username: "", + password: "abc", + toggle: "visible", + }, + }, + }, + { + name: "Ensure a dismissed password-change doorhanger appears on an input event when editing a saved password", + prefEnabled: true, + isLoggedIn: true, + logins: [{ username: "", password: "pass1" }], + formDefaults: {}, + formChanges: { + [passwordInputSelector]: "pass", + }, + shouldBlur: false, + expected: { + initialForm: { + username: "", + password: "pass1", + }, + doorhanger: { + type: "password-change", + dismissed: true, + anchorExtraAttr: "", + username: "", + password: "pass", + toggle: "visible", + }, + }, + }, + { + name: "Ensure no dismissed doorhanger is shown on 'input' when Primary Password is locked", + prefEnabled: true, + isLoggedIn: false, + logins: [], + formDefaults: {}, + formChanges: { + [passwordInputSelector]: "pass", + }, + shouldBlur: false, + expected: { + initialForm: { + username: "", + password: "", + }, + doorhanger: null, + }, + }, + { + name: "Ensure no dismissed doorhanger is shown on 'change' when Primary Password is locked", + prefEnabled: true, + isLoggedIn: false, + logins: [], + formDefaults: {}, + formChanges: { + [passwordInputSelector]: "pass", + }, + shouldBlur: true, + expected: { + initialForm: { + username: "", + password: "", + }, + doorhanger: null, + }, + }, +]; + +requestLongerTimeout(2); +SimpleTest.requestCompleteLog(); + +for (let testData of testCases) { + let tmp = { + async [testData.name]() { + await SpecialPowers.pushPrefEnv({ + set: [["signon.passwordEditCapture.enabled", testData.prefEnabled]], + }); + if (!testData.isLoggedIn) { + // Enable Primary Password + LoginTestUtils.primaryPassword.enable(); + } + for (let passwordFieldType of ["password", "text"]) { + info( + "testing with type=" + + passwordFieldType + + ": " + + JSON.stringify(testData) + ); + await testPasswordChange(testData, { passwordFieldType }); + } + if (!testData.isLoggedIn) { + LoginTestUtils.primaryPassword.disable(); + } + await SpecialPowers.popPrefEnv(); + }, + }; + add_task(tmp[testData.name]); +} + +async function testPasswordChange( + { + logins = [], + formDefaults = {}, + formChanges = {}, + expected, + isLoggedIn, + shouldBlur = true, + }, + { passwordFieldType } +) { + await LoginTestUtils.clearData(); + await cleanupDoorhanger(); + + let url = TEST_ORIGIN + BASIC_FORM_PAGE_PATH; + for (let login of logins) { + await LoginTestUtils.addLogin(login); + } + + for (let login of Services.logins.getAllLogins()) { + info(`Saved login: ${login.username}, ${login.password}, ${login.origin}`); + } + + let formProcessedPromise = listenForTestNotification("FormProcessed"); + info("Opening tab with url: " + url); + await BrowserTestUtils.withNewTab( + { + gBrowser, + url, + }, + async function (browser) { + info(`Opened tab with url: ${url}, waiting for focus`); + await SimpleTest.promiseFocus(browser.ownerGlobal); + info("Waiting for form-processed message"); + await formProcessedPromise; + await initForm(browser, formDefaults, { passwordFieldType }); + await checkForm(browser, expected.initialForm); + info("form checked"); + + // A message is still sent to the parent process when Primary Password is enabled + let notificationMessage = + expected.doorhanger || !isLoggedIn + ? "PasswordEditedOrGenerated" + : "PasswordIgnoreEdit"; + let passwordTestNotification = + listenForTestNotification(notificationMessage); + + await changeContentFormValues(browser, formChanges, shouldBlur); + + info( + `form edited, waiting for test notification of ${notificationMessage}` + ); + + await passwordTestNotification; + info("Resolved passwordTestNotification promise"); + + if (!expected.doorhanger) { + let notif; + try { + await TestUtils.waitForCondition( + () => { + return (notif = PopupNotifications.getNotification( + "password", + browser + )); + }, + `Waiting to ensure no notification`, + undefined, + 25 + ); + } catch (ex) {} + Assert.ok(!notif, "No doorhanger expected"); + // the remainder of the test is for doorhanger-expected cases + return; + } + + let notificationType = expected.doorhanger.type; + Assert.ok( + /^password-save|password-change$/.test(notificationType), + "test provided an expected notification type: " + notificationType + ); + info("waiting for doorhanger"); + await waitForDoorhanger(browser, notificationType); + + info("verifying doorhanger"); + let notif = await openAndVerifyDoorhanger( + browser, + notificationType, + expected.doorhanger + ); + Assert.ok(notif, "Doorhanger was shown"); + + let promiseHidden = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popuphidden" + ); + clickDoorhangerButton(notif, DONT_CHANGE_BUTTON); + await promiseHidden; + + info("cleanup doorhanger"); + await cleanupDoorhanger(notif); + } + ); +} + +async function initForm(browser, formDefaults, passwordFieldType) { + await ContentTask.spawn( + browser, + { passwordInputSelector, passwordFieldType }, + async function ({ passwordInputSelector, passwordFieldType }) { + content.document.querySelector(passwordInputSelector).type = + passwordFieldType; + } + ); + await ContentTask.spawn( + browser, + formDefaults, + async function (selectorValues) { + for (let [sel, value] of Object.entries(selectorValues)) { + content.document.querySelector(sel).value = value; + } + } + ); +} + +async function checkForm(browser, expected) { + await ContentTask.spawn( + browser, + { + [passwordInputSelector]: expected.password, + [usernameInputSelector]: expected.username, + }, + async function contentCheckForm(selectorValues) { + for (let [sel, value] of Object.entries(selectorValues)) { + let field = content.document.querySelector(sel); + Assert.equal( + field.value, + value, + sel + " has the expected initial value" + ); + } + } + ); +} + +async function openAndVerifyDoorhanger(browser, type, expected) { + // check a dismissed prompt was shown with extraAttr attribute + let notif = getCaptureDoorhanger(type); + Assert.ok(notif, `${type} doorhanger was created`); + Assert.equal( + notif.dismissed, + expected.dismissed, + "Check notification dismissed property" + ); + Assert.equal( + notif.anchorElement.getAttribute("extraAttr"), + expected.anchorExtraAttr, + "Check icon extraAttr attribute" + ); + let { panel } = PopupNotifications; + // if the doorhanged is dimissed, we will open it to check panel contents + Assert.equal(panel.state, "closed", "Panel is initially closed"); + let promiseShown = BrowserTestUtils.waitForEvent(panel, "popupshown"); + // synthesize click on anchor as this also blurs the form field triggering + // a change event + EventUtils.synthesizeMouseAtCenter(notif.anchorElement, {}); + await promiseShown; + await Promise.resolve(); + await checkDoorhangerUsernamePassword(expected.username, expected.password); + + let notificationElement = PopupNotifications.panel.childNodes[0]; + let checkbox = notificationElement.querySelector( + "#password-notification-visibilityToggle" + ); + + if (expected.toggle == "visible") { + // Bug 1692284 + // Assert.ok(BrowserTestUtils.is_visible(checkbox), "Toggle checkbox visible as expected"); + } else if (expected.toggle == "hidden") { + Assert.ok( + BrowserTestUtils.is_hidden(checkbox), + "Toggle checkbox hidden as expected" + ); + } else { + info("Not checking toggle checkbox visibility"); + } + return notif; +} diff --git a/toolkit/components/passwordmgr/test/browser/browser_doorhanger_generated_password.js b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_generated_password.js new file mode 100644 index 0000000000..bbcab81854 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_generated_password.js @@ -0,0 +1,1845 @@ +/** + * Test using the generated passwords produces the right doorhangers/notifications + */ + +/* eslint no-shadow:"off" */ + +"use strict"; + +// The origin for the test URIs. +const TEST_ORIGIN = "https://example.com"; +const FORM_PAGE_PATH = + "/browser/toolkit/components/passwordmgr/test/browser/form_basic.html"; +const passwordInputSelector = "#form-basic-password"; +const usernameInputSelector = "#form-basic-username"; + +requestLongerTimeout(2); + +async function task_setup() { + Services.logins.removeAllUserFacingLogins(); + LoginTestUtils.resetGeneratedPasswordsCache(); + await cleanupPasswordNotifications(); + await LoginTestUtils.remoteSettings.setupImprovedPasswordRules(); +} + +async function setup_withOneLogin(username = "username", password = "pass1") { + // Reset to a single, known login + await task_setup(); + let login = await LoginTestUtils.addLogin({ username, password }); + return login; +} + +async function setup_withNoLogins() { + // Reset to a single, known login + await task_setup(); + Assert.equal( + Services.logins.getAllLogins().length, + 0, + "0 logins at the start of the test" + ); +} + +async function fillGeneratedPasswordFromACPopup( + browser, + passwordInputSelector +) { + let popup = document.getElementById("PopupAutoComplete"); + Assert.ok(popup, "Got popup"); + await openACPopup(popup, browser, passwordInputSelector); + await fillGeneratedPasswordFromOpenACPopup(browser, passwordInputSelector); +} + +async function checkPromptContents( + anchorElement, + browser, + expectedPasswordLength = 0 +) { + let { panel } = PopupNotifications; + Assert.ok(PopupNotifications.isPanelOpen, "Confirm popup is open"); + let notificationElement = panel.childNodes[0]; + if (expectedPasswordLength) { + info( + `Waiting for password value to be ${expectedPasswordLength} chars long` + ); + await BrowserTestUtils.waitForCondition(() => { + return ( + notificationElement.querySelector("#password-notification-password") + .value.length == expectedPasswordLength + ); + }, "Wait for nsLoginManagerPrompter writeDataToUI()"); + } + + return { + passwordValue: notificationElement.querySelector( + "#password-notification-password" + ).value, + usernameValue: notificationElement.querySelector( + "#password-notification-username" + ).value, + }; +} + +async function verifyGeneratedPasswordWasFilled( + browser, + passwordInputSelector +) { + await SpecialPowers.spawn( + browser, + [[passwordInputSelector]], + function checkFinalFieldValue(inputSelector) { + let { LoginTestUtils: LTU } = ChromeUtils.importESModule( + "resource://testing-common/LoginTestUtils.sys.mjs" + ); + let passwordInput = content.document.querySelector(inputSelector); + Assert.equal( + passwordInput.value.length, + LTU.generation.LENGTH, + "Password field was filled with generated password" + ); + } + ); +} + +async function openFormInNewTab(url, formValues, taskFn) { + let formFilled = listenForTestNotification("FormProcessed"); + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url, + }, + async function (browser) { + await SimpleTest.promiseFocus(browser.ownerGlobal); + await formFilled; + + await SpecialPowers.spawn( + browser, + [formValues], + async function prepareAndCheckForm({ + password: passwordProps, + username: usernameProps, + }) { + let doc = content.document; + // give the form an action so we can know when submit is complete + doc.querySelector("form").action = "/"; + + let props = passwordProps; + if (props) { + // We'll reuse the form_basic.html, but ensure we'll get the generated password autocomplete option + let field = doc.querySelector(props.selector); + if (props.type) { + // Change the type from 'password' to something else. + field.type = props.type; + } + + field.setAttribute("autocomplete", "new-password"); + if (props.hasOwnProperty("expectedValue")) { + Assert.equal( + field.value, + props.expectedValue, + "Check autofilled password value" + ); + } + } + props = usernameProps; + if (props) { + let field = doc.querySelector(props.selector); + if (props.hasOwnProperty("expectedValue")) { + Assert.equal( + field.value, + props.expectedValue, + "Check autofilled username value" + ); + } + } + } + ); + + if (formValues.password && formValues.password.setValue !== undefined) { + info( + "Editing the password, expectedMessage? " + + formValues.password.expectedMessage + ); + let messagePromise = formValues.password.expectedMessage + ? listenForTestNotification(formValues.password.expectedMessage) + : Promise.resolve(); + await changeContentInputValue( + browser, + formValues.password.selector, + formValues.password.setValue + ); + await messagePromise; + info("messagePromise resolved"); + } + + if (formValues.username && formValues.username.setValue !== undefined) { + info( + "Editing the username, expectedMessage? " + + formValues.username.expectedMessage + ); + let messagePromise = formValues.username.expectedMessage + ? listenForTestNotification(formValues.username.expectedMessage) + : Promise.resolve(); + await changeContentInputValue( + browser, + formValues.username.selector, + formValues.username.setValue + ); + await messagePromise; + info("messagePromise resolved"); + } + + await taskFn(browser); + await closePopup( + browser.ownerDocument.getElementById("confirmation-hint") + ); + } + ); +} + +async function openAndVerifyDoorhanger(browser, type, expected) { + // check a dismissed prompt was shown with extraAttr attribute + let notif = getCaptureDoorhanger(type); + Assert.ok(notif, `${type} doorhanger was created`); + Assert.equal( + notif.dismissed, + expected.dismissed, + "Check notification dismissed property" + ); + Assert.equal( + notif.anchorElement.getAttribute("extraAttr"), + expected.anchorExtraAttr, + "Check icon extraAttr attribute" + ); + let { panel } = PopupNotifications; + // if the doorhanged is dimissed, we will open it to check panel contents + if (panel.state !== "open") { + let promiseShown = BrowserTestUtils.waitForEvent(panel, "popupshown"); + if (panel.state !== "showing") { + // synthesize click on anchor as this also blurs the form field triggering + // a change event + EventUtils.synthesizeMouseAtCenter(notif.anchorElement, {}); + } + await promiseShown; + } + let { passwordValue, usernameValue } = await checkPromptContents( + notif.anchorElement, + browser, + expected.passwordLength + ); + Assert.equal( + passwordValue.length, + expected.passwordLength || LoginTestUtils.generation.LENGTH, + "Doorhanger password field has generated 15-char value" + ); + Assert.equal( + usernameValue, + expected.usernameValue, + "Doorhanger username field was popuplated" + ); + return notif; +} + +async function appendContentInputvalue(browser, selector, str) { + await ContentTask.spawn( + browser, + { selector, str }, + async function ({ selector, str }) { + const EventUtils = ContentTaskUtils.getEventUtils(content); + let input = content.document.querySelector(selector); + input.focus(); + input.select(); + await EventUtils.synthesizeKey("KEY_ArrowRight", {}, content); + let changedPromise = ContentTaskUtils.waitForEvent(input, "change"); + if (str) { + await EventUtils.sendString(str, content); + } + input.blur(); + await changedPromise; + } + ); + info("Input value changed"); + await TestUtils.waitForTick(); +} + +async function submitForm(browser) { + // Submit the form + info("Now submit the form"); + let correctPathNamePromise = BrowserTestUtils.browserLoaded(browser); + await SpecialPowers.spawn(browser, [], async function () { + content.document.querySelector("form").submit(); + }); + await correctPathNamePromise; + await SpecialPowers.spawn(browser, [], async () => { + let win = content; + await ContentTaskUtils.waitForCondition(() => { + return ( + win.location.pathname == "/" && win.document.readyState == "complete" + ); + }, "Wait for form submission load"); + }); +} + +add_setup(async function () { + await SpecialPowers.pushPrefEnv({ + set: [ + ["signon.generation.available", true], + ["signon.generation.enabled", true], + ], + }); + // assert that there are no logins + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 0, "There are no logins"); +}); + +add_task(async function autocomplete_generated_password_auto_saved() { + // confirm behavior when filling a generated password via autocomplete + // when there are no other logins + await setup_withNoLogins(); + await openFormInNewTab( + TEST_ORIGIN + FORM_PAGE_PATH, + { + password: { selector: passwordInputSelector, expectedValue: "" }, + username: { selector: usernameInputSelector, expectedValue: "" }, + }, + async function taskFn(browser) { + let storageChangedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "addLogin" + ); + // Let the hint hide itself this first time + let forceClosePopup = false; + let hintShownAndVerified = verifyConfirmationHint( + browser, + forceClosePopup + ); + + await fillGeneratedPasswordFromACPopup(browser, passwordInputSelector); + let [{ username, password }] = await storageChangedPromise; + await verifyGeneratedPasswordWasFilled(browser, passwordInputSelector); + + // Make sure confirmation hint was shown + info("waiting for verifyConfirmationHint"); + await hintShownAndVerified; + + // Check properties of the newly auto-saved login + Assert.equal(username, "", "Saved login should have no username"); + Assert.equal( + password.length, + LoginTestUtils.generation.LENGTH, + "Saved login should have generated password" + ); + + let notif = await openAndVerifyDoorhanger(browser, "password-change", { + dismissed: true, + anchorExtraAttr: "attention", + usernameValue: "", + passwordLength: LoginTestUtils.generation.LENGTH, + }); + + let promiseHidden = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popuphidden" + ); + clickDoorhangerButton(notif, DONT_CHANGE_BUTTON); + await promiseHidden; + + // confirm the extraAttr attribute is removed after opening & dismissing the doorhanger + Assert.ok( + !notif.anchorElement.hasAttribute("extraAttr"), + "Check if the extraAttr attribute was removed" + ); + await cleanupDoorhanger(notif); + + storageChangedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "modifyLogin" + ); + let [autoSavedLogin] = Services.logins.getAllLogins(); + info("waiting for submitForm"); + await submitForm(browser); + await storageChangedPromise; + verifyLogins([ + { + timesUsed: autoSavedLogin.timesUsed + 1, + username: "", + }, + ]); + } + ); +}); + +add_task( + async function autocomplete_generated_password_with_confirm_field_auto_saved() { + // confirm behavior when filling a generated password via autocomplete + // when there are no other logins and the form has a confirm password field + const FORM_WITH_CONFIRM_FIELD_PAGE_PATH = + "/browser/toolkit/components/passwordmgr/test/browser/form_basic_with_confirm_field.html"; + const confirmPasswordInputSelector = "#form-basic-confirm-password"; + await setup_withNoLogins(); + await openFormInNewTab( + TEST_ORIGIN + FORM_WITH_CONFIRM_FIELD_PAGE_PATH, + { + password: { selector: passwordInputSelector, expectedValue: "" }, + username: { selector: usernameInputSelector, expectedValue: "" }, + }, + async function taskFn(browser) { + let storageChangedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "addLogin" + ); + // Let the hint hide itself this first time + let forceClosePopup = false; + let hintShownAndVerified = verifyConfirmationHint( + browser, + forceClosePopup + ); + + await fillGeneratedPasswordFromACPopup(browser, passwordInputSelector); + let [{ username, password }] = await storageChangedPromise; + await verifyGeneratedPasswordWasFilled(browser, passwordInputSelector); + await verifyGeneratedPasswordWasFilled( + browser, + confirmPasswordInputSelector + ); + + // Make sure confirmation hint was shown + info("waiting for verifyConfirmationHint"); + await hintShownAndVerified; + + // Check properties of the newly auto-saved login + Assert.equal(username, "", "Saved login should have no username"); + Assert.equal( + password.length, + LoginTestUtils.generation.LENGTH, + "Saved login should have generated password" + ); + + let notif = await openAndVerifyDoorhanger(browser, "password-change", { + dismissed: true, + anchorExtraAttr: "attention", + usernameValue: "", + passwordLength: LoginTestUtils.generation.LENGTH, + }); + + let promiseHidden = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popuphidden" + ); + clickDoorhangerButton(notif, DONT_CHANGE_BUTTON); + await promiseHidden; + + // confirm the extraAttr attribute is removed after opening & dismissing the doorhanger + Assert.ok( + !notif.anchorElement.hasAttribute("extraAttr"), + "Check if the extraAttr attribute was removed" + ); + await cleanupDoorhanger(notif); + + storageChangedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "modifyLogin" + ); + let [autoSavedLogin] = Services.logins.getAllLogins(); + info("waiting for submitForm"); + await submitForm(browser); + await storageChangedPromise; + verifyLogins([ + { + timesUsed: autoSavedLogin.timesUsed + 1, + username: "", + }, + ]); + } + ); + } +); + +add_task(async function autocomplete_generated_password_saved_empty_username() { + // confirm behavior when filling a generated password via autocomplete + // when there is an existing saved login with a "" username + await setup_withOneLogin("", "xyzpassword"); + await openFormInNewTab( + TEST_ORIGIN + FORM_PAGE_PATH, + { + password: { + selector: passwordInputSelector, + expectedValue: "xyzpassword", + setValue: "", + expectedMessage: "PasswordEditedOrGenerated", + }, + username: { selector: usernameInputSelector, expectedValue: "" }, + }, + async function taskFn(browser) { + let [savedLogin] = Services.logins.getAllLogins(); + let storageChangedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "modifyLogin" + ); + await fillGeneratedPasswordFromACPopup(browser, passwordInputSelector); + await waitForDoorhanger(browser, "password-change"); + info("Waiting to openAndVerifyDoorhanger"); + await openAndVerifyDoorhanger(browser, "password-change", { + dismissed: true, + anchorExtraAttr: "", + usernameValue: "", + passwordLength: LoginTestUtils.generation.LENGTH, + }); + await hideDoorhangerPopup(); + info("Waiting to verifyGeneratedPasswordWasFilled"); + await verifyGeneratedPasswordWasFilled(browser, passwordInputSelector); + + info("waiting for submitForm"); + await submitForm(browser); + let notif = await openAndVerifyDoorhanger(browser, "password-change", { + dismissed: false, + anchorExtraAttr: "", + usernameValue: "", + passwordLength: LoginTestUtils.generation.LENGTH, + }); + + let promiseHidden = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popuphidden" + ); + clickDoorhangerButton(notif, CHANGE_BUTTON); + await promiseHidden; + + info("Waiting for modifyLogin"); + await storageChangedPromise; + verifyLogins([ + { + timesUsed: savedLogin.timesUsed + 1, + username: "", + }, + ]); + await cleanupDoorhanger(notif); // cleanup the doorhanger for next test + } + ); +}); + +add_task(async function autocomplete_generated_password_saved_username() { + // confirm behavior when filling a generated password via autocomplete + // into a form with username matching an existing saved login + await setup_withOneLogin("user1", "xyzpassword"); + await openFormInNewTab( + TEST_ORIGIN + FORM_PAGE_PATH, + { + password: { + selector: passwordInputSelector, + expectedValue: "xyzpassword", + setValue: "", + expectedMessage: "PasswordEditedOrGenerated", + }, + username: { + selector: usernameInputSelector, + expectedValue: "user1", + }, + }, + async function taskFn(browser) { + let storageChangedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "addLogin" + ); + // We don't need to wait to confirm the hint hides itelf every time + let forceClosePopup = true; + let hintShownAndVerified = verifyConfirmationHint( + browser, + forceClosePopup + ); + + await fillGeneratedPasswordFromACPopup(browser, passwordInputSelector); + + // Make sure confirmation hint was shown + info("waiting for verifyConfirmationHint"); + await hintShownAndVerified; + + info("waiting for addLogin"); + await storageChangedPromise; + await verifyGeneratedPasswordWasFilled(browser, passwordInputSelector); + + // Check properties of the newly auto-saved login + let [user1LoginSnapshot, autoSavedLogin] = verifyLogins([ + { + username: "user1", + password: "xyzpassword", // user1 is unchanged + }, + { + timesUsed: 1, + username: "", + passwordLength: LoginTestUtils.generation.LENGTH, + }, + ]); + + let notif = await openAndVerifyDoorhanger(browser, "password-change", { + dismissed: true, + anchorExtraAttr: "attention", + usernameValue: "user1", + passwordLength: LoginTestUtils.generation.LENGTH, + }); + + let promiseHidden = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popuphidden" + ); + clickDoorhangerButton(notif, DONT_CHANGE_BUTTON); + await promiseHidden; + + // confirm the extraAttr attribute is removed after opening & dismissing the doorhanger + Assert.ok( + !notif.anchorElement.hasAttribute("extraAttr"), + "Check if the extraAttr attribute was removed" + ); + await cleanupDoorhanger(notif); + + storageChangedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "modifyLogin" + ); + info("waiting for submitForm"); + await submitForm(browser); + promiseHidden = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popuphidden" + ); + clickDoorhangerButton(notif, CHANGE_BUTTON); + await promiseHidden; + await storageChangedPromise; + verifyLogins([ + { + timesUsed: user1LoginSnapshot.timesUsed + 1, + username: "user1", + password: autoSavedLogin.password, + }, + ]); + } + ); +}); + +add_task(async function ac_gen_pw_saved_empty_un_stored_non_empty_un_in_form() { + // confirm behavior when when the form's username field has a non-empty value + // and there is an existing saved login with a "" username + await setup_withOneLogin("", "xyzpassword"); + await openFormInNewTab( + TEST_ORIGIN + FORM_PAGE_PATH, + { + password: { + selector: passwordInputSelector, + expectedValue: "xyzpassword", + setValue: "", + expectedMessage: "PasswordEditedOrGenerated", + }, + username: { + selector: usernameInputSelector, + expectedValue: "", + setValue: "myusername", + // with an empty password value, no message is sent for a username change + expectedMessage: "", + }, + }, + async function taskFn(browser) { + let [savedLogin] = Services.logins.getAllLogins(); + let storageChangedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "addLogin" + ); + await fillGeneratedPasswordFromACPopup(browser, passwordInputSelector); + await waitForDoorhanger(browser, "password-save"); + info("Waiting to openAndVerifyDoorhanger"); + await openAndVerifyDoorhanger(browser, "password-save", { + dismissed: true, + anchorExtraAttr: "", + usernameValue: "myusername", + passwordLength: LoginTestUtils.generation.LENGTH, + }); + await hideDoorhangerPopup(); + info("Waiting to verifyGeneratedPasswordWasFilled"); + await verifyGeneratedPasswordWasFilled(browser, passwordInputSelector); + + info("waiting for submitForm"); + await submitForm(browser); + let notif = await openAndVerifyDoorhanger(browser, "password-save", { + dismissed: false, + anchorExtraAttr: "", + usernameValue: "myusername", + passwordLength: LoginTestUtils.generation.LENGTH, + }); + + let promiseHidden = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popuphidden" + ); + clickDoorhangerButton(notif, REMEMBER_BUTTON); + await promiseHidden; + + info("Waiting for addLogin"); + await storageChangedPromise; + verifyLogins([ + { + timesUsed: savedLogin.timesUsed, + username: "", + password: "xyzpassword", + }, + { + timesUsed: 1, + username: "myusername", + }, + ]); + await cleanupDoorhanger(notif); // cleanup the doorhanger for next test + } + ); +}); + +add_task(async function contextfill_generated_password_saved_empty_username() { + // confirm behavior when filling a generated password via context menu + // when there is an existing saved login with a "" username + await setup_withOneLogin("", "xyzpassword"); + await openFormInNewTab( + TEST_ORIGIN + FORM_PAGE_PATH, + { + password: { + selector: passwordInputSelector, + expectedValue: "xyzpassword", + setValue: "", + expectedMessage: "PasswordEditedOrGenerated", + }, + username: { selector: usernameInputSelector, expectedValue: "" }, + }, + async function taskFn(browser) { + let [savedLogin] = Services.logins.getAllLogins(); + let storageChangedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "modifyLogin" + ); + await doFillGeneratedPasswordContextMenuItem( + browser, + passwordInputSelector + ); + await waitForDoorhanger(browser, "password-change"); + info("Waiting to openAndVerifyDoorhanger"); + await openAndVerifyDoorhanger(browser, "password-change", { + dismissed: true, + anchorExtraAttr: "", + usernameValue: "", + passwordLength: LoginTestUtils.generation.LENGTH, + }); + await hideDoorhangerPopup(); + info("Waiting to verifyGeneratedPasswordWasFilled"); + await verifyGeneratedPasswordWasFilled(browser, passwordInputSelector); + + info("waiting for submitForm"); + await submitForm(browser); + let notif = await openAndVerifyDoorhanger(browser, "password-change", { + dismissed: false, + anchorExtraAttr: "", + usernameValue: "", + passwordLength: LoginTestUtils.generation.LENGTH, + }); + + let promiseHidden = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popuphidden" + ); + clickDoorhangerButton(notif, CHANGE_BUTTON); + await promiseHidden; + + info("Waiting for modifyLogin"); + await storageChangedPromise; + verifyLogins([ + { + timesUsed: savedLogin.timesUsed + 1, + username: "", + }, + ]); + await cleanupDoorhanger(notif); // cleanup the doorhanger for next test + } + ); +}); + +async function autocomplete_generated_password_edited_no_auto_save( + passwordType = "password" +) { + // confirm behavior when filling a generated password via autocomplete + // when there is an existing saved login with a "" username and then editing + // the password and autocompleting again. + await setup_withOneLogin("", "xyzpassword"); + await openFormInNewTab( + TEST_ORIGIN + FORM_PAGE_PATH, + { + password: { + selector: passwordInputSelector, + expectedValue: "xyzpassword", + setValue: "", + type: passwordType, + expectedMessage: "PasswordEditedOrGenerated", + }, + username: { selector: usernameInputSelector, expectedValue: "" }, + }, + async function taskFn(browser) { + let [savedLogin] = Services.logins.getAllLogins(); + let storageChangedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "modifyLogin" + ); + await fillGeneratedPasswordFromACPopup(browser, passwordInputSelector); + info( + "Filled generated password, waiting for dismissed password-change doorhanger" + ); + await waitForDoorhanger(browser, "password-change"); + info("Waiting to openAndVerifyDoorhanger"); + let notif = await openAndVerifyDoorhanger(browser, "password-change", { + dismissed: true, + anchorExtraAttr: "", + usernameValue: "", + passwordLength: LoginTestUtils.generation.LENGTH, + }); + + let promiseHidden = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popuphidden" + ); + clickDoorhangerButton(notif, DONT_CHANGE_BUTTON); + await promiseHidden; + + info("Waiting to verifyGeneratedPasswordWasFilled"); + await verifyGeneratedPasswordWasFilled(browser, passwordInputSelector); + + await BrowserTestUtils.sendChar("!", browser); + await BrowserTestUtils.sendChar("@", browser); + await BrowserTestUtils.synthesizeKey("KEY_Tab", undefined, browser); + + await waitForDoorhanger(browser, "password-change"); + info("Waiting to openAndVerifyDoorhanger"); + notif = await openAndVerifyDoorhanger(browser, "password-change", { + dismissed: true, + anchorExtraAttr: "", + usernameValue: "", + passwordLength: LoginTestUtils.generation.LENGTH + 2, + }); + + promiseHidden = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popuphidden" + ); + clickDoorhangerButton(notif, DONT_CHANGE_BUTTON); + await promiseHidden; + + verifyLogins([ + { + timesUsed: savedLogin.timesUsed, + username: "", + password: "xyzpassword", + }, + ]); + + info("waiting for submitForm"); + await submitForm(browser); + notif = await openAndVerifyDoorhanger(browser, "password-change", { + dismissed: false, + anchorExtraAttr: "", + usernameValue: "", + passwordLength: LoginTestUtils.generation.LENGTH + 2, + }); + + promiseHidden = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popuphidden" + ); + clickDoorhangerButton(notif, CHANGE_BUTTON); + await promiseHidden; + + info("Waiting for modifyLogin"); + await storageChangedPromise; + verifyLogins([ + { + timesUsed: savedLogin.timesUsed + 1, + username: "", + }, + ]); + await cleanupDoorhanger(notif); // cleanup the doorhanger for next test + } + ); + + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().clear(); +} + +add_task(autocomplete_generated_password_edited_no_auto_save); + +add_task( + async function autocomplete_generated_password_edited_no_auto_save_type_text() { + await autocomplete_generated_password_edited_no_auto_save("text"); + } +); + +add_task(async function contextmenu_fill_generated_password_and_set_username() { + // test when filling with a generated password and editing the username in the form + // * the prompt should display the form's username + // * the auto-saved login should have "" for username + // * confirming the prompt should edit the "" login and add the username + await setup_withOneLogin("olduser", "xyzpassword"); + await openFormInNewTab( + TEST_ORIGIN + FORM_PAGE_PATH, + { + password: { + selector: passwordInputSelector, + expectedValue: "xyzpassword", + setValue: "", + expectedMessage: "PasswordEditedOrGenerated", + }, + username: { + selector: usernameInputSelector, + expectedValue: "olduser", + setValue: "differentuser", + // with an empty password value, no message is sent for a username change + expectedMessage: "", + }, + }, + async function taskFn(browser) { + let storageChangedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "addLogin" + ); + await SpecialPowers.spawn( + browser, + [[passwordInputSelector, usernameInputSelector]], + function checkEmptyPasswordField([passwordSelector, usernameSelector]) { + Assert.equal( + content.document.querySelector(passwordSelector).value, + "", + "Password field is empty" + ); + } + ); + + // Let the hint hide itself this first time + let forceClosePopup = false; + let hintShownAndVerified = verifyConfirmationHint( + browser, + forceClosePopup + ); + + info("waiting to fill generated password using context menu"); + await doFillGeneratedPasswordContextMenuItem( + browser, + passwordInputSelector + ); + + info("waiting for verifyConfirmationHint"); + await hintShownAndVerified; + info("waiting for dismissed password-change notification"); + await waitForDoorhanger(browser, "password-change"); + + info("waiting for addLogin"); + await storageChangedPromise; + + // Check properties of the newly auto-saved login + verifyLogins([ + null, // ignore the first one + { + timesUsed: 1, + username: "", + passwordLength: LoginTestUtils.generation.LENGTH, + }, + ]); + + info("Waiting to openAndVerifyDoorhanger"); + await openAndVerifyDoorhanger(browser, "password-change", { + dismissed: true, + anchorExtraAttr: "attention", + usernameValue: "differentuser", + passwordLength: LoginTestUtils.generation.LENGTH, + }); + await hideDoorhangerPopup(); + info("Waiting to verifyGeneratedPasswordWasFilled"); + await verifyGeneratedPasswordWasFilled(browser, passwordInputSelector); + + info("waiting for submitForm"); + await submitForm(browser); + let notif = await openAndVerifyDoorhanger(browser, "password-change", { + dismissed: false, + anchorExtraAttr: "", + usernameValue: "differentuser", + passwordLength: LoginTestUtils.generation.LENGTH, + }); + + storageChangedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "modifyLogin" + ); + + let promiseHidden = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popuphidden" + ); + clickDoorhangerButton(notif, CHANGE_BUTTON); + await promiseHidden; + + info("Waiting for modifyLogin"); + await storageChangedPromise; + verifyLogins([ + null, + { + username: "differentuser", + passwordLength: LoginTestUtils.generation.LENGTH, + timesUsed: 2, + }, + ]); + await cleanupDoorhanger(notif); // cleanup the doorhanger for next test + } + ); +}); + +add_task(async function contextmenu_password_change_form_without_username() { + // test doorhanger behavior when a generated password is filled into a change-password + // form with no username + await setup_withOneLogin("user1", "xyzpassword"); + await LoginTestUtils.addLogin({ username: "username2", password: "pass2" }); + const passwordInputSelector = "#newpass"; + + const CHANGE_FORM_PATH = + "/browser/toolkit/components/passwordmgr/test/browser/form_password_change.html"; + await openFormInNewTab( + TEST_ORIGIN + CHANGE_FORM_PATH, + { + password: { + selector: passwordInputSelector, + expectedValue: "", + }, + }, + async function taskFn(browser) { + let storageChangedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "addLogin" + ); + + // We don't need to wait to confirm the hint hides itelf every time + let forceClosePopup = true; + let hintShownAndVerified = verifyConfirmationHint( + browser, + forceClosePopup + ); + + // Make the 2nd field use a generated password + info("Using contextmenu to fill with a generated password"); + await doFillGeneratedPasswordContextMenuItem( + browser, + passwordInputSelector + ); + + info("waiting for dismissed password-change notification"); + await waitForDoorhanger(browser, "password-change"); + + // Make sure confirmation hint was shown + info("waiting for verifyConfirmationHint"); + await hintShownAndVerified; + + info("waiting for addLogin"); + await storageChangedPromise; + // Check properties of the newly auto-saved login + verifyLogins([ + null, // ignore the first one + null, // ignore the 2nd one + { + timesUsed: 1, + username: "", + passwordLength: LoginTestUtils.generation.LENGTH, + }, + ]); + + info("Waiting to openAndVerifyDoorhanger"); + let notif = await openAndVerifyDoorhanger(browser, "password-change", { + dismissed: true, + anchorExtraAttr: "attention", + usernameValue: "", + passwordLength: LoginTestUtils.generation.LENGTH, + }); + // remove notification so we can unambiguously check no new notification gets created later + await cleanupDoorhanger(notif); + + info("Waiting to verifyGeneratedPasswordWasFilled"); + await verifyGeneratedPasswordWasFilled(browser, passwordInputSelector); + + storageChangedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "modifyLogin" + ); + let { timeLastUsed } = Services.logins.getAllLogins()[2]; + + info("waiting for submitForm"); + await submitForm(browser); + + info("Waiting for modifyLogin"); + await storageChangedPromise; + verifyLogins([ + null, // ignore the first one + null, // ignore the 2nd one + { + timesUsed: 2, + usedSince: timeLastUsed, + }, + ]); + // Check no new doorhanger was shown + notif = getCaptureDoorhanger("password-change"); + Assert.ok(!notif, "No new doorhanger should be shown"); + await cleanupDoorhanger(); // cleanup for next test + } + ); +}); + +add_task( + async function autosaved_login_updated_to_existing_login_via_doorhanger() { + // test when filling with a generated password and editing the username in the + // doorhanger to match an existing login: + // * the matching login should be updated + // * the auto-saved login should be deleted + // * the metadata for the matching login should be updated + // * the by-origin cache for the password should point at the updated login + await setup_withOneLogin("user1", "xyzpassword"); + await LoginTestUtils.addLogin({ + username: "user2", + password: "abcpassword", + }); + await openFormInNewTab( + TEST_ORIGIN + FORM_PAGE_PATH, + { + password: { + selector: passwordInputSelector, + expectedValue: "", + }, + username: { + selector: usernameInputSelector, + expectedValue: "", + }, + }, + async function taskFn(browser) { + await SimpleTest.promiseFocus(browser.ownerGlobal); + + let storageChangedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "addLogin" + ); + // We don't need to wait to confirm the hint hides itelf every time + let forceClosePopup = true; + let hintShownAndVerified = verifyConfirmationHint( + browser, + forceClosePopup + ); + + info("waiting to fill generated password using context menu"); + await doFillGeneratedPasswordContextMenuItem( + browser, + passwordInputSelector + ); + + info("waiting for dismissed password-change notification"); + await waitForDoorhanger(browser, "password-change"); + + // Make sure confirmation hint was shown + info("waiting for verifyConfirmationHint"); + await hintShownAndVerified; + + info("waiting for addLogin"); + await storageChangedPromise; + info("addLogin promise resolved"); + // Check properties of the newly auto-saved login + let [user1LoginSnapshot, unused, autoSavedLogin] = verifyLogins([ + null, // ignore the first one + null, // ignore the 2nd one + { + timesUsed: 1, + username: "", + passwordLength: LoginTestUtils.generation.LENGTH, + }, + ]); + info("user1LoginSnapshot, guid: " + user1LoginSnapshot.guid); + info("unused, guid: " + unused.guid); + info("autoSavedLogin, guid: " + autoSavedLogin.guid); + + info("verifyLogins ok"); + let passwordCacheEntry = + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().get( + "https://example.com" + ); + + Assert.ok( + passwordCacheEntry, + "Got the cached generated password entry for https://example.com" + ); + Assert.equal( + passwordCacheEntry.value, + autoSavedLogin.password, + "Cached password matches the auto-saved login password" + ); + Assert.equal( + passwordCacheEntry.storageGUID, + autoSavedLogin.guid, + "Cached password guid matches the auto-saved login guid" + ); + + info("Waiting to openAndVerifyDoorhanger"); + let notif = await openAndVerifyDoorhanger(browser, "password-change", { + dismissed: true, + anchorExtraAttr: "attention", + usernameValue: "", + password: autoSavedLogin.password, + }); + Assert.ok(notif, "Got password-change notification"); + + info("Calling updateDoorhangerInputValues"); + await updateDoorhangerInputValues({ + username: "user1", + }); + info("doorhanger inputs updated"); + + let loginModifiedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (subject, data) => { + if (data == "modifyLogin") { + info("passwordmgr-storage-changed, action: " + data); + info("subject: " + JSON.stringify(subject)); + return true; + } + return false; + } + ); + let loginRemovedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (subject, data) => { + if (data == "removeLogin") { + info("passwordmgr-storage-changed, action: " + data); + info("subject: " + JSON.stringify(subject)); + return true; + } + return false; + } + ); + + let promiseHidden = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popuphidden" + ); + info("clicking change button"); + clickDoorhangerButton(notif, CHANGE_BUTTON); + await promiseHidden; + + info("Waiting for modifyLogin promise"); + await loginModifiedPromise; + + info("Waiting for removeLogin promise"); + await loginRemovedPromise; + + info("storage-change promises resolved"); + // Check the auto-saved login was removed and the original login updated + verifyLogins([ + { + username: "user1", + password: autoSavedLogin.password, + timeCreated: user1LoginSnapshot.timeCreated, + timeLastUsed: user1LoginSnapshot.timeLastUsed, + passwordChangedSince: autoSavedLogin.timePasswordChanged, + }, + null, // ignore user2 + ]); + + // Check we have no notifications at this point + Assert.ok(!PopupNotifications.isPanelOpen, "No doorhanger is open"); + Assert.ok( + !PopupNotifications.getNotification("password", browser), + "No notifications" + ); + + // make sure the cache entry is unchanged with the removal of the auto-saved login + Assert.equal( + autoSavedLogin.password, + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().get( + "https://example.com" + ).value, + "Generated password cache entry has the expected password value" + ); + } + ); + } +); + +add_task(async function autosaved_login_updated_to_existing_login_onsubmit() { + // test when selecting auto-saved generated password in a form filled with an + // existing login and submitting the form: + // * the matching login should be updated + // * the auto-saved login should be deleted + // * the metadata for the matching login should be updated + // * the by-origin cache for the password should point at the updated login + + // clear both fields which should be autofilled with our single login + await setup_withOneLogin("user1", "xyzpassword"); + await openFormInNewTab( + TEST_ORIGIN + FORM_PAGE_PATH, + { + password: { + selector: passwordInputSelector, + expectedValue: "xyzpassword", + setValue: "", + expectedMessage: "PasswordEditedOrGenerated", + }, + username: { + selector: usernameInputSelector, + expectedValue: "user1", + setValue: "", + // with an empty password value, no message is sent for a username change + expectedMessage: "", + }, + }, + async function taskFn(browser) { + await SimpleTest.promiseFocus(browser.ownerGlobal); + + // first, create an auto-saved login with generated password + let storageChangedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "addLogin" + ); + // We don't need to wait to confirm the hint hides itelf every time + let forceClosePopup = true; + let hintShownAndVerified = verifyConfirmationHint( + browser, + forceClosePopup + ); + + info("waiting to fill generated password using context menu"); + await doFillGeneratedPasswordContextMenuItem( + browser, + passwordInputSelector + ); + + info("waiting for dismissed password-change notification"); + await waitForDoorhanger(browser, "password-change"); + + // Make sure confirmation hint was shown + info("waiting for verifyConfirmationHint"); + await hintShownAndVerified; + + info("waiting for addLogin"); + await storageChangedPromise; + info("addLogin promise resolved"); + // Check properties of the newly auto-saved login + let [user1LoginSnapshot, autoSavedLogin] = verifyLogins([ + null, // ignore the first one + { + timesUsed: 1, + username: "", + passwordLength: LoginTestUtils.generation.LENGTH, + }, + ]); + info("user1LoginSnapshot, guid: " + user1LoginSnapshot.guid); + info("autoSavedLogin, guid: " + autoSavedLogin.guid); + + info("verifyLogins ok"); + let passwordCacheEntry = + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().get( + "https://example.com" + ); + + Assert.ok( + passwordCacheEntry, + "Got the cached generated password entry for https://example.com" + ); + Assert.equal( + passwordCacheEntry.value, + autoSavedLogin.password, + "Cached password matches the auto-saved login password" + ); + Assert.equal( + passwordCacheEntry.storageGUID, + autoSavedLogin.guid, + "Cached password guid matches the auto-saved login guid" + ); + + let notif = await openAndVerifyDoorhanger(browser, "password-change", { + dismissed: true, + anchorExtraAttr: "attention", + usernameValue: "", + password: autoSavedLogin.password, + }); + await cleanupDoorhanger(notif); + + // now update and submit the form with the user1 username and the generated password + info(`submitting form`); + let submitResults = await submitFormAndGetResults( + browser, + "formsubmit.sjs", + { + "#form-basic-username": "user1", + } + ); + Assert.equal( + submitResults.username, + "user1", + "Form submitted with expected username" + ); + Assert.equal( + submitResults.password, + autoSavedLogin.password, + "Form submitted with expected password" + ); + info( + `form was submitted, got username/password ${submitResults.username}/${submitResults.password}` + ); + + await waitForDoorhanger(browser, "password-change"); + notif = await openAndVerifyDoorhanger(browser, "password-change", { + dismissed: false, + anchorExtraAttr: "", + usernameValue: "user1", + password: autoSavedLogin.password, + }); + + let promiseHidden = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popuphidden" + ); + let loginModifiedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => { + if (data == "modifyLogin") { + info("passwordmgr-storage-changed, action: " + data); + info("subject: " + JSON.stringify(_)); + return true; + } + return false; + } + ); + let loginRemovedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => { + if (data == "removeLogin") { + info("passwordmgr-storage-changed, action: " + data); + info("subject: " + JSON.stringify(_)); + return true; + } + return false; + } + ); + + info("clicking change button"); + clickDoorhangerButton(notif, CHANGE_BUTTON); + await promiseHidden; + + info("Waiting for modifyLogin promise"); + await loginModifiedPromise; + + info("Waiting for removeLogin promise"); + await loginRemovedPromise; + + info("storage-change promises resolved"); + // Check the auto-saved login was removed and the original login updated + verifyLogins([ + { + username: "user1", + password: autoSavedLogin.password, + timeCreated: user1LoginSnapshot.timeCreated, + timeLastUsed: user1LoginSnapshot.timeLastUsed, + passwordChangedSince: autoSavedLogin.timePasswordChanged, + }, + ]); + + // Check we have no notifications at this point + Assert.ok(!PopupNotifications.isPanelOpen, "No doorhanger is open"); + Assert.ok( + !PopupNotifications.getNotification("password", browser), + "No notifications" + ); + + // make sure the cache entry is unchanged with the removal of the auto-saved login + Assert.equal( + autoSavedLogin.password, + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().get( + "https://example.com" + ).value, + "Generated password cache entry has the expected password value" + ); + } + ); +}); + +add_task(async function form_change_from_autosaved_login_to_existing_login() { + // test when changing from a generated password in a form to an existing saved login + // * the auto-saved login should not be deleted + // * the metadata for the matching login should be updated + // * the by-origin cache for the password should point at the autosaved login + + await setup_withOneLogin("user1", "xyzpassword"); + await openFormInNewTab( + TEST_ORIGIN + FORM_PAGE_PATH, + { + password: { + selector: passwordInputSelector, + expectedValue: "xyzpassword", + setValue: "", + expectedMessage: "PasswordEditedOrGenerated", + }, + username: { + selector: usernameInputSelector, + expectedValue: "user1", + setValue: "", + // with an empty password value, no message is sent for a username change + expectedMessage: "", + }, + }, + async function taskFn(browser) { + await SimpleTest.promiseFocus(browser); + + // first, create an auto-saved login with generated password + let storageChangedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "addLogin" + ); + // We don't need to wait to confirm the hint hides itelf every time + let forceClosePopup = true; + let hintShownAndVerified = verifyConfirmationHint( + browser, + forceClosePopup + ); + + info("Filling generated password from AC menu"); + await fillGeneratedPasswordFromACPopup(browser, passwordInputSelector); + + info("waiting for dismissed password-change notification"); + await waitForDoorhanger(browser, "password-change"); + + // Make sure confirmation hint was shown + info("waiting for verifyConfirmationHint"); + await hintShownAndVerified; + + info("waiting for addLogin"); + await storageChangedPromise; + info("addLogin promise resolved"); + // Check properties of the newly auto-saved login + let [user1LoginSnapshot, autoSavedLogin] = verifyLogins([ + null, // ignore the first one + { + timesUsed: 1, + username: "", + passwordLength: LoginTestUtils.generation.LENGTH, + }, + ]); + info("user1LoginSnapshot, guid: " + user1LoginSnapshot.guid); + info("autoSavedLogin, guid: " + autoSavedLogin.guid); + + info("verifyLogins ok"); + let passwordCacheEntry = + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().get( + "https://example.com" + ); + + Assert.ok( + passwordCacheEntry, + "Got the cached generated password entry for https://example.com" + ); + Assert.equal( + passwordCacheEntry.value, + autoSavedLogin.password, + "Cached password matches the auto-saved login password" + ); + Assert.equal( + passwordCacheEntry.storageGUID, + autoSavedLogin.guid, + "Cached password guid matches the auto-saved login guid" + ); + + let notif = await openAndVerifyDoorhanger(browser, "password-change", { + dismissed: true, + anchorExtraAttr: "attention", + usernameValue: "", + password: autoSavedLogin.password, + }); + + // close but don't remove the doorhanger, we want to ensure it is updated/replaced on further form edits + let promiseHidden = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popuphidden" + ); + let PN = notif.owner; + PN.panel.hidePopup(); + await promiseHidden; + await TestUtils.waitForTick(); + + // now update the form with the user1 username and password + info(`updating form`); + let passwordEditedMessages = listenForTestNotification( + "PasswordEditedOrGenerated", + 2 + ); + let passwordChangeDoorhangerPromise = waitForDoorhanger( + browser, + "password-change" + ); + let hintDidShow = false; + let hintPromiseShown = BrowserTestUtils.waitForPopupEvent( + document.getElementById("confirmation-hint"), + "shown" + ); + hintPromiseShown.then(() => (hintDidShow = true)); + + info("Entering username and password for the previously saved login"); + + await changeContentFormValues(browser, { + [passwordInputSelector]: user1LoginSnapshot.password, + [usernameInputSelector]: user1LoginSnapshot.username, + }); + info( + "form edited, waiting for test notification of PasswordEditedOrGenerated" + ); + + await passwordEditedMessages; + info("Resolved listenForTestNotification promise"); + + await passwordChangeDoorhangerPromise; + // wait to ensure there's no confirmation hint + try { + await TestUtils.waitForCondition( + () => { + return hintDidShow; + }, + `Waiting for confirmationHint popup`, + undefined, + 25 + ); + } catch (ex) { + info("Got expected timeout from the waitForCondition: ", ex); + } finally { + Assert.ok(!hintDidShow, "No confirmation hint shown"); + } + + // the previous doorhanger would have old values, verify it was updated/replaced with new values from the form + notif = await openAndVerifyDoorhanger(browser, "password-change", { + dismissed: true, + anchorExtraAttr: "", + usernameValue: user1LoginSnapshot.username, + passwordLength: user1LoginSnapshot.password.length, + }); + await cleanupDoorhanger(notif); + + storageChangedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "modifyLogin" + ); + + // submit the form to ensure the correct updates are made + await submitForm(browser); + info("form submitted, waiting for storage changed"); + await storageChangedPromise; + + // Check the auto-saved login has not changed and only metadata on the original login updated + verifyLogins([ + { + username: "user1", + password: "xyzpassword", + timeCreated: user1LoginSnapshot.timeCreated, + usedSince: user1LoginSnapshot.timeLastUsed, + }, + { + username: "", + password: autoSavedLogin.password, + timeCreated: autoSavedLogin.timeCreated, + timeLastUsed: autoSavedLogin.timeLastUsed, + }, + ]); + + // Check we have no notifications at this point + Assert.ok(!PopupNotifications.isPanelOpen, "No doorhanger is open"); + Assert.ok( + !PopupNotifications.getNotification("password", browser), + "No notifications" + ); + + // make sure the cache entry is unchanged with the removal of the auto-saved login + Assert.equal( + autoSavedLogin.password, + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().get( + "https://example.com" + ).value, + "Generated password cache entry has the expected password value" + ); + } + ); +}); + +add_task(async function form_edit_username_and_password_of_generated_login() { + // test when changing the username and then the password in a form with a generated password (bug 1625242) + // * the toast is not shown for the username change as the auto-saved login is not modified + // * the dismissed doorhanger for the username change has the correct username and password + // * the toast is shown for the change to the generated password + // * the dismissed doorhanger for the password change has the correct username and password + + await setup_withNoLogins(); + await openFormInNewTab( + TEST_ORIGIN + FORM_PAGE_PATH, + {}, + async function taskFn(browser) { + await SimpleTest.promiseFocus(browser); + + // first, create an auto-saved login with generated password + let storageChangedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "addLogin" + ); + // We don't need to wait to confirm the hint hides itelf every time + let forceClosePopup = true; + let hintShownAndVerified = verifyConfirmationHint( + browser, + forceClosePopup + ); + + info("Filling generated password from context menu"); + // there's no new-password field in this form so we'll use the context menu + await doFillGeneratedPasswordContextMenuItem( + browser, + passwordInputSelector + ); + + info("waiting for dismissed password-change notification"); + await waitForDoorhanger(browser, "password-change"); + + // Make sure confirmation hint was shown + info("waiting for verifyConfirmationHint"); + await hintShownAndVerified; + + info("waiting for addLogin"); + await storageChangedPromise; + info("addLogin promise resolved"); + // Check properties of the newly auto-saved login + let [autoSavedLoginSnapshot] = verifyLogins([ + { + timesUsed: 1, + username: "", + passwordLength: LoginTestUtils.generation.LENGTH, + }, + ]); + + let notif = await openAndVerifyDoorhanger(browser, "password-change", { + dismissed: true, + anchorExtraAttr: "attention", + usernameValue: "", + password: autoSavedLoginSnapshot.password, + }); + + // close but don't remove the doorhanger, we want to ensure it is updated/replaced on further form edits + let promiseHidden = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popuphidden" + ); + let PN = notif.owner; + PN.panel.hidePopup(); + await promiseHidden; + await TestUtils.waitForTick(); + + // change the username then the password in the form + for (let { + fieldSelector, + fieldValue, + expectedConfirmation, + expectedDoorhangerUsername, + expectedDoorhangerPassword, + expectedDoorhangerType, + } of [ + { + fieldSelector: usernameInputSelector, + fieldValue: "someuser", + expectedConfirmation: false, + expectedDoorhangerUsername: "someuser", + expectedDoorhangerPassword: autoSavedLoginSnapshot.password, + expectedDoorhangerType: "password-change", + }, + { + fieldSelector: passwordInputSelector, + fieldValue: "!!", + expectedConfirmation: true, + expectedDoorhangerUsername: "someuser", + expectedDoorhangerPassword: autoSavedLoginSnapshot.password + "!!", + expectedDoorhangerType: "password-change", + }, + ]) { + let loginModifiedPromise = expectedConfirmation + ? TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "modifyLogin" + ) + : Promise.resolve(); + + // now edit the field value + let passwordEditedMessage = listenForTestNotification( + "PasswordEditedOrGenerated" + ); + let passwordChangeDoorhangerPromise = waitForDoorhanger( + browser, + expectedDoorhangerType + ); + let hintDidShow = false; + let hintPromiseShown = BrowserTestUtils.waitForPopupEvent( + document.getElementById("confirmation-hint"), + "shown" + ); + hintPromiseShown.then(() => (hintDidShow = true)); + + info(`updating form: ${fieldSelector}: ${fieldValue}`); + await appendContentInputvalue(browser, fieldSelector, fieldValue); + info( + "form edited, waiting for test notification of PasswordEditedOrGenerated" + ); + await passwordEditedMessage; + info( + "Resolved listenForTestNotification promise, waiting for doorhanger" + ); + await passwordChangeDoorhangerPromise; + // wait for possible confirmation hint + try { + info("Waiting for hintDidShow"); + await TestUtils.waitForCondition( + () => hintDidShow, + `Waiting for confirmationHint popup`, + undefined, + 25 + ); + } catch (ex) { + info("Got expected timeout from the waitForCondition: " + ex); + } finally { + info("confirmationHint check done, assert on hintDidShow"); + Assert.equal( + hintDidShow, + expectedConfirmation, + "Confirmation hint shown" + ); + } + info( + "Waiting for loginModifiedPromise, expectedConfirmation? " + + expectedConfirmation + ); + await loginModifiedPromise; + + // the previous doorhanger would have old values, verify it was updated/replaced with new values from the form + info("Verifying the doorhanger"); + notif = await openAndVerifyDoorhanger(browser, "password-change", { + dismissed: true, + anchorExtraAttr: expectedConfirmation ? "attention" : "", + usernameValue: expectedDoorhangerUsername, + passwordLength: expectedDoorhangerPassword.length, + }); + await cleanupDoorhanger(notif); + } + + // submit the form to verify we still get the right doorhanger values + let passwordChangeDoorhangerPromise = waitForDoorhanger( + browser, + "password-change" + ); + await submitForm(browser); + info("form submitted, waiting for doorhanger"); + await passwordChangeDoorhangerPromise; + notif = await openAndVerifyDoorhanger(browser, "password-change", { + dismissed: false, + anchorExtraAttr: "", + usernameValue: "someuser", + passwordLength: LoginTestUtils.generation.LENGTH + 2, + }); + await cleanupDoorhanger(notif); + } + ); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_doorhanger_httpsUpgrade.js b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_httpsUpgrade.js new file mode 100644 index 0000000000..acf3b64e08 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_httpsUpgrade.js @@ -0,0 +1,303 @@ +/* + * Test capture popup notifications with HTTPS upgrades + */ + +let nsLoginInfo = new Components.Constructor( + "@mozilla.org/login-manager/loginInfo;1", + Ci.nsILoginInfo, + "init" +); +let login1 = new nsLoginInfo( + "http://example.com", + "http://example.com", + null, + "notifyu1", + "notifyp1", + "user", + "pass" +); +let login1HTTPS = new nsLoginInfo( + "https://example.com", + "https://example.com", + null, + "notifyu1", + "notifyp1", + "user", + "pass" +); + +add_task(async function test_httpsUpgradeCaptureFields_noChange() { + info( + "Check that we don't prompt to remember when capturing an upgraded login with no change" + ); + await Services.logins.addLoginAsync(login1); + // Sanity check the HTTP login exists. + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should have the HTTP login"); + + await testSubmittingLoginForm( + "subtst_notifications_1.html", + function (fieldValues) { + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = getCaptureDoorhanger("password-save"); + Assert.ok(!notif, "checking for no notification popup"); + }, + "https://example.com" + ); // This is HTTPS whereas the saved login is HTTP + + logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should only have 1 login still"); + let login = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal( + login.origin, + "http://example.com", + "Check the origin is unchanged" + ); + Assert.equal(login.username, "notifyu1", "Check the username is unchanged"); + Assert.equal(login.password, "notifyp1", "Check the password is unchanged"); + Assert.equal(login.timesUsed, 2, "Check times used increased"); + + Services.logins.removeLogin(login1); +}); + +add_task(async function test_httpsUpgradeCaptureFields_changePW() { + info( + "Check that we prompt to change when capturing an upgraded login with a new PW" + ); + await Services.logins.addLoginAsync(login1); + // Sanity check the HTTP login exists. + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should have the HTTP login"); + + await testSubmittingLoginForm( + "subtst_notifications_8.html", + async function (fieldValues) { + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "pass2", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-change"); + Assert.ok(notif, "checking for a change popup"); + + await checkDoorhangerUsernamePassword("notifyu1", "pass2"); + clickDoorhangerButton(notif, CHANGE_BUTTON); + + Assert.ok( + !getCaptureDoorhanger("password-change"), + "popup should be gone" + ); + }, + "https://example.com" + ); // This is HTTPS whereas the saved login is HTTP + + checkOnlyLoginWasUsedTwice({ justChanged: true }); + logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should only have 1 login still"); + let login = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal( + login.origin, + "https://example.com", + "Check the origin is upgraded" + ); + Assert.equal( + login.formActionOrigin, + "https://example.com", + "Check the formActionOrigin is upgraded" + ); + Assert.equal(login.username, "notifyu1", "Check the username is unchanged"); + Assert.equal(login.password, "pass2", "Check the password changed"); + Assert.equal(login.timesUsed, 2, "Check times used increased"); + + Services.logins.removeAllUserFacingLogins(); +}); + +add_task( + async function test_httpsUpgradeCaptureFields_changePWWithBothSchemesSaved() { + info( + "Check that we prompt to change and properly save when capturing an upgraded login with a new PW when an http login also exists for that username" + ); + await Services.logins.addLogins([login1, login1HTTPS]); + + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 2, "Should have both HTTP and HTTPS logins"); + + await testSubmittingLoginForm( + "subtst_notifications_8.html", + async function (fieldValues) { + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "pass2", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-change"); + Assert.ok(notif, "checking for a change popup"); + + await checkDoorhangerUsernamePassword("notifyu1", "pass2"); + clickDoorhangerButton(notif, CHANGE_BUTTON); + + Assert.ok( + !getCaptureDoorhanger("password-change"), + "popup should be gone" + ); + }, + "https://example.com" + ); + + logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 2, "Should have 2 logins still"); + let loginHTTP = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + let loginHTTPS = logins[1].QueryInterface(Ci.nsILoginMetaInfo); + Assert.ok( + LoginHelper.doLoginsMatch(login1, loginHTTP, { ignorePassword: true }), + "Check HTTP login is equal" + ); + Assert.equal(loginHTTP.timesUsed, 1, "Check times used stayed the same"); + Assert.equal( + loginHTTP.timeCreated, + loginHTTP.timePasswordChanged, + "login.timeCreated == login.timePasswordChanged" + ); + Assert.equal( + loginHTTP.timeLastUsed, + loginHTTP.timePasswordChanged, + "timeLastUsed == timePasswordChanged" + ); + + Assert.ok( + LoginHelper.doLoginsMatch(login1HTTPS, loginHTTPS, { + ignorePassword: true, + }), + "Check HTTPS login is equal" + ); + Assert.equal( + loginHTTPS.username, + "notifyu1", + "Check the username is unchanged" + ); + Assert.equal(loginHTTPS.password, "pass2", "Check the password changed"); + Assert.equal(loginHTTPS.timesUsed, 2, "Check times used increased"); + Assert.ok( + loginHTTPS.timeCreated < loginHTTPS.timePasswordChanged, + "login.timeCreated < login.timePasswordChanged" + ); + Assert.equal( + loginHTTPS.timeLastUsed, + loginHTTPS.timePasswordChanged, + "timeLastUsed == timePasswordChanged" + ); + + Services.logins.removeAllUserFacingLogins(); + } +); + +add_task(async function test_httpsUpgradeCaptureFields_captureMatchingHTTP() { + info("Capture a new HTTP login which matches a stored HTTPS one."); + await Services.logins.addLoginAsync(login1HTTPS); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_1.html", + async function (fieldValues) { + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-save"); + Assert.ok(notif, "got notification popup"); + + Assert.equal( + Services.logins.getAllLogins().length, + 1, + "Should only have the HTTPS login" + ); + + await checkDoorhangerUsernamePassword("notifyu1", "notifyp1"); + clickDoorhangerButton(notif, REMEMBER_BUTTON); + } + ); + + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 2, "Should have both HTTP and HTTPS logins"); + for (let login of logins) { + login = login.QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal( + login.username, + "notifyu1", + "Check the username used on the new entry" + ); + Assert.equal( + login.password, + "notifyp1", + "Check the password used on the new entry" + ); + Assert.equal(login.timesUsed, 1, "Check times used on entry"); + } + + info( + "Make sure Remember took effect and we don't prompt for an existing HTTP login" + ); + await testSubmittingLoginFormHTTP( + "subtst_notifications_1.html", + function (fieldValues) { + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = getCaptureDoorhanger("password-save"); + Assert.ok(!notif, "checking for no notification popup"); + } + ); + + logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 2, "Should have both HTTP and HTTPS still"); + + let httpsLogins = LoginHelper.searchLoginsWithObject({ + origin: "https://example.com", + }); + Assert.equal(httpsLogins.length, 1, "Check https logins count"); + let httpsLogin = httpsLogins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.ok(httpsLogin.equals(login1HTTPS), "Check HTTPS login didn't change"); + Assert.equal(httpsLogin.timesUsed, 1, "Check times used"); + + let httpLogins = LoginHelper.searchLoginsWithObject({ + origin: "http://example.com", + }); + Assert.equal(httpLogins.length, 1, "Check http logins count"); + let httpLogin = httpLogins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.ok(httpLogin.equals(login1), "Check HTTP login is as expected"); + Assert.equal(httpLogin.timesUsed, 2, "Check times used increased"); + + Services.logins.removeLogin(login1); + Services.logins.removeLogin(login1HTTPS); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_doorhanger_multipage_form.js b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_multipage_form.js new file mode 100644 index 0000000000..ff7bffcb44 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_multipage_form.js @@ -0,0 +1,182 @@ +/** + * Test that the doorhanger notification for password saving is populated with + * the correct values in various password capture cases (multipage login form). + */ + +const testCases = [ + { + name: "No saved logins, username and password", + username: "username", + password: "password", + expectOutcome: [ + { + username: "username", + password: "password", + }, + ], + }, + { + name: "No saved logins, password with empty username", + username: "", + password: "password", + expectOutcome: [ + { + username: "", + password: "password", + }, + ], + }, + { + name: "Saved login with username, update password", + username: "username", + oldPassword: "password", + password: "newPassword", + expectOutcome: [ + { + username: "username", + password: "newPassword", + }, + ], + }, + { + name: "Saved login with username, add username", + oldUsername: "username", + username: "newUsername", + password: "password", + expectOutcome: [ + { + username: "newUsername", + password: "password", + }, + ], + }, + { + name: "Saved login with no username, add username and different password", + oldUsername: "", + username: "username", + oldPassword: "password", + password: "newPassword", + expectOutcome: [ + { + username: "", + password: "password", + }, + { + username: "username", + password: "newPassword", + }, + ], + }, +]; + +add_task(async function test_initialize() { + Services.prefs.setBoolPref("signon.usernameOnlyForm.enabled", true); + registerCleanupFunction(() => { + Services.prefs.clearUserPref("signon.usernameOnlyForm.enabled"); + }); +}); + +for (let testData of testCases) { + let tmp = { + async [testData.name]() { + info("testing with: " + JSON.stringify(testData)); + await test_save_change(testData); + }, + }; + add_task(tmp[testData.name]); +} + +async function test_save_change(testData) { + let { oldUsername, username, oldPassword, password, expectOutcome } = + testData; + // Add a login for the origin of the form if testing a change notification. + if (oldPassword) { + await Services.logins.addLoginAsync( + LoginTestUtils.testData.formLogin({ + origin: "https://example.com", + formActionOrigin: "https://example.com", + username: typeof oldUsername !== "undefined" ? oldUsername : username, + password: oldPassword, + }) + ); + } + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: + "https://example.com/browser/toolkit/components/" + + "passwordmgr/test/browser/form_multipage.html", + }, + async function (browser) { + await SimpleTest.promiseFocus(browser.ownerGlobal); + + // Update the username filed from the test case. + info(`update form with username: ${username}`); + await changeContentFormValues(browser, { + "#form-basic-username": username, + }); + + // Submit the username-only form, which then advance to the password-only + // form. + info(`submit the username-only form`); + await SpecialPowers.spawn(browser, [], async function () { + let doc = this.content.document; + doc.getElementById("form-basic-submit").click(); + await ContentTaskUtils.waitForCondition(() => { + return doc.getElementById("form-basic-password"); + }, "Wait for the username field"); + }); + + // Update the password filed from the test case. + info(`update form with password: ${password}`); + await changeContentFormValues(browser, { + "#form-basic-password": password, + }); + + // Submit the form. + info(`submit the password-only form`); + let formSubmittedPromise = listenForTestNotification("ShowDoorhanger"); + await SpecialPowers.spawn(browser, [], async function () { + let doc = this.content.document; + doc.getElementById("form-basic-submit").click(); + }); + await formSubmittedPromise; + + // Simulate the action on the notification to request the login to be + // saved, and wait for the data to be updated or saved based on the type + // of operation we expect. + let expectedNotification, expectedDoorhanger; + if (oldPassword !== undefined && oldUsername !== undefined) { + expectedNotification = "addLogin"; + expectedDoorhanger = "password-save"; + } else if (oldPassword !== undefined) { + expectedNotification = "modifyLogin"; + expectedDoorhanger = "password-change"; + } else { + expectedNotification = "addLogin"; + expectedDoorhanger = "password-save"; + } + + info("Waiting for doorhanger of type: " + expectedDoorhanger); + let notif = await waitForDoorhanger(browser, expectedDoorhanger); + + // Check the actual content of the popup notification. + await checkDoorhangerUsernamePassword(username, password); + + let promiseLogin = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == expectedNotification + ); + await clickDoorhangerButton(notif, REMEMBER_BUTTON); + await promiseLogin; + await cleanupDoorhanger(notif); // clean slate for the next test + + // Check that the values in the database match the expected values. + verifyLogins(expectOutcome); + } + ); + + // Clean up the database before the next test case is executed. + Services.logins.removeAllUserFacingLogins(); +} diff --git a/toolkit/components/passwordmgr/test/browser/browser_doorhanger_password_edits.js b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_password_edits.js new file mode 100644 index 0000000000..804612cf53 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_password_edits.js @@ -0,0 +1,220 @@ +/** + * Test changing the password inside the doorhanger notification for passwords. + * + * We check the following cases: + * - Editing the password of a new login. + * - Editing the password of an existing login. + * - Changing both username and password to an existing login. + * - Changing the username to an existing login. + * - Editing username to an empty one and a new password. + * + * If both the username and password matches an already existing login, we should not + * update it's password, but only it's usage timestamp and count. + */ +add_task(async function test_edit_password() { + let testCases = [ + { + description: "No saved logins, update password in doorhanger", + usernameInPage: "username", + passwordInPage: "password", + passwordChangedTo: "newPassword", + timesUsed: 1, + }, + { + description: "Login is saved, update password in doorhanger", + usernameInPage: "username", + usernameInPageExists: true, + passwordInPage: "password", + passwordInStorage: "oldPassword", + passwordChangedTo: "newPassword", + timesUsed: 2, + }, + { + description: + "Change username in doorhanger to match saved login, update password in doorhanger", + usernameInPage: "username", + usernameChangedTo: "newUsername", + usernameChangedToExists: true, + passwordInPage: "password", + passwordChangedTo: "newPassword", + timesUsed: 2, + }, + { + description: + "Change username in doorhanger to match saved login, dont update password in doorhanger", + usernameInPage: "username", + usernameChangedTo: "newUsername", + usernameChangedToExists: true, + passwordInPage: "password", + passwordChangedTo: "password", + timesUsed: 2, + checkPasswordNotUpdated: true, + }, + { + description: + "Change username and password in doorhanger to match saved empty-username login", + usernameInPage: "newUsername", + usernameChangedTo: "", + usernameChangedToExists: true, + passwordInPage: "password", + passwordChangedTo: "newPassword", + timesUsed: 2, + }, + ]; + + for (let testCase of testCases) { + info("Test case: " + JSON.stringify(testCase)); + // Clean state before the test case is executed. + await LoginTestUtils.clearData(); + await cleanupDoorhanger(); + await cleanupPasswordNotifications(); + + // Create the pre-existing logins when needed. + if (testCase.usernameInPageExists) { + await Services.logins.addLoginAsync( + LoginTestUtils.testData.formLogin({ + origin: "https://example.com", + formActionOrigin: "https://example.com", + username: testCase.usernameInPage, + password: testCase.passwordInStorage, + }) + ); + } + + if (testCase.usernameChangedToExists) { + await Services.logins.addLoginAsync( + LoginTestUtils.testData.formLogin({ + origin: "https://example.com", + formActionOrigin: "https://example.com", + username: testCase.usernameChangedTo, + password: testCase.passwordChangedTo, + }) + ); + } + + let formFilledPromise = listenForTestNotification("FormProcessed"); + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: + "https://example.com/browser/toolkit/components/" + + "passwordmgr/test/browser/form_basic.html", + }, + async function (browser) { + await formFilledPromise; + + // Set the form to a known state so we can expect a single PasswordEditedOrGenerated message + await initForm(browser, { + "#form-basic-username": testCase.usernameInPage, + "#form-basic-password": "", + }); + + let passwordEditedPromise = listenForTestNotification( + "PasswordEditedOrGenerated" + ); + info("Editing the form"); + await changeContentFormValues(browser, { + "#form-basic-password": testCase.passwordInPage, + }); + info("Waiting for passwordEditedPromise"); + await passwordEditedPromise; + + // reset doorhanger/notifications, we're only interested in the submit outcome + await cleanupDoorhanger(); + await cleanupPasswordNotifications(); + // reset message cache, we're only interested in the submit outcome + await clearMessageCache(browser); + + // Submit the form in the content page with the credentials from the test + // case. This will cause the doorhanger notification to be displayed. + info("Submitting the form"); + let formSubmittedPromise = listenForTestNotification("ShowDoorhanger"); + let promiseShown = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popupshown", + event => event.target == PopupNotifications.panel + ); + await SpecialPowers.spawn(browser, [], function () { + content.document.getElementById("form-basic").submit(); + }); + await formSubmittedPromise; + + let notif = await waitForDoorhanger(browser, "any"); + Assert.ok(!notif.dismissed, "Doorhanger is not dismissed"); + await promiseShown; + + // Modify the username & password in the dialog if requested. + await updateDoorhangerInputValues({ + username: testCase.usernameChangedTo, + password: testCase.passwordChangedTo, + }); + + // We expect a modifyLogin notification if the final username used by the + // dialog exists in the logins database, otherwise an addLogin one. + let expectModifyLogin = + typeof testCase.usernameChangedTo !== "undefined" + ? testCase.usernameChangedToExists + : testCase.usernameInPageExists; + + // Simulate the action on the notification to request the login to be + // saved, and wait for the data to be updated or saved based on the type + // of operation we expect. + let expectedNotification = expectModifyLogin + ? "modifyLogin" + : "addLogin"; + let promiseLogin = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == expectedNotification + ); + + let promiseHidden = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popuphidden" + ); + clickDoorhangerButton(notif, CHANGE_BUTTON); + await promiseHidden; + info("Waiting for storage changed"); + let [result] = await promiseLogin; + + // Check that the values in the database match the expected values. + let login = expectModifyLogin + ? result + .QueryInterface(Ci.nsIArray) + .queryElementAt(1, Ci.nsILoginInfo) + : result.QueryInterface(Ci.nsILoginInfo); + let meta = login.QueryInterface(Ci.nsILoginMetaInfo); + + let expectedLogin = { + username: + "usernameChangedTo" in testCase + ? testCase.usernameChangedTo + : testCase.usernameInPage, + password: + "passwordChangedTo" in testCase + ? testCase.passwordChangedTo + : testCase.passwordInPage, + timesUsed: testCase.timesUsed, + }; + // Check that the password was not updated if the user is empty + if (testCase.checkPasswordNotUpdated) { + expectedLogin.usedSince = meta.timeCreated; + expectedLogin.timeCreated = meta.timePasswordChanged; + } + verifyLogins([expectedLogin]); + } + ); + } +}); + +async function initForm(browser, formDefaults = {}) { + await ContentTask.spawn( + browser, + formDefaults, + async function (selectorValues) { + for (let [sel, value] of Object.entries(selectorValues)) { + content.document.querySelector(sel).value = value; + } + } + ); +} diff --git a/toolkit/components/passwordmgr/test/browser/browser_doorhanger_promptToChangePassword.js b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_promptToChangePassword.js new file mode 100644 index 0000000000..84c241e020 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_promptToChangePassword.js @@ -0,0 +1,685 @@ +/** + * Test result of different input to the promptToChangePassword doorhanger + */ + +"use strict"; + +// The origin for the test URIs. +const TEST_ORIGIN = "https://example.com"; +const passwordInputSelector = "#form-basic-password"; +const usernameInputSelector = "#form-basic-username"; + +const availLoginsByValue = new Map(); +let savedLoginsByName; +const finalLoginsByGuid = new Map(); +let finalLogins; + +const availLogins = { + emptyXYZ: LoginTestUtils.testData.formLogin({ + username: "", + password: "xyz", + }), + bobXYZ: LoginTestUtils.testData.formLogin({ + username: "bob", + password: "xyz", + }), + bobABC: LoginTestUtils.testData.formLogin({ + username: "bob", + password: "abc", + }), +}; +availLoginsByValue.set(availLogins.emptyXYZ, "emptyXYZ"); +availLoginsByValue.set(availLogins.bobXYZ, "bobXYZ"); +availLoginsByValue.set(availLogins.bobABC, "bobABC"); + +async function showChangePasswordDoorhanger( + browser, + oldLogin, + formLogin, + { notificationType = "password-change", autoSavedLoginGuid = "" } = {} +) { + let windowGlobal = browser.browsingContext.currentWindowGlobal; + let loginManagerActor = windowGlobal.getActor("LoginManager"); + let prompter = loginManagerActor._getPrompter(browser, null); + Assert.ok( + !PopupNotifications.isPanelOpen, + "Check the doorhanger isn't already open" + ); + + let promiseShown = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popupshown" + ); + + prompter.promptToChangePassword( + browser, + oldLogin, + formLogin, + false, // dimissed prompt + false, // notifySaved + autoSavedLoginGuid + ); + await promiseShown; + + let notif = getCaptureDoorhanger(notificationType); + Assert.ok(notif, `${notificationType} notification exists`); + + let { panel } = PopupNotifications; + let notificationElement = panel.childNodes[0]; + await BrowserTestUtils.waitForCondition(() => { + return ( + notificationElement.querySelector("#password-notification-password") + .value == formLogin.password && + notificationElement.querySelector("#password-notification-username") + .value == formLogin.username + ); + }, "Wait for the notification panel to be populated"); + return notif; +} + +async function setupLogins(...logins) { + Services.logins.removeAllUserFacingLogins(); + let savedLogins = {}; + let timesCreated = new Set(); + for (let login of logins) { + let loginName = availLoginsByValue.get(login); + let savedLogin = await LoginTestUtils.addLogin(login); + // we rely on sorting by timeCreated so ensure none are identical + Assert.ok( + !timesCreated.has(savedLogin.timeCreated), + "Each login has a different timeCreated" + ); + timesCreated.add(savedLogin.timeCreated); + savedLogins[loginName || savedLogin.guid] = savedLogin.clone(); + } + return savedLogins; +} + +add_setup(async function () { + await SpecialPowers.pushPrefEnv({ + set: [["signon.autofillForms", false]], + }); + Assert.ok(!PopupNotifications.isPanelOpen, "No notifications panel open"); +}); + +async function promptToChangePasswordTest(testData) { + info("Starting: " + testData.name); + savedLoginsByName = await setupLogins(...testData.initialSavedLogins); + await SimpleTest.promiseFocus(); + info("got focus"); + + let oldLogin = savedLoginsByName[testData.promptArgs.oldLogin]; + let changeLogin = LoginTestUtils.testData.formLogin( + testData.promptArgs.changeLogin + ); + let options; + if (testData.autoSavedLoginName) { + options = { + autoSavedLoginGuid: savedLoginsByName[testData.autoSavedLoginName].guid, + }; + } + info( + "Waiting for showChangePasswordDoorhanger, username: " + + changeLogin.username + ); + await BrowserTestUtils.withNewTab( + { + gBrowser, + TEST_ORIGIN, + }, + async function (browser) { + await SimpleTest.promiseFocus(browser.ownerGlobal); + let notif = await showChangePasswordDoorhanger( + browser, + oldLogin, + changeLogin, + options + ); + + await updateDoorhangerInputValues(testData.promptTextboxValues); + + let mainActionButton = getDoorhangerButton(notif, CHANGE_BUTTON); + Assert.equal( + mainActionButton.label, + testData.expectedButtonLabel, + "Check button label" + ); + + let { panel } = PopupNotifications; + let promiseHidden = BrowserTestUtils.waitForEvent(panel, "popuphidden"); + let storagePromise; + if (testData.expectedStorageChange) { + storagePromise = TestUtils.topicObserved("passwordmgr-storage-changed"); + } + + info("Clicking mainActionButton"); + mainActionButton.doCommand(); + info("Waiting for promiseHidden"); + await promiseHidden; + info("Waiting for storagePromise"); + await storagePromise; + + // ensure the notification was removed to keep clean state for next run + await cleanupDoorhanger(notif); + + info(testData.resultDescription); + + finalLoginsByGuid.clear(); + finalLogins = Services.logins.getAllLogins(); + finalLogins.sort((a, b) => a.timeCreated > b.timeCreated); + + for (let l of finalLogins) { + info(`saved login: ${l.guid}: ${l.username}/${l.password}`); + finalLoginsByGuid.set(l.guid, l); + } + info("verifyLogins next"); + verifyLogins(testData.expectedResultLogins); + if (testData.resultCheck) { + testData.resultCheck(); + } + } + ); +} + +let tests = [ + { + name: "Add username to sole login", + initialSavedLogins: [availLogins.emptyXYZ], + promptArgs: { + oldLogin: "emptyXYZ", + changeLogin: { + username: "zaphod", + password: "xyz", + }, + }, + promptTextboxValues: {}, + expectedButtonLabel: "Update", + resultDescription: "The existing login just gets a new password", + expectedStorageChange: true, + expectedResultLogins: [ + { + username: "zaphod", + password: "xyz", + }, + ], + resultCheck() { + Assert.equal( + finalLogins[0].guid, + savedLoginsByName.emptyXYZ.guid, + "Check guid" + ); + }, + }, + { + name: "Change password of the sole login", + initialSavedLogins: [availLogins.bobXYZ], + promptArgs: { + oldLogin: "bobXYZ", + changeLogin: { + username: "bob", + password: "&*$", + }, + }, + promptTextboxValues: {}, + expectedButtonLabel: "Update", + resultDescription: "The existing login just gets a new password", + expectedStorageChange: true, + expectedResultLogins: [ + { + username: "bob", + password: "&*$", + }, + ], + resultCheck() { + Assert.equal( + finalLogins[0].guid, + savedLoginsByName.bobXYZ.guid, + "Check guid" + ); + }, + }, + { + name: "Change password of the sole empty-username login", + initialSavedLogins: [availLogins.emptyXYZ], + promptArgs: { + oldLogin: "emptyXYZ", + changeLogin: { + username: "", + password: "&*$", + }, + }, + promptTextboxValues: {}, + expectedButtonLabel: "Update", + resultDescription: "The existing login just gets a new password", + expectedStorageChange: true, + expectedResultLogins: [ + { + username: "", + password: "&*$", + }, + ], + resultCheck() { + Assert.equal( + finalLogins[0].guid, + savedLoginsByName.emptyXYZ.guid, + "Check guid" + ); + }, + }, + { + name: "Add different username to empty-usernamed login", + initialSavedLogins: [availLogins.emptyXYZ, availLogins.bobABC], + promptArgs: { + oldLogin: "emptyXYZ", + changeLogin: { + username: "alice", + password: "xyz", + }, + }, + promptTextboxValues: {}, + expectedButtonLabel: "Update", + resultDescription: "The existing login just gets a new username", + expectedStorageChange: true, + expectedResultLogins: [ + { + username: "alice", + password: "xyz", + }, + { + username: "bob", + password: "abc", + }, + ], + resultCheck() { + Assert.equal( + finalLogins[0].guid, + savedLoginsByName.emptyXYZ.guid, + "Check guid" + ); + Assert.ok( + finalLogins[0].timeLastUsed > savedLoginsByName.emptyXYZ.timeLastUsed, + "Check timeLastUsed of 0th login" + ); + }, + }, + { + name: "Add username to autosaved login to match an existing usernamed login", + initialSavedLogins: [availLogins.emptyXYZ, availLogins.bobABC], + autoSavedLoginName: "emptyXYZ", + promptArgs: { + oldLogin: "emptyXYZ", + changeLogin: { + username: "bob", + password: availLogins.emptyXYZ.password, + }, + }, + promptTextboxValues: {}, + expectedButtonLabel: "Update", + resultDescription: + "Empty-username login is removed, other login gets the empty-login's password", + expectedStorageChange: true, + expectedResultLogins: [ + { + username: "bob", + password: "xyz", + }, + ], + resultCheck() { + Assert.equal( + finalLogins[0].guid, + savedLoginsByName.bobABC.guid, + "Check guid" + ); + Assert.ok( + finalLogins[0].timeLastUsed > savedLoginsByName.bobABC.timeLastUsed, + "Check timeLastUsed changed" + ); + }, + }, + { + name: "Add username to non-autosaved login to match an existing usernamed login", + initialSavedLogins: [availLogins.emptyXYZ, availLogins.bobABC], + autoSavedLoginName: "", + promptArgs: { + oldLogin: "emptyXYZ", + changeLogin: { + username: "bob", + password: availLogins.emptyXYZ.password, + }, + }, + promptTextboxValues: {}, + expectedButtonLabel: "Update", + // We can't end up with duplicates (bob:xyz and bob:ABC) so the following seems reasonable. + // We could delete the emptyXYZ but we would want to intelligently merge metadata. + resultDescription: + "Multiple login matches but user indicated they want bob:xyz in the prompt so modify bob to give that", + expectedStorageChange: true, + expectedResultLogins: [ + { + username: "", + password: "xyz", + }, + { + username: "bob", + password: "xyz", + }, + ], + resultCheck() { + Assert.equal( + finalLogins[0].guid, + savedLoginsByName.emptyXYZ.guid, + "Check guid" + ); + Assert.equal( + finalLogins[0].timeLastUsed, + savedLoginsByName.emptyXYZ.timeLastUsed, + "Check timeLastUsed didn't change" + ); + Assert.equal( + finalLogins[0].timePasswordChanged, + savedLoginsByName.emptyXYZ.timePasswordChanged, + "Check timePasswordChanged didn't change" + ); + + Assert.equal( + finalLogins[1].guid, + savedLoginsByName.bobABC.guid, + "Check guid" + ); + Assert.ok( + finalLogins[1].timeLastUsed > savedLoginsByName.bobABC.timeLastUsed, + "Check timeLastUsed did change" + ); + Assert.ok( + finalLogins[1].timePasswordChanged > + savedLoginsByName.bobABC.timePasswordChanged, + "Check timePasswordChanged did change" + ); + }, + }, + { + name: "Username & password changes to an auto-saved login apply to matching usernamed-login", + // when we update an auto-saved login - changing both username & password, is + // the matching login updated and empty-username login removed? + initialSavedLogins: [availLogins.emptyXYZ, availLogins.bobABC], + autoSavedLoginName: "emptyXYZ", + promptArgs: { + oldLogin: "emptyXYZ", + changeLogin: { + username: "bob", + password: "xyz", + }, + }, + promptTextboxValues: { + // type a new password in the doorhanger + password: "newpassword", + }, + expectedButtonLabel: "Update", + resultDescription: + "The empty-username login is removed, other login gets the new password", + expectedStorageChange: true, + expectedResultLogins: [ + { + username: "bob", + password: "newpassword", + }, + ], + resultCheck() { + Assert.equal( + finalLogins[0].guid, + savedLoginsByName.bobABC.guid, + "Check guid" + ); + Assert.ok( + finalLogins[0].timeLastUsed > savedLoginsByName.bobABC.timeLastUsed, + "Check timeLastUsed did change" + ); + }, + }, + { + name: "Username & password changes to a non-auto-saved login matching usernamed-login", + // when we update a non-auto-saved login - changing both username & password, is + // the matching login updated and empty-username login unchanged? + initialSavedLogins: [availLogins.emptyXYZ, availLogins.bobABC], + autoSavedLoginName: "", // no auto-saved logins for this session + promptArgs: { + oldLogin: "emptyXYZ", + changeLogin: { + username: "bob", + password: "xyz", + }, + }, + promptTextboxValues: { + // type a new password in the doorhanger + password: "newpassword", + }, + expectedButtonLabel: "Update", + resultDescription: + "The empty-username login is not changed, other login gets the new password", + expectedStorageChange: true, + expectedResultLogins: [ + { + username: "", + password: "xyz", + }, + { + username: "bob", + password: "newpassword", + }, + ], + resultCheck() { + Assert.equal( + finalLogins[0].guid, + savedLoginsByName.emptyXYZ.guid, + "Check guid" + ); + Assert.equal( + finalLogins[0].timeLastUsed, + savedLoginsByName.emptyXYZ.timeLastUsed, + "Check timeLastUsed didn't change" + ); + Assert.equal( + finalLogins[0].timePasswordChanged, + savedLoginsByName.emptyXYZ.timePasswordChanged, + "Check timePasswordChanged didn't change" + ); + Assert.equal( + finalLogins[1].guid, + savedLoginsByName.bobABC.guid, + "Check guid" + ); + Assert.ok( + finalLogins[1].timeLastUsed > savedLoginsByName.bobABC.timeLastUsed, + "Check timeLastUsed did change" + ); + Assert.ok( + finalLogins[1].timePasswordChanged > + savedLoginsByName.bobABC.timePasswordChanged, + "Check timePasswordChanged did change" + ); + }, + }, + { + name: "Remove the username and change password of autosaved login", + initialSavedLogins: [availLogins.bobABC], + autoSavedLoginName: "bobABC", + promptArgs: { + oldLogin: "bobABC", + changeLogin: { + username: "bob", + password: "abc!", // trigger change prompt with a password change + }, + }, + promptTextboxValues: { + username: "", + }, + expectedButtonLabel: "Update", + resultDescription: + "The auto-saved login is updated with new empty-username login and new password", + expectedStorageChange: true, + expectedResultLogins: [ + { + username: "", + password: "abc!", + }, + ], + resultCheck() { + Assert.equal( + finalLogins[0].guid, + savedLoginsByName.bobABC.guid, + "Check guid" + ); + Assert.ok( + finalLogins[0].timeLastUsed > savedLoginsByName.bobABC.timeLastUsed, + "Check timeLastUsed did change" + ); + Assert.ok( + finalLogins[0].timePasswordChanged > + savedLoginsByName.bobABC.timePasswordChanged, + "Check timePasswordChanged did change" + ); + }, + }, + { + name: "Remove the username and change password of non-autosaved login", + initialSavedLogins: [availLogins.bobABC], + // no autosaved guid + promptArgs: { + oldLogin: "bobABC", + changeLogin: { + username: "bob", + password: "abc!", // trigger change prompt with a password change + }, + }, + promptTextboxValues: { + username: "", + }, + expectedButtonLabel: "Save", + resultDescription: + "A new empty-username login is created with the new password", + expectedStorageChange: true, + expectedResultLogins: [ + { + username: "bob", + password: "abc", + }, + { + username: "", + password: "abc!", + }, + ], + resultCheck() { + Assert.equal( + finalLogins[0].guid, + savedLoginsByName.bobABC.guid, + "Check guid" + ); + Assert.equal( + finalLogins[0].timeLastUsed, + savedLoginsByName.bobABC.timeLastUsed, + "Check timeLastUsed didn't change" + ); + Assert.equal( + finalLogins[0].timePasswordChanged, + savedLoginsByName.bobABC.timePasswordChanged, + "Check timePasswordChanged didn't change" + ); + }, + }, + { + name: "Remove username from the auto-saved sole login", + initialSavedLogins: [availLogins.bobABC], + autoSavedLoginName: "bobABC", + promptArgs: { + oldLogin: "bobABC", + changeLogin: { + username: "bob", + password: "abc!", // trigger change prompt with a password change + }, + }, + promptTextboxValues: { + username: "", + password: "abc", // put password back to what it was + }, + expectedButtonLabel: "Update", + resultDescription: "The existing login is updated", + expectedStorageChange: true, + expectedResultLogins: [ + { + username: "", + password: "abc", + }, + ], + resultCheck() { + Assert.equal( + finalLogins[0].guid, + savedLoginsByName.bobABC.guid, + "Check guid" + ); + Assert.ok( + finalLogins[0].timeLastUsed > savedLoginsByName.bobABC.timeLastUsed, + "Check timeLastUsed did change" + ); + todo_is( + finalLogins[0].timePasswordChanged, + savedLoginsByName.bobABC.timePasswordChanged, + "Check timePasswordChanged didn't change" + ); + }, + }, + { + name: "Remove username from the non-auto-saved sole login", + initialSavedLogins: [availLogins.bobABC], + // no autoSavedLoginGuid + promptArgs: { + oldLogin: "bobABC", + changeLogin: { + username: "bob", + password: "abc!", // trigger change prompt with a password change + }, + }, + promptTextboxValues: { + username: "", + password: "abc", // put password back to what it was + }, + expectedButtonLabel: "Save", + resultDescription: "A new empty-username login is created", + expectedStorageChange: true, + expectedResultLogins: [ + { + username: "bob", + password: "abc", + }, + { + username: "", + password: "abc", + }, + ], + resultCheck() { + Assert.equal( + finalLogins[0].guid, + savedLoginsByName.bobABC.guid, + "Check guid" + ); + Assert.equal( + finalLogins[0].timeLastUsed, + savedLoginsByName.bobABC.timeLastUsed, + "Check timeLastUsed didn't change" + ); + Assert.equal( + finalLogins[0].timePasswordChanged, + savedLoginsByName.bobABC.timePasswordChanged, + "Check timePasswordChanged didn't change" + ); + }, + }, +]; + +for (let testData of tests) { + let tmp = { + async [testData.name]() { + await promptToChangePasswordTest(testData); + }, + }; + add_task(tmp[testData.name]); +} diff --git a/toolkit/components/passwordmgr/test/browser/browser_doorhanger_remembering.js b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_remembering.js new file mode 100644 index 0000000000..bc0b245e4d --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_remembering.js @@ -0,0 +1,1275 @@ +/* + * Test capture popup notifications + */ + +const BRAND_BUNDLE = Services.strings.createBundle( + "chrome://branding/locale/brand.properties" +); +const BRAND_SHORT_NAME = BRAND_BUNDLE.GetStringFromName("brandShortName"); + +let nsLoginInfo = new Components.Constructor( + "@mozilla.org/login-manager/loginInfo;1", + Ci.nsILoginInfo, + "init" +); +let login1 = new nsLoginInfo( + "http://example.com", + "http://example.com", + null, + "notifyu1", + "notifyp1", + "user", + "pass" +); +let login2 = new nsLoginInfo( + "http://example.com", + "http://example.com", + null, + "", + "notifyp1", + "", + "pass" +); +let login1B = new nsLoginInfo( + "http://example.com", + "http://example.com", + null, + "notifyu1B", + "notifyp1B", + "user", + "pass" +); +let login2B = new nsLoginInfo( + "http://example.com", + "http://example.com", + null, + "", + "notifyp1B", + "", + "pass" +); + +requestLongerTimeout(2); + +add_setup(async function () { + // Load recipes for this test. + let recipeParent = await LoginManagerParent.recipeParentPromise; + await recipeParent.load({ + siteRecipes: [ + { + hosts: ["example.org"], + usernameSelector: "#user", + passwordSelector: "#pass", + }, + ], + }); +}); + +add_task(async function test_remember_opens() { + await testSubmittingLoginFormHTTP( + "subtst_notifications_1.html", + async function (fieldValues) { + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-save"); + Assert.ok(notif, "got notification popup"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + await cleanupDoorhanger(notif); + } + ); +}); + +add_task(async function test_clickNever() { + await testSubmittingLoginFormHTTP( + "subtst_notifications_1.html", + async function (fieldValues) { + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-save"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + Assert.ok(notif, "got notification popup"); + Assert.equal( + true, + Services.logins.getLoginSavingEnabled("http://example.com"), + "Checking for login saving enabled" + ); + + await checkDoorhangerUsernamePassword("notifyu1", "notifyp1"); + clickDoorhangerButton(notif, NEVER_MENUITEM); + await cleanupDoorhanger(notif); + } + ); + + Assert.equal( + Services.logins.getAllLogins().length, + 0, + "Should not have any logins yet" + ); + + info("Make sure Never took effect"); + await testSubmittingLoginFormHTTP( + "subtst_notifications_1.html", + function (fieldValues) { + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = getCaptureDoorhanger("password-save"); + Assert.ok(!notif, "checking for no notification popup"); + Assert.equal( + false, + Services.logins.getLoginSavingEnabled("http://example.com"), + "Checking for login saving disabled" + ); + Services.logins.setLoginSavingEnabled("http://example.com", true); + } + ); + + Assert.equal( + Services.logins.getAllLogins().length, + 0, + "Should not have any logins yet" + ); +}); + +add_task(async function test_clickRemember() { + await testSubmittingLoginFormHTTP( + "subtst_notifications_1.html", + async function (fieldValues) { + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-save"); + Assert.ok(notif, "got notification popup"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + + Assert.equal( + Services.logins.getAllLogins().length, + 0, + "Should not have any logins yet" + ); + + await checkDoorhangerUsernamePassword("notifyu1", "notifyp1"); + let promiseNewSavedPassword = TestUtils.topicObserved( + "LoginStats:NewSavedPassword", + (subject, data) => subject == gBrowser.selectedBrowser + ); + clickDoorhangerButton(notif, REMEMBER_BUTTON); + await promiseNewSavedPassword; + } + ); + + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should only have 1 login"); + let login = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal( + login.username, + "notifyu1", + "Check the username used on the new entry" + ); + Assert.equal( + login.password, + "notifyp1", + "Check the password used on the new entry" + ); + Assert.equal(login.timesUsed, 1, "Check times used on new entry"); + + info( + "Make sure Remember took effect and we don't prompt for an existing login" + ); + await testSubmittingLoginFormHTTP( + "subtst_notifications_1.html", + function (fieldValues) { + // form login matches a saved login, we don't expect a notification on change or submit + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = getCaptureDoorhanger("password-save"); + Assert.ok(!notif, "checking for no notification popup"); + } + ); + + logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should only have 1 login"); + login = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal(login.username, "notifyu1", "Check the username used"); + Assert.equal(login.password, "notifyp1", "Check the password used"); + Assert.equal(login.timesUsed, 2, "Check times used incremented"); + + checkOnlyLoginWasUsedTwice({ justChanged: false }); + + // remove that login + Services.logins.removeLogin(login1); + await cleanupDoorhanger(); +}); + +/* signons.rememberSignons pref tests... */ + +add_task(async function test_rememberSignonsFalse() { + info("Make sure we don't prompt with rememberSignons=false"); + Services.prefs.setBoolPref("signon.rememberSignons", false); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_1.html", + function (fieldValues) { + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = getCaptureDoorhanger("password-save"); + Assert.ok(!notif, "checking for no notification popup"); + } + ); + + Assert.equal( + Services.logins.getAllLogins().length, + 0, + "Should not have any logins yet" + ); +}); + +add_task(async function test_rememberSignonsTrue() { + info("Make sure we prompt with rememberSignons=true"); + Services.prefs.setBoolPref("signon.rememberSignons", true); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_1.html", + async function (fieldValues) { + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-save"); + Assert.ok(notif, "got notification popup"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + await cleanupDoorhanger(notif); + } + ); + + Assert.equal( + Services.logins.getAllLogins().length, + 0, + "Should not have any logins yet" + ); +}); + +/* autocomplete=off tests... */ + +add_task(async function test_autocompleteOffUsername() { + info( + "Check for notification popup when autocomplete=off present on username" + ); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_2.html", + async function (fieldValues) { + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-save"); + Assert.ok(notif, "checking for notification popup"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + await cleanupDoorhanger(notif); + } + ); + + Assert.equal( + Services.logins.getAllLogins().length, + 0, + "Should not have any logins yet" + ); +}); + +add_task(async function test_autocompleteOffPassword() { + info( + "Check for notification popup when autocomplete=off present on password" + ); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_3.html", + async function (fieldValues) { + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-save"); + Assert.ok(notif, "checking for notification popup"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + await cleanupDoorhanger(notif); + } + ); + + Assert.equal( + Services.logins.getAllLogins().length, + 0, + "Should not have any logins yet" + ); +}); + +add_task(async function test_autocompleteOffForm() { + info("Check for notification popup when autocomplete=off present on form"); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_4.html", + async function (fieldValues) { + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-save"); + Assert.ok(notif, "checking for notification popup"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + await cleanupDoorhanger(notif); + } + ); + + Assert.equal( + Services.logins.getAllLogins().length, + 0, + "Should not have any logins yet" + ); +}); + +add_task(async function test_noPasswordField() { + info("Check for no notification popup when no password field present"); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_5.html", + function (fieldValues) { + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal(fieldValues.password, "null", "Checking submitted password"); + let notif = getCaptureDoorhanger("password-save"); + Assert.ok(!notif, "checking for no notification popup"); + } + ); + + Assert.equal( + Services.logins.getAllLogins().length, + 0, + "Should not have any logins yet" + ); +}); + +add_task(async function test_pwOnlyNewLoginMatchesUPForm() { + info("Check for update popup when new existing pw-only login matches form."); + await Services.logins.addLoginAsync(login2); + await testSubmittingLoginFormHTTP( + "subtst_notifications_1.html", + async function (fieldValues) { + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-change"); + Assert.ok(notif, "checking for notification popup"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + Assert.equal( + notif.message, + "Add username to saved password?", + "Check message" + ); + + let { panel } = PopupNotifications; + let passwordVisiblityToggle = panel.querySelector( + "#password-notification-visibilityToggle" + ); + Assert.ok( + !passwordVisiblityToggle.hidden, + "Toggle visible for a recently saved pw" + ); + + await checkDoorhangerUsernamePassword("notifyu1", "notifyp1"); + clickDoorhangerButton(notif, CHANGE_BUTTON); + + Assert.ok( + !getCaptureDoorhanger("password-change"), + "popup should be gone" + ); + } + ); + + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should only have 1 login"); + let login = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal(login.username, "notifyu1", "Check the username"); + Assert.equal(login.password, "notifyp1", "Check the password"); + Assert.equal(login.timesUsed, 2, "Check times used"); + + Services.logins.removeLogin(login); +}); + +add_task(async function test_pwOnlyOldLoginMatchesUPForm() { + info("Check for update popup when old existing pw-only login matches form."); + await Services.logins.addLoginAsync(login2); + + // Change the timePasswordChanged to be old so that the password won't be + // revealed in the doorhanger. + let oldTimeMS = new Date("2009-11-15").getTime(); + Services.logins.modifyLogin( + login2, + LoginHelper.newPropertyBag({ + timeCreated: oldTimeMS, + timeLastUsed: oldTimeMS + 1, + timePasswordChanged: oldTimeMS, + }) + ); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_1.html", + async function (fieldValues) { + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-change"); + Assert.ok(notif, "checking for notification popup"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + Assert.equal( + notif.message, + "Add username to saved password?", + "Check message" + ); + + let { panel } = PopupNotifications; + let passwordVisiblityToggle = panel.querySelector( + "#password-notification-visibilityToggle" + ); + Assert.ok( + passwordVisiblityToggle.hidden, + "Toggle hidden for an old saved pw" + ); + + await checkDoorhangerUsernamePassword("notifyu1", "notifyp1"); + clickDoorhangerButton(notif, CHANGE_BUTTON); + + Assert.ok( + !getCaptureDoorhanger("password-change"), + "popup should be gone" + ); + } + ); + + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should only have 1 login"); + let login = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal(login.username, "notifyu1", "Check the username"); + Assert.equal(login.password, "notifyp1", "Check the password"); + Assert.equal(login.timesUsed, 2, "Check times used"); + + Services.logins.removeLogin(login); +}); + +add_task(async function test_pwOnlyFormMatchesLogin() { + info( + "Check for no notification popup when pw-only form matches existing login." + ); + await Services.logins.addLoginAsync(login1); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_6.html", + function (fieldValues) { + Assert.equal(fieldValues.username, "null", "Checking submitted username"); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = getCaptureDoorhanger("password-save"); + Assert.ok(!notif, "checking for no notification popup"); + } + ); + + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should only have 1 login"); + let login = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal(login.username, "notifyu1", "Check the username"); + Assert.equal(login.password, "notifyp1", "Check the password"); + Assert.equal(login.timesUsed, 2, "Check times used"); + + Services.logins.removeLogin(login1); +}); + +add_task(async function test_pwOnlyFormDoesntMatchExisting() { + info( + "Check for notification popup when pw-only form doesn't match existing login." + ); + await Services.logins.addLoginAsync(login1B); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_6.html", + async function (fieldValues) { + Assert.equal(fieldValues.username, "null", "Checking submitted username"); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-save"); + Assert.ok(notif, "got notification popup"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + await cleanupDoorhanger(notif); + } + ); + + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should only have 1 login"); + let login = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal(login.username, "notifyu1B", "Check the username unchanged"); + Assert.equal(login.password, "notifyp1B", "Check the password unchanged"); + Assert.equal(login.timesUsed, 1, "Check times used"); + + Services.logins.removeLogin(login1B); +}); + +add_task(async function test_changeUPLoginOnUPForm_dont() { + info("Check for change-password popup, u+p login on u+p form. (not changed)"); + await Services.logins.addLoginAsync(login1); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_8.html", + async function (fieldValues) { + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "pass2", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-change"); + Assert.ok(notif, "got notification popup"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + Assert.equal( + notif.message, + "Update login for example.com?", + "Check message" + ); + + await checkDoorhangerUsernamePassword("notifyu1", "pass2"); + clickDoorhangerButton(notif, DONT_CHANGE_BUTTON); + } + ); + + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should only have 1 login"); + let login = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal(login.username, "notifyu1", "Check the username unchanged"); + Assert.equal(login.password, "notifyp1", "Check the password unchanged"); + Assert.equal(login.timesUsed, 1, "Check times used"); + + Services.logins.removeLogin(login1); +}); + +add_task(async function test_changeUPLoginOnUPForm_remove() { + info("Check for change-password popup, u+p login on u+p form. (remove)"); + await Services.logins.addLoginAsync(login1); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_8.html", + async function (fieldValues, browser) { + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "pass2", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-change"); + Assert.ok(notif, "got notification popup"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + Assert.equal( + notif.message, + "Update login for example.com?", + "Check message" + ); + + await checkDoorhangerUsernamePassword("notifyu1", "pass2"); + clickDoorhangerButton(notif, REMOVE_LOGIN_MENUITEM); + + // Let the hint hide itself + const forceClosePopup = false; + // Make sure confirmation hint was shown + info("waiting for verifyConfirmationHint"); + await verifyConfirmationHint(browser, forceClosePopup, "identity-icon"); + } + ); + + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 0, "Should have 0 logins"); +}); + +add_task(async function test_changeUPLoginOnUPForm_change() { + info("Check for change-password popup, u+p login on u+p form."); + await Services.logins.addLoginAsync(login1); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_8.html", + async function (fieldValues) { + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "pass2", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-change"); + Assert.ok(notif, "got notification popup"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + Assert.equal( + notif.message, + "Update login for example.com?", + "Check message" + ); + + await checkDoorhangerUsernamePassword("notifyu1", "pass2"); + let promiseLoginUpdateSaved = TestUtils.topicObserved( + "LoginStats:LoginUpdateSaved", + (subject, data) => subject == gBrowser.selectedBrowser + ); + clickDoorhangerButton(notif, CHANGE_BUTTON); + await promiseLoginUpdateSaved; + + Assert.ok( + !getCaptureDoorhanger("password-change"), + "popup should be gone" + ); + } + ); + + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should only have 1 login"); + let login = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal(login.username, "notifyu1", "Check the username unchanged"); + Assert.equal(login.password, "pass2", "Check the password changed"); + Assert.equal(login.timesUsed, 2, "Check times used"); + + checkOnlyLoginWasUsedTwice({ justChanged: true }); + + // cleanup + login1.password = "pass2"; + Services.logins.removeLogin(login1); + login1.password = "notifyp1"; +}); + +add_task(async function test_changePLoginOnUPForm() { + info("Check for change-password popup, p-only login on u+p form (empty u)."); + await Services.logins.addLoginAsync(login2); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_9.html", + async function (fieldValues) { + Assert.equal(fieldValues.username, "", "Checking submitted username"); + Assert.equal( + fieldValues.password, + "pass2", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-change"); + Assert.ok(notif, "got notification popup"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + Assert.equal( + notif.message, + "Update password for example.com?", + "Check msg" + ); + + await checkDoorhangerUsernamePassword("", "pass2"); + clickDoorhangerButton(notif, CHANGE_BUTTON); + + Assert.ok( + !getCaptureDoorhanger("password-change"), + "popup should be gone" + ); + } + ); + + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should only have 1 login"); + let login = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal(login.username, "", "Check the username unchanged"); + Assert.equal(login.password, "pass2", "Check the password changed"); + Assert.equal(login.timesUsed, 2, "Check times used"); + + // no cleanup -- saved password to be used in the next test. +}); + +add_task(async function test_changePLoginOnPForm() { + info("Check for change-password popup, p-only login on p-only form."); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_10.html", + async function (fieldValues) { + Assert.equal(fieldValues.username, "null", "Checking submitted username"); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-change"); + Assert.ok(notif, "got notification popup"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + Assert.equal( + notif.message, + "Update password for example.com?", + "Check msg" + ); + + await checkDoorhangerUsernamePassword("", "notifyp1"); + clickDoorhangerButton(notif, CHANGE_BUTTON); + + Assert.ok( + !getCaptureDoorhanger("password-change"), + "popup should be gone" + ); + } + ); + + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should only have 1 login"); + let login = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal(login.username, "", "Check the username unchanged"); + Assert.equal(login.password, "notifyp1", "Check the password changed"); + Assert.equal(login.timesUsed, 3, "Check times used"); + + Services.logins.removeLogin(login2); +}); + +add_task(async function test_checkUPSaveText() { + info("Check text on a user+pass notification popup"); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_1.html", + async function (fieldValues) { + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-save"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + Assert.ok(notif, "got notification popup"); + // Check the text, which comes from the localized saveLoginMsg string. + let notificationText = notif.message; + let expectedText = "Save login for example.com?"; + Assert.equal( + notificationText, + expectedText, + "Checking text: " + notificationText + ); + await cleanupDoorhanger(notif); + } + ); + + Assert.equal( + Services.logins.getAllLogins().length, + 0, + "Should not have any logins yet" + ); +}); + +add_task(async function test_checkPSaveText() { + info("Check text on a pass-only notification popup"); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_6.html", + async function (fieldValues) { + Assert.equal(fieldValues.username, "null", "Checking submitted username"); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-save"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + Assert.ok(notif, "got notification popup"); + // Check the text, which comes from the localized saveLoginMsgNoUser string. + let notificationText = notif.message; + let expectedText = "Save password for example.com?"; + Assert.equal( + notificationText, + expectedText, + "Checking text: " + notificationText + ); + await cleanupDoorhanger(notif); + } + ); + + Assert.equal( + Services.logins.getAllLogins().length, + 0, + "Should not have any logins yet" + ); +}); + +add_task(async function test_capture2pw0un() { + info( + "Check for notification popup when a form with 2 password fields (no username) " + + "is submitted and there are no saved logins." + ); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_2pw_0un.html", + async function (fieldValues) { + Assert.equal(fieldValues.username, "null", "Checking submitted username"); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-save"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + Assert.ok(notif, "got notification popup"); + await cleanupDoorhanger(notif); + } + ); + + Assert.equal( + Services.logins.getAllLogins().length, + 0, + "Should not have any logins yet" + ); +}); + +add_task(async function test_change2pw0unExistingDifferentUP() { + info( + "Check for notification popup when a form with 2 password fields (no username) " + + "is submitted and there is a saved login with a username and different password." + ); + + await Services.logins.addLoginAsync(login1B); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_2pw_0un.html", + async function (fieldValues) { + Assert.equal(fieldValues.username, "null", "Checking submitted username"); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-change"); + Assert.ok(notif, "got notification popup"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + await cleanupDoorhanger(notif); + } + ); + + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should only have 1 login"); + let login = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal(login.username, "notifyu1B", "Check the username unchanged"); + Assert.equal(login.password, "notifyp1B", "Check the password unchanged"); + Assert.equal(login.timesUsed, 1, "Check times used"); + + Services.logins.removeLogin(login1B); +}); + +add_task(async function test_change2pw0unExistingDifferentP() { + info( + "Check for notification popup when a form with 2 password fields (no username) " + + "is submitted and there is a saved login with no username and different password." + ); + + await Services.logins.addLoginAsync(login2B); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_2pw_0un.html", + async function (fieldValues) { + Assert.equal(fieldValues.username, "null", "Checking submitted username"); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-change"); + Assert.ok(notif, "got notification popup"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + await cleanupDoorhanger(notif); + } + ); + + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should only have 1 login"); + let login = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal(login.username, "", "Check the username unchanged"); + Assert.equal(login.password, "notifyp1B", "Check the password unchanged"); + Assert.equal(login.timesUsed, 1, "Check times used"); + + Services.logins.removeLogin(login2B); +}); + +add_task(async function test_change2pw0unExistingWithSameP() { + info( + "Check for no notification popup when a form with 2 password fields (no username) " + + "is submitted and there is a saved login with a username and the same password." + ); + + await Services.logins.addLoginAsync(login2); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_2pw_0un.html", + function (fieldValues) { + Assert.equal(fieldValues.username, "null", "Checking submitted username"); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = getCaptureDoorhanger("password-change"); + Assert.ok(!notif, "checking for no notification popup"); + } + ); + + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should only have 1 login"); + let login = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal(login.username, "", "Check the username unchanged"); + Assert.equal(login.password, "notifyp1", "Check the password unchanged"); + Assert.equal(login.timesUsed, 2, "Check times used incremented"); + + checkOnlyLoginWasUsedTwice({ justChanged: false }); + + Services.logins.removeLogin(login2); +}); + +add_task(async function test_changeUPLoginOnPUpdateForm() { + info("Check for change-password popup, u+p login on password update form."); + await Services.logins.addLoginAsync(login1); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_change_p.html", + async function (fieldValues) { + Assert.equal(fieldValues.username, "null", "Checking submitted username"); + Assert.equal( + fieldValues.password, + "pass2", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-change"); + Assert.ok(notif, "got notification popup"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + + await checkDoorhangerUsernamePassword("notifyu1", "pass2"); + clickDoorhangerButton(notif, CHANGE_BUTTON); + + Assert.ok( + !getCaptureDoorhanger("password-change"), + "popup should be gone" + ); + } + ); + + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should only have 1 login"); + let login = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal(login.username, "notifyu1", "Check the username unchanged"); + Assert.equal(login.password, "pass2", "Check the password changed"); + Assert.equal(login.timesUsed, 2, "Check times used"); + + checkOnlyLoginWasUsedTwice({ justChanged: true }); + + // cleanup + login1.password = "pass2"; + Services.logins.removeLogin(login1); + login1.password = "notifyp1"; +}); + +add_task(async function test_recipeCaptureFields_NewLogin() { + info( + "Check that we capture the proper fields when a field recipe is in use." + ); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_2pw_1un_1text.html", + async function (fieldValues) { + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-save"); + Assert.ok(notif, "got notification popup"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + + // Sanity check, no logins should exist yet. + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 0, "Should not have any logins yet"); + + await checkDoorhangerUsernamePassword("notifyu1", "notifyp1"); + clickDoorhangerButton(notif, REMEMBER_BUTTON); + }, + "http://example.org" + ); // The recipe is for example.org + + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should only have 1 login"); + let login = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal(login.username, "notifyu1", "Check the username unchanged"); + Assert.equal(login.password, "notifyp1", "Check the password unchanged"); + Assert.equal(login.timesUsed, 1, "Check times used"); +}); + +add_task(async function test_recipeCaptureFields_ExistingLogin() { + info( + "Check that we capture the proper fields when a field recipe is in use " + + "and there is a matching login" + ); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_2pw_1un_1text.html", + function (fieldValues) { + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = getCaptureDoorhanger("password-save"); + Assert.ok(!notif, "checking for no notification popup"); + }, + "http://example.org" + ); + + checkOnlyLoginWasUsedTwice({ justChanged: false }); + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should only have 1 login"); + let login = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal(login.username, "notifyu1", "Check the username unchanged"); + Assert.equal(login.password, "notifyp1", "Check the password unchanged"); + Assert.equal(login.timesUsed, 2, "Check times used incremented"); + + Services.logins.removeAllUserFacingLogins(); +}); + +add_task(async function test_saveUsingEnter() { + async function testWithTextboxSelector(fieldSelector) { + let storageChangedPromise = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "addLogin" + ); + + info("Waiting for form submit and doorhanger interaction"); + await testSubmittingLoginFormHTTP( + "subtst_notifications_1.html", + async function (fieldValues) { + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = await getCaptureDoorhangerThatMayOpen("password-save"); + Assert.ok(notif, "got notification popup"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + Assert.equal( + Services.logins.getAllLogins().length, + 0, + "Should not have any logins yet" + ); + await checkDoorhangerUsernamePassword("notifyu1", "notifyp1"); + let notificationElement = PopupNotifications.panel.childNodes[0]; + let textbox = notificationElement.querySelector(fieldSelector); + textbox.focus(); + await EventUtils.synthesizeKey("KEY_Enter"); + } + ); + await storageChangedPromise; + + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should only have 1 login"); + let login = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal( + login.username, + "notifyu1", + "Check the username used on the new entry" + ); + Assert.equal( + login.password, + "notifyp1", + "Check the password used on the new entry" + ); + Assert.equal(login.timesUsed, 1, "Check times used on new entry"); + + Services.logins.removeAllUserFacingLogins(); + } + + await testWithTextboxSelector("#password-notification-password"); + await testWithTextboxSelector("#password-notification-username"); +}); + +add_task(async function test_noShowPasswordOnDismissal() { + info("Check for no Show Password field when the doorhanger is dismissed"); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_1.html", + async function (fieldValues) { + info("Opening popup"); + let notif = await getCaptureDoorhangerThatMayOpen("password-save"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + let { panel } = PopupNotifications; + + info("Hiding popup."); + let promiseHidden = BrowserTestUtils.waitForEvent(panel, "popuphidden"); + panel.hidePopup(); + await promiseHidden; + + info("Clicking on anchor to reshow popup."); + let promiseShown = BrowserTestUtils.waitForEvent(panel, "popupshown"); + notif.anchorElement.click(); + await promiseShown; + + let passwordVisiblityToggle = panel.querySelector( + "#password-notification-visibilityToggle" + ); + Assert.equal( + passwordVisiblityToggle.hidden, + true, + "Check that the Show Password field is Hidden" + ); + await cleanupDoorhanger(notif); + } + ); +}); + +add_task(async function test_showPasswordOn1stOpenOfDismissedByDefault() { + info("Show Password toggle when the doorhanger is dismissed by default"); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_1.html", + async function (fieldValues) { + info("Opening popup"); + let notif = await getCaptureDoorhangerThatMayOpen("password-save"); + Assert.ok(!notif.dismissed, "doorhanger is not dismissed"); + let { panel } = PopupNotifications; + + info("Hiding popup."); + let promiseHidden = BrowserTestUtils.waitForEvent(panel, "popuphidden"); + panel.hidePopup(); + await promiseHidden; + + info("Clicking on anchor to reshow popup."); + let promiseShown = BrowserTestUtils.waitForEvent(panel, "popupshown"); + notif.anchorElement.click(); + await promiseShown; + + let passwordVisiblityToggle = panel.querySelector( + "#password-notification-visibilityToggle" + ); + Assert.equal( + passwordVisiblityToggle.hidden, + true, + "Check that the Show Password field is Hidden" + ); + await cleanupDoorhanger(notif); + } + ); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_doorhanger_replace_dismissed_with_visible_while_opening.js b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_replace_dismissed_with_visible_while_opening.js new file mode 100644 index 0000000000..401e0add1b --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_replace_dismissed_with_visible_while_opening.js @@ -0,0 +1,65 @@ +/** + * Replacing a dismissed doorhanger with a visible one while it's opening. + * + * There are various races between popup notification callbacks to catch with this. + * This can happen in the real world by blurring an edited login field by clicking on the login doorhanger. + */ + +XPCOMUtils.defineLazyServiceGetter( + this, + "prompterSvc", + "@mozilla.org/login-manager/prompter;1", + Ci.nsILoginManagerPrompter +); + +add_task(async function test_replaceDismissedWithVisibleWhileOpening() { + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: "https://example.com", + }, + async function load(browser) { + info("Show a dismissed save doorhanger"); + prompterSvc.promptToSavePassword( + browser, + LoginTestUtils.testData.formLogin({}), + true, + false, + null + ); + let doorhanger = await waitForDoorhanger(browser, "password-save"); + Assert.ok(doorhanger, "Got doorhanger"); + EventUtils.synthesizeMouseAtCenter(doorhanger.anchorElement, {}); + await BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popupshowing" + ); + await checkDoorhangerUsernamePassword("the username", "the password"); + info( + "Replace the doorhanger with a non-dismissed one immediately after clicking to open" + ); + prompterSvc.promptToSavePassword( + browser, + LoginTestUtils.testData.formLogin({}), + true, + false, + null + ); + await Promise.race([ + BrowserTestUtils.waitForCondition(() => { + if ( + document.getElementById("password-notification-username").value != + "the username" || + document.getElementById("password-notification-password").value != + "the password" + ) { + return Promise.reject("Field changed to incorrect values"); + } + return false; + }, "See if username/password values change to incorrect values"), + // eslint-disable-next-line mozilla/no-arbitrary-setTimeout + new Promise(resolve => setTimeout(resolve, 1000)), + ]); + } + ); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_doorhanger_save_password.js b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_save_password.js new file mode 100644 index 0000000000..5401ff31af --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_save_password.js @@ -0,0 +1,159 @@ +/** + * Test that the doorhanger notification for password saving is populated with + * the correct values in various password capture cases. + */ + +const testCases = [ + { + name: "No saved logins, username and password", + username: "username", + password: "password", + expectOutcome: [ + { + username: "username", + password: "password", + }, + ], + }, + { + name: "No saved logins, password with empty username", + username: "", + password: "password", + expectOutcome: [ + { + username: "", + password: "password", + }, + ], + }, + { + name: "Saved login with username, update password", + username: "username", + oldPassword: "password", + password: "newPassword", + expectOutcome: [ + { + username: "username", + password: "newPassword", + }, + ], + }, + { + name: "Saved login with no username, update password", + username: "", + oldPassword: "password", + password: "newPassword", + expectOutcome: [ + { + username: "", + password: "newPassword", + }, + ], + }, + { + name: "Saved login with no username, add username and different password", + oldUsername: "", + username: "username", + oldPassword: "password", + password: "newPassword", + expectOutcome: [ + { + username: "", + password: "password", + }, + { + username: "username", + password: "newPassword", + }, + ], + }, +]; + +for (let testData of testCases) { + let tmp = { + async [testData.name]() { + info("testing with: " + JSON.stringify(testData)); + await test_save_change(testData); + }, + }; + add_task(tmp[testData.name]); +} + +async function test_save_change(testData) { + let { oldUsername, username, oldPassword, password, expectOutcome } = + testData; + // Add a login for the origin of the form if testing a change notification. + if (oldPassword) { + await Services.logins.addLoginAsync( + LoginTestUtils.testData.formLogin({ + origin: "https://example.com", + formActionOrigin: "https://example.com", + username: typeof oldUsername !== "undefined" ? oldUsername : username, + password: oldPassword, + }) + ); + } + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: + "https://example.com/browser/toolkit/components/" + + "passwordmgr/test/browser/form_basic.html", + }, + async function (browser) { + await SimpleTest.promiseFocus(browser.ownerGlobal); + + // Update the form with credentials from the test case. + info(`update form with username: ${username}, password: ${password}`); + await changeContentFormValues(browser, { + "#form-basic-username": username, + "#form-basic-password": password, + }); + + // Submit the form with the new credentials. This will cause the doorhanger + // notification to be displayed. + let formSubmittedPromise = listenForTestNotification("ShowDoorhanger"); + await SpecialPowers.spawn(browser, [], async function () { + let doc = this.content.document; + doc.getElementById("form-basic").submit(); + }); + await formSubmittedPromise; + + // Simulate the action on the notification to request the login to be + // saved, and wait for the data to be updated or saved based on the type + // of operation we expect. + let expectedNotification, expectedDoorhanger; + if (oldPassword !== undefined && oldUsername !== undefined) { + expectedNotification = "addLogin"; + expectedDoorhanger = "password-save"; + } else if (oldPassword !== undefined) { + expectedNotification = "modifyLogin"; + expectedDoorhanger = "password-change"; + } else { + expectedNotification = "addLogin"; + expectedDoorhanger = "password-save"; + } + + info("Waiting for doorhanger of type: " + expectedDoorhanger); + let notif = await waitForDoorhanger(browser, expectedDoorhanger); + + // Check the actual content of the popup notification. + await checkDoorhangerUsernamePassword(username, password); + + let promiseLogin = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == expectedNotification + ); + await clickDoorhangerButton(notif, REMEMBER_BUTTON); + await promiseLogin; + await cleanupDoorhanger(notif); // clean slate for the next test + + // Check that the values in the database match the expected values. + verifyLogins(expectOutcome); + } + ); + + // Clean up the database before the next test case is executed. + Services.logins.removeAllUserFacingLogins(); +} diff --git a/toolkit/components/passwordmgr/test/browser/browser_doorhanger_submit_telemetry.js b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_submit_telemetry.js new file mode 100644 index 0000000000..97353007ac --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_submit_telemetry.js @@ -0,0 +1,387 @@ +/** + * Test that doorhanger submit telemetry is sent when the user saves/updates. + */ + +add_setup(function () { + // This test used to rely on the initial timer of + // TestUtils.waitForCondition. See bug 1695395. + // The test is perma-fail on Linux asan opt without this. + let originalWaitForCondition = TestUtils.waitForCondition; + TestUtils.waitForCondition = async function ( + condition, + msg, + interval = 100, + maxTries = 50 + ) { + // eslint-disable-next-line mozilla/no-arbitrary-setTimeout + await new Promise(resolve => setTimeout(resolve, 100)); + + return originalWaitForCondition(condition, msg, interval, maxTries); + }; + registerCleanupFunction(function () { + TestUtils.waitForCondition = originalWaitForCondition; + }); +}); + +const PAGE_USERNAME_SELECTOR = "#form-basic-username"; +const PAGE_PASSWORD_SELECTOR = "#form-basic-password"; + +const TEST_CASES = [ + { + description: + "Saving a new login from page values without modification sends a 'no modification' event", + savedLogin: undefined, + userActions: [ + { + pageChanges: { + username: "pageUn", + password: "pagePw", + }, + doorhangerChanges: [], + }, + ], + expectedEvents: [ + { + type: "save", + ping: { + did_edit_un: "false", + did_select_un: "false", + did_edit_pw: "false", + did_select_pw: "false", + }, + }, + ], + }, + ///////////////// + { + description: "Saving two logins sends two events", + userActions: [ + { + pageChanges: { password: "pagePw" }, + doorhangerChanges: [ + { + typedUsername: "doorhangerUn", + }, + ], + }, + { + pageChanges: { password: "pagePw2" }, + doorhangerChanges: [ + { + typedPassword: "doorhangerPw", + }, + ], + }, + ], + expectedEvents: [ + { + type: "save", + ping: { + did_edit_un: "true", + did_select_un: "false", + did_edit_pw: "false", + did_select_pw: "false", + }, + }, + { + type: "update", + ping: { + did_edit_un: "false", + did_select_un: "false", + did_edit_pw: "true", + did_select_pw: "false", + }, + }, + ], + }, + ///////////////// + { + description: "Updating a doorhanger password sends a 'pw updated' event", + savedLogin: { + username: "savedUn", + password: "savedPw", + }, + userActions: [ + { + pageChanges: { password: "pagePw" }, + doorhangerChanges: [ + { + typedPassword: "doorhangerPw", + }, + ], + }, + ], + expectedEvents: [ + { + type: "update", + ping: { + did_edit_un: "false", + did_select_un: "false", + did_edit_pw: "true", + did_select_pw: "false", + }, + }, + ], + }, + ///////////////// + { + description: + "Saving a new username with an existing password sends a 'un updated' event", + savedLogin: { + username: "savedUn", + password: "savedPw", + }, + userActions: [ + { + pageChanges: { password: "pagePw" }, + doorhangerChanges: [ + { + typedUsername: "doorhangerUn", + }, + ], + }, + ], + expectedEvents: [ + { + type: "update", + ping: { + did_edit_un: "true", + did_select_un: "false", + did_edit_pw: "false", + did_select_pw: "false", + }, + }, + ], + }, + /////////////// + { + description: "selecting a saved username sends a 'not edited' event", + savedLogin: { + username: "savedUn", + password: "savedPw", + }, + userActions: [ + { + pageChanges: { password: "pagePw" }, + doorhangerChanges: [ + { + selectUsername: "savedUn", + }, + ], + }, + ], + expectedEvents: [ + { + type: "update", + ping: { + did_edit_un: "false", + did_select_un: "true", + did_edit_pw: "false", + did_select_pw: "false", + }, + }, + ], + }, + ///////////////// + { + description: + "typing a new username then selecting a saved username sends a 'not edited' event", + savedLogin: { + username: "savedUn", + password: "savedPw", + }, + userActions: [ + { + pageChanges: { password: "pagePw" }, + doorhangerChanges: [ + { + typedUsername: "doorhangerTypedUn", + }, + { + selectUsername: "savedUn", + }, + ], + }, + ], + expectedEvents: [ + { + type: "update", + ping: { + did_edit_un: "false", + did_select_un: "true", + did_edit_pw: "false", + did_select_pw: "false", + }, + }, + ], + }, + ///////////////// + { + description: + "selecting a saved username then typing a new username sends an 'edited' event", + savedLogin: { + username: "savedUn", + password: "savedPw", + }, + userActions: [ + { + pageChanges: { password: "pagePw" }, + doorhangerChanges: [ + { + selectUsername: "savedUn", + }, + { + typedUsername: "doorhangerTypedUn", + }, + ], + }, + ], + expectedEvents: [ + { + type: "update", + ping: { + did_edit_un: "true", + did_select_un: "false", + did_edit_pw: "false", + did_select_pw: "false", + }, + }, + ], + }, + ///////////////// +]; + +for (let testData of TEST_CASES) { + let tmp = { + async [testData.description]() { + info("testing with: " + JSON.stringify(testData)); + await test_submit_telemetry(testData); + }, + }; + add_task(tmp[testData.description]); +} + +function _validateTestCase(tc) { + for (let event of tc.expectedEvents) { + Assert.ok( + !(event.ping.did_edit_un && event.ping.did_select_un), + "'did_edit_un' and 'did_select_un' can never be true at the same time" + ); + Assert.ok( + !(event.ping.did_edit_pw && event.ping.did_select_pw), + "'did_edit_pw' and 'did_select_pw' can never be true at the same time" + ); + } +} + +async function test_submit_telemetry(tc) { + if (tc.savedLogin) { + await Services.logins.addLoginAsync( + LoginTestUtils.testData.formLogin({ + origin: "https://example.com", + formActionOrigin: "https://example.com", + username: tc.savedLogin.username, + password: tc.savedLogin.password, + }) + ); + } + + let notif; + for (let userAction of tc.userActions) { + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: + "https://example.com/browser/toolkit/components/" + + "passwordmgr/test/browser/form_basic.html", + }, + async function (browser) { + await SimpleTest.promiseFocus(browser.ownerGlobal); + + if (userAction.pageChanges) { + info( + `Update form with changes: ${JSON.stringify( + userAction.pageChanges + )}` + ); + let changeTo = {}; + if (userAction.pageChanges.username) { + changeTo[PAGE_USERNAME_SELECTOR] = userAction.pageChanges.username; + } + if (userAction.pageChanges.password) { + changeTo[PAGE_PASSWORD_SELECTOR] = userAction.pageChanges.password; + } + + await changeContentFormValues(browser, changeTo); + } + + info("Submitting form"); + let formSubmittedPromise = listenForTestNotification("ShowDoorhanger"); + await SpecialPowers.spawn(browser, [], async function () { + let doc = this.content.document; + doc.getElementById("form-basic").submit(); + }); + await formSubmittedPromise; + + let saveDoorhanger = waitForDoorhanger(browser, "password-save"); + let updateDoorhanger = waitForDoorhanger(browser, "password-change"); + notif = await Promise.race([saveDoorhanger, updateDoorhanger]); + + if (PopupNotifications.panel.state !== "open") { + await BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popupshown" + ); + } + + if (userAction.doorhangerChanges) { + for (let doorhangerChange of userAction.doorhangerChanges) { + if ( + doorhangerChange.typedUsername || + doorhangerChange.typedPassword + ) { + await updateDoorhangerInputValues({ + username: doorhangerChange.typedUsername, + password: doorhangerChange.typedPassword, + }); + } + + if (doorhangerChange.selectUsername) { + await selectDoorhangerUsername(doorhangerChange.selectUsername); + } + if (doorhangerChange.selectPassword) { + await selectDoorhangerPassword(doorhangerChange.selectPassword); + } + } + } + + info("Waiting for doorhanger"); + await clickDoorhangerButton(notif, REMEMBER_BUTTON); + } + ); + } + + let expectedEvents = tc.expectedEvents.map(expectedEvent => [ + "pwmgr", + "doorhanger_submitted", + expectedEvent.type, + null, + expectedEvent.ping, + ]); + + await LoginTestUtils.telemetry.waitForEventCount( + expectedEvents.length, + "parent", + "pwmgr", + "doorhanger_submitted" + ); + TelemetryTestUtils.assertEvents( + expectedEvents, + { category: "pwmgr", method: "doorhanger_submitted" }, + { clear: true } + ); + + // Clean up the database before the next test case is executed. + await cleanupDoorhanger(notif); + Services.logins.removeAllUserFacingLogins(); +} diff --git a/toolkit/components/passwordmgr/test/browser/browser_doorhanger_target_blank.js b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_target_blank.js new file mode 100644 index 0000000000..63ba1fa2a7 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_target_blank.js @@ -0,0 +1,94 @@ +/** + * Test capture popup notifications when the login form uses target="_blank" + */ + +add_setup(async function () { + await SimpleTest.promiseFocus(window); +}); + +add_task(async function test_saveTargetBlank() { + // This test submits the form to a new tab using target="_blank". + let url = "subtst_notifications_12_target_blank.html?notifyu3|notifyp3||"; + let notifShownPromise = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popupshown" + ); + + let submissionTabPromise = BrowserTestUtils.waitForNewTab( + gBrowser, + url => { + info(url); + return url.includes("formsubmit.sjs"); + }, + false, + true + ); + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: "http://mochi.test:8888" + DIRECTORY_PATH + url, + }, + async function () { + // For now the doorhanger appears in the previous tab but it should maybe + // appear in the new tab from target="_blank"? + BrowserTestUtils.removeTab(await submissionTabPromise); + + let notif = await TestUtils.waitForCondition( + () => + getCaptureDoorhangerThatMayOpen( + "password-save", + PopupNotifications, + gBrowser.selectedBrowser + ), + "Waiting for doorhanger" + ); + Assert.ok(notif, "got notification popup"); + + EventUtils.synthesizeMouseAtCenter(notif.anchorElement, {}); + await notifShownPromise; + await checkDoorhangerUsernamePassword("notifyu3", "notifyp3"); + let storageChangedPromised = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (subject, data) => data != "removeLogin" + ); + + clickDoorhangerButton(notif, REMEMBER_BUTTON); + await storageChangedPromised; + BrowserTestUtils.removeTab(gBrowser.selectedTab); + } + ); + + // Check result of clicking Remember + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should only have 1 login now"); + let login = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal( + login.username, + "notifyu3", + "Check the username used on the new entry" + ); + Assert.equal( + login.password, + "notifyp3", + "Check the password used on the new entry" + ); + Assert.equal(login.timesUsed, 1, "Check times used on new entry"); + + // Check for stale values in the doorhanger <input> after closing. + let usernameField = document.getElementById("password-notification-username"); + todo_is( + usernameField.value, + "", + "Check the username field doesn't have a stale value" + ); + let passwordField = document.getElementById("password-notification-password"); + todo_is( + passwordField.value, + "", + "Check the password field doesn't have a stale value" + ); + + // Cleanup + Services.logins.removeLogin(login); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_doorhanger_toggles.js b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_toggles.js new file mode 100644 index 0000000000..f529369522 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_toggles.js @@ -0,0 +1,478 @@ +/* eslint no-shadow:"off" */ + +const passwordInputSelector = "#form-basic-password"; +const usernameInputSelector = "#form-basic-username"; +const FORM_URL = + "https://example.com/browser/toolkit/components/passwordmgr/test/browser/form_basic.html"; + +add_setup(async function () { + await SpecialPowers.pushPrefEnv({ + set: [["signon.rememberSignons.visibilityToggle", true]], + }); +}); + +let testCases = [ + { + /* Test that the doorhanger password field shows plain or * text + * when the checkbox is checked. + */ + name: "test_toggle_password", + logins: [], + enabledPrimaryPassword: false, + formDefaults: {}, + formChanges: { + [passwordInputSelector]: "pw", + [usernameInputSelector]: "username", + }, + expected: { + initialForm: { + username: "", + password: "", + }, + passwordChangedDoorhanger: null, + submitDoorhanger: { + type: "password-save", + dismissed: false, + username: "username", + password: "pw", + toggleVisible: true, + initialToggleState: { + inputType: "password", + toggleChecked: false, + }, + afterToggleClick0: { + inputType: "text", + toggleChecked: true, + }, + afterToggleClick1: { + inputType: "password", + toggleChecked: false, + }, + }, + }, + }, + { + /* Test that the doorhanger password toggle checkbox is disabled + * when the primary password is set. + */ + name: "test_checkbox_disabled_if_has_primary_password", + logins: [], + enabledPrimaryPassword: true, + formDefaults: {}, + formChanges: { + [passwordInputSelector]: "pass", + [usernameInputSelector]: "username", + }, + expected: { + initialForm: { + username: "", + password: "", + }, + passwordChangedDoorhanger: null, + submitDoorhanger: { + type: "password-save", + dismissed: false, + username: "username", + password: "pass", + toggleVisible: false, + initialToggleState: { + inputType: "password", + toggleChecked: false, + }, + }, + }, + }, + { + /* Test that the reveal password checkbox is hidden when editing the + * password of an autofilled login + */ + name: "test_edit_autofilled_password", + logins: [{ username: "username1", password: "password" }], + formDefaults: {}, + formChanges: { + [passwordInputSelector]: "password!", + }, + expected: { + initialForm: { + username: "username1", + password: "password", + }, + passwordChangedDoorhanger: { + type: "password-change", + dismissed: true, + username: "username1", + password: "password!", + toggleVisible: false, + initialToggleState: { + inputType: "password", + toggleChecked: false, + }, + }, + submitDoorhanger: { + type: "password-change", + dismissed: false, + username: "username1", + password: "password!", + toggleVisible: false, + initialToggleState: { + inputType: "password", + toggleChecked: false, + }, + }, + }, + }, + { + /* Test that the reveal password checkbox is shown when editing the + * password of a login that has been autofilled and then deleted + */ + name: "test_autofilled_cleared_then_updated_password", + logins: [{ username: "username1", password: "password" }], + formDefaults: {}, + formChanges: [ + { + [passwordInputSelector]: "", + }, + { + [passwordInputSelector]: "password!", + }, + ], + expected: { + initialForm: { + username: "username1", + password: "password", + }, + passwordChangedDoorhanger: { + type: "password-change", + dismissed: true, + username: "username1", + password: "password!", + toggleVisible: true, + initialToggleState: { + inputType: "password", + toggleChecked: false, + }, + }, + submitDoorhanger: { + type: "password-change", + dismissed: false, + username: "username1", + password: "password!", + toggleVisible: true, + initialToggleState: { + inputType: "password", + toggleChecked: false, + }, + }, + }, + }, + { + /* Test that the reveal password checkbox is hidden when editing the + * username of an autofilled login + */ + name: "test_edit_autofilled_username", + logins: [{ username: "username1", password: "password" }], + formDefaults: {}, + formChanges: { + [usernameInputSelector]: "username2", + }, + expected: { + initialForm: { + username: "username1", + password: "password", + }, + passwordChangedDoorhanger: { + type: "password-save", + dismissed: true, + username: "username2", + password: "password", + toggleVisible: false, + initialToggleState: { + inputType: "password", + toggleChecked: false, + }, + }, + submitDoorhanger: { + type: "password-save", + dismissed: false, + username: "username2", + password: "password", + toggleVisible: false, + initialToggleState: { + inputType: "password", + toggleChecked: false, + }, + }, + }, + }, +]; + +for (let testData of testCases) { + if (testData.skip) { + info("Skipping test:", testData.name); + continue; + } + let tmp = { + async [testData.name]() { + await testDoorhangerToggles(testData); + }, + }; + add_task(tmp[testData.name]); +} + +/** + * Set initial test conditions, + * Load and populate the form, + * Submit it and verify doorhanger toggle behavior + */ +async function testDoorhangerToggles({ + logins = [], + formDefaults = {}, + formChanges = {}, + expected, + enabledPrimaryPassword, +}) { + formChanges = Array.isArray(formChanges) ? formChanges : [formChanges]; + + for (let login of logins) { + await LoginTestUtils.addLogin(login); + } + if (enabledPrimaryPassword) { + LoginTestUtils.primaryPassword.enable(); + } + let formProcessedPromise = listenForTestNotification("FormProcessed"); + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: FORM_URL, + }, + async function (browser) { + info(`Opened tab with url: ${FORM_URL}, waiting for focus`); + await SimpleTest.promiseFocus(browser.ownerGlobal); + info("Waiting for form-processed message"); + await formProcessedPromise; + await initForm(browser, formDefaults); + await checkForm(browser, expected.initialForm); + info("form checked"); + + // some tests check the dismissed doorhanger from editing the password + let formChanged = expected.passwordChangedDoorhanger + ? listenForTestNotification("PasswordEditedOrGenerated") + : Promise.resolve(); + for (let change of formChanges) { + await changeContentFormValues(browser, change, { + method: "paste_text", + }); + } + + await formChanged; + + if (expected.passwordChangedDoorhanger) { + let expectedDoorhanger = expected.passwordChangedDoorhanger; + info("Verifying dismissed doorhanger from password change"); + let notif = await waitForDoorhanger(browser, expectedDoorhanger.type); + Assert.ok(notif, "got notification popup"); + Assert.equal( + notif.dismissed, + expectedDoorhanger.dismissed, + "Check notification dismissed property" + ); + let { panel } = browser.ownerGlobal.PopupNotifications; + // we will open dismissed doorhanger to check panel contents + Assert.equal(panel.state, "closed", "Panel is initially closed"); + let promiseShown = BrowserTestUtils.waitForEvent(panel, "popupshown"); + info("Opening the doorhanger popup"); + // synthesize click on anchor as this also blurs the form field triggering + // a change event + EventUtils.synthesizeMouseAtCenter(notif.anchorElement, {}); + await promiseShown; + await TestUtils.waitForTick(); + Assert.ok( + panel.children.length, + `Check the popup has at least one notification (${panel.children.length})` + ); + + // Check the password-changed-capture doorhanger contents & behaviour + info("Verifying the doorhanger"); + await verifyDoorhangerToggles(browser, notif, expectedDoorhanger); + await hideDoorhangerPopup(notif); + } + + if (expected.submitDoorhanger) { + let expectedDoorhanger = expected.submitDoorhanger; + let { panel } = browser.ownerGlobal.PopupNotifications; + // submit the form and wait for the doorhanger + info("Submitting the form"); + let submittedPromise = listenForTestNotification("ShowDoorhanger"); + let promiseShown = BrowserTestUtils.waitForEvent(panel, "popupshown"); + await submitForm(browser, "/"); + await submittedPromise; + info("Waiting for doorhanger popup to open"); + await promiseShown; + let notif = await getCaptureDoorhanger(expectedDoorhanger.type); + Assert.ok(notif, "got notification popup"); + Assert.equal( + notif.dismissed, + expectedDoorhanger.dismissed, + "Check notification dismissed property" + ); + Assert.ok( + panel.children.length, + `Check the popup has at least one notification (${panel.children.length})` + ); + + // Check the submit-capture doorhanger contents & behaviour + info("Verifying the submit doorhanger"); + await verifyDoorhangerToggles(browser, notif, expectedDoorhanger); + await cleanupDoorhanger(notif); + } + } + ); + await LoginTestUtils.clearData(); + if (enabledPrimaryPassword) { + LoginTestUtils.primaryPassword.disable(); + } + await cleanupPasswordNotifications(); +} + +// -------------------------------------------------------------------- +// Helpers + +async function verifyDoorhangerToggles(browser, notif, expected) { + let { initialToggleState, afterToggleClick0, afterToggleClick1 } = expected; + + let { panel } = browser.ownerGlobal.PopupNotifications; + let notificationElement = panel.childNodes[0]; + let passwordTextbox = notificationElement.querySelector( + "#password-notification-password" + ); + let toggleCheckbox = notificationElement.querySelector( + "#password-notification-visibilityToggle" + ); + Assert.equal(panel.state, "open", "Panel is open"); + Assert.ok( + BrowserTestUtils.is_visible(passwordTextbox), + "The doorhanger password field is visible" + ); + + await checkDoorhangerUsernamePassword(expected.username, expected.password); + if (expected.toggleVisible) { + Assert.ok( + BrowserTestUtils.is_visible(toggleCheckbox), + "The visibility checkbox is shown" + ); + } else { + Assert.ok( + BrowserTestUtils.is_hidden(toggleCheckbox), + "The visibility checkbox is hidden" + ); + } + + if (initialToggleState) { + Assert.equal( + toggleCheckbox.checked, + initialToggleState.toggleChecked, + `Initially, toggle is ${ + initialToggleState.toggleChecked ? "checked" : "unchecked" + }` + ); + Assert.equal( + passwordTextbox.type, + initialToggleState.inputType, + `Initially, password input has type: ${initialToggleState.inputType}` + ); + } + if (afterToggleClick0) { + Assert.ok( + !toggleCheckbox.hidden, + "The checkbox shouldnt be hidden when clicking on it" + ); + info("Clicking on the visibility toggle"); + await EventUtils.synthesizeMouseAtCenter(toggleCheckbox, {}); + await TestUtils.waitForTick(); + Assert.equal( + toggleCheckbox.checked, + afterToggleClick0.toggleChecked, + `After 1st click, expect toggle to be checked? ${afterToggleClick0.toggleChecked}, actual: ${toggleCheckbox.checked}` + ); + Assert.equal( + passwordTextbox.type, + afterToggleClick0.inputType, + `After 1st click, expect password input to have type: ${afterToggleClick0.inputType}` + ); + } + if (afterToggleClick1) { + Assert.ok( + !toggleCheckbox.hidden, + "The checkbox shouldnt be hidden when clicking on it" + ); + info("Clicking on the visibility toggle again"); + await EventUtils.synthesizeMouseAtCenter(toggleCheckbox, {}); + await TestUtils.waitForTick(); + Assert.equal( + toggleCheckbox.checked, + afterToggleClick1.toggleChecked, + `After 2nd click, expect toggle to be checked? ${afterToggleClick0.toggleChecked}, actual: ${toggleCheckbox.checked}` + ); + Assert.equal( + passwordTextbox.type, + afterToggleClick1.inputType, + `After 2nd click, expect password input to have type: ${afterToggleClick1.inputType}` + ); + } +} + +async function initForm(browser, formDefaults) { + await ContentTask.spawn( + browser, + formDefaults, + async function (selectorValues = {}) { + for (let [sel, value] of Object.entries(selectorValues)) { + content.document.querySelector(sel).value = value; + } + } + ); +} + +async function checkForm(browser, expected) { + await ContentTask.spawn( + browser, + { + [passwordInputSelector]: expected.password, + [usernameInputSelector]: expected.username, + }, + async function contentCheckForm(selectorValues) { + for (let [sel, value] of Object.entries(selectorValues)) { + let field = content.document.querySelector(sel); + Assert.equal( + field.value, + value, + sel + " has the expected initial value" + ); + } + } + ); +} + +async function submitForm(browser, action = "") { + // Submit the form + let correctPathNamePromise = BrowserTestUtils.browserLoaded(browser); + await SpecialPowers.spawn(browser, [action], async function (actionPathname) { + let form = content.document.querySelector("form"); + if (actionPathname) { + form.action = actionPathname; + } + info("Submitting form to:" + form.action); + form.submit(); + info("Submitted the form"); + }); + await correctPathNamePromise; + await SpecialPowers.spawn(browser, [action], async actionPathname => { + let win = content; + await ContentTaskUtils.waitForCondition(() => { + return ( + win.location.pathname == actionPathname && + win.document.readyState == "complete" + ); + }, "Wait for form submission load"); + }); +} diff --git a/toolkit/components/passwordmgr/test/browser/browser_doorhanger_username_edits.js b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_username_edits.js new file mode 100644 index 0000000000..79dd92db12 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_username_edits.js @@ -0,0 +1,192 @@ +/** + * Test changing the username inside the doorhanger notification for passwords. + * + * We have to test combination of existing and non-existing logins both for + * the original one from the webpage and the final one used by the dialog. + * + * We also check switching to and from empty usernames. + */ +add_task(async function test_edit_username() { + let testCases = [ + { + usernameInPage: "username", + usernameChangedTo: "newUsername", + }, + { + usernameInPage: "username", + usernameInPageExists: true, + usernameChangedTo: "newUsername", + }, + { + usernameInPage: "username", + usernameChangedTo: "newUsername", + usernameChangedToExists: true, + }, + { + usernameInPage: "username", + usernameInPageExists: true, + usernameChangedTo: "newUsername", + usernameChangedToExists: true, + }, + { + usernameInPage: "", + usernameChangedTo: "newUsername", + }, + { + usernameInPage: "newUsername", + usernameChangedTo: "", + }, + { + usernameInPage: "", + usernameChangedTo: "newUsername", + usernameChangedToExists: true, + }, + { + usernameInPage: "newUsername", + usernameChangedTo: "", + usernameChangedToExists: true, + }, + ]; + + for (let testCase of testCases) { + info("Test case: " + JSON.stringify(testCase)); + // Clean state before the test case is executed. + await LoginTestUtils.clearData(); + await cleanupDoorhanger(); + await cleanupPasswordNotifications(); + + // Create the pre-existing logins when needed. + if (testCase.usernameInPageExists) { + await Services.logins.addLoginAsync( + LoginTestUtils.testData.formLogin({ + origin: "https://example.com", + formActionOrigin: "https://example.com", + username: testCase.usernameInPage, + password: "old password", + }) + ); + } + + if (testCase.usernameChangedToExists) { + await Services.logins.addLoginAsync( + LoginTestUtils.testData.formLogin({ + origin: "https://example.com", + formActionOrigin: "https://example.com", + username: testCase.usernameChangedTo, + password: "old password", + }) + ); + } + + let formFilledPromise = listenForTestNotification("FormProcessed"); + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: + "https://example.com/browser/toolkit/components/" + + "passwordmgr/test/browser/form_basic.html", + }, + async function (browser) { + await formFilledPromise; + await initForm(browser, { + "#form-basic-username": testCase.usernameInPage, + }); + + let passwordEditedPromise = listenForTestNotification( + "PasswordEditedOrGenerated" + ); + info("Editing the form"); + await changeContentFormValues(browser, { + "#form-basic-password": "password", + }); + info("Waiting for passwordEditedPromise"); + await passwordEditedPromise; + + // reset doorhanger/notifications, we're only interested in the submit outcome + await cleanupDoorhanger(); + await cleanupPasswordNotifications(); + // reset message cache, we're only interested in the submit outcome + await clearMessageCache(browser); + + // Submit the form in the content page with the credentials from the test + // case. This will cause the doorhanger notification to be displayed. + info("Submitting the form"); + let formSubmittedPromise = listenForTestNotification("ShowDoorhanger"); + let promiseShown = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popupshown", + event => event.target == PopupNotifications.panel + ); + await SpecialPowers.spawn(browser, [], async function () { + content.document.getElementById("form-basic").submit(); + }); + info("Waiting for the submit message"); + await formSubmittedPromise; + + info("Waiting for the doorhanger"); + let notif = await waitForDoorhanger(browser, "any"); + Assert.ok(!notif.dismissed, "Doorhanger is not dismissed"); + await promiseShown; + + // Modify the username in the dialog if requested. + if (testCase.usernameChangedTo !== undefined) { + await updateDoorhangerInputValues({ + username: testCase.usernameChangedTo, + }); + } + + // We expect a modifyLogin notification if the final username used by the + // dialog exists in the logins database, otherwise an addLogin one. + let expectModifyLogin = + testCase.usernameChangedTo !== undefined + ? testCase.usernameChangedToExists + : testCase.usernameInPageExists; + // Simulate the action on the notification to request the login to be + // saved, and wait for the data to be updated or saved based on the type + // of operation we expect. + let expectedNotification = expectModifyLogin + ? "modifyLogin" + : "addLogin"; + let promiseLogin = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == expectedNotification + ); + let promiseHidden = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popuphidden" + ); + clickDoorhangerButton(notif, CHANGE_BUTTON); + await promiseHidden; + info("Waiting for storage changed"); + let [result] = await promiseLogin; + + // Check that the values in the database match the expected values. + let login = expectModifyLogin + ? result + .QueryInterface(Ci.nsIArray) + .queryElementAt(1, Ci.nsILoginInfo) + : result.QueryInterface(Ci.nsILoginInfo); + Assert.equal( + login.username, + testCase.usernameChangedTo !== undefined + ? testCase.usernameChangedTo + : testCase.usernameInPage + ); + Assert.equal(login.password, "password"); + } + ); + } +}); + +async function initForm(browser, formDefaults = {}) { + await ContentTask.spawn( + browser, + formDefaults, + async function (selectorValues) { + for (let [sel, value] of Object.entries(selectorValues)) { + content.document.querySelector(sel).value = value; + } + } + ); +} diff --git a/toolkit/components/passwordmgr/test/browser/browser_doorhanger_window_open.js b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_window_open.js new file mode 100644 index 0000000000..2375a3c53a --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_doorhanger_window_open.js @@ -0,0 +1,201 @@ +/* + * Test capture popup notifications in content opened by window.open + */ + +let nsLoginInfo = new Components.Constructor( + "@mozilla.org/login-manager/loginInfo;1", + Ci.nsILoginInfo, + "init" +); +let login1 = new nsLoginInfo( + "http://mochi.test:8888", + "http://mochi.test:8888", + null, + "notifyu1", + "notifyp1", + "user", + "pass" +); +let login2 = new nsLoginInfo( + "http://mochi.test:8888", + "http://mochi.test:8888", + null, + "notifyu2", + "notifyp2", + "user", + "pass" +); + +function withTestTabUntilStorageChange(aPageFile, aTaskFn) { + function storageChangedObserved(subject, data) { + // Watch for actions triggered from a doorhanger (not cleanup tasks with removeLogin) + if (data == "removeLogin") { + return false; + } + return true; + } + + let storageChangedPromised = TestUtils.topicObserved( + "passwordmgr-storage-changed", + storageChangedObserved + ); + return BrowserTestUtils.withNewTab( + { + gBrowser, + url: "http://mochi.test:8888" + DIRECTORY_PATH + aPageFile, + }, + async function (browser) { + Assert.ok(true, "loaded " + aPageFile); + info("running test case task"); + await aTaskFn(); + info("waiting for storage change"); + await storageChangedPromised; + } + ); +} + +add_setup(async function () { + await SimpleTest.promiseFocus(window); +}); + +add_task(async function test_saveChromeHiddenAutoClose() { + let notifShownPromise = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popupshown" + ); + // query arguments are: username, password, features, auto-close (delimited by '|') + let url = + "subtst_notifications_11.html?notifyu1|notifyp1|" + + "menubar=no,toolbar=no,location=no|autoclose"; + await withTestTabUntilStorageChange(url, async function () { + info("waiting for popupshown"); + await notifShownPromise; + // the popup closes and the doorhanger should appear in the opener + let popup = await getCaptureDoorhangerThatMayOpen("password-save"); + Assert.ok(popup, "got notification popup"); + await checkDoorhangerUsernamePassword("notifyu1", "notifyp1"); + // Sanity check, no logins should exist yet. + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 0, "Should not have any logins yet"); + + clickDoorhangerButton(popup, REMEMBER_BUTTON); + }); + // Check result of clicking Remember + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should only have 1 login"); + let login = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal(login.timesUsed, 1, "Check times used on new entry"); + Assert.equal( + login.username, + "notifyu1", + "Check the username used on the new entry" + ); + Assert.equal( + login.password, + "notifyp1", + "Check the password used on the new entry" + ); +}); + +add_task(async function test_changeChromeHiddenAutoClose() { + let notifShownPromise = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popupshown" + ); + let url = + "subtst_notifications_11.html?notifyu1|pass2|menubar=no,toolbar=no,location=no|autoclose"; + await withTestTabUntilStorageChange(url, async function () { + info("waiting for popupshown"); + await notifShownPromise; + let popup = await getCaptureDoorhangerThatMayOpen("password-change"); + Assert.ok(popup, "got notification popup"); + await checkDoorhangerUsernamePassword("notifyu1", "pass2"); + clickDoorhangerButton(popup, CHANGE_BUTTON); + }); + + // Check to make sure we updated the password, timestamps and use count for + // the login being changed with this form. + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should only have 1 login"); + let login = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal(login.username, "notifyu1", "Check the username"); + Assert.equal(login.password, "pass2", "Check password changed"); + Assert.equal(login.timesUsed, 2, "check .timesUsed incremented on change"); + Assert.ok(login.timeCreated < login.timeLastUsed, "timeLastUsed bumped"); + Assert.ok( + login.timeLastUsed == login.timePasswordChanged, + "timeUsed == timeChanged" + ); + + login1.password = "pass2"; + Services.logins.removeLogin(login1); + login1.password = "notifyp1"; +}); + +add_task(async function test_saveChromeVisibleSameWindow() { + // This test actually opens a new tab in the same window with default browser settings. + let url = "subtst_notifications_11.html?notifyu2|notifyp2||"; + let notifShownPromise = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popupshown" + ); + await withTestTabUntilStorageChange(url, async function () { + await notifShownPromise; + let popup = await getCaptureDoorhangerThatMayOpen("password-save"); + Assert.ok(popup, "got notification popup"); + await checkDoorhangerUsernamePassword("notifyu2", "notifyp2"); + clickDoorhangerButton(popup, REMEMBER_BUTTON); + BrowserTestUtils.removeTab(gBrowser.selectedTab); + }); + + // Check result of clicking Remember + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should only have 1 login now"); + let login = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal( + login.username, + "notifyu2", + "Check the username used on the new entry" + ); + Assert.equal( + login.password, + "notifyp2", + "Check the password used on the new entry" + ); + Assert.equal(login.timesUsed, 1, "Check times used on new entry"); +}); + +add_task(async function test_changeChromeVisibleSameWindow() { + let url = "subtst_notifications_11.html?notifyu2|pass2||"; + let notifShownPromise = BrowserTestUtils.waitForEvent( + PopupNotifications.panel, + "popupshown" + ); + await withTestTabUntilStorageChange(url, async function () { + await notifShownPromise; + let popup = await getCaptureDoorhangerThatMayOpen("password-change"); + Assert.ok(popup, "got notification popup"); + await checkDoorhangerUsernamePassword("notifyu2", "pass2"); + clickDoorhangerButton(popup, CHANGE_BUTTON); + BrowserTestUtils.removeTab(gBrowser.selectedTab); + }); + + // Check to make sure we updated the password, timestamps and use count for + // the login being changed with this form. + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should have 1 login"); + let login = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal(login.username, "notifyu2", "Check the username"); + Assert.equal(login.password, "pass2", "Check password changed"); + Assert.equal(login.timesUsed, 2, "check .timesUsed incremented on change"); + Assert.ok(login.timeCreated < login.timeLastUsed, "timeLastUsed bumped"); + Assert.ok( + login.timeLastUsed == login.timePasswordChanged, + "timeUsed == timeChanged" + ); + + // cleanup + login2.password = "pass2"; + Services.logins.removeLogin(login2); + login2.password = "notifyp2"; +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_entry_point_telemetry.js b/toolkit/components/passwordmgr/test/browser/browser_entry_point_telemetry.js new file mode 100644 index 0000000000..aabf2cf63a --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_entry_point_telemetry.js @@ -0,0 +1,103 @@ +const TEST_ORIGIN = "https://example.com"; + +add_setup(async function () { + await SpecialPowers.pushPrefEnv({ + set: [["signon.rememberSignons.visibilityToggle", true]], + }); + Services.telemetry.clearEvents(); +}); + +add_task(async function mainMenu_entryPoint() { + await SimpleTest.promiseFocus(); + info("mainMenu_entryPoint, got focus"); + + let mainMenu = document.getElementById("appMenu-popup"); + let target = document.getElementById("PanelUI-menu-button"); + await TestUtils.waitForCondition( + () => BrowserTestUtils.is_visible(target), + "Main menu button should be visible." + ); + info("mainMenu_entryPoint, Main menu button is visible"); + Assert.equal( + mainMenu.state, + "closed", + `Menu panel (${mainMenu.id}) is initally closed.` + ); + + info("mainMenu_entryPoint, clicking target and waiting for popup"); + let popupshown = BrowserTestUtils.waitForEvent(mainMenu, "popupshown"); + EventUtils.synthesizeMouseAtCenter(target, {}); + await popupshown; + + info("mainMenu_entryPoint, main menu popup is shown"); + Assert.equal(mainMenu.state, "open", `Menu panel (${mainMenu.id}) is open.`); + + let loginsButtonID = "appMenu-passwords-button"; + + let item = document.getElementById(loginsButtonID); + await TestUtils.waitForCondition( + () => BrowserTestUtils.is_visible(item), + "Logins and passwords button is visible." + ); + + info("mainMenu_entryPoint, clicking on Logins and passwords button"); + let openingFunc = () => EventUtils.synthesizeMouseAtCenter(item, {}); + let passwordManager = await openPasswordManager(openingFunc); + info("mainMenu_entryPoint, password manager dialog shown"); + + await LoginTestUtils.telemetry.waitForEventCount(1); + TelemetryTestUtils.assertEvents( + [["pwmgr", "open_management", "mainmenu"]], + { + category: "pwmgr", + method: "open_management", + }, + { clear: true, process: "content" } + ); + + info("mainMenu_entryPoint, close dialog and main menu"); + await passwordManager.close(); + mainMenu.hidePopup(); +}); + +add_task(async function pageInfo_entryPoint() { + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_ORIGIN, + }, + async function (browser) { + info("pageInfo_entryPoint, opening pageinfo"); + let pageInfo = BrowserPageInfo(TEST_ORIGIN, "securityTab", {}); + await BrowserTestUtils.waitForEvent(pageInfo, "page-info-init"); + info( + "pageInfo_entryPoint, got pageinfo, wait until password button is visible" + ); + let passwordsButton = pageInfo.document.getElementById( + "security-view-password" + ); + + await TestUtils.waitForCondition( + () => BrowserTestUtils.is_visible(passwordsButton), + "Show passwords button should be visible." + ); + info("pageInfo_entryPoint, clicking the show passwords button..."); + await SimpleTest.promiseFocus(pageInfo); + let openingFunc = () => + EventUtils.synthesizeMouseAtCenter(passwordsButton, {}, pageInfo); + + info("pageInfo_entryPoint, waiting for the passwords manager dialog"); + let passwordManager = await openPasswordManager(openingFunc); + + TelemetryTestUtils.assertEvents( + [["pwmgr", "open_management", "pageinfo"]], + { category: "pwmgr", method: "open_management" }, + { clear: true, process: "content" } + ); + + info("pageInfo_entryPoint, close dialog and pageInfo"); + await passwordManager.close(); + pageInfo.close(); + } + ); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_exceptions_dialog.js b/toolkit/components/passwordmgr/test/browser/browser_exceptions_dialog.js new file mode 100644 index 0000000000..854f0656b8 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_exceptions_dialog.js @@ -0,0 +1,141 @@ +"use strict"; + +const LOGIN_HOST = "https://example.com"; + +function openExceptionsDialog() { + return window.openDialog( + "chrome://browser/content/preferences/dialogs/permissions.xhtml", + "Toolkit:PasswordManagerExceptions", + "", + { + blockVisible: true, + sessionVisible: false, + allowVisible: false, + hideStatusColumn: true, + prefilledHost: "", + permissionType: "login-saving", + } + ); +} + +function countDisabledHosts(dialog) { + return dialog.document.getElementById("permissionsBox").itemCount; +} + +function promiseStorageChanged(expectedData) { + function observer(subject, data) { + return ( + data == expectedData && + subject.QueryInterface(Ci.nsISupportsString).data == LOGIN_HOST + ); + } + + return TestUtils.topicObserved("passwordmgr-storage-changed", observer); +} + +add_task(async function test_disable() { + let dialog = openExceptionsDialog(); + let promiseChanged = promiseStorageChanged("hostSavingDisabled"); + + await BrowserTestUtils.waitForEvent(dialog, "load"); + await new Promise(resolve => { + waitForFocus(resolve, dialog); + }); + Services.logins.setLoginSavingEnabled(LOGIN_HOST, false); + await promiseChanged; + Assert.equal(countDisabledHosts(dialog), 1, "Verify disabled host added"); + await BrowserTestUtils.closeWindow(dialog); +}); + +add_task(async function test_enable() { + let dialog = openExceptionsDialog(); + let promiseChanged = promiseStorageChanged("hostSavingEnabled"); + + await BrowserTestUtils.waitForEvent(dialog, "load"); + await new Promise(resolve => { + waitForFocus(resolve, dialog); + }); + Services.logins.setLoginSavingEnabled(LOGIN_HOST, true); + await promiseChanged; + Assert.equal(countDisabledHosts(dialog), 0, "Verify disabled host removed"); + await BrowserTestUtils.closeWindow(dialog); +}); + +add_task(async function test_block_button_with_enter_key() { + // Test ensures that the Enter/Return key does not activate the "Allow" button + // in the "Saved Logins" exceptions dialog + + let dialog = openExceptionsDialog(); + + await BrowserTestUtils.waitForEvent(dialog, "load"); + await new Promise(resolve => waitForFocus(resolve, dialog)); + let btnBlock = dialog.document.getElementById("btnBlock"); + let btnCookieSession = dialog.document.getElementById("btnCookieSession"); + let btnHttpsOnlyOff = dialog.document.getElementById("btnHttpsOnlyOff"); + let btnHttpsOnlyOffTmp = dialog.document.getElementById("btnHttpsOnlyOffTmp"); + let btnAllow = dialog.document.getElementById("btnAllow"); + + Assert.ok(!btnBlock.hidden, "Block button is visible"); + Assert.ok(btnCookieSession.hidden, "Cookie session button is not visible"); + Assert.ok(btnAllow.hidden, "Allow button is not visible"); + Assert.ok(btnHttpsOnlyOff.hidden, "HTTPS-Only session button is not visible"); + Assert.ok( + btnHttpsOnlyOffTmp.hidden, + "HTTPS-Only session button is not visible" + ); + Assert.ok(btnBlock.disabled, "Block button is initially disabled"); + Assert.ok( + btnCookieSession.disabled, + "Cookie session button is initially disabled" + ); + Assert.ok(btnAllow.disabled, "Allow button is initially disabled"); + Assert.ok( + btnHttpsOnlyOff.disabled, + "HTTPS-Only off-button is initially disabled" + ); + Assert.ok( + btnHttpsOnlyOffTmp.disabled, + "HTTPS-Only temporary off-button is initially disabled" + ); + + EventUtils.sendString(LOGIN_HOST, dialog); + + Assert.ok( + !btnBlock.disabled, + "Block button is enabled after entering text in the URL input" + ); + Assert.ok( + btnCookieSession.disabled, + "Cookie session button is still disabled after entering text in the URL input" + ); + Assert.ok( + btnAllow.disabled, + "Allow button is still disabled after entering text in the URL input" + ); + Assert.ok( + btnHttpsOnlyOff.disabled, + "HTTPS-Only off-button is still disabled after entering text in the URL input" + ); + Assert.ok( + btnHttpsOnlyOffTmp.disabled, + "HTTPS-Only session off-button is still disabled after entering text in the URL input" + ); + + Assert.equal( + countDisabledHosts(dialog), + 0, + "No blocked hosts should be present before hitting the Enter/Return key" + ); + EventUtils.sendKey("return", dialog); + + Assert.equal( + countDisabledHosts(dialog), + 1, + "Verify the blocked host was added" + ); + Assert.ok( + btnBlock.disabled, + "Block button is disabled after submitting to the list" + ); + await BrowserTestUtils.closeWindow(dialog); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_fileURIOrigin.js b/toolkit/components/passwordmgr/test/browser/browser_fileURIOrigin.js new file mode 100644 index 0000000000..ae8c860792 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_fileURIOrigin.js @@ -0,0 +1,51 @@ +/* Any copyright is dedicated to the Public Domain. + * https://creativecommons.org/publicdomain/zero/1.0/ */ + +"use strict"; + +function getDataFromNextSubmitMessage() { + return new Promise(resolve => { + LoginManagerParent.setListenerForTests((msg, data) => { + if (msg == "ShowDoorhanger") { + resolve(data); + } + }); + }); +} + +add_task(async function testCrossOriginFormUsesCorrectOrigin() { + const registry = Cc["@mozilla.org/chrome/chrome-registry;1"].getService( + Ci.nsIChromeRegistry + ); + + let dataPromise = getDataFromNextSubmitMessage(); + + let url = + registry.convertChromeURL(Services.io.newURI(getRootDirectory(gTestPath))) + .asciiSpec + "form_basic.html"; + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url, + }, + async function (browser) { + await SpecialPowers.spawn(browser.browsingContext, [], () => { + let doc = content.document; + doc.getElementById("form-basic-username").setUserInput("username"); + doc.getElementById("form-basic-password").setUserInput("password"); + doc.getElementById("form-basic").submit(); + info("Submitting form"); + }); + } + ); + + let data = await dataPromise; + info("Origin retrieved from message listener"); + + Assert.equal( + data.origin, + "file://", + "Message origin should match form origin" + ); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_focus_before_first_DOMContentLoaded.js b/toolkit/components/passwordmgr/test/browser/browser_focus_before_first_DOMContentLoaded.js new file mode 100644 index 0000000000..783f8ea3d8 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_focus_before_first_DOMContentLoaded.js @@ -0,0 +1,103 @@ +/** + * Test that autocomplete is properly attached to a username field which gets + * focused before DOMContentLoaded in a new browser and process. + */ + +"use strict"; + +add_setup(async () => { + let nsLoginInfo = Components.Constructor( + "@mozilla.org/login-manager/loginInfo;1", + Ci.nsILoginInfo, + "init" + ); + Assert.ok(nsLoginInfo != null, "nsLoginInfo constructor"); + + info("Adding two logins to get autocomplete instead of autofill"); + let login1 = new nsLoginInfo( + "https://example.com", + "https://autocomplete:8888", + null, + "tempuser1", + "temppass1" + ); + + let login2 = new nsLoginInfo( + "https://example.com", + "https://autocomplete:8888", + null, + "testuser2", + "testpass2" + ); + + await Services.logins.addLogins([login1, login2]); +}); + +add_task(async function test_autocompleteFromUsername() { + let autocompletePopup = document.getElementById("PopupAutoComplete"); + let autocompletePopupShown = BrowserTestUtils.waitForEvent( + autocompletePopup, + "popupshown" + ); + + const URL = `https://example.com${DIRECTORY_PATH}file_focus_before_DOMContentLoaded.sjs`; + + let newTab = await BrowserTestUtils.openNewForegroundTab({ + gBrowser, + opening: URL, + forceNewProcess: true, + }); + + await SpecialPowers.spawn( + newTab.linkedBrowser, + [], + function checkInitialValues() { + let doc = content.document; + let uname = doc.querySelector("#uname"); + let pword = doc.querySelector("#pword"); + + Assert.ok(uname, "Username field found"); + Assert.ok(pword, "Password field found"); + + Assert.equal( + doc.activeElement, + uname, + "#uname element should be focused" + ); + Assert.equal(uname.value, "", "Checking username is empty"); + Assert.equal(pword.value, "", "Checking password is empty"); + } + ); + + await BrowserTestUtils.synthesizeKey("VK_DOWN", {}, newTab.linkedBrowser); + await autocompletePopupShown; + + let richlistbox = autocompletePopup.richlistbox; + Assert.equal( + richlistbox.localName, + "richlistbox", + "The richlistbox should be the first anonymous node" + ); + for (let i = 0; i < autocompletePopup.view.matchCount; i++) { + if ( + richlistbox.selectedItem && + richlistbox.selectedItem.textContent.includes("tempuser1") + ) { + break; + } + await BrowserTestUtils.synthesizeKey("VK_DOWN", {}, newTab.linkedBrowser); + } + + await BrowserTestUtils.synthesizeKey("VK_RETURN", {}, newTab.linkedBrowser); + + await SpecialPowers.spawn(newTab.linkedBrowser, [], function checkFill() { + let doc = content.document; + let uname = doc.querySelector("#uname"); + let pword = doc.querySelector("#pword"); + + Assert.equal(uname.value, "tempuser1", "Checking username is filled"); + Assert.equal(pword.value, "temppass1", "Checking password is filled"); + }); + + BrowserTestUtils.removeTab(newTab); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_form_history_fallback.js b/toolkit/components/passwordmgr/test/browser/browser_form_history_fallback.js new file mode 100644 index 0000000000..ad76e5479c --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_form_history_fallback.js @@ -0,0 +1,65 @@ +const { FormHistoryTestUtils } = ChromeUtils.importESModule( + "resource://testing-common/FormHistoryTestUtils.sys.mjs" +); + +const usernameFieldName = "user"; + +async function cleanup() { + Services.prefs.clearUserPref("signon.rememberSignons"); + Services.logins.removeAllLogins(); + await FormHistoryTestUtils.clear(usernameFieldName); +} + +add_setup(async function () { + await cleanup(); +}); + +add_task( + async function test_username_not_saved_in_form_history_when_password_manager_enabled() { + Services.prefs.setBoolPref("signon.rememberSignons", true); + + await testSubmittingLoginFormHTTP( + "subtst_notifications_1.html", + async () => { + const notif = await getCaptureDoorhangerThatMayOpen("password-save"); + await clickDoorhangerButton(notif, REMEMBER_BUTTON); + } + ); + + const loginEntries = Services.logins.getAllLogins().length; + const historyEntries = await FormHistoryTestUtils.count(usernameFieldName); + + Assert.equal( + loginEntries, + 1, + "Username should be saved in password manager" + ); + + Assert.equal( + historyEntries, + 0, + "Username should not be saved in form history" + ); + await cleanup(); + } +); + +add_task( + async function test_username_saved_in_form_history_when_password_manager_disabled() { + Services.prefs.setBoolPref("signon.rememberSignons", false); + + await testSubmittingLoginFormHTTP("subtst_notifications_1.html"); + + const loginEntries = Services.logins.getAllLogins().length; + const historyEntries = await FormHistoryTestUtils.count(usernameFieldName); + + Assert.equal( + loginEntries, + 0, + "Username should not be saved in password manager" + ); + + Assert.equal(historyEntries, 1, "Username should be saved in form history"); + await cleanup(); + } +); diff --git a/toolkit/components/passwordmgr/test/browser/browser_formless_submit_chrome.js b/toolkit/components/passwordmgr/test/browser/browser_formless_submit_chrome.js new file mode 100644 index 0000000000..212b5f79d8 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_formless_submit_chrome.js @@ -0,0 +1,161 @@ +/* + * Test that browser chrome UI interactions don't trigger a capture doorhanger. + */ + +"use strict"; + +async function fillTestPage( + aBrowser, + username = "my_username", + password = "my_password" +) { + let notif = getCaptureDoorhanger("any", undefined, aBrowser); + Assert.ok(!notif, "No doorhangers should be present before filling the form"); + + await changeContentFormValues(aBrowser, { + "#form-basic-username": username, + "#form-basic-password": password, + }); + if (LoginHelper.passwordEditCaptureEnabled) { + // Filling the password will generate a dismissed doorhanger. + // Check and remove that before running the rest of the task + notif = await waitForDoorhanger(aBrowser, "any"); + Assert.ok(notif.dismissed, "Only a dismissed doorhanger should be present"); + await cleanupDoorhanger(notif); + } +} + +function withTestPage(aTaskFn) { + return BrowserTestUtils.withNewTab( + { + gBrowser, + url: "https://example.com" + DIRECTORY_PATH + "formless_basic.html", + }, + async function (aBrowser) { + info("tab opened"); + await fillTestPage(aBrowser); + await aTaskFn(aBrowser); + + // Give a chance for the doorhanger to appear + await new Promise(resolve => SimpleTest.executeSoon(resolve)); + let notif = getCaptureDoorhanger("any"); + Assert.ok(!notif, "No doorhanger should be present"); + await cleanupDoorhanger(notif); + } + ); +} + +add_setup(async function () { + await SimpleTest.promiseFocus(window); +}); + +add_task(async function test_urlbar_new_URL() { + await withTestPage(async function (aBrowser) { + gURLBar.value = ""; + let focusPromise = BrowserTestUtils.waitForEvent(gURLBar, "focus"); + gURLBar.focus(); + await focusPromise; + info("focused"); + EventUtils.sendString("http://mochi.test:8888/"); + EventUtils.synthesizeKey("KEY_Enter"); + await BrowserTestUtils.browserLoaded( + aBrowser, + false, + "http://mochi.test:8888/" + ); + }); +}); + +add_task(async function test_urlbar_fragment_enter() { + await withTestPage(function (aBrowser) { + gURLBar.focus(); + gURLBar.select(); + EventUtils.synthesizeKey("KEY_ArrowRight"); + EventUtils.sendString("#fragment"); + EventUtils.synthesizeKey("KEY_Enter"); + }); +}); + +add_task(async function test_backButton_forwardButton() { + await withTestPage(async function (aBrowser) { + info("Loading formless_basic.html?second"); + // Load a new page in the tab so we can test going back + BrowserTestUtils.loadURIString( + aBrowser, + "https://example.com" + DIRECTORY_PATH + "formless_basic.html?second" + ); + await BrowserTestUtils.browserLoaded( + aBrowser, + false, + "https://example.com" + DIRECTORY_PATH + "formless_basic.html?second" + ); + info("Loaded formless_basic.html?second"); + await fillTestPage(aBrowser, "my_username", "password_2"); + + info("formless_basic.html?second form is filled, clicking back"); + let backPromise = BrowserTestUtils.browserStopped(aBrowser); + EventUtils.synthesizeMouseAtCenter( + document.getElementById("back-button"), + {} + ); + await backPromise; + + // Give a chance for the doorhanger to appear + await new Promise(resolve => SimpleTest.executeSoon(resolve)); + Assert.ok(!getCaptureDoorhanger("any"), "No doorhanger should be present"); + + // Now go forward again after filling + await fillTestPage(aBrowser, "my_username", "password_3"); + + let forwardButton = document.getElementById("forward-button"); + await BrowserTestUtils.waitForCondition(() => { + return !forwardButton.disabled; + }); + let forwardPromise = BrowserTestUtils.browserStopped(aBrowser); + info("click the forward button"); + EventUtils.synthesizeMouseAtCenter(forwardButton, {}); + await forwardPromise; + info("done"); + }); +}); + +add_task(async function test_reloadButton() { + await withTestPage(async function (aBrowser) { + let reloadButton = document.getElementById("reload-button"); + let loadPromise = BrowserTestUtils.browserLoaded( + aBrowser, + false, + "https://example.com" + DIRECTORY_PATH + "formless_basic.html" + ); + + await BrowserTestUtils.waitForCondition(() => { + return !reloadButton.disabled; + }); + EventUtils.synthesizeMouseAtCenter(reloadButton, {}); + await loadPromise; + }); +}); + +add_task(async function test_back_keyboard_shortcut() { + await withTestPage(async function (aBrowser) { + // Load a new page in the tab so we can test going back + BrowserTestUtils.loadURIString( + aBrowser, + "https://example.com" + DIRECTORY_PATH + "formless_basic.html?second" + ); + await BrowserTestUtils.browserLoaded( + aBrowser, + false, + "https://example.com" + DIRECTORY_PATH + "formless_basic.html?second" + ); + await fillTestPage(aBrowser); + + let backPromise = BrowserTestUtils.browserStopped(aBrowser); + + const goBackKeyModifier = + AppConstants.platform == "macosx" ? { metaKey: true } : { altKey: true }; + EventUtils.synthesizeKey("KEY_ArrowLeft", goBackKeyModifier); + + await backPromise; + }); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_insecurePasswordConsoleWarning.js b/toolkit/components/passwordmgr/test/browser/browser_insecurePasswordConsoleWarning.js new file mode 100644 index 0000000000..68d5663258 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_insecurePasswordConsoleWarning.js @@ -0,0 +1,131 @@ +"use strict"; + +const WARNING_PATTERN = [ + { + key: "INSECURE_FORM_ACTION", + msg: 'JavaScript Warning: "Password fields present in a form with an insecure (http://) form action. This is a security risk that allows user login credentials to be stolen."', + }, + { + key: "INSECURE_PAGE", + msg: 'JavaScript Warning: "Password fields present on an insecure (http://) page. This is a security risk that allows user login credentials to be stolen."', + }, +]; + +add_task(async function testInsecurePasswordWarning() { + // By default, proxies don't apply to 127.0.0.1. We need them to for this test, though: + await SpecialPowers.pushPrefEnv({ + set: [["network.proxy.allow_hijacking_localhost", true]], + }); + let warningPatternHandler; + + function messageHandler(msgObj) { + function findWarningPattern(msg) { + return WARNING_PATTERN.find(patternPair => { + return msg.includes(patternPair.msg); + }); + } + + let warning = findWarningPattern(msgObj.message); + + // Only handle the insecure password related warning messages. + if (warning) { + // Prevent any unexpected or redundant matched warning message coming after + // the test case is ended. + Assert.ok( + warningPatternHandler, + "Invoke a valid warning message handler" + ); + warningPatternHandler(warning, msgObj.message); + } + } + Services.console.registerListener(messageHandler); + registerCleanupFunction(function () { + Services.console.unregisterListener(messageHandler); + }); + + for (let [origin, testFile, expectWarnings] of [ + ["http://127.0.0.1", "form_basic.html", []], + ["http://127.0.0.1", "formless_basic.html", []], + ["http://example.com", "form_basic.html", ["INSECURE_PAGE"]], + ["http://example.com", "formless_basic.html", ["INSECURE_PAGE"]], + ["https://example.com", "form_basic.html", []], + ["https://example.com", "formless_basic.html", []], + + // For a form with customized action link in the same origin. + ["http://127.0.0.1", "form_same_origin_action.html", []], + ["http://example.com", "form_same_origin_action.html", ["INSECURE_PAGE"]], + ["https://example.com", "form_same_origin_action.html", []], + + // For a form with an insecure (http) customized action link. + [ + "http://127.0.0.1", + "form_cross_origin_insecure_action.html", + ["INSECURE_FORM_ACTION"], + ], + [ + "http://example.com", + "form_cross_origin_insecure_action.html", + ["INSECURE_PAGE"], + ], + [ + "https://example.com", + "form_cross_origin_insecure_action.html", + ["INSECURE_FORM_ACTION"], + ], + + // For a form with a secure (https) customized action link. + ["http://127.0.0.1", "form_cross_origin_secure_action.html", []], + [ + "http://example.com", + "form_cross_origin_secure_action.html", + ["INSECURE_PAGE"], + ], + ["https://example.com", "form_cross_origin_secure_action.html", []], + ]) { + let testURL = origin + DIRECTORY_PATH + testFile; + let promiseConsoleMessages = new Promise(resolve => { + warningPatternHandler = function (warning, originMessage) { + Assert.ok(warning, "Handling a warning pattern"); + let fullMessage = `[${warning.msg} {file: "${testURL}" line: 0 column: 0 source: "0"}]`; + Assert.equal( + originMessage, + fullMessage, + "Message full matched:" + originMessage + ); + + let index = expectWarnings.indexOf(warning.key); + isnot( + index, + -1, + "Found warning: " + warning.key + " for URL:" + testURL + ); + if (index !== -1) { + // Remove the shown message. + expectWarnings.splice(index, 1); + } + if (expectWarnings.length === 0) { + info("All warnings are shown for URL:" + testURL); + resolve(); + } + }; + }); + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: testURL, + }, + function () { + if (expectWarnings.length === 0) { + info("All warnings are shown for URL:" + testURL); + return Promise.resolve(); + } + return promiseConsoleMessages; + } + ); + + // Remove warningPatternHandler to stop handling the matched warning pattern + // and the task should not get any warning anymore. + warningPatternHandler = null; + } +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_isProbablyASignUpForm.js b/toolkit/components/passwordmgr/test/browser/browser_isProbablyASignUpForm.js new file mode 100644 index 0000000000..0f256d74a1 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_isProbablyASignUpForm.js @@ -0,0 +1,42 @@ +"use strict"; + +const TEST_URL = `https://example.com${DIRECTORY_PATH}form_signup_detection.html`; + +add_task(async () => { + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_URL, + }, + async function (browser) { + await SpecialPowers.spawn(browser, [], async () => { + const doc = content.document; + const { LoginManagerChild } = ChromeUtils.importESModule( + "resource://gre/modules/LoginManagerChild.sys.mjs" + ); + const loginManagerChild = new LoginManagerChild(); + const docState = loginManagerChild.stateForDocument(doc); + let isSignUpForm; + + info("Test case: Obvious signup form is detected as sign up form"); + const signUpForm = doc.getElementById("obvious-signup-form"); + isSignUpForm = docState.isProbablyASignUpForm(signUpForm); + Assert.equal(isSignUpForm, true); + + info( + "Test case: Obvious non signup form is detected as non sign up form" + ); + const loginForm = doc.getElementById("obvious-login-form"); + isSignUpForm = docState.isProbablyASignUpForm(loginForm); + Assert.equal(isSignUpForm, false); + + info( + "Test case: An <input> HTML element is detected as non sign up form" + ); + const inputField = doc.getElementById("obvious-signup-username"); + isSignUpForm = docState.isProbablyASignUpForm(inputField); + Assert.equal(isSignUpForm, false); + }); + } + ); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_localip_frame.js b/toolkit/components/passwordmgr/test/browser/browser_localip_frame.js new file mode 100644 index 0000000000..33ae0e6c0b --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_localip_frame.js @@ -0,0 +1,86 @@ +"use strict"; + +add_setup(async () => { + const login1 = LoginTestUtils.testData.formLogin({ + origin: "http://10.0.0.0", + formActionOrigin: "https://example.org", + username: "username1", + password: "password1", + }); + const login2 = LoginTestUtils.testData.formLogin({ + origin: "https://example.org", + formActionOrigin: "https://example.org", + username: "username2", + password: "password2", + }); + await Services.logins.addLogins([login1, login2]); +}); + +add_task(async function test_warningForLocalIP() { + let tests = [ + /* when the url of top-level and iframe are both ip address, do not show insecure warning */ + { + top: "http://192.168.0.0", + iframe: "http://10.0.0.0", + expected: `[originaltype="loginWithOrigin"]`, + }, + { + top: "http://192.168.0.0", + iframe: "https://example.org", + expected: `[type="insecureWarning"]`, + }, + { + top: "http://example.com", + iframe: "http://10.0.0.0", + expected: `[type="insecureWarning"]`, + }, + { + top: "http://example.com", + iframe: "http://example.org", + expected: `[type="insecureWarning"]`, + }, + ]; + + for (let test of tests) { + let urlTop = test.top + DIRECTORY_PATH + "empty.html"; + let urlIframe = + test.iframe + DIRECTORY_PATH + "insecure_test_subframe.html"; + + let tab = await BrowserTestUtils.openNewForegroundTab(gBrowser, urlTop); + let browser = tab.linkedBrowser; + + await SpecialPowers.spawn(browser, [urlIframe], async url => { + await new content.Promise(resolve => { + let ifr = content.document.createElement("iframe"); + ifr.onload = resolve; + ifr.src = url; + content.document.body.appendChild(ifr); + }); + }); + + let popup = document.getElementById("PopupAutoComplete"); + Assert.ok(popup, "Got popup"); + + let ifr = browser.browsingContext.children[0]; + Assert.ok(ifr, "Got iframe"); + + let popupShown = openACPopup( + popup, + tab.linkedBrowser, + "#form-basic-username", + ifr + ); + await popupShown; + + let item = popup.querySelector(test.expected); + Assert.ok(item, "Got expected richlistitem"); + + await BrowserTestUtils.waitForCondition( + () => !item.collapsed, + "Wait for autocomplete to show" + ); + + await closePopup(popup); + BrowserTestUtils.removeTab(tab); + } +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_message_onFormSubmit.js b/toolkit/components/passwordmgr/test/browser/browser_message_onFormSubmit.js new file mode 100644 index 0000000000..5e611a7384 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_message_onFormSubmit.js @@ -0,0 +1,82 @@ +/** + * Test "passwordmgr-form-submission-detected" should be notified + * regardless of whehter the password saving is enabled. + */ + +async function waitForFormSubmissionDetected() { + return new Promise(resolve => { + Services.obs.addObserver(function observer(subject, topic) { + Services.obs.removeObserver( + observer, + "passwordmgr-form-submission-detected" + ); + resolve(); + }, "passwordmgr-form-submission-detected"); + }); +} + +add_task(async function test_login_save_disable() { + await SpecialPowers.pushPrefEnv({ + set: [["signon.rememberSignons", false]], + }); + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: + "https://example.com/browser/toolkit/components/" + + "passwordmgr/test/browser/form_basic.html", + }, + async function (browser) { + await SimpleTest.promiseFocus(browser.ownerGlobal); + await changeContentFormValues(browser, { + "#form-basic-username": "username", + "#form-basic-password": "password", + }); + + let promise = waitForFormSubmissionDetected(); + await SpecialPowers.spawn(browser, [], async function () { + let doc = this.content.document; + doc.getElementById("form-basic").submit(); + }); + + await promise; + Assert.ok(true, "Test completed"); + } + ); +}); + +add_task(async function test_login_save_enable() { + await SpecialPowers.pushPrefEnv({ + set: [["signon.rememberSignons", true]], + }); + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: + "https://example.com/browser/toolkit/components/" + + "passwordmgr/test/browser/form_basic.html", + }, + async function (browser) { + await SimpleTest.promiseFocus(browser.ownerGlobal); + + await changeContentFormValues(browser, { + "#form-basic-username": "username", + "#form-basic-password": "password", + }); + + // When login saving is enabled, we should receive both FormSubmit + // event and "passwordmgr-form-submission-detected" event + let p1 = waitForFormSubmissionDetected(); + let p2 = listenForTestNotification("ShowDoorhanger"); + await SpecialPowers.spawn(browser, [], async function () { + let doc = this.content.document; + doc.getElementById("form-basic").submit(); + }); + + await Promise.all([p1, p2]); + Assert.ok(true, "Test completed"); + } + ); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_openPasswordManager.js b/toolkit/components/passwordmgr/test/browser/browser_openPasswordManager.js new file mode 100644 index 0000000000..0bb50f81c8 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_openPasswordManager.js @@ -0,0 +1,161 @@ +const { sinon } = ChromeUtils.importESModule( + "resource://testing-common/Sinon.sys.mjs" +); + +add_task(async function test_noFilter() { + let openingFunc = () => + LoginHelper.openPasswordManager(window, { entryPoint: "mainmenu" }); + let passwordManager = await openPasswordManager(openingFunc); + + Assert.ok(passwordManager, "Login dialog was opened"); + await passwordManager.close(); + await TestUtils.waitForCondition(() => { + return Services.wm.getMostRecentWindow("Toolkit:PasswordManager") === null; + }, "Waiting for the password manager dialog to close"); +}); + +add_task(async function test_filter() { + // Greek IDN for example.test + let domain = "παράδειγμα.δοκιμή"; + let openingFunc = () => + LoginHelper.openPasswordManager(window, { + filterString: domain, + entryPoint: "mainmenu", + }); + let passwordManager = await openPasswordManager(openingFunc, true); + Assert.equal( + passwordManager.filterValue, + domain, + "search string to filter logins should match expectation" + ); + await passwordManager.close(); + await TestUtils.waitForCondition(() => { + return Services.wm.getMostRecentWindow("Toolkit:PasswordManager") === null; + }, "Waiting for the password manager dialog to close"); +}); + +add_task(async function test_management_noFilter() { + let tabOpenPromise = BrowserTestUtils.waitForNewTab(gBrowser, "about:logins"); + LoginHelper.openPasswordManager(window, { entryPoint: "mainmenu" }); + let tab = await tabOpenPromise; + Assert.ok(tab, "Got the new tab"); + BrowserTestUtils.removeTab(tab); +}); + +add_task(async function test_management_filter() { + let tabOpenPromise = BrowserTestUtils.waitForNewTab( + gBrowser, + "about:logins?filter=%CF%80%CE%B1%CF%81%CE%AC%CE%B4%CE%B5%CE%B9%CE%B3%CE%BC%CE%B1.%CE%B4%CE%BF%CE%BA%CE%B9%CE%BC%CE%AE" + ); + // Greek IDN for example.test + LoginHelper.openPasswordManager(window, { + filterString: "παράδειγμα.δοκιμή", + entryPoint: "mainmenu", + }); + let tab = await tabOpenPromise; + Assert.ok(tab, "Got the new tab with a domain filter"); + BrowserTestUtils.removeTab(tab); +}); + +add_task( + async function test_url_when_opening_password_manager_without_a_filterString() { + sinon.spy(window, "openTrustedLinkIn"); + const openingFunc = () => + LoginHelper.openPasswordManager(window, { + filterString: "", + entryPoint: "mainmenu", + }); + const passwordManager = await openPasswordManager(openingFunc); + + const url = window.openTrustedLinkIn.lastCall.args[0]; + + Assert.ok( + !url.includes("filter"), + "LoginHelper.openPasswordManager call without a filterString navigated to a URL with a filter query param" + ); + Assert.equal( + 0, + url.split("").filter(char => char === "&").length, + "LoginHelper.openPasswordManager call without a filterString navigated to a URL with an &" + ); + Assert.equal( + url, + "about:logins?entryPoint=mainmenu", + "LoginHelper.openPasswordManager call without a filterString navigated to an unexpected URL" + ); + + Assert.ok(passwordManager, "Login dialog was opened"); + await passwordManager.close(); + window.openTrustedLinkIn.restore(); + } +); + +add_task( + async function test_url_when_opening_password_manager_with_a_filterString() { + sinon.spy(window, "openTrustedLinkIn"); + const openingFunc = () => + LoginHelper.openPasswordManager(window, { + filterString: "testFilter", + entryPoint: "mainmenu", + }); + const passwordManager = await openPasswordManager(openingFunc); + + const url = window.openTrustedLinkIn.lastCall.args[0]; + + Assert.ok( + url.includes("filter"), + "LoginHelper.openPasswordManager call with a filterString navigated to a URL without a filter query param" + ); + Assert.equal( + 1, + url.split("").filter(char => char === "&").length, + "LoginHelper.openPasswordManager call with a filterString navigated to a URL without the correct number of '&'s" + ); + Assert.equal( + url, + "about:logins?filter=testFilter&entryPoint=mainmenu", + "LoginHelper.openPasswordManager call with a filterString navigated to an unexpected URL" + ); + + Assert.ok(passwordManager, "Login dialog was opened"); + await passwordManager.close(); + window.openTrustedLinkIn.restore(); + } +); + +add_task( + async function test_url_when_opening_password_manager_without_filterString_or_entryPoint() { + sinon.spy(window, "openTrustedLinkIn"); + const openingFunc = () => + LoginHelper.openPasswordManager(window, { + filterString: "", + entryPoint: "", + }); + const passwordManager = await openPasswordManager(openingFunc); + + const url = window.openTrustedLinkIn.lastCall.args[0]; + + Assert.ok( + !url.includes("filter"), + "LoginHelper.openPasswordManager call without a filterString navigated to a URL with a filter query param" + ); + Assert.ok( + !url.includes("entryPoint"), + "LoginHelper.openPasswordManager call without an entryPoint navigated to a URL with an entryPoint query param" + ); + Assert.equal( + 0, + url.split("").filter(char => char === "&").length, + "LoginHelper.openPasswordManager call without query params navigated to a URL that included at least one '&'" + ); + Assert.equal( + url, + "about:logins", + "LoginHelper.openPasswordManager call without a filterString or entryPoint navigated to an unexpected URL" + ); + + Assert.ok(passwordManager, "Login dialog was opened"); + await passwordManager.close(); + window.openTrustedLinkIn.restore(); + } +); diff --git a/toolkit/components/passwordmgr/test/browser/browser_preselect_login.js b/toolkit/components/passwordmgr/test/browser/browser_preselect_login.js new file mode 100644 index 0000000000..146b0ae92b --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_preselect_login.js @@ -0,0 +1,183 @@ +const TEST_ORIGIN = "https://example.org"; +const ABOUT_LOGINS_ORIGIN = "about:logins"; +const TEST_URL_PATH = `${TEST_ORIGIN}${DIRECTORY_PATH}form_basic_login.html`; + +const LOGINS_DATA = [ + { + origin: "https://aurl.com", + username: "user1", + password: "pass1", + guid: Services.uuid.generateUUID().toString(), + }, + { + origin: TEST_ORIGIN, + username: "user2", + password: "pass2", + guid: Services.uuid.generateUUID().toString(), + }, + { + origin: TEST_ORIGIN, + username: "user3", + password: "pass3", + guid: Services.uuid.generateUUID().toString(), + }, +]; + +const waitForAppMenu = async () => { + const appMenu = document.getElementById("appMenu-popup"); + const appMenuButton = document.getElementById("PanelUI-menu-button"); + await TestUtils.waitForCondition( + () => BrowserTestUtils.is_visible(appMenuButton), + "App menu button should be visible." + ); + + let popupshown = BrowserTestUtils.waitForEvent(appMenu, "popupshown"); + EventUtils.synthesizeMouseAtCenter(appMenuButton, {}); + await popupshown; + Assert.equal( + appMenu.state, + "open", + `Menu panel (${appMenu.id}) should be visible` + ); +}; + +const isExpectedLoginItemSelected = async ({ expectedGuid }) => { + const loginList = content.document.querySelector("login-list").shadowRoot; + + await ContentTaskUtils.waitForCondition( + () => + loginList.querySelector("li[aria-selected='true']")?.dataset?.guid === + expectedGuid, + "Wait for login item to be selected" + ); + + Assert.equal( + loginList.querySelector("li[aria-selected='true']")?.dataset?.guid, + expectedGuid, + "Expected login is preselected" + ); +}; + +add_setup(async () => { + await Services.logins.addLogins( + LOGINS_DATA.map(login => LoginTestUtils.testData.formLogin(login)) + ); +}); + +add_task(async function test_about_logins_defaults_to_first_item() { + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: "about:logins#random-guid", + }, + async function (gBrowser) { + await SpecialPowers.spawn( + gBrowser, + [{ expectedGuid: LOGINS_DATA[0].guid }], + isExpectedLoginItemSelected + ); + + Assert.ok( + true, + "First item of the list is selected when random hash is supplied." + ); + } + ); +}); + +add_task( + async function test_gear_icon_opens_about_logins_with_preselected_login() { + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_URL_PATH, + }, + async function (browser) { + const popup = document.getElementById("PopupAutoComplete"); + + await openACPopup(popup, browser, "#form-basic-username"); + + const secondLoginItem = popup.firstChild.getItemAtIndex(1); + const secondLoginItemSettingsIcon = secondLoginItem.querySelector( + ".ac-settings-button" + ); + + Assert.ok( + !secondLoginItemSettingsIcon.checkVisibility({ + checkVisibilityCSS: true, + }), + "Gear icon should not be visible initially" + ); + + await EventUtils.synthesizeKey("KEY_ArrowDown"); + await EventUtils.synthesizeKey("KEY_ArrowDown"); + + await BrowserTestUtils.waitForCondition( + () => secondLoginItem.attributes.selected, + "Wait for second login to become active" + ); + + Assert.ok( + secondLoginItemSettingsIcon.checkVisibility({ + checkVisibilityCSS: true, + }), + "Gear icon should be visible when login item is active" + ); + + const aboutLoginsTabPromise = BrowserTestUtils.waitForNewTab( + gBrowser, + url => url.includes(ABOUT_LOGINS_ORIGIN), + true + ); + + EventUtils.synthesizeMouseAtCenter(secondLoginItemSettingsIcon, {}); + const aboutLoginsTab = await aboutLoginsTabPromise; + + await SpecialPowers.spawn( + aboutLoginsTab.linkedBrowser, + [{ expectedGuid: LOGINS_DATA[2].guid }], + isExpectedLoginItemSelected + ); + + await closePopup(popup); + gBrowser.removeTab(aboutLoginsTab); + } + ); + } +); + +add_task( + async function test_password_menu_opens_about_logins_with_preselected_login() { + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_URL_PATH, + }, + async function (browser) { + await waitForAppMenu(); + + const appMenuPasswordsButton = document.getElementById( + "appMenu-passwords-button" + ); + + const aboutLoginsTabPromise = BrowserTestUtils.waitForNewTab( + gBrowser, + url => url.includes(ABOUT_LOGINS_ORIGIN), + true + ); + + EventUtils.synthesizeMouseAtCenter(appMenuPasswordsButton, {}); + + const aboutLoginsTab = await aboutLoginsTabPromise; + + await SpecialPowers.spawn( + aboutLoginsTab.linkedBrowser, + [{ expectedGuid: LOGINS_DATA[1].guid }], + isExpectedLoginItemSelected + ); + + gBrowser.removeTab(aboutLoginsTab); + } + ); + } +); diff --git a/toolkit/components/passwordmgr/test/browser/browser_private_window.js b/toolkit/components/passwordmgr/test/browser/browser_private_window.js new file mode 100644 index 0000000000..513549fbbe --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_private_window.js @@ -0,0 +1,954 @@ +"use strict"; + +async function focusWindow(win) { + if (Services.focus.activeWindow == win) { + return; + } + let promise = new Promise(resolve => { + win.addEventListener( + "focus", + function () { + resolve(); + }, + { capture: true, once: true } + ); + }); + win.focus(); + await promise; +} + +function getDialogDoc() { + // Trudge through all the open windows, until we find the one + // that has either commonDialog.xhtml or selectDialog.xhtml loaded. + // var enumerator = Services.wm.getEnumerator("navigator:browser"); + for (let { docShell } of Services.wm.getEnumerator(null)) { + var containedDocShells = docShell.getAllDocShellsInSubtree( + docShell.typeChrome, + docShell.ENUMERATE_FORWARDS + ); + for (let childDocShell of containedDocShells) { + // Get the corresponding document for this docshell + // We don't want it if it's not done loading. + if (childDocShell.busyFlags != Ci.nsIDocShell.BUSY_FLAGS_NONE) { + continue; + } + var childDoc = childDocShell.contentViewer.DOMDocument; + if ( + childDoc.location.href != + "chrome://global/content/commonDialog.xhtml" && + childDoc.location.href != "chrome://global/content/selectDialog.xhtml" + ) { + continue; + } + + // We're expecting the dialog to be focused. If it's not yet, try later. + // (In particular, this is needed on Linux to reliably check focused elements.) + if (Services.focus.focusedWindow != childDoc.defaultView) { + continue; + } + + return childDoc; + } + } + + return null; +} + +async function waitForAuthPrompt() { + let promptDoc = await TestUtils.waitForCondition(() => { + return getAuthPrompt(); + }); + info("Got prompt: " + promptDoc); + return promptDoc; +} + +function getAuthPrompt() { + let doc = getDialogDoc(); + if (!doc) { + return false; // try again in a bit + } + return doc; +} + +async function loadAccessRestrictedURL(browser, url, username, password) { + let browserLoaded = BrowserTestUtils.browserLoaded(browser); + BrowserTestUtils.loadURIString(browser, url); + + // Wait for the auth prompt, enter the login details and close the prompt + await PromptTestUtils.handleNextPrompt( + browser, + { modalType: authPromptModalType, promptType: "promptUserAndPass" }, + { buttonNumClick: 0, loginInput: username, passwordInput: password } + ); + + await SimpleTest.promiseFocus(browser.ownerGlobal); + await browserLoaded; +} + +const PRIVATE_BROWSING_CAPTURE_PREF = "signon.privateBrowsingCapture.enabled"; +let nsLoginInfo = new Components.Constructor( + "@mozilla.org/login-manager/loginInfo;1", + Ci.nsILoginInfo, + "init" +); +let login = new nsLoginInfo( + "https://example.com", + "https://example.com", + null, + "notifyu1", + "notifyp1", + "user", + "pass" +); +const form1Url = `https://example.com/${DIRECTORY_PATH}subtst_privbrowsing_1.html`; +const form2Url = `https://example.com/${DIRECTORY_PATH}form_password_change.html`; +const authUrl = `https://example.com/${DIRECTORY_PATH}authenticate.sjs`; + +let normalWin; +let privateWin; +let authPromptModalType; + +// XXX: Note that tasks are currently run in sequence. Some tests may assume the state +// resulting from successful or unsuccessful logins in previous tasks + +add_task(async function test_setup() { + authPromptModalType = Services.prefs.getIntPref("prompts.modalType.httpAuth"); + normalWin = await BrowserTestUtils.openNewBrowserWindow({ private: false }); + privateWin = await BrowserTestUtils.openNewBrowserWindow({ private: true }); + Services.logins.removeAllUserFacingLogins(); +}); + +add_task(async function test_normal_popup_notification_1() { + info("test 1: run outside of private mode, popup notification should appear"); + await focusWindow(normalWin); + await BrowserTestUtils.withNewTab( + { + gBrowser: normalWin.gBrowser, + url: form1Url, + }, + async function (browser) { + let fieldValues = await submitFormAndGetResults( + browser, + "formsubmit.sjs", + { + "#user": "notifyu1", + "#pass": "notifyp1", + } + ); + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + + let notif = getCaptureDoorhanger( + "password-save", + PopupNotifications, + browser + ); + Assert.ok(notif, "got notification popup"); + if (notif) { + await TestUtils.waitForCondition( + () => !notif.dismissed, + "notification should not be dismissed" + ); + await cleanupDoorhanger(notif); + } + } + ); +}); + +add_task(async function test_private_popup_notification_2() { + info( + "test 2: run inside of private mode, dismissed popup notification should appear" + ); + + const capturePrefValue = Services.prefs.getBoolPref( + PRIVATE_BROWSING_CAPTURE_PREF + ); + Assert.ok( + capturePrefValue, + `Expect ${PRIVATE_BROWSING_CAPTURE_PREF} to default to true` + ); + + // clear existing logins for parity with the previous test + Services.logins.removeAllUserFacingLogins(); + await focusWindow(privateWin); + await BrowserTestUtils.withNewTab( + { + gBrowser: privateWin.gBrowser, + url: form1Url, + }, + async function (browser) { + let fieldValues = await submitFormAndGetResults( + browser, + "formsubmit.sjs", + { + "#user": "notifyu1", + "#pass": "notifyp1", + } + ); + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + + let notif = getCaptureDoorhanger( + "password-save", + PopupNotifications, + browser + ); + Assert.ok(notif, "Expected notification popup"); + if (notif) { + await TestUtils.waitForCondition( + () => notif.dismissed, + "notification should be dismissed" + ); + + let { panel } = privateWin.PopupNotifications; + let promiseShown = BrowserTestUtils.waitForEvent(panel, "popupshown"); + notif.anchorElement.click(); + await promiseShown; + + let notificationElement = panel.childNodes[0]; + let toggleCheckbox = notificationElement.querySelector( + "#password-notification-visibilityToggle" + ); + + Assert.ok( + !toggleCheckbox.hidden, + "Toggle should be visible upon 1st opening" + ); + + info("Hiding popup."); + let promiseHidden = BrowserTestUtils.waitForEvent(panel, "popuphidden"); + panel.hidePopup(); + await promiseHidden; + + info("Clicking on anchor to reshow popup."); + promiseShown = BrowserTestUtils.waitForEvent(panel, "popupshown"); + notif.anchorElement.click(); + await promiseShown; + + Assert.ok( + toggleCheckbox.hidden, + "Toggle should be hidden upon 2nd opening" + ); + + await cleanupDoorhanger(notif); + } + } + ); + Assert.equal( + Services.logins.getAllLogins().length, + 0, + "No logins were saved" + ); +}); + +add_task(async function test_private_popup_notification_no_capture_pref_2b() { + info( + "test 2b: run inside of private mode, with capture pref off," + + "popup notification should not appear" + ); + + const capturePrefValue = Services.prefs.getBoolPref( + PRIVATE_BROWSING_CAPTURE_PREF + ); + Services.prefs.setBoolPref(PRIVATE_BROWSING_CAPTURE_PREF, false); + + // clear existing logins for parity with the previous test + Services.logins.removeAllUserFacingLogins(); + + await focusWindow(privateWin); + await BrowserTestUtils.withNewTab( + { + gBrowser: privateWin.gBrowser, + url: form1Url, + }, + async function (browser) { + let fieldValues = await submitFormAndGetResults( + browser, + "formsubmit.sjs", + { + "#user": "notifyu1", + "#pass": "notifyp1", + } + ); + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + + let notif = getCaptureDoorhanger( + "password-save", + PopupNotifications, + browser + ); + // restore the pref to its original value + Services.prefs.setBoolPref( + PRIVATE_BROWSING_CAPTURE_PREF, + capturePrefValue + ); + + Assert.ok(!notif, "Expected no notification popup"); + if (notif) { + await cleanupDoorhanger(notif); + } + } + ); + Assert.equal( + Services.logins.getAllLogins().length, + 0, + "No logins were saved" + ); +}); + +add_task(async function test_normal_popup_notification_3() { + info( + "test 3: run with a login, outside of private mode, " + + "match existing username/password: no popup notification should appear" + ); + + Services.logins.removeAllUserFacingLogins(); + await Services.logins.addLoginAsync(login); + let allLogins = Services.logins.getAllLogins(); + // Sanity check the HTTP login exists. + Assert.equal(allLogins.length, 1, "Should have the HTTP login"); + let timeLastUsed = allLogins[0].timeLastUsed; + let loginGuid = allLogins[0].guid; + + await focusWindow(normalWin); + await BrowserTestUtils.withNewTab( + { + gBrowser: normalWin.gBrowser, + url: form1Url, + }, + async function (browser) { + let fieldValues = await submitFormAndGetResults( + browser, + "formsubmit.sjs", + { + "#user": "notifyu1", + "#pass": "notifyp1", + } + ); + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + + let notif = getCaptureDoorhanger("any", PopupNotifications, browser); + Assert.ok(!notif, "got no notification popup"); + if (notif) { + await cleanupDoorhanger(notif); + } + } + ); + allLogins = Services.logins.getAllLogins(); + Assert.equal( + allLogins[0].guid, + loginGuid, + "Sanity-check we are comparing the same login record" + ); + Assert.ok( + allLogins[0].timeLastUsed > timeLastUsed, + "The timeLastUsed timestamp has been updated" + ); +}); + +add_task(async function test_private_popup_notification_3b() { + info( + "test 3b: run with a login, in private mode," + + " match existing username/password: no popup notification should appear" + ); + + Services.logins.removeAllUserFacingLogins(); + await Services.logins.addLoginAsync(login); + let allLogins = Services.logins.getAllLogins(); + // Sanity check the HTTP login exists. + Assert.equal(allLogins.length, 1, "Should have the HTTP login"); + let timeLastUsed = allLogins[0].timeLastUsed; + let loginGuid = allLogins[0].guid; + + await focusWindow(privateWin); + await BrowserTestUtils.withNewTab( + { + gBrowser: privateWin.gBrowser, + url: form1Url, + }, + async function (browser) { + let fieldValues = await submitFormAndGetResults( + browser, + "formsubmit.sjs", + { + "#user": "notifyu1", + "#pass": "notifyp1", + } + ); + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + + let notif = getCaptureDoorhanger("any", PopupNotifications, browser); + + Assert.ok(!notif, "got no notification popup"); + if (notif) { + await cleanupDoorhanger(notif); + } + } + ); + allLogins = Services.logins.getAllLogins(); + Assert.equal( + allLogins[0].guid, + loginGuid, + "Sanity-check we are comparing the same login record" + ); + Assert.equal( + allLogins[0].timeLastUsed, + timeLastUsed, + "The timeLastUsed timestamp has not been updated" + ); +}); + +add_task(async function test_normal_new_password_4() { + info( + "test 4: run with a login, outside of private mode," + + " add a new password: popup notification should appear" + ); + Services.logins.removeAllUserFacingLogins(); + await Services.logins.addLoginAsync(login); + let allLogins = Services.logins.getAllLogins(); + // Sanity check the HTTP login exists. + Assert.equal(allLogins.length, 1, "Should have the HTTP login"); + let timeLastUsed = allLogins[0].timeLastUsed; + let loginGuid = allLogins[0].guid; + + await focusWindow(normalWin); + await BrowserTestUtils.withNewTab( + { + gBrowser: normalWin.gBrowser, + url: form2Url, + }, + async function (browser) { + let fieldValues = await submitFormAndGetResults( + browser, + "formsubmit.sjs", + { + "#pass": "notifyp1", + "#newpass": "notifyp2", + } + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = getCaptureDoorhanger( + "password-change", + PopupNotifications, + browser + ); + Assert.ok(notif, "got notification popup"); + if (notif) { + await TestUtils.waitForCondition( + () => !notif.dismissed, + "notification should not be dismissed" + ); + await cleanupDoorhanger(notif); + } + } + ); + // We put up a doorhanger, but didn't interact with it, so we expect the login timestamps + // to be unchanged + allLogins = Services.logins.getAllLogins(); + Assert.equal( + allLogins[0].guid, + loginGuid, + "Sanity-check we are comparing the same login record" + ); + Assert.equal( + allLogins[0].timeLastUsed, + timeLastUsed, + "The timeLastUsed timestamp was not updated" + ); +}); + +add_task(async function test_private_new_password_5() { + info( + "test 5: run with a login, in private mode," + + "add a new password: popup notification should appear" + ); + + const capturePrefValue = Services.prefs.getBoolPref( + PRIVATE_BROWSING_CAPTURE_PREF + ); + Assert.ok( + capturePrefValue, + `Expect ${PRIVATE_BROWSING_CAPTURE_PREF} to default to true` + ); + + let allLogins = Services.logins.getAllLogins(); + // Sanity check the HTTP login exists. + Assert.equal(allLogins.length, 1, "Should have the HTTP login"); + let timeLastUsed = allLogins[0].timeLastUsed; + let loginGuid = allLogins[0].guid; + + await focusWindow(privateWin); + await BrowserTestUtils.withNewTab( + { + gBrowser: privateWin.gBrowser, + url: form2Url, + }, + async function (browser) { + let fieldValues = await submitFormAndGetResults( + browser, + "formsubmit.sjs", + { + "#pass": "notifyp1", + "#newpass": "notifyp2", + } + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = getCaptureDoorhanger( + "password-change", + PopupNotifications, + browser + ); + Assert.ok(notif, "Expected notification popup"); + if (notif) { + await TestUtils.waitForCondition( + () => !notif.dismissed, + "notification should not be dismissed" + ); + await cleanupDoorhanger(notif); + } + } + ); + // We put up a doorhanger, but didn't interact with it, so we expect the login timestamps + // to be unchanged + allLogins = Services.logins.getAllLogins(); + Assert.equal( + allLogins[0].guid, + loginGuid, + "Sanity-check we are comparing the same login record" + ); + Assert.equal( + allLogins[0].timeLastUsed, + timeLastUsed, + "The timeLastUsed timestamp has not been updated" + ); +}); + +add_task(async function test_normal_with_login_6() { + info( + "test 6: run with a login, outside of private mode, " + + "submit with an existing password (from test 4): popup notification should appear" + ); + + await focusWindow(normalWin); + await BrowserTestUtils.withNewTab( + { + gBrowser: normalWin.gBrowser, + url: form2Url, + }, + async function (browser) { + let fieldValues = await submitFormAndGetResults( + browser, + "formsubmit.sjs", + { + "#pass": "notifyp1", + "#newpass": "notifyp2", + } + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + let notif = getCaptureDoorhanger( + "password-change", + PopupNotifications, + browser + ); + Assert.ok(notif, "got notification popup"); + if (notif) { + await TestUtils.waitForCondition( + () => !notif.dismissed, + "notification should not be dismissed" + ); + await cleanupDoorhanger(notif); + } + Services.logins.removeLogin(login); + } + ); +}); + +add_task(async function test_normal_autofilled_7() { + info("test 7: verify that the user/pass pair was autofilled"); + await Services.logins.addLoginAsync(login); + + // Sanity check the HTTP login exists. + Assert.equal( + Services.logins.getAllLogins().length, + 1, + "Should have the HTTP login" + ); + + await focusWindow(normalWin); + await BrowserTestUtils.withNewTab( + { + gBrowser: normalWin.gBrowser, + url: "about:blank", + }, + async function (browser) { + // Add the observer before loading the form page + let formFilled = listenForTestNotification("FormProcessed"); + await SimpleTest.promiseFocus(browser.ownerGlobal); + BrowserTestUtils.loadURIString(browser, form1Url); + await formFilled; + + // the form should have been autofilled, so submit without updating field values + let fieldValues = await submitFormAndGetResults( + browser, + "formsubmit.sjs", + {} + ); + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + } + ); +}); + +add_task(async function test_private_not_autofilled_8() { + info("test 8: verify that the user/pass pair was not autofilled"); + // Sanity check the HTTP login exists. + Assert.equal( + Services.logins.getAllLogins().length, + 1, + "Should have the HTTP login" + ); + + let formFilled = listenForTestNotification("FormProcessed"); + + await focusWindow(privateWin); + await BrowserTestUtils.withNewTab( + { + gBrowser: privateWin.gBrowser, + url: form1Url, + }, + async function (browser) { + await formFilled; + let fieldValues = await submitFormAndGetResults( + browser, + "formsubmit.sjs", + {} + ); + Assert.ok(!fieldValues.username, "Checking submitted username"); + Assert.ok(!fieldValues.password, "Checking submitted password"); + } + ); +}); + +// Disabled for Bug 1523777 +// add_task(async function test_private_autocomplete_9() { +// info("test 9: verify that the user/pass pair was available for autocomplete"); +// // Sanity check the HTTP login exists. +// Assert.equal(Services.logins.getAllLogins().length, 1, "Should have the HTTP login"); + +// await focusWindow(privateWin); +// await BrowserTestUtils.withNewTab({ +// gBrowser: privateWin.gBrowser, +// url: form1Url, +// }, async function(browser) { +// let popup = document.getElementById("PopupAutoComplete"); +// Assert.ok(popup, "Got popup"); + +// let promiseShown = BrowserTestUtils.waitForEvent(popup, "popupshown"); + +// // focus the user field. This should trigger the autocomplete menu +// await ContentTask.spawn(browser, null, async function() { +// content.document.getElementById("user").focus(); +// }); +// await promiseShown; +// Assert.ok(promiseShown, "autocomplete shown"); + +// let promiseFormInput = ContentTask.spawn(browser, null, async function() { +// let doc = content.document; +// await new Promise(resolve => { +// doc.getElementById("form").addEventListener("input", resolve, { once: true }); +// }); +// }); +// info("sending keys"); +// // select the item and hit enter to fill the form +// await BrowserTestUtils.synthesizeKey("VK_DOWN", {}, browser); +// await BrowserTestUtils.synthesizeKey("VK_DOWN", {}, browser); +// await BrowserTestUtils.synthesizeKey("VK_RETURN", {}, browser); +// await promiseFormInput; + +// let fieldValues = await submitFormAndGetResults(browser, "formsubmit.sjs", {}); +// Assert.equal(fieldValues.username, "notifyu1", "Checking submitted username"); +// Assert.equal(fieldValues.password, "notifyp1", "Checking submitted password"); +// }); +// }); + +add_task(async function test_normal_autofilled_10() { + info( + "test 10: verify that the user/pass pair does get autofilled in non-private window" + ); + // Sanity check the HTTP login exists. + Assert.equal( + Services.logins.getAllLogins().length, + 1, + "Should have the HTTP login" + ); + + let formFilled = listenForTestNotification("FormProcessed"); + + await focusWindow(normalWin); + await BrowserTestUtils.withNewTab( + { + gBrowser: normalWin.gBrowser, + url: form1Url, + }, + async function (browser) { + await formFilled; + let fieldValues = await submitFormAndGetResults( + browser, + "formsubmit.sjs", + {} + ); + Assert.equal( + fieldValues.username, + "notifyu1", + "Checking submitted username" + ); + Assert.equal( + fieldValues.password, + "notifyp1", + "Checking submitted password" + ); + } + ); +}); + +add_task(async function test_normal_http_basic_auth() { + info( + "test normal/basic-auth: verify that we get a doorhanger after basic-auth login" + ); + Services.logins.removeAllUserFacingLogins(); + clearHttpAuths(); + + await focusWindow(normalWin); + await BrowserTestUtils.withNewTab( + { + gBrowser: normalWin.gBrowser, + url: "https://example.com", + }, + async function (browser) { + await loadAccessRestrictedURL(browser, authUrl, "test", "testpass"); + Assert.ok(true, "Auth-required page loaded"); + + // verify result in the response document + let fieldValues = await SpecialPowers.spawn( + browser, + [[]], + async function () { + let username = content.document.getElementById("user").textContent; + let password = content.document.getElementById("pass").textContent; + let ok = content.document.getElementById("ok").textContent; + return { + username, + password, + ok, + }; + } + ); + Assert.equal(fieldValues.ok, "PASS", "Checking authorization passed"); + Assert.equal( + fieldValues.username, + "test", + "Checking authorized username" + ); + Assert.equal( + fieldValues.password, + "testpass", + "Checking authorized password" + ); + + let notif = getCaptureDoorhanger( + "password-save", + PopupNotifications, + browser + ); + Assert.ok(notif, "got notification popup"); + if (notif) { + await TestUtils.waitForCondition( + () => !notif.dismissed, + "notification should not be dismissed" + ); + await cleanupDoorhanger(notif); + } + } + ); +}); + +add_task(async function test_private_http_basic_auth() { + info( + "test private/basic-auth: verify that we don't get a doorhanger after basic-auth login" + ); + Services.logins.removeAllUserFacingLogins(); + clearHttpAuths(); + + const capturePrefValue = Services.prefs.getBoolPref( + PRIVATE_BROWSING_CAPTURE_PREF + ); + Assert.ok( + capturePrefValue, + `Expect ${PRIVATE_BROWSING_CAPTURE_PREF} to default to true` + ); + + await focusWindow(privateWin); + await BrowserTestUtils.withNewTab( + { + gBrowser: privateWin.gBrowser, + url: "https://example.com", + }, + async function (browser) { + await loadAccessRestrictedURL(browser, authUrl, "test", "testpass"); + + let fieldValues = await getFormSubmitResponseResult( + browser, + "authenticate.sjs" + ); + Assert.equal( + fieldValues.username, + "test", + "Checking authorized username" + ); + Assert.equal( + fieldValues.password, + "testpass", + "Checking authorized password" + ); + + let notif = getCaptureDoorhanger( + "password-save", + PopupNotifications, + browser + ); + Assert.ok(notif, "got notification popup"); + if (notif) { + await TestUtils.waitForCondition( + () => notif.dismissed, + "notification should be dismissed" + ); + await cleanupDoorhanger(notif); + } + } + ); +}); + +add_task(async function test_private_http_basic_auth_no_capture_pref() { + info( + "test private/basic-auth: verify that we don't get a doorhanger after basic-auth login" + + "with capture pref off" + ); + + const capturePrefValue = Services.prefs.getBoolPref( + PRIVATE_BROWSING_CAPTURE_PREF + ); + Services.prefs.setBoolPref(PRIVATE_BROWSING_CAPTURE_PREF, false); + + Services.logins.removeAllUserFacingLogins(); + clearHttpAuths(); + + await focusWindow(privateWin); + await BrowserTestUtils.withNewTab( + { + gBrowser: privateWin.gBrowser, + url: "https://example.com", + }, + async function (browser) { + await loadAccessRestrictedURL(browser, authUrl, "test", "testpass"); + + let fieldValues = await getFormSubmitResponseResult( + browser, + "authenticate.sjs" + ); + Assert.equal( + fieldValues.username, + "test", + "Checking authorized username" + ); + Assert.equal( + fieldValues.password, + "testpass", + "Checking authorized password" + ); + + let notif = getCaptureDoorhanger( + "password-save", + PopupNotifications, + browser + ); + // restore the pref to its original value + Services.prefs.setBoolPref( + PRIVATE_BROWSING_CAPTURE_PREF, + capturePrefValue + ); + + Assert.ok(!notif, "got no notification popup"); + if (notif) { + await cleanupDoorhanger(notif); + } + } + ); +}); + +add_task(async function test_cleanup() { + await BrowserTestUtils.closeWindow(normalWin); + await BrowserTestUtils.closeWindow(privateWin); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_proxyAuth_prompt.js b/toolkit/components/passwordmgr/test/browser/browser_proxyAuth_prompt.js new file mode 100644 index 0000000000..478f204581 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_proxyAuth_prompt.js @@ -0,0 +1,182 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +"use strict"; + +let proxyChannel; + +function initProxy() { + return new Promise(resolve => { + let proxyChannel; + + let proxyCallback = { + QueryInterface: ChromeUtils.generateQI(["nsIProtocolProxyCallback"]), + + onProxyAvailable(req, uri, pi, status) { + class ProxyChannelListener { + onStartRequest(request) { + resolve(proxyChannel); + } + onStopRequest(request, status) {} + } + // I'm cheating a bit here... We should probably do some magic foo to get + // something implementing nsIProxiedProtocolHandler and then call + // NewProxiedChannel(), so we have something that's definately a proxied + // channel. But Mochitests use a proxy for a number of hosts, so just + // requesting a normal channel will give us a channel that's proxied. + // The proxyChannel needs to move to at least on-modify-request to + // have valid ProxyInfo, but we use OnStartRequest during startup() + // for simplicity. + proxyChannel = Services.io.newChannel( + "http://mochi.test:8888", + null, + null, + null, // aLoadingNode + Services.scriptSecurityManager.getSystemPrincipal(), + null, // aTriggeringPrincipal + Ci.nsILoadInfo.SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL, + Ci.nsIContentPolicy.TYPE_OTHER + ); + proxyChannel.asyncOpen(new ProxyChannelListener()); + }, + }; + + // Need to allow for arbitrary network servers defined in PAC instead of a hardcoded moz-proxy. + let pps = Cc["@mozilla.org/network/protocol-proxy-service;1"].getService(); + + let channel = Services.io.newChannel( + "https://example.com", + null, + null, + null, // aLoadingNode + Services.scriptSecurityManager.getSystemPrincipal(), + null, // aTriggeringPrincipal + Ci.nsILoadInfo.SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL, + Ci.nsIContentPolicy.TYPE_OTHER + ); + pps.asyncResolve(channel, 0, proxyCallback); + }); +} + +add_setup(async function () { + await SpecialPowers.pushPrefEnv({ + // This test relies on tab auth prompts. + set: [["prompts.modalType.httpAuth", Services.prompt.MODAL_TYPE_TAB]], + }); + proxyChannel = await initProxy(); +}); + +/** + * Create an object for consuming an nsIAuthPromptCallback. + * @returns result + * @returns {nsIAuthPromptCallback} result.callback - Callback to be passed into + * asyncPromptAuth. + * @returns {Promise} result.promise - Promise which resolves with authInfo once + * the callback has been called. + */ +function getAuthPromptCallback() { + let callbackResolver; + let promise = new Promise(resolve => { + callbackResolver = resolve; + }); + let callback = { + onAuthAvailable(context, authInfo) { + callbackResolver(authInfo); + }, + }; + return { callback, promise }; +} + +/** + * Tests that if a window proxy auth prompt is open, subsequent auth calls with + * matching realm will be merged into the existing prompt. This should work even + * if the follwing auth call has browser parent. + */ +add_task(async function testProxyAuthPromptMerge() { + let tabA = await BrowserTestUtils.openNewForegroundTab( + gBrowser, + "https://example.com" + ); + let tabB = await BrowserTestUtils.openNewForegroundTab( + gBrowser, + "https://example.org" + ); + + const promptFac = Cc[ + "@mozilla.org/passwordmanager/authpromptfactory;1" + ].getService(Ci.nsIPromptFactory); + let prompter = promptFac.getPrompt(window, Ci.nsIAuthPrompt2); + + let level = Ci.nsIAuthPrompt2.LEVEL_NONE; + let proxyAuthinfo = { + username: "", + password: "", + domain: "", + flags: Ci.nsIAuthInformation.AUTH_PROXY, + authenticationScheme: "basic", + realm: "", + }; + + // The next prompt call will result in window prompt, because the prompt does + // not have a browser set yet. The browser is used as a parent for tab + // prompts. + let promptOpened = PromptTestUtils.waitForPrompt(null, { + modalType: Services.prompt.MODAL_TYPE_WINDOW, + }); + let cbWinPrompt = getAuthPromptCallback(); + info("asyncPromptAuth no parent"); + prompter.asyncPromptAuth( + proxyChannel, + cbWinPrompt.callback, + null, + level, + proxyAuthinfo + ); + let prompt = await promptOpened; + + // Set a browser so the next prompt would open as tab prompt. + prompter.QueryInterface(Ci.nsILoginManagerAuthPrompter).browser = + tabA.linkedBrowser; + + // Since we already have an open window prompts, subsequent calls with + // matching realm should be merged into this prompt and no additional prompts + // must be spawned. + let cbNoPrompt = getAuthPromptCallback(); + info("asyncPromptAuth tabA parent"); + prompter.asyncPromptAuth( + proxyChannel, + cbNoPrompt.callback, + null, + level, + proxyAuthinfo + ); + + // Switch to the next tabs browser. + prompter.QueryInterface(Ci.nsILoginManagerAuthPrompter).browser = + tabB.linkedBrowser; + + let cbNoPrompt2 = getAuthPromptCallback(); + info("asyncPromptAuth tabB parent"); + prompter.asyncPromptAuth( + proxyChannel, + cbNoPrompt2.callback, + null, + level, + proxyAuthinfo + ); + + // Accept the prompt. + PromptTestUtils.handlePrompt(prompt, {}); + + // Accepting the window prompts should complete all auth requests. + let authInfo1 = await cbWinPrompt.promise; + Assert.ok(authInfo1, "Received callback from first proxy auth call."); + let authInfo2 = await cbNoPrompt.promise; + Assert.ok(authInfo2, "Received callback from second proxy auth call."); + let authInfo3 = await cbNoPrompt2.promise; + Assert.ok(authInfo3, "Received callback from third proxy auth call."); + + BrowserTestUtils.removeTab(tabA); + BrowserTestUtils.removeTab(tabB); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_relay_telemetry.js b/toolkit/components/passwordmgr/test/browser/browser_relay_telemetry.js new file mode 100644 index 0000000000..4a6cee3b43 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_relay_telemetry.js @@ -0,0 +1,514 @@ +const { sinon } = ChromeUtils.importESModule( + "resource://testing-common/Sinon.sys.mjs" +); +const { HttpServer } = ChromeUtils.import("resource://testing-common/httpd.js"); +const { getFxAccountsSingleton } = ChromeUtils.importESModule( + "resource://gre/modules/FxAccounts.sys.mjs" +); +const { FirefoxRelayTelemetry } = ChromeUtils.importESModule( + "resource://gre/modules/FirefoxRelayTelemetry.mjs" +); + +const gFxAccounts = getFxAccountsSingleton(); +let gRelayACOptionsTitles; +let gHttpServer; + +const TEST_URL_PATH = `https://example.org${DIRECTORY_PATH}form_basic_signup.html`; + +const MOCK_MASKS = [ + { + full_address: "email1@mozilla.com", + description: "Email 1 Description", + enabled: true, + }, + { + full_address: "email2@mozilla.com", + description: "Email 2 Description", + enabled: false, + }, + { + full_address: "email3@mozilla.com", + description: "Email 3 Description", + enabled: true, + }, +]; + +const SERVER_SCENARIOS = { + free_tier_limit: { + "/relayaddresses/": { + POST: (request, response) => { + response.setStatusLine(request.httpVersion, 403); + response.write(JSON.stringify({ error_code: "free_tier_limit" })); + }, + GET: (_, response) => { + response.write(JSON.stringify(MOCK_MASKS)); + }, + }, + }, + unknown_error: { + "/relayaddresses/": { + default: (request, response) => { + response.setStatusLine(request.httpVersion, 408); + }, + }, + }, + + default: { + default: (request, response) => { + response.setStatusLine(request.httpVersion, 200); + response.write(JSON.stringify({ foo: "bar" })); + }, + }, +}; + +const simpleRouter = scenarioName => (request, response) => { + const routeHandler = + SERVER_SCENARIOS[scenarioName][request._path] ?? SERVER_SCENARIOS.default; + const methodHandler = + routeHandler?.[request._method] ?? + routeHandler.default ?? + SERVER_SCENARIOS.default.default; + methodHandler(request, response); +}; +const setupServerScenario = (scenarioName = "default") => + gHttpServer.registerPrefixHandler("/", simpleRouter(scenarioName)); + +const setupRelayScenario = async scenarioName => { + await SpecialPowers.pushPrefEnv({ + set: [["signon.firefoxRelay.feature", scenarioName]], + }); + Services.telemetry.clearEvents(); +}; + +const waitForEvents = async expectedEvents => + TestUtils.waitForCondition( + () => { + const snapshots = Services.telemetry.snapshotEvents( + Ci.nsITelemetry.DATASET_PRERELEASE_CHANNELS, + false + ); + + return (snapshots.parent?.length ?? 0) >= (expectedEvents.length ?? 0); + }, + "Wait for telemetry to be collected", + 100, + 100 + ); + +async function assertEvents(expectedEvents) { + // To avoid intermittent failures, we wait for telemetry to be collected + await waitForEvents(expectedEvents); + const events = TelemetryTestUtils.getEvents( + { category: "relay_integration" }, + { process: "parent" } + ); + + for (let i = 0; i < expectedEvents.length; i++) { + const keysInExpectedEvent = Object.keys(expectedEvents[i]); + keysInExpectedEvent.forEach(key => { + const assertFn = + typeof events[i][key] === "object" + ? Assert.deepEqual.bind(Assert) + : Assert.equal.bind(Assert); + assertFn( + events[i][key], + expectedEvents[i][key], + `Key value for ${key} should match` + ); + }); + } +} + +async function openRelayAC(browser) { + // In rare cases, especially in chaos mode in verify tests, some events creep in. + // Clear them out before we start. + Services.telemetry.clearEvents(); + const popup = document.getElementById("PopupAutoComplete"); + await openACPopup(popup, browser, "#form-basic-username"); + const popupItem = document + .querySelector("richlistitem") + .getAttribute("ac-label"); + const popupItemTitle = JSON.parse(popupItem).title; + + Assert.ok( + gRelayACOptionsTitles.some(title => title.value === popupItemTitle), + "AC Popup has an item Relay option shown in popup" + ); + + const promiseHidden = BrowserTestUtils.waitForEvent(popup, "popuphidden"); + popup.firstChild.getItemAtIndex(0).click(); + await promiseHidden; +} + +add_setup(async function () { + gHttpServer = new HttpServer(); + setupServerScenario(); + + gHttpServer.start(-1); + + const API_ENDPOINT = `http://localhost:${gHttpServer.identity.primaryPort}/`; + await SpecialPowers.pushPrefEnv({ + set: [ + ["signon.firefoxRelay.feature", "available"], + ["signon.firefoxRelay.base_url", API_ENDPOINT], + ], + }); + + sinon.stub(gFxAccounts, "hasLocalSession").returns(true); + sinon + .stub(gFxAccounts.constructor.config, "isProductionConfig") + .returns(true); + sinon.stub(gFxAccounts, "getOAuthToken").returns("MOCK_TOKEN"); + sinon.stub(gFxAccounts, "getSignedInUser").returns({ + email: "example@mozilla.com", + }); + + const canRecordExtendedOld = Services.telemetry.canRecordExtended; + Services.telemetry.canRecordExtended = true; + Services.telemetry.clearEvents(); + Services.telemetry.setEventRecordingEnabled("relay_integration", true); + + gRelayACOptionsTitles = await new Localization([ + "browser/firefoxRelay.ftl", + "toolkit/branding/brandings.ftl", + ]).formatMessages([ + "firefox-relay-opt-in-title-1", + "firefox-relay-use-mask-title", + ]); + + registerCleanupFunction(async () => { + await new Promise(resolve => { + gHttpServer.stop(function () { + resolve(); + }); + }); + Services.telemetry.setEventRecordingEnabled("relay_integration", false); + Services.telemetry.clearEvents(); + Services.telemetry.canRecordExtended = canRecordExtendedOld; + sinon.restore(); + }); +}); + +add_task(async function test_pref_toggle() { + await setupRelayScenario("available"); + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: "about:preferences#privacy", + }, + async function (browser) { + const relayIntegrationCheckbox = content.document.querySelector( + "checkbox#relayIntegration" + ); + relayIntegrationCheckbox.click(); + relayIntegrationCheckbox.click(); + await assertEvents([ + { object: "pref_change", method: "disabled" }, + { object: "pref_change", method: "enabled" }, + ]); + } + ); +}); + +add_task(async function test_popup_option_optin_enabled() { + await setupRelayScenario("available"); + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_URL_PATH, + }, + async function (browser) { + await openRelayAC(browser); + const notificationPopup = document.getElementById("notification-popup"); + const notificationShown = BrowserTestUtils.waitForPopupEvent( + notificationPopup, + "shown" + ); + const notificationHidden = BrowserTestUtils.waitForPopupEvent( + notificationPopup, + "hidden" + ); + + await notificationShown; + + notificationPopup + .querySelector("button.popup-notification-primary-button") + .click(); + + await notificationHidden; + + await BrowserTestUtils.waitForEvent( + ConfirmationHint._panel, + "popuphidden" + ); + + await assertEvents([ + { + object: "offer_relay", + method: "shown", + extra: { is_relay_user: "true", scenario: "SignUpFormScenario" }, + }, + { + object: "offer_relay", + method: "clicked", + extra: { is_relay_user: "true", scenario: "SignUpFormScenario" }, + }, + { object: "opt_in_panel", method: "shown" }, + { object: "opt_in_panel", method: "enabled" }, + { + object: "fill_username", + method: "shown", + extra: { error_code: "0" }, + }, + ]); + } + ); +}); + +add_task(async function test_popup_option_optin_postponed() { + await setupRelayScenario("available"); + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_URL_PATH, + }, + async function (browser) { + await openRelayAC(browser); + const notificationPopup = document.getElementById("notification-popup"); + const notificationShown = BrowserTestUtils.waitForPopupEvent( + notificationPopup, + "shown" + ); + const notificationHidden = BrowserTestUtils.waitForPopupEvent( + notificationPopup, + "hidden" + ); + + await notificationShown; + + notificationPopup + .querySelector("button.popup-notification-secondary-button") + .click(); + + await notificationHidden; + + await assertEvents([ + { object: "offer_relay", method: "shown" }, + { object: "offer_relay", method: "clicked" }, + { object: "opt_in_panel", method: "shown" }, + { object: "opt_in_panel", method: "postponed" }, + ]); + } + ); +}); + +add_task(async function test_popup_option_optin_disabled() { + await setupRelayScenario("available"); + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_URL_PATH, + }, + async function (browser) { + await openRelayAC(browser); + const notificationPopup = document.getElementById("notification-popup"); + const notificationShown = BrowserTestUtils.waitForPopupEvent( + notificationPopup, + "shown" + ); + const notificationHidden = BrowserTestUtils.waitForPopupEvent( + notificationPopup, + "hidden" + ); + + await notificationShown; + const menupopup = notificationPopup.querySelector("menupopup"); + const menuitem = menupopup.querySelector("menuitem"); + + menuitem.click(); + await notificationHidden; + + await assertEvents([ + { object: "offer_relay", method: "shown" }, + { object: "offer_relay", method: "clicked" }, + { object: "opt_in_panel", method: "shown" }, + { object: "opt_in_panel", method: "disabled" }, + ]); + } + ); +}); + +add_task(async function test_popup_option_fillusername() { + await setupRelayScenario("enabled"); + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_URL_PATH, + }, + async function (browser) { + await openRelayAC(browser); + await BrowserTestUtils.waitForEvent( + ConfirmationHint._panel, + "popuphidden" + ); + await assertEvents([ + { object: "fill_username", method: "shown" }, + { + object: "fill_username", + method: "clicked", + }, + ]); + } + ); +}); + +add_task(async function test_fillusername_free_tier_limit() { + await setupRelayScenario("enabled"); + setupServerScenario("free_tier_limit"); + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_URL_PATH, + }, + async function (browser) { + await openRelayAC(browser); + + const notificationPopup = document.getElementById("notification-popup"); + const notificationShown = BrowserTestUtils.waitForPopupEvent( + notificationPopup, + "shown" + ); + const notificationHidden = BrowserTestUtils.waitForPopupEvent( + notificationPopup, + "hidden" + ); + + await notificationShown; + notificationPopup.querySelector(".reusable-relay-masks button").click(); + await notificationHidden; + + await assertEvents([ + { object: "fill_username", method: "shown" }, + { + object: "fill_username", + method: "clicked", + }, + { + object: "fill_username", + method: "shown", + extra: { error_code: "free_tier_limit" }, + }, + { + object: "reuse_panel", + method: "shown", + }, + { + object: "reuse_panel", + method: "reuse_mask", + }, + ]); + + await SpecialPowers.spawn(browser, [], async function () { + const username = content.document.getElementById("form-basic-username"); + Assert.equal( + username.value, + "email1@mozilla.com", + "Username field should be filled with the first mask" + ); + }); + } + ); +}); + +add_task(async function test_fillusername_error() { + await setupRelayScenario("enabled"); + setupServerScenario("unknown_error"); + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_URL_PATH, + }, + async function (browser) { + await openRelayAC(browser); + + const notificationPopup = document.getElementById("notification-popup"); + const notificationShown = BrowserTestUtils.waitForPopupEvent( + notificationPopup, + "shown" + ); + + await notificationShown; + Assert.equal( + notificationPopup.querySelector("popupnotification").id, + "relay-integration-error-notification", + "Error message should be displayed" + ); + + await assertEvents([ + { object: "fill_username", method: "shown" }, + { + object: "fill_username", + method: "clicked", + }, + { + object: "reuse_panel", + method: "shown", + extra: { error_code: "408" }, + }, + ]); + } + ); +}); + +add_task(async function test_auth_token_error() { + setupRelayScenario("enabled"); + gFxAccounts.getOAuthToken.restore(); + const oauthTokenStub = sinon.stub(gFxAccounts, "getOAuthToken").throws(); + await BrowserTestUtils.withNewTab( + { + gBrowser, + url: TEST_URL_PATH, + }, + async function (browser) { + await openRelayAC(browser); + const notificationPopup = document.getElementById("notification-popup"); + const notificationShown = BrowserTestUtils.waitForPopupEvent( + notificationPopup, + "shown" + ); + const notificationHidden = BrowserTestUtils.waitForPopupEvent( + notificationPopup, + "hidden" + ); + + await notificationShown; + + notificationPopup + .querySelector("button.popup-notification-primary-button") + .click(); + + await notificationHidden; + + await assertEvents([ + { + object: "fill_username", + method: "shown", + extra: { error_code: "0" }, + }, + { + object: "fill_username", + method: "clicked", + extra: { error_code: "0" }, + }, + { + object: "fill_username", + method: "shown", + extra: { error_code: "418" }, + }, + ]); + } + ); + oauthTokenStub.restore(); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_telemetry_SignUpFormRuleset.js b/toolkit/components/passwordmgr/test/browser/browser_telemetry_SignUpFormRuleset.js new file mode 100644 index 0000000000..e1ea3af99a --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_telemetry_SignUpFormRuleset.js @@ -0,0 +1,57 @@ +"use strict"; + +const SIGNUP_DETECTION_HISTOGRAM = "PWMGR_SIGNUP_FORM_DETECTION_MS"; +const TEST_URL = `https://example.com${DIRECTORY_PATH}form_signup_detection.html`; + +/** + * + * @param {Object} histogramData The histogram data to examine + * @returns The amount of entries found in the histogram data + */ +function countEntries(histogramData) { + info(typeof histogramData); + return histogramData + ? Object.values(histogramData.values).reduce((a, b) => a + b, 0) + : null; +} + +/** + * @param {String} id The histogram to examine + * @param {Number} expected The expected amount of entries for a histogram + */ +async function countEntriesOfChildHistogram(id, expected) { + let histogram; + await TestUtils.waitForCondition(() => { + let histograms = Services.telemetry.getSnapshotForHistograms( + "main", + false + ).content; + + histogram = histograms[id]; + + return !!histogram && countEntries(histogram) == expected; + }, `The histogram ${id} was expected to have ${expected} entries.`); + Assert.equal(countEntries(histogram), expected); +} + +add_setup(async () => { + await SpecialPowers.pushPrefEnv({ + set: [["signon.signupDetection.enabled", true]], + }); + Services.telemetry.getHistogramById(SIGNUP_DETECTION_HISTOGRAM).clear(); +}); + +add_task(async () => { + let formProcessed = listenForTestNotification("FormProcessed", 2); + + let tab = await BrowserTestUtils.openNewForegroundTab(gBrowser, TEST_URL); + + await formProcessed; + + info( + "Test case: When loading the document the two <form> HTML elements are processed and each one is run against the SignUpFormRuleset. After the page load the histogram PWMGR_SIGNUP_FORM_DETECTION_MS should have two entries." + ); + await countEntriesOfChildHistogram(SIGNUP_DETECTION_HISTOGRAM, 2); + + gBrowser.removeTab(tab); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_test_changeContentInputValue.js b/toolkit/components/passwordmgr/test/browser/browser_test_changeContentInputValue.js new file mode 100644 index 0000000000..d0016708b2 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_test_changeContentInputValue.js @@ -0,0 +1,129 @@ +/** + * Tests head.js#changeContentInputValue. + */ + +"use strict"; + +// The origin for the test URIs. +const TEST_ORIGIN = "https://example.com"; +const BASIC_FORM_PAGE_PATH = DIRECTORY_PATH + "form_basic.html"; +const USERNAME_INPUT_SELECTOR = "#form-basic-username"; + +let testCases = [ + { + name: "blank string should clear input value", + originalValue: "start text", + inputEvent: "", + expectedKeypresses: ["Backspace"], + }, + { + name: "input value that adds to original string should only add the difference", + originalValue: "start text", + inputEvent: "start text!!!", + expectedKeypresses: ["!", "!", "!"], + }, + { + name: "input value that is a subset of original string should only delete the difference", + originalValue: "start text", + inputEvent: "start", + expectedKeypresses: ["Backspace"], + }, + { + name: "input value that is unrelated to the original string should replace it", + originalValue: "start text", + inputEvent: "wut?", + expectedKeypresses: ["w", "u", "t", "?"], + }, +]; + +for (let testData of testCases) { + let tmp = { + async [testData.name]() { + await testStringChange(testData); + }, + }; + add_task(tmp[testData.name]); +} + +async function testStringChange({ + name, + originalValue, + inputEvent, + expectedKeypresses, +}) { + info("Starting test " + name); + await LoginTestUtils.clearData(); + + await LoginTestUtils.addLogin({ + username: originalValue, + password: "password", + }); + + let formProcessedPromise = listenForTestNotification("FormProcessed"); + let url = TEST_ORIGIN + BASIC_FORM_PAGE_PATH; + info("Opening tab with url: " + url); + + await BrowserTestUtils.withNewTab( + { + gBrowser, + url, + }, + async function (browser) { + info(`Opened tab with url: ${url}, waiting for focus`); + await SimpleTest.promiseFocus(browser.ownerGlobal); + info("Waiting for form-processed message"); + await formProcessedPromise; + await checkForm(browser, originalValue); + info("form checked"); + + await ContentTask.spawn( + browser, + { USERNAME_INPUT_SELECTOR, expectedKeypresses }, + async function ({ USERNAME_INPUT_SELECTOR, expectedKeypresses }) { + let input = content.document.querySelector(USERNAME_INPUT_SELECTOR); + + let verifyKeyListener = event => { + Assert.equal( + expectedKeypresses[0], + event.key, + "Key press matches expected value" + ); + expectedKeypresses.shift(); + + if (!expectedKeypresses.length) { + input.removeEventListner("keydown", verifyKeyListener); + input.addEventListener("keydown", () => { + throw new Error("Unexpected keypress encountered"); + }); + } + }; + + input.addEventListener("keydown", verifyKeyListener); + } + ); + + changeContentInputValue(browser, USERNAME_INPUT_SELECTOR, inputEvent); + } + ); +} + +async function checkForm(browser, expectedUsername) { + await ContentTask.spawn( + browser, + { + expectedUsername, + USERNAME_INPUT_SELECTOR, + }, + async function contentCheckForm({ + expectedUsername, + USERNAME_INPUT_SELECTOR, + }) { + let field = content.document.querySelector(USERNAME_INPUT_SELECTOR); + Assert.equal( + field.value, + expectedUsername, + `Username field has teh expected initial value '${expectedUsername}'` + ); + } + ); +} diff --git a/toolkit/components/passwordmgr/test/browser/browser_username_only_form_telemetry.js b/toolkit/components/passwordmgr/test/browser/browser_username_only_form_telemetry.js new file mode 100644 index 0000000000..54304c24ac --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_username_only_form_telemetry.js @@ -0,0 +1,198 @@ +/* Any copyright is dedicated to the Public Domain. + http://creativecommons.org/publicdomain/zero/1.0/ */ + +/* eslint-disable mozilla/no-arbitrary-setTimeout */ + +"use strict"; + +async function setupForms(numUsernameOnly, numBasic, numOther) { + const TEST_HOSTNAME = "https://example.com"; + let tab = await BrowserTestUtils.openNewForegroundTab( + gBrowser, + TEST_HOSTNAME + DIRECTORY_PATH + "empty.html" + ); + + await SpecialPowers.spawn( + tab.linkedBrowser, + [ + { + numUsernameOnly, + numBasic, + }, + ], + async function (data) { + // type: 1: basic, 2:usernameOnly, 3:other + function addForm(type) { + const form = content.document.createElement("form"); + content.document.body.appendChild(form); + + const user = content.document.createElement("input"); + if (type === 3) { + user.type = "url"; + } else { + user.type = "text"; + user.autocomplete = "username"; + } + form.appendChild(user); + + if (type === 1) { + const password = content.document.createElement("input"); + password.type = "password"; + form.appendChild(password); + } + } + for (let i = 0; i < data.numBasic; i++) { + addForm(1); + } + for (let i = 0; i < data.numUsernameOnly; i++) { + addForm(2); + } + for (let i = 0; i < data.numOther; i++) { + addForm(3); + } + } + ); + + return tab; +} + +async function checkChildHistogram(id, index, expected) { + let histogram; + await TestUtils.waitForCondition(() => { + let histograms = Services.telemetry.getSnapshotForHistograms( + "main", + false /* clear */ + ).content; + + histogram = histograms[id]; + return !!histogram && histogram.values[index] == expected; + }); + Assert.equal(histogram.values[index], expected); +} + +add_setup(async function () { + SpecialPowers.pushPrefEnv({ + set: [ + ["signon.usernameOnlyForm.enabled", true], + ["signon.usernameOnlyForm.lookupThreshold", 100], // ignore the threshold in test + ], + }); + + // Wait 1sec to make sure all the telemetry data recorded prior to the beginning of the + // test is cleared. + await new Promise(res => setTimeout(res, 1000)); + Services.telemetry.getSnapshotForHistograms("main", true /* clear */); +}); + +add_task(async function test_oneUsernameOnlyForm() { + const numUsernameOnlyForms = 1; + const numBasicForms = 0; + + // number of "other" forms doesn't change the outcome, set it to 2 here and + // in the following testcase just to ensure it doesn't affect the result. + let tab = await setupForms(numUsernameOnlyForms, numBasicForms, 2); + + await checkChildHistogram( + "PWMGR_IS_USERNAME_ONLY_FORM", + 1, + numUsernameOnlyForms + ); + await checkChildHistogram( + "PWMGR_NUM_FORM_HAS_POSSIBLE_USERNAME_EVENT_PER_DOC", + numUsernameOnlyForms, + 1 + ); + + BrowserTestUtils.removeTab(tab); + Services.telemetry.getSnapshotForHistograms("main", true /* clear */); +}); + +add_task(async function test_multipleUsernameOnlyForms() { + const numUsernameOnlyForms = 3; + const numBasicForms = 2; + + let tab = await setupForms(numUsernameOnlyForms, numBasicForms, 2); + + await checkChildHistogram( + "PWMGR_IS_USERNAME_ONLY_FORM", + 1, + numUsernameOnlyForms + ); + await checkChildHistogram( + "PWMGR_NUM_FORM_HAS_POSSIBLE_USERNAME_EVENT_PER_DOC", + 5, + 1 + ); + + BrowserTestUtils.removeTab(tab); + Services.telemetry.getSnapshotForHistograms("main", true /* clear */); +}); + +add_task(async function test_multipleDocument() { + // The first document + let numUsernameOnlyForms1 = 2; + let numBasicForms1 = 2; + + let tab1 = await setupForms(numUsernameOnlyForms1, numBasicForms1, 2); + + await checkChildHistogram( + "PWMGR_IS_USERNAME_ONLY_FORM", + 1, + numUsernameOnlyForms1 + ); + await checkChildHistogram( + "PWMGR_NUM_FORM_HAS_POSSIBLE_USERNAME_EVENT_PER_DOC", + numUsernameOnlyForms1 + numBasicForms1, + 1 + ); + + // The second document + let numUsernameOnlyForms2 = 15; + let numBasicForms2 = 3; + + let tab2 = await setupForms(numUsernameOnlyForms2, numBasicForms2, 2); + + await checkChildHistogram( + "PWMGR_IS_USERNAME_ONLY_FORM", + 1, + numUsernameOnlyForms1 + numUsernameOnlyForms2 + ); + + // the result is stacked, so the new document add a counter to all + // buckets under "numUsernameOnlyForms2 + numBasicForms2" + await checkChildHistogram( + "PWMGR_NUM_FORM_HAS_POSSIBLE_USERNAME_EVENT_PER_DOC", + numUsernameOnlyForms1 + numBasicForms1, + 2 + ); + await checkChildHistogram( + "PWMGR_NUM_FORM_HAS_POSSIBLE_USERNAME_EVENT_PER_DOC", + numUsernameOnlyForms2 + numBasicForms2, + 1 + ); + + BrowserTestUtils.removeTab(tab1); + BrowserTestUtils.removeTab(tab2); + Services.telemetry.getSnapshotForHistograms("main", true /* clear */); +}); + +add_task(async function test_tooManyUsernameOnlyForms() { + const numUsernameOnlyForms = 25; + const numBasicForms = 2; + + let tab = await setupForms(numUsernameOnlyForms, numBasicForms, 2); + + await checkChildHistogram( + "PWMGR_IS_USERNAME_ONLY_FORM", + 1, + numUsernameOnlyForms + ); + await checkChildHistogram( + "PWMGR_NUM_FORM_HAS_POSSIBLE_USERNAME_EVENT_PER_DOC", + 21, + numUsernameOnlyForms + numBasicForms - 20 // maximum is 20 + ); + + BrowserTestUtils.removeTab(tab); + Services.telemetry.getSnapshotForHistograms("main", true /* clear */); +}); diff --git a/toolkit/components/passwordmgr/test/browser/browser_username_select_dialog.js b/toolkit/components/passwordmgr/test/browser/browser_username_select_dialog.js new file mode 100644 index 0000000000..03ac74e9ef --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/browser_username_select_dialog.js @@ -0,0 +1,177 @@ +/* + * Test username selection dialog, on password update from a p-only form, + * when there are multiple saved logins on the domain. + */ + +// Copied from prompt_common.js. TODO: share the code. +function getSelectDialogDoc() { + // Trudge through all the open windows, until we find the one + // that has selectDialog.xhtml loaded. + // var enumerator = Services.wm.getEnumerator("navigator:browser"); + for (let { docShell } of Services.wm.getEnumerator(null)) { + var containedDocShells = docShell.getAllDocShellsInSubtree( + docShell.typeChrome, + docShell.ENUMERATE_FORWARDS + ); + for (let childDocShell of containedDocShells) { + // We don't want it if it's not done loading. + if (childDocShell.busyFlags != Ci.nsIDocShell.BUSY_FLAGS_NONE) { + continue; + } + var childDoc = childDocShell.contentViewer.DOMDocument; + + if ( + childDoc.location.href == "chrome://global/content/selectDialog.xhtml" + ) { + return childDoc; + } + } + } + + return null; +} + +let nsLoginInfo = new Components.Constructor( + "@mozilla.org/login-manager/loginInfo;1", + Ci.nsILoginInfo, + "init" +); +let login1 = new nsLoginInfo( + "https://example.com", + "https://example.com", + null, + "notifyu1", + "notifyp1", + "user", + "pass" +); +let login1B = new nsLoginInfo( + "https://example.com", + "https://example.com", + null, + "notifyu1B", + "notifyp1B", + "user", + "pass" +); + +add_task(async function test_changeUPLoginOnPUpdateForm_accept() { + info( + "Select an u+p login from multiple logins, on password update form, and accept." + ); + await Services.logins.addLogins([login1, login1B]); + + let selectDialogPromise = TestUtils.topicObserved("select-dialog-loaded"); + + await testSubmittingLoginForm( + "subtst_notifications_change_p.html", + async function (fieldValues) { + Assert.equal(fieldValues.username, "null", "Checking submitted username"); + Assert.equal( + fieldValues.password, + "pass2", + "Checking submitted password" + ); + + info("Waiting for select dialog to appear."); + let doc = (await selectDialogPromise)[0].document; + let dialog = doc.getElementsByTagName("dialog")[0]; + let listbox = doc.getElementById("list"); + + Assert.equal(listbox.selectedIndex, 0, "Checking selected index"); + Assert.equal(listbox.itemCount, 2, "Checking selected length"); + ["notifyu1", "notifyu1B"].forEach((username, i) => { + Assert.equal( + listbox.getItemAtIndex(i).label, + username, + "Check username selection on dialog" + ); + }); + + dialog.acceptDialog(); + + await TestUtils.waitForCondition(() => { + return !getSelectDialogDoc(); + }, "Wait for selection dialog to disappear."); + } + ); + + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 2, "Should have 2 logins"); + + let login = SpecialPowers.wrap(logins[0]).QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal(login.username, "notifyu1", "Check the username unchanged"); + Assert.equal(login.password, "pass2", "Check the password changed"); + Assert.equal(login.timesUsed, 2, "Check times used"); + + login = SpecialPowers.wrap(logins[1]).QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal(login.username, "notifyu1B", "Check the username unchanged"); + Assert.equal(login.password, "notifyp1B", "Check the password unchanged"); + Assert.equal(login.timesUsed, 1, "Check times used"); + + // cleanup + login1.password = "pass2"; + Services.logins.removeLogin(login1); + login1.password = "notifyp1"; + + Services.logins.removeLogin(login1B); +}); + +add_task(async function test_changeUPLoginOnPUpdateForm_cancel() { + info( + "Select an u+p login from multiple logins, on password update form, and cancel." + ); + await Services.logins.addLogins([login1, login1B]); + + let selectDialogPromise = TestUtils.topicObserved("select-dialog-loaded"); + + await testSubmittingLoginForm( + "subtst_notifications_change_p.html", + async function (fieldValues) { + Assert.equal(fieldValues.username, "null", "Checking submitted username"); + Assert.equal( + fieldValues.password, + "pass2", + "Checking submitted password" + ); + + info("Waiting for select dialog to appear."); + let doc = (await selectDialogPromise)[0].document; + let dialog = doc.getElementsByTagName("dialog")[0]; + let listbox = doc.getElementById("list"); + + Assert.equal(listbox.selectedIndex, 0, "Checking selected index"); + Assert.equal(listbox.itemCount, 2, "Checking selected length"); + ["notifyu1", "notifyu1B"].forEach((username, i) => { + Assert.equal( + listbox.getItemAtIndex(i).label, + username, + "Check username selection on dialog" + ); + }); + + dialog.cancelDialog(); + + await TestUtils.waitForCondition(() => { + return !getSelectDialogDoc(); + }, "Wait for selection dialog to disappear."); + } + ); + + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 2, "Should have 2 logins"); + + let login = SpecialPowers.wrap(logins[0]).QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal(login.username, "notifyu1", "Check the username unchanged"); + Assert.equal(login.password, "notifyp1", "Check the password unchanged"); + Assert.equal(login.timesUsed, 1, "Check times used"); + + login = SpecialPowers.wrap(logins[1]).QueryInterface(Ci.nsILoginMetaInfo); + Assert.equal(login.username, "notifyu1B", "Check the username unchanged"); + Assert.equal(login.password, "notifyp1B", "Check the password unchanged"); + Assert.equal(login.timesUsed, 1, "Check times used"); + + // cleanup + Services.logins.removeLogin(login1); + Services.logins.removeLogin(login1B); +}); diff --git a/toolkit/components/passwordmgr/test/browser/empty.html b/toolkit/components/passwordmgr/test/browser/empty.html new file mode 100644 index 0000000000..1ad28bb1f7 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/empty.html @@ -0,0 +1,8 @@ +<!DOCTYPE HTML> +<html> +<head> +<title>Empty file</title> +</head> +<body> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/browser/file_focus_before_DOMContentLoaded.sjs b/toolkit/components/passwordmgr/test/browser/file_focus_before_DOMContentLoaded.sjs new file mode 100644 index 0000000000..b99246c166 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/file_focus_before_DOMContentLoaded.sjs @@ -0,0 +1,35 @@ +/** + * Focus a username field before DOMContentLoaded. + */ + +"use strict"; + +const DELAY = 2 * 1000; // Delay two seconds before completing the request. + +// In an SJS file we need to get the setTimeout bits ourselves, despite +// what eslint might think applies for browser tests. +// eslint-disable-next-line mozilla/no-redeclare-with-import-autofix +let { setTimeout } = ChromeUtils.importESModule( + "resource://gre/modules/Timer.sys.mjs" +); + +function handleRequest(request, response) { + response.processAsync(); + + response.setHeader("Content-Type", "text/html;charset=utf-8", false); + response.setHeader("Cache-Control", "no-cache", false); + response.write(` + <!DOCTYPE html><html><body> + <form id="early_focus_form" action="https://autocomplete:8888/formtest.js"> + <input type="text" id="uname" name="uname"> + <input type="password" id="pword" name="pword"> + <button type="submit">Submit</button> + </form> + <script>document.querySelector("#uname").focus();</script> + `); + + setTimeout(function finishOutput() { + response.write(`</body></html>`); + response.finish(); + }, DELAY); +} diff --git a/toolkit/components/passwordmgr/test/browser/form_autofocus_frame.html b/toolkit/components/passwordmgr/test/browser/form_autofocus_frame.html new file mode 100644 index 0000000000..3a145a9ea8 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/form_autofocus_frame.html @@ -0,0 +1,10 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head> +<body> +<form id="form-basic"> + <input id="form-basic-username" name="username" autofocus> + <input id="form-basic-password" name="password" type="password"> + <input id="form-basic-submit" type="submit"> +</form> +<iframe src="/document-builder.sjs?html=<html><body>Hi</body></html>"></iframe> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/browser/form_autofocus_js.html b/toolkit/components/passwordmgr/test/browser/form_autofocus_js.html new file mode 100644 index 0000000000..76056e3751 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/form_autofocus_js.html @@ -0,0 +1,10 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head> +<body onload="document.getElementById('form-basic-username').focus();"> +<!-- Username field is focused by js onload --> +<form id="form-basic"> + <input id="form-basic-username" name="username"> + <input id="form-basic-password" name="password" type="password"> + <input id="form-basic-submit" type="submit"> +</form> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/browser/form_basic.html b/toolkit/components/passwordmgr/test/browser/form_basic.html new file mode 100644 index 0000000000..df2083a93c --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/form_basic.html @@ -0,0 +1,12 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!-- Simplest form with username and password fields. --> +<form id="form-basic"> + <input id="form-basic-username" name="username"> + <input id="form-basic-password" name="password" type="password"> + <input id="form-basic-submit" type="submit"> +</form> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/browser/form_basic_iframe.html b/toolkit/components/passwordmgr/test/browser/form_basic_iframe.html new file mode 100644 index 0000000000..dd34739e6d --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/form_basic_iframe.html @@ -0,0 +1,23 @@ +<!DOCTYPE html> +<html> + +<head> + <meta charset="utf-8"> +</head> + +<body> + <!-- Form in an iframe --> + <iframe src="https://example.org/browser/toolkit/components/passwordmgr/test/browser/form_basic.html" id="test-iframe"></iframe> + + <!-- Form in a fully sandboxed iframe --> + <iframe src="https://example.org/browser/toolkit/components/passwordmgr/test/browser/form_basic.html" + sandbox="" + id="test-iframe-sandbox"></iframe> + + <!-- Form in an "allow-same-origin" sandboxed iframe --> + <iframe src="https://example.org/browser/toolkit/components/passwordmgr/test/browser/form_basic.html" + sandbox="allow-same-origin" + id="test-iframe-sandbox-same-origin"></iframe> +</body> + +</html> diff --git a/toolkit/components/passwordmgr/test/browser/form_basic_login.html b/toolkit/components/passwordmgr/test/browser/form_basic_login.html new file mode 100644 index 0000000000..f63aca8b41 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/form_basic_login.html @@ -0,0 +1,12 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!-- Simplest login form with username and password fields. --> +<form id="form-basic-login"> + <input id="form-basic-username" name="username"> + <input id="form-basic-password" name="password" type="password"> + <input id="form-basic-submit" type="submit" value="sign in"> +</form> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/browser/form_basic_no_username.html b/toolkit/components/passwordmgr/test/browser/form_basic_no_username.html new file mode 100644 index 0000000000..885fa9c11c --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/form_basic_no_username.html @@ -0,0 +1,11 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!-- Simplest form with just password field. --> +<form id="form-basic"> + <input id="form-basic-password" name="password" type="password"> + <input id="form-basic-submit" type="submit"> +</form> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/browser/form_basic_signup.html b/toolkit/components/passwordmgr/test/browser/form_basic_signup.html new file mode 100644 index 0000000000..a42a8cc609 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/form_basic_signup.html @@ -0,0 +1,10 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> +<form id="form-basic-signup"> + <input id="form-basic-username" name="username"> + <input id="form-basic-password" name="password" type="password" autocomplete="new-password"> + <input id="form-basic-submit" type="submit" value="sign up"> +</form> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/browser/form_basic_with_confirm_field.html b/toolkit/components/passwordmgr/test/browser/form_basic_with_confirm_field.html new file mode 100644 index 0000000000..c638be4af7 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/form_basic_with_confirm_field.html @@ -0,0 +1,13 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!-- Simplest form with username, password and confirm password fields. --> +<form id="form-basic"> + <input id="form-basic-username" name="username"> + <input id="form-basic-password" name="password" type="password"> + <input id="form-basic-confirm-password" name="confirm-password" type="password"> + <input id="form-basic-submit" type="submit"> +</form> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/browser/form_cross_origin_insecure_action.html b/toolkit/components/passwordmgr/test/browser/form_cross_origin_insecure_action.html new file mode 100644 index 0000000000..8dde7ceb63 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/form_cross_origin_insecure_action.html @@ -0,0 +1,12 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!-- Simplest form with username and password fields. --> +<form id="form-basic" action="http://example.org/custom_action.html"> + <input id="form-basic-username" name="username"> + <input id="form-basic-password" name="password" type="password"> + <input id="form-basic-submit" type="submit"> +</form> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/browser/form_cross_origin_secure_action.html b/toolkit/components/passwordmgr/test/browser/form_cross_origin_secure_action.html new file mode 100644 index 0000000000..2d95419549 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/form_cross_origin_secure_action.html @@ -0,0 +1,12 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!-- Simplest form with username and password fields. --> +<form id="form-basic" action="https://example.org/custom_action.html"> + <input id="form-basic-username" name="username"> + <input id="form-basic-password" name="password" type="password"> + <input id="form-basic-submit" type="submit"> +</form> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/browser/form_crossframe.html b/toolkit/components/passwordmgr/test/browser/form_crossframe.html new file mode 100644 index 0000000000..fbb759c632 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/form_crossframe.html @@ -0,0 +1,13 @@ +<html><body> + +<button onclick="window.location = 'about:blank'">Next</button> +<iframe src="https://test2.example.org:443/browser/toolkit/components/passwordmgr/test/browser/form_crossframe_inner.html" + width="300" height="300"></iframe> +<form id="outer-form" action="formsubmit.sjs"> + <input id="outer-username" name="outer-username"> + <input id="outer-password" name="outer-password" type="password"> + <input id="outer-submit" type="submit"> + <button id="outer-gobutton" onclick="this.location = 'about:blank'">Go</button> +</form> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/browser/form_crossframe_inner.html b/toolkit/components/passwordmgr/test/browser/form_crossframe_inner.html new file mode 100644 index 0000000000..9a919993bf --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/form_crossframe_inner.html @@ -0,0 +1,13 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!-- Form for use inside a frame. --> +<form id="inner-form" action="formsubmit.sjs"> + <input id="inner-username" name="username"> + <input id="inner-password" name="password" type="password"> + <input id="inner-submit" type="submit"> +</form> +<button id="inner-gobutton" onclick="document.location = 'about:blank'">Go</button> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/browser/form_disabled_readonly_passwordField.html b/toolkit/components/passwordmgr/test/browser/form_disabled_readonly_passwordField.html new file mode 100644 index 0000000000..4e47d9790d --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/form_disabled_readonly_passwordField.html @@ -0,0 +1,12 @@ +<!DOCTYPE html><body> + <form id="login_form_disabled_password"> + <input type="text" name="username" autocomplete="username"> + <input type="password" name="password" autocomplete="password" disabled> + <button type="submit">Log in</button> + </form> + <form id="login_form_readonly_password"> + <input type="text" name="username" autocomplete="username"> + <input type="password" name="password" autocomplete="password" readonly> + <button type="submit">Log in</button> + </form> +</body></html> diff --git a/toolkit/components/passwordmgr/test/browser/form_expanded.html b/toolkit/components/passwordmgr/test/browser/form_expanded.html new file mode 100644 index 0000000000..567a373f5b --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/form_expanded.html @@ -0,0 +1,16 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!-- Expanded page containing a form + several unrelated elements --> + +<form id="form-basic"> + <input id="form-expanded-search"> + <input id="form-expanded-username" name="username"> + <input id="form-expanded-password" name="password" type="password"> + <input id="form-expanded-submit" type="submit"> + <input id="form-expanded-captcha"> +</form> +<input id="form-expanded-non-form-input"> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/browser/form_multipage.html b/toolkit/components/passwordmgr/test/browser/form_multipage.html new file mode 100644 index 0000000000..908457fd50 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/form_multipage.html @@ -0,0 +1,32 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!-- Form with a username-only field. --> +<form id="form-basic"> + <input id="form-basic-username" type="text" name="username" autocomplete="username"> + <input id="form-basic-submit" type="submit"> +</form> + +<script> + const form = document.getElementById( "form-basic" ); + form.addEventListener( "submit", function onFormSubmit(event) { + event.preventDefault() + document.getElementById("form-basic").remove(); + + // Create the password-only form after the username-only form is submitted. + var form = document.createElement("form"); + form.id = "form-basic"; + var password = document.createElement("input"); + password.id = "form-basic-password"; + password.type = "password"; + form.appendChild(password); + var submit = document.createElement("input"); + submit.id = "form-basic-submit"; + submit.type = "submit"; + form.appendChild(submit); + document.body.appendChild(form); + }); +</script> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/browser/form_password_change.html b/toolkit/components/passwordmgr/test/browser/form_password_change.html new file mode 100644 index 0000000000..279de622f2 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/form_password_change.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Test for Login Manager notifications w/ new password</title> +</head> +<body> +<h2>Test for Login Manager notifications w/ new password</h2> + +<form id="form" action="formsubmit.sjs"> + <input id="pass" name="pass" type="password"> + <input id="newpass" name="newpass" type="password"> + <button type='submit'>Submit</button> +</form> + +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/browser/form_same_origin_action.html b/toolkit/components/passwordmgr/test/browser/form_same_origin_action.html new file mode 100644 index 0000000000..8f0c9a14e2 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/form_same_origin_action.html @@ -0,0 +1,12 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!-- Simplest form with username and password fields. --> +<form id="form-basic" action="./custom_action.html"> + <input id="form-basic-username" name="username"> + <input id="form-basic-password" name="password" type="password"> + <input id="form-basic-submit" type="submit"> +</form> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/browser/form_signup_detection.html b/toolkit/components/passwordmgr/test/browser/form_signup_detection.html new file mode 100644 index 0000000000..de01223239 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/form_signup_detection.html @@ -0,0 +1,31 @@ +<!DOCTYPE html> +<html lang="en"> +<head> + <meta charset="UTF-8"> +</head> +<body> + <h1>Sign up</h1> + <form id="obvious-signup-form"> + <label for="obvious-signup-email">Email</label> + <input id="obvious-signup-email" type="email"> + <label for="obvious-signup-username">Username</label> + <input id="obvious-signup-username"> + <label for="obvious-signup-password">Password</label> + <input id="obvious-signup-password" type="password" autocomplete="new-password"> + <input id= "obvious-signup-privacyPolicy" type="checkbox"> + <label for="obvious-signup-privacyPolicy">I have read and agree to the privacy policy.</label> + <input id="obvious-signup-submit" type="submit" value="Sign up"> + </form> + <h1>Login</h1> + <form id="obvious-login-form"> + <label for="obvious-login-username">Username</label> + <input id="obvious-login-username"> + <label for="obvious-login-password">Password</label> + <input id="obvious-login-password" type="password" autocomplete="current-password"> + <a>Password forgotten?</a> + <input id= "obvious-login-rememberMe" type="checkbox"> + <label for="obvious-login-rememberMe">Remember me</label> + <input id="obvious-login-submit" type="submit" value="Login"> + </form> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/browser/formless_basic.html b/toolkit/components/passwordmgr/test/browser/formless_basic.html new file mode 100644 index 0000000000..17455df96e --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/formless_basic.html @@ -0,0 +1,18 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> + +<!-- Simplest form with username and password fields. --> + <input id="form-basic-username" name="username"> + <input id="form-basic-password" name="password" type="password"> + <input id="form-basic-submit" type="submit"> + + <button id="add">Add input[type=password]</button> + + <script> + document.getElementById("add").addEventListener("click", function() { + var node = document.createElement("input"); + node.setAttribute("type", "password"); + document.querySelector("body").appendChild(node); + }); + </script> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/browser/head.js b/toolkit/components/passwordmgr/test/browser/head.js new file mode 100644 index 0000000000..70a1f685e2 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/head.js @@ -0,0 +1,965 @@ +const DIRECTORY_PATH = "/browser/toolkit/components/passwordmgr/test/browser/"; + +var { LoginTestUtils } = ChromeUtils.importESModule( + "resource://testing-common/LoginTestUtils.sys.mjs" +); + +const { TelemetryTestUtils } = ChromeUtils.importESModule( + "resource://testing-common/TelemetryTestUtils.sys.mjs" +); +const { PromptTestUtils } = ChromeUtils.importESModule( + "resource://testing-common/PromptTestUtils.sys.mjs" +); + +add_setup(async function common_initialize() { + await SpecialPowers.pushPrefEnv({ + set: [ + ["signon.rememberSignons", true], + ["signon.testOnlyUserHasInteractedByPrefValue", true], + ["signon.testOnlyUserHasInteractedWithDocument", true], + ["toolkit.telemetry.ipcBatchTimeout", 0], + ], + }); + if (LoginHelper.relatedRealmsEnabled) { + await LoginTestUtils.remoteSettings.setupWebsitesWithSharedCredentials(); + registerCleanupFunction(async function () { + await LoginTestUtils.remoteSettings.cleanWebsitesWithSharedCredentials(); + }); + } +}); + +registerCleanupFunction( + async function cleanup_removeAllLoginsAndResetRecipes() { + await SpecialPowers.popPrefEnv(); + + LoginTestUtils.clearData(); + LoginTestUtils.resetGeneratedPasswordsCache(); + clearHttpAuths(); + Services.telemetry.clearEvents(); + + let recipeParent = LoginTestUtils.recipes.getRecipeParent(); + if (!recipeParent) { + // No need to reset the recipes if the recipe module wasn't even loaded. + return; + } + await recipeParent.then(recipeParentResult => recipeParentResult.reset()); + + await cleanupDoorhanger(); + await cleanupPasswordNotifications(); + await closePopup(document.getElementById("contentAreaContextMenu")); + await closePopup(document.getElementById("PopupAutoComplete")); + } +); + +/** + * Compared logins in storage to expected values + * + * @param {array} expectedLogins + * An array of expected login properties + * @return {nsILoginInfo[]} - All saved logins sorted by timeCreated + */ +function verifyLogins(expectedLogins = []) { + let allLogins = Services.logins.getAllLogins(); + allLogins.sort((a, b) => a.timeCreated > b.timeCreated); + Assert.equal( + allLogins.length, + expectedLogins.length, + "Check actual number of logins matches the number of provided expected property-sets" + ); + for (let i = 0; i < expectedLogins.length; i++) { + // if the test doesn't care about comparing properties for this login, just pass false/null. + let expected = expectedLogins[i]; + if (expected) { + let login = allLogins[i]; + if (typeof expected.timesUsed !== "undefined") { + Assert.equal(login.timesUsed, expected.timesUsed, "Check timesUsed"); + } + if (typeof expected.passwordLength !== "undefined") { + Assert.equal( + login.password.length, + expected.passwordLength, + "Check passwordLength" + ); + } + if (typeof expected.username !== "undefined") { + Assert.equal(login.username, expected.username, "Check username"); + } + if (typeof expected.password !== "undefined") { + Assert.equal(login.password, expected.password, "Check password"); + } + if (typeof expected.usedSince !== "undefined") { + Assert.ok( + login.timeLastUsed > expected.usedSince, + "Check timeLastUsed" + ); + } + if (typeof expected.passwordChangedSince !== "undefined") { + Assert.ok( + login.timePasswordChanged > expected.passwordChangedSince, + "Check timePasswordChanged" + ); + } + if (typeof expected.timeCreated !== "undefined") { + Assert.equal( + login.timeCreated, + expected.timeCreated, + "Check timeCreated" + ); + } + } + } + return allLogins; +} + +/** + * Submit the content form and return a promise resolving to the username and + * password values echoed out in the response + * + * @param {Object} [browser] - browser with the form + * @param {String = ""} formAction - Optional url to set the form's action to before submitting + * @param {Object = null} selectorValues - Optional object with field values to set before form submission + * @param {Object = null} responseSelectors - Optional object with selectors to find the username and password in the response + */ +async function submitFormAndGetResults( + browser, + formAction = "", + selectorValues, + responseSelectors +) { + async function contentSubmitForm([contentFormAction, contentSelectorValues]) { + const { WrapPrivileged } = ChromeUtils.importESModule( + "resource://testing-common/WrapPrivileged.sys.mjs" + ); + let doc = content.document; + let form = doc.querySelector("form"); + if (contentFormAction) { + form.action = contentFormAction; + } + for (let [sel, value] of Object.entries(contentSelectorValues)) { + try { + let field = doc.querySelector(sel); + let gotInput = ContentTaskUtils.waitForEvent( + field, + "input", + "Got input event on " + sel + ); + // we don't get an input event if the new value == the old + field.value = "###"; + WrapPrivileged.wrap(field, this).setUserInput(value); + await gotInput; + } catch (ex) { + throw new Error( + `submitForm: Couldn't set value of field at: ${sel}: ${ex.message}` + ); + } + } + form.submit(); + } + + let loadPromise = BrowserTestUtils.browserLoaded(browser); + await SpecialPowers.spawn( + browser, + [[formAction, selectorValues]], + contentSubmitForm + ); + await loadPromise; + + let result = await getFormSubmitResponseResult( + browser, + formAction, + responseSelectors + ); + return result; +} + +/** + * Wait for a given result page to load and return a promise resolving to an object with the parsed-out + * username/password values from the response + * + * @param {Object} [browser] - browser which is loading this page + * @param {String} resultURL - the path or filename to look for in the content.location + * @param {Object = null} - Optional object with selectors to find the username and password in the response + */ +async function getFormSubmitResponseResult( + browser, + resultURL = "/formsubmit.sjs", + { username = "#user", password = "#pass" } = {} +) { + // default selectors are for the response page produced by formsubmit.sjs + let fieldValues = await ContentTask.spawn( + browser, + { + resultURL, + usernameSelector: username, + passwordSelector: password, + }, + async function ({ resultURL, usernameSelector, passwordSelector }) { + await ContentTaskUtils.waitForCondition(() => { + return ( + content.location.pathname.endsWith(resultURL) && + content.document.readyState == "complete" + ); + }, `Wait for form submission load (${resultURL})`); + let username = + content.document.querySelector(usernameSelector).textContent; + // Bug 1686071: Since generated passwords can have special characters in them, + // we need to unescape the characters. These special characters are automatically escaped + // when we submit a form in `submitFormAndGetResults`. + // Otherwise certain tests will intermittently fail when these special characters are present in the passwords. + let password = unescape( + content.document.querySelector(passwordSelector).textContent + ); + return { + username, + password, + }; + } + ); + return fieldValues; +} + +/** + * Loads a test page in `DIRECTORY_URL` which automatically submits to formsubmit.sjs and returns a + * promise resolving with the field values when the optional `aTaskFn` is done. + * + * @param {String} aPageFile - test page file name which auto-submits to formsubmit.sjs + * @param {Function} aTaskFn - task which can be run before the tab closes. + * @param {String} [aOrigin="https://example.com"] - origin of the server to use + * to load `aPageFile`. + */ +function testSubmittingLoginForm( + aPageFile, + aTaskFn, + aOrigin = "https://example.com" +) { + return BrowserTestUtils.withNewTab( + { + gBrowser, + url: aOrigin + DIRECTORY_PATH + aPageFile, + }, + async function (browser) { + Assert.ok(true, "loaded " + aPageFile); + let fieldValues = await getFormSubmitResponseResult( + browser, + "/formsubmit.sjs" + ); + Assert.ok(true, "form submission loaded"); + if (aTaskFn) { + await aTaskFn(fieldValues, browser); + } + return fieldValues; + } + ); +} +/** + * Loads a test page in `DIRECTORY_URL` which automatically submits to formsubmit.sjs and returns a + * promise resolving with the field values when the optional `aTaskFn` is done. + * + * @param {String} aPageFile - test page file name which auto-submits to formsubmit.sjs + * @param {Function} aTaskFn - task which can be run before the tab closes. + * @param {String} [aOrigin="http://example.com"] - origin of the server to use + * to load `aPageFile`. + */ +function testSubmittingLoginFormHTTP( + aPageFile, + aTaskFn, + aOrigin = "http://example.com" +) { + return testSubmittingLoginForm(aPageFile, aTaskFn, aOrigin); +} + +function checkOnlyLoginWasUsedTwice({ justChanged }) { + // Check to make sure we updated the timestamps and use count on the + // existing login that was submitted for the test. + let logins = Services.logins.getAllLogins(); + Assert.equal(logins.length, 1, "Should only have 1 login"); + Assert.ok(logins[0] instanceof Ci.nsILoginMetaInfo, "metainfo QI"); + Assert.equal( + logins[0].timesUsed, + 2, + "check .timesUsed for existing login submission" + ); + Assert.ok( + logins[0].timeCreated < logins[0].timeLastUsed, + "timeLastUsed bumped" + ); + if (justChanged) { + Assert.equal( + logins[0].timeLastUsed, + logins[0].timePasswordChanged, + "timeLastUsed == timePasswordChanged" + ); + } else { + Assert.equal( + logins[0].timeCreated, + logins[0].timePasswordChanged, + "timeChanged not updated" + ); + } +} + +function clearHttpAuths() { + let authMgr = Cc["@mozilla.org/network/http-auth-manager;1"].getService( + Ci.nsIHttpAuthManager + ); + authMgr.clearAll(); +} + +// Begin popup notification (doorhanger) functions // + +const REMEMBER_BUTTON = "button"; +const NEVER_MENUITEM = 0; + +const CHANGE_BUTTON = "button"; +const DONT_CHANGE_BUTTON = "secondaryButton"; +const REMOVE_LOGIN_MENUITEM = 0; + +/** + * Checks if we have a password capture popup notification + * of the right type and with the right label. + * + * @param {String} aKind The desired `passwordNotificationType` ("any" for any type) + * @param {Object} [popupNotifications = PopupNotifications] + * @param {Object} [browser = null] Optional browser whose notifications should be searched. + * @return the found password popup notification. + */ +function getCaptureDoorhanger( + aKind, + popupNotifications = PopupNotifications, + browser = null +) { + Assert.ok(true, "Looking for " + aKind + " popup notification"); + let notification = popupNotifications.getNotification("password", browser); + if (!aKind) { + throw new Error( + "getCaptureDoorhanger needs aKind to be a non-empty string" + ); + } + if (aKind !== "any" && notification) { + Assert.equal( + notification.options.passwordNotificationType, + aKind, + "Notification type matches." + ); + if (aKind == "password-change") { + Assert.equal( + notification.mainAction.label, + "Update", + "Main action label matches update doorhanger." + ); + } else if (aKind == "password-save") { + Assert.equal( + notification.mainAction.label, + "Save", + "Main action label matches save doorhanger." + ); + } + } + return notification; +} + +async function getCaptureDoorhangerThatMayOpen( + aKind, + popupNotifications = PopupNotifications, + browser = null +) { + let notif = getCaptureDoorhanger(aKind, popupNotifications, browser); + if (notif && !notif.dismissed) { + if (popupNotifications.panel.state !== "open") { + await BrowserTestUtils.waitForEvent( + popupNotifications.panel, + "popupshown" + ); + } + } + return notif; +} + +async function waitForDoorhanger(browser, type) { + let notif; + await TestUtils.waitForCondition(() => { + notif = PopupNotifications.getNotification("password", browser); + if (notif && type !== "any") { + return ( + notif.options.passwordNotificationType == type && + notif.anchorElement && + BrowserTestUtils.is_visible(notif.anchorElement) + ); + } + return notif; + }, `Waiting for a ${type} notification`); + return notif; +} + +async function hideDoorhangerPopup() { + info("hideDoorhangerPopup"); + if (!PopupNotifications.isPanelOpen) { + return; + } + let { panel } = PopupNotifications; + let promiseHidden = BrowserTestUtils.waitForEvent(panel, "popuphidden"); + panel.hidePopup(); + await promiseHidden; + info("got popuphidden from notification panel"); +} + +function getDoorhangerButton(aPopup, aButtonIndex) { + let notifications = aPopup.owner.panel.children; + Assert.ok(!!notifications.length, "at least one notification displayed"); + Assert.ok(true, notifications.length + " notification(s)"); + let notification = notifications[0]; + + if (aButtonIndex == "button") { + return notification.button; + } else if (aButtonIndex == "secondaryButton") { + return notification.secondaryButton; + } + return notification.menupopup.querySelectorAll("menuitem")[aButtonIndex]; +} + +/** + * Clicks the specified popup notification button. + * + * @param {Element} aPopup Popup Notification element + * @param {Number} aButtonIndex Number indicating which button to click. + * See the constants in this file. + */ +function clickDoorhangerButton(aPopup, aButtonIndex) { + Assert.ok(true, "Looking for action at index " + aButtonIndex); + + let button = getDoorhangerButton(aPopup, aButtonIndex); + if (aButtonIndex == "button") { + Assert.ok(true, "Triggering main action"); + } else if (aButtonIndex == "secondaryButton") { + Assert.ok(true, "Triggering secondary action"); + } else { + Assert.ok(true, "Triggering menuitem # " + aButtonIndex); + } + button.doCommand(); +} + +async function cleanupDoorhanger(notif) { + let PN = notif ? notif.owner : PopupNotifications; + if (notif) { + notif.remove(); + } + let promiseHidden = PN.isPanelOpen + ? BrowserTestUtils.waitForEvent(PN.panel, "popuphidden") + : Promise.resolve(); + PN.panel.hidePopup(); + await promiseHidden; +} + +async function cleanupPasswordNotifications( + popupNotifications = PopupNotifications +) { + let notif; + while ((notif = popupNotifications.getNotification("password"))) { + notif.remove(); + } +} + +async function clearMessageCache(browser) { + await SpecialPowers.spawn(browser, [], async () => { + const { LoginManagerChild } = ChromeUtils.importESModule( + "resource://gre/modules/LoginManagerChild.sys.mjs" + ); + let docState = LoginManagerChild.forWindow(content).stateForDocument( + content.document + ); + docState.lastSubmittedValuesByRootElement = new content.WeakMap(); + }); +} + +/** + * Checks the doorhanger's username and password. + * + * @param {String} username The username. + * @param {String} password The password. + */ +async function checkDoorhangerUsernamePassword(username, password) { + await BrowserTestUtils.waitForCondition(() => { + return ( + document.getElementById("password-notification-username").value == + username && + document.getElementById("password-notification-password").value == + password + ); + }, "Wait for nsLoginManagerPrompter writeDataToUI() to update to the correct username/password values"); +} + +/** + * Change the doorhanger's username and password input values. + * + * @param {object} newValues + * named values to update + * @param {string} [newValues.password = undefined] + * An optional string value to replace whatever is in the password field + * @param {string} [newValues.username = undefined] + * An optional string value to replace whatever is in the username field + * @param {Object} [popupNotifications = PopupNotifications] + */ +async function updateDoorhangerInputValues( + newValues, + popupNotifications = PopupNotifications +) { + let { panel } = popupNotifications; + if (popupNotifications.panel.state !== "open") { + await BrowserTestUtils.waitForEvent(popupNotifications.panel, "popupshown"); + } + Assert.equal(panel.state, "open", "Check the doorhanger is already open"); + + let notifElem = panel.childNodes[0]; + + // Note: setUserInput does not reliably dispatch input events from chrome elements? + async function setInputValue(target, value) { + info(`setInputValue: on target: ${target.id}, value: ${value}`); + target.focus(); + target.select(); + info( + `setInputValue: current value: '${target.value}', setting new value '${value}'` + ); + await EventUtils.synthesizeKey("KEY_Backspace"); + await EventUtils.sendString(value); + await EventUtils.synthesizeKey("KEY_Tab"); + return Promise.resolve(); + } + + let passwordField = notifElem.querySelector( + "#password-notification-password" + ); + let usernameField = notifElem.querySelector( + "#password-notification-username" + ); + + if (typeof newValues.password !== "undefined") { + if (passwordField.value !== newValues.password) { + await setInputValue(passwordField, newValues.password); + } + } + if (typeof newValues.username !== "undefined") { + if (usernameField.value !== newValues.username) { + await setInputValue(usernameField, newValues.username); + } + } +} + +/** + * Open doorhanger autocomplete popup and select a username value. + * + * @param {string} text the text value of the username that should be selected. + * Noop if `text` is falsy. + */ +async function selectDoorhangerUsername(text) { + await _selectDoorhanger( + text, + "#password-notification-username", + "#password-notification-username-dropmarker" + ); +} + +/** + * Open doorhanger autocomplete popup and select a password value. + * + * @param {string} text the text value of the password that should be selected. + * Noop if `text` is falsy. + */ +async function selectDoorhangerPassword(text) { + await _selectDoorhanger( + text, + "#password-notification-password", + "#password-notification-password-dropmarker" + ); +} + +async function _selectDoorhanger(text, inputSelector, dropmarkerSelector) { + if (!text) { + return; + } + + info("Opening doorhanger suggestion popup"); + + let doorhangerPopup = document.getElementById("password-notification"); + let dropmarker = doorhangerPopup.querySelector(dropmarkerSelector); + + let autocompletePopup = document.getElementById("PopupAutoComplete"); + let popupShown = BrowserTestUtils.waitForEvent( + autocompletePopup, + "popupshown" + ); + // the dropmarker gets un-hidden async when looking up username suggestions + await TestUtils.waitForCondition(() => !dropmarker.hidden); + + EventUtils.synthesizeMouseAtCenter(dropmarker, {}); + + await popupShown; + + let suggestions = [ + ...document + .getElementById("PopupAutoComplete") + .getElementsByTagName("richlistitem"), + ].filter(richlistitem => !richlistitem.collapsed); + + let suggestionText = suggestions.map( + richlistitem => richlistitem.querySelector(".ac-title-text").innerHTML + ); + + let targetIndex = suggestionText.indexOf(text); + Assert.ok(targetIndex != -1, "Suggestions include expected text"); + + let promiseHidden = BrowserTestUtils.waitForEvent( + autocompletePopup, + "popuphidden" + ); + + info("Selecting doorhanger suggestion"); + + EventUtils.synthesizeMouseAtCenter(suggestions[targetIndex], {}); + + await promiseHidden; +} + +// End popup notification (doorhanger) functions // + +async function openPasswordManager(openingFunc, waitForFilter) { + info("waiting for new tab to open"); + let tabPromise = BrowserTestUtils.waitForNewTab( + gBrowser, + url => url.includes("about:logins") && !url.includes("entryPoint="), + true + ); + await openingFunc(); + let tab = await tabPromise; + Assert.ok(tab, "got password management tab"); + let filterValue; + if (waitForFilter) { + filterValue = await SpecialPowers.spawn(tab.linkedBrowser, [], async () => { + let loginFilter = Cu.waiveXrays( + content.document + .querySelector("login-list") + .shadowRoot.querySelector("login-filter") + ); + await ContentTaskUtils.waitForCondition( + () => !!loginFilter.value, + "wait for login-filter to have a value" + ); + return loginFilter.value; + }); + } + return { + filterValue, + close() { + BrowserTestUtils.removeTab(tab); + }, + }; +} + +// Autocomplete popup related functions // + +async function openACPopup( + popup, + browser, + inputSelector, + iframeBrowsingContext = null +) { + let promiseShown = BrowserTestUtils.waitForEvent(popup, "popupshown"); + + await SimpleTest.promiseFocus(browser); + info("content window focused"); + + // Focus the username field to open the popup. + let target = iframeBrowsingContext || browser; + await SpecialPowers.spawn( + target, + [[inputSelector]], + function openAutocomplete(sel) { + content.document.querySelector(sel).focus(); + } + ); + + let shown = await promiseShown; + Assert.ok(shown, "autocomplete popup shown"); + return shown; +} + +async function closePopup(popup) { + if (popup.state == "closed") { + await Promise.resolve(); + } else { + let promiseHidden = BrowserTestUtils.waitForEvent(popup, "popuphidden"); + popup.hidePopup(); + await promiseHidden; + } +} + +async function fillGeneratedPasswordFromOpenACPopup( + browser, + passwordInputSelector +) { + let popup = browser.ownerDocument.getElementById("PopupAutoComplete"); + let item; + + await new Promise(requestAnimationFrame); + await TestUtils.waitForCondition(() => { + item = popup.querySelector(`[originaltype="generatedPassword"]`); + return item && !EventUtils.isHidden(item); + }, "Waiting for item to become visible"); + + let inputEventPromise = ContentTask.spawn( + browser, + [passwordInputSelector], + async function waitForInput(inputSelector) { + let passwordInput = content.document.querySelector(inputSelector); + await ContentTaskUtils.waitForEvent( + passwordInput, + "input", + "Password input value changed" + ); + } + ); + + let passwordGeneratedPromise = listenForTestNotification( + "PasswordEditedOrGenerated" + ); + + info("Clicking the generated password AC item"); + EventUtils.synthesizeMouseAtCenter(item, {}); + info("Waiting for the content input value to change"); + await inputEventPromise; + info("Waiting for the passwordGeneratedPromise"); + await passwordGeneratedPromise; +} + +// Contextmenu functions // + +/** + * Synthesize mouse clicks to open the password manager context menu popup + * for a target password input element. + * + * assertCallback should return true if we should continue or else false. + */ +async function openPasswordContextMenu( + browser, + input, + assertCallback = null, + browsingContext = null, + openFillMenu = null +) { + const doc = browser.ownerDocument; + const CONTEXT_MENU = doc.getElementById("contentAreaContextMenu"); + const POPUP_HEADER = doc.getElementById("fill-login"); + const LOGIN_POPUP = doc.getElementById("fill-login-popup"); + + if (!browsingContext) { + browsingContext = browser.browsingContext; + } + + let contextMenuShownPromise = BrowserTestUtils.waitForEvent( + CONTEXT_MENU, + "popupshown" + ); + + // Synthesize a right mouse click over the password input element, we have to trigger + // both events because formfill code relies on this event happening before the contextmenu + // (which it does for real user input) in order to not show the password autocomplete. + let eventDetails = { type: "mousedown", button: 2 }; + await BrowserTestUtils.synthesizeMouseAtCenter( + input, + eventDetails, + browsingContext + ); + // Synthesize a contextmenu event to actually open the context menu. + eventDetails = { type: "contextmenu", button: 2 }; + await BrowserTestUtils.synthesizeMouseAtCenter( + input, + eventDetails, + browsingContext + ); + + await contextMenuShownPromise; + + if (assertCallback) { + let shouldContinue = await assertCallback(); + if (!shouldContinue) { + return; + } + } + + if (openFillMenu) { + // Open the fill login menu. + let popupShownPromise = BrowserTestUtils.waitForEvent( + LOGIN_POPUP, + "popupshown" + ); + POPUP_HEADER.openMenu(true); + await popupShownPromise; + } +} + +/** + * Listen for the login manager test notification specified by + * expectedMessage. Possible messages: + * FormProcessed - a form was processed after page load. + * FormSubmit - a form was just submitted. + * PasswordEditedOrGenerated - a password was filled in or modified. + * + * The count is the number of that messages to wait for. This should + * typically be used when waiting for the FormProcessed message for a page + * that has subframes to ensure all have been handled. + * + * Returns a promise that will passed additional data specific to the message. + */ +function listenForTestNotification(expectedMessage, count = 1) { + return new Promise(resolve => { + LoginManagerParent.setListenerForTests((msg, data) => { + if (msg == expectedMessage && --count == 0) { + LoginManagerParent.setListenerForTests(null); + info("listenForTestNotification, resolving for message: " + msg); + resolve(data); + } + }); + }); +} + +/** + * Use the contextmenu to fill a field with a generated password + */ +async function doFillGeneratedPasswordContextMenuItem(browser, passwordInput) { + await SimpleTest.promiseFocus(browser); + await openPasswordContextMenu(browser, passwordInput); + + let generatedPasswordItem = document.getElementById( + "fill-login-generated-password" + ); + let generatedPasswordSeparator = document.getElementById( + "passwordmgr-items-separator" + ); + + Assert.ok( + BrowserTestUtils.is_visible(generatedPasswordItem), + "generated password item is visible" + ); + Assert.ok( + BrowserTestUtils.is_visible(generatedPasswordSeparator), + "separator is visible" + ); + + let popup = document.getElementById("PopupAutoComplete"); + Assert.ok(popup, "Got popup"); + let promiseShown = BrowserTestUtils.waitForEvent(popup, "popupshown"); + + await new Promise(resolve => { + SimpleTest.executeSoon(resolve); + }); + + let contextMenu = document.getElementById("contentAreaContextMenu"); + contextMenu.activateItem(generatedPasswordItem); + + await promiseShown; + await fillGeneratedPasswordFromOpenACPopup(browser, passwordInput); +} + +// Content form helpers +async function changeContentFormValues( + browser, + selectorValues, + shouldBlur = true +) { + for (let [sel, value] of Object.entries(selectorValues)) { + info("changeContentFormValues, update: " + sel + ", to: " + value); + await changeContentInputValue(browser, sel, value, shouldBlur); + await TestUtils.waitForTick(); + } +} + +async function changeContentInputValue( + browser, + selector, + str, + shouldBlur = true +) { + await SimpleTest.promiseFocus(browser.ownerGlobal); + let oldValue = await ContentTask.spawn(browser, [selector], function (sel) { + return content.document.querySelector(sel).value; + }); + + if (str === oldValue) { + info("no change needed to value of " + selector + ": " + oldValue); + return; + } + info(`changeContentInputValue: from "${oldValue}" to "${str}"`); + await ContentTask.spawn( + browser, + { selector, str, shouldBlur }, + async function ({ selector, str, shouldBlur }) { + const EventUtils = ContentTaskUtils.getEventUtils(content); + let input = content.document.querySelector(selector); + + input.focus(); + if (!str) { + input.select(); + await EventUtils.synthesizeKey("KEY_Backspace", {}, content); + } else if (input.value.startsWith(str)) { + info( + `New string is substring of value: ${str.length}, ${input.value.length}` + ); + input.setSelectionRange(str.length, input.value.length); + await EventUtils.synthesizeKey("KEY_Backspace", {}, content); + } else if (str.startsWith(input.value)) { + info( + `New string appends to value: ${input.value}, ${str.substring( + input.value.length + )}` + ); + input.setSelectionRange(input.value.length, input.value.length); + await EventUtils.sendString(str.substring(input.value.length), content); + } else { + input.select(); + await EventUtils.sendString(str, content); + } + + if (shouldBlur) { + let changedPromise = ContentTaskUtils.waitForEvent(input, "change"); + input.blur(); + await changedPromise; + } + + Assert.equal(str, input.value, `Expected value '${str}' is set on input`); + } + ); + info("Input value changed"); + await TestUtils.waitForTick(); +} + +async function verifyConfirmationHint( + browser, + forceClose, + anchorID = "password-notification-icon" +) { + let hintElem = browser.ownerGlobal.ConfirmationHint._panel; + await BrowserTestUtils.waitForPopupEvent(hintElem, "shown"); + try { + Assert.equal(hintElem.state, "open", "hint popup is open"); + Assert.ok( + BrowserTestUtils.is_visible(hintElem.anchorNode), + "hint anchorNode is visible" + ); + Assert.equal( + hintElem.anchorNode.id, + anchorID, + "Hint should be anchored on the expected notification icon" + ); + info("verifyConfirmationHint, hint is shown and has its anchorNode"); + if (forceClose) { + await closePopup(hintElem); + } else { + info("verifyConfirmationHint, assertion ok, wait for poopuphidden"); + await BrowserTestUtils.waitForPopupEvent(hintElem, "hidden"); + info("verifyConfirmationHint, hintElem popup is hidden"); + } + } catch (ex) { + Assert.ok(false, "Confirmation hint not shown: " + ex.message); + } finally { + info("verifyConfirmationHint promise finalized"); + } +} diff --git a/toolkit/components/passwordmgr/test/browser/insecure_test.html b/toolkit/components/passwordmgr/test/browser/insecure_test.html new file mode 100644 index 0000000000..fedea1428e --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/insecure_test.html @@ -0,0 +1,9 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!-- This frame is initially loaded over HTTP. --> +<iframe id="test-iframe" + src="http://example.org/browser/toolkit/components/passwordmgr/test/browser/insecure_test_subframe.html"/> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/browser/insecure_test_subframe.html b/toolkit/components/passwordmgr/test/browser/insecure_test_subframe.html new file mode 100644 index 0000000000..42411ff6bc --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/insecure_test_subframe.html @@ -0,0 +1,16 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!-- Simplest form with username and password fields. --> +<form id="form-basic" action="https://example.org/custom_action.html"> + <input id="form-basic-username" name="username"> + <input id="form-basic-password" name="password" type="password"> + <input id="form-basic-submit" type="submit"> +</form> + +<!-- Link to reload this page over HTTPS. --> +<a id="test-link" + href="https://example.org/browser/toolkit/components/passwordmgr/test/browser/insecure_test_subframe.html">HTTPS</a> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/browser/multiple_forms.html b/toolkit/components/passwordmgr/test/browser/multiple_forms.html new file mode 100644 index 0000000000..33c5de8a0e --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/multiple_forms.html @@ -0,0 +1,145 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + + +<form class="test-form" + description="Password only form"> + <input id='test-password-1' type='password' name='pname' value=''> + <input type='submit'>Submit</input> +</form> + +<!-- This is a username-only form --> +<form class="test-form" + description="Username only form"> + <input id='test-username-1' type='text' name='uname' autocomplete='username' value=''> + <input type='submit'>Submit</input> +</form> + +<!-- This is NOT a username-only form --> +<form class="test-form" + description="text input only form"> + <input id='test-input-2' type='text' name='uname' value=''> + <input type='submit'>Submit</input> +</form> + +<form class="test-form" + description="Simple username and password blank form"> + <input id='test-username-3' type='text' name='uname' value=''> + <input id='test-password-3' type='password' name='pname' value=''> + <button type='submit'>Submit</button> +</form> + + +<form class="test-form" + description="Simple username and password form, prefilled username"> + <input id='test-username-4' type='text' name='uname' value='testuser'> + <input id='test-password-4' type='password' name='pname' value=''> + <button type='submit'>Submit</button> +</form> + + +<form class="test-form" + description="Simple username and password form, prefilled username and password"> + <input id='test-username-5' type='text' name='uname' value='testuser'> + <input id='test-password-5' type='password' name='pname' value='testpass'> + <button type='submit'>Submit</button> +</form> + + +<form class="test-form" + description="One username and two passwords empty form"> + <input id='test-username-6' type='text' name='uname'> + <input id='test-password-6' type='password' name='pname'> + <input id='test-password2-6' type='password' name='pname2'> + <button type='submit'>Submit</button> +</form> + + +<form class="test-form" + description="One username and two passwords form, fields prefiled"> + <input id='test-username-7' type='text' name='uname' value="testuser"> + <input id='test-password-7' type='password' name='pname' value="testpass"> + <input id='test-password2-7' type='password' name='pname2' value="testpass"> + <button type='submit'>Submit</button> +</form> + + +<div class="test-form" + description="Username and password fields with no form"> + <input id='test-username-8' type='text' name='uname' value="testuser"> + <input id='test-password-8' type='password' name='pname' value="testpass"> +</div> + + +<form class="test-form" + description="Simple username and password blank form, with disabled password"> + <input id='test-username-9' type='text' name='uname' value=''> + <input id='test-password-9' type='password' name='pname' value='' disabled> + <button type='submit'>Submit</button> +</form> + + +<form class="test-form" + description="Simple username and password blank form, with disabled username"> + <input id='test-username-10' type='text' name='uname' value='' disabled> + <input id='test-password-10' type='password' name='pname' value=''> + <button type='submit'>Submit</button> +</form> + + +<form class="test-form" + description="Simple username and password blank form, with readonly password"> + <input id='test-username-11' type='text' name='uname' value=''> + <input id='test-password-11' type='password' name='pname' value='' readonly> + <button type='submit'>Submit</button> +</form> + + +<form class="test-form" + description="Simple username and password blank form, with readonly username"> + <input id='test-username-12' type='text' name='uname' value='' readonly> + <input id='test-password-12' type='password' name='pname' value=''> + <button type='submit'>Submit</button> +</form> + + +<form class="test-form" + description="Two username and one passwords form, fields prefiled"> + <input id='test-username-13' type='text' name='uname' value="testuser"> + <input id='test-username2-13' type='text' name='uname2' value="testuser"> + <input id='test-password-13' type='password' name='pname' value="testpass"> + <button type='submit'>Submit</button> +</form> + + +<form class="test-form" + description="Two username and one passwords form, one disabled username field"> + <input id='test-username-14' type='text' name='uname'> + <input id='test-username2-14' type='text' name='uname2' disabled> + <input id='test-password-14' type='password' name='pname'> + <button type='submit'>Submit</button> +</form> + + +<div class="test-form" + description="Second username and password fields with no form"> + <input id='test-username-15' type='text' name='uname'> + <input id='test-password-15' type='password' name='pname' expectedFail> +</div> + +<form class="test-form" + description="Simple username and password blank form with the password field unmasked by JS"> + <input id='test-username-16' type='text' name='uname' value=''> + <input id='test-password-16' type='password' name='pname' value='' data-type="password"> + <button type='submit'>Submit</button> +</form> + +<!-- Form in an iframe --> +<iframe src="https://example.org/browser/toolkit/components/passwordmgr/test/browser/form_basic.html" id="test-iframe"></iframe> + +<script> + document.getElementById("test-password-16").type = "text"; +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/browser/subtst_notifications_1.html b/toolkit/components/passwordmgr/test/browser/subtst_notifications_1.html new file mode 100644 index 0000000000..c90fb083ae --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/subtst_notifications_1.html @@ -0,0 +1,29 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Subtest for Login Manager notifications - Basic 1un 1pw</title> +</head> +<body> +<h2>Subtest 1</h2> +<form id="form" action="formsubmit.sjs"> + <input id="user" name="user"> + <input id="pass" name="pass" type="password"> + <button type='submit'>Submit</button> +</form> + +<script> +function submitForm() { + SpecialPowers.wrap(userField).setUserInput("notifyu1"); + SpecialPowers.wrap(passField).setUserInput("notifyp1"); + form.submit(); +} + +window.onload = submitForm; +var form = document.getElementById("form"); +var userField = document.getElementById("user"); +var passField = document.getElementById("pass"); + +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/browser/subtst_notifications_10.html b/toolkit/components/passwordmgr/test/browser/subtst_notifications_10.html new file mode 100644 index 0000000000..7eca613bc3 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/subtst_notifications_10.html @@ -0,0 +1,27 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Subtest for Login Manager notifications</title> +</head> +<body> +<h2>Subtest 10</h2> +<form id="form" action="formsubmit.sjs"> + <input id="pass" name="pass" type="password"> + <button type='submit'>Submit</button> +</form> + +<script> +function submitForm() { + SpecialPowers.wrap(passField).setUserInput("notifyp1"); + form.submit(); +} + +window.onload = submitForm; +var form = document.getElementById("form"); +var userField = document.getElementById("user"); +var passField = document.getElementById("pass"); + +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/browser/subtst_notifications_11.html b/toolkit/components/passwordmgr/test/browser/subtst_notifications_11.html new file mode 100644 index 0000000000..cd29d0536f --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/subtst_notifications_11.html @@ -0,0 +1,26 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Subtest for Login Manager notifications - Popup Windows</title> +</head> +<body> +<h2>Subtest 11 (popup windows)</h2> +<script> + +// Ignore the '?' and split on | +let [username, password, features, autoClose] = window.location.search.substring(1).split("|"); + +var url = "subtst_notifications_11_popup.html?" + username + "|" + password; +var popupWin = window.open(url, "subtst_11", features); + +// Popup window will call this function on form submission. +function formSubmitted() { + if (autoClose) { + popupWin.close(); + } +} + +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/browser/subtst_notifications_11_popup.html b/toolkit/components/passwordmgr/test/browser/subtst_notifications_11_popup.html new file mode 100644 index 0000000000..67aa3fafd8 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/subtst_notifications_11_popup.html @@ -0,0 +1,32 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Subtest for Login Manager notifications</title> +</head> +<body> +<h2>Subtest 11</h2> +<form id="form" action="formsubmit.sjs"> + <input id="user" name="user"> + <input id="pass" name="pass" type="password"> + <button type='submit'>Submit</button> +</form> + +<script> +function submitForm() { + // Get the password from the query string (exclude '?'). + let [username, password] = window.location.search.substring(1).split("|"); + SpecialPowers.wrap(userField).setUserInput(username); + SpecialPowers.wrap(passField).setUserInput(password); + form.submit(); + window.opener.formSubmitted(); +} + +window.onload = submitForm; +var form = document.getElementById("form"); +var userField = document.getElementById("user"); +var passField = document.getElementById("pass"); + +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/browser/subtst_notifications_12_target_blank.html b/toolkit/components/passwordmgr/test/browser/subtst_notifications_12_target_blank.html new file mode 100644 index 0000000000..06c924c2ab --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/subtst_notifications_12_target_blank.html @@ -0,0 +1,31 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>target="_blank" subtest for Login Manager notifications</title> +</head> +<body> +<h2>Subtest 12 - target="_blank"</h2> +<form id="form" action="formsubmit.sjs" target="_blank"> + <input id="user" name="user"> + <input id="pass" name="pass" type="password"> + <button type='submit'>Submit</button> +</form> + +<script> +function submitForm() { + // Get the password from the query string (exclude '?'). + let [username, password] = window.location.search.substring(1).split("|"); + SpecialPowers.wrap(userField).setUserInput(username); + SpecialPowers.wrap(passField).setUserInput(password); + form.submit(); +} + +window.onload = submitForm; +var form = document.getElementById("form"); +var userField = document.getElementById("user"); +var passField = document.getElementById("pass"); + +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/browser/subtst_notifications_2.html b/toolkit/components/passwordmgr/test/browser/subtst_notifications_2.html new file mode 100644 index 0000000000..e732252c16 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/subtst_notifications_2.html @@ -0,0 +1,30 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Subtest for Login Manager notifications - autocomplete=off on the username field</title> +</head> +<body> +<h2>Subtest 2</h2> +(username autocomplete=off) +<form id="form" action="formsubmit.sjs"> + <input id="user" name="user" autocomplete="off"> + <input id="pass" name="pass" type="password"> + <button type='submit'>Submit</button> +</form> + +<script> +function submitForm() { + SpecialPowers.wrap(userField).setUserInput("notifyu1"); + SpecialPowers.wrap(passField).setUserInput("notifyp1"); + form.submit(); +} + +window.onload = submitForm; +var form = document.getElementById("form"); +var userField = document.getElementById("user"); +var passField = document.getElementById("pass"); + +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/browser/subtst_notifications_2pw_0un.html b/toolkit/components/passwordmgr/test/browser/subtst_notifications_2pw_0un.html new file mode 100644 index 0000000000..f6a4b1bf78 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/subtst_notifications_2pw_0un.html @@ -0,0 +1,27 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Subtest for Login Manager notifications with 2 password fields and no username</title> +</head> +<body> +<h2>Subtest 24</h2> +<form id="form" action="formsubmit.sjs"> + <input id="pass1" name="pass1" type="password" value="staticpw"> + <input id="pass" name="pass" type="password"> + <button type="submit">Submit</button> +</form> + +<script> +function submitForm() { + SpecialPowers.wrap(pass).setUserInput("notifyp1"); + form.submit(); +} + +window.onload = submitForm; +var form = document.getElementById("form"); +var pass = document.getElementById("pass"); + +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/browser/subtst_notifications_2pw_1un_1text.html b/toolkit/components/passwordmgr/test/browser/subtst_notifications_2pw_1un_1text.html new file mode 100644 index 0000000000..d5ccbc8d18 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/subtst_notifications_2pw_1un_1text.html @@ -0,0 +1,31 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Subtest for Login Manager notifications with 2 password fields and 1 username field and one other text field before the first password field</title> +</head> +<body> +<h2>1 username field followed by a text field followed by 2 username fields</h2> +<form id="form" action="formsubmit.sjs"> + <input id="user" name="user" value="staticpw"> + <input id="city" name="city" value="city"> + <input id="pass" name="pass" type="password"> + <input id="pin" name="pin" type="password" value="static-pin"> + <button type="submit">Submit</button> +</form> + +<script> +function submitForm() { + SpecialPowers.wrap(userField).setUserInput("notifyu1"); + SpecialPowers.wrap(passField).setUserInput("notifyp1"); + form.submit(); +} + +window.onload = submitForm; +var form = document.getElementById("form"); +var userField = document.getElementById("user"); +var passField = document.getElementById("pass"); + +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/browser/subtst_notifications_3.html b/toolkit/components/passwordmgr/test/browser/subtst_notifications_3.html new file mode 100644 index 0000000000..1a5e6c3417 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/subtst_notifications_3.html @@ -0,0 +1,30 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Subtest for Login Manager notifications - autocomplete=off on the password field</title> +</head> +<body> +<h2>Subtest 3</h2> +(password autocomplete=off) +<form id="form" action="formsubmit.sjs"> + <input id="user" name="user"> + <input id="pass" name="pass" type="password" autocomplete="off"> + <button type='submit'>Submit</button> +</form> + +<script> +function submitForm() { + SpecialPowers.wrap(userField).setUserInput("notifyu1"); + SpecialPowers.wrap(passField).setUserInput("notifyp1"); + form.submit(); +} + +window.onload = submitForm; +var form = document.getElementById("form"); +var userField = document.getElementById("user"); +var passField = document.getElementById("pass"); + +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/browser/subtst_notifications_4.html b/toolkit/components/passwordmgr/test/browser/subtst_notifications_4.html new file mode 100644 index 0000000000..2df721f995 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/subtst_notifications_4.html @@ -0,0 +1,30 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8" > + <title>Subtest for Login Manager notifications</title> +</head> +<body> +<h2>Subtest 4</h2> +(form autocomplete=off) +<form id="form" action="formsubmit.sjs" autocomplete="off"> + <input id="user" name="user"> + <input id="pass" name="pass" type="password"> + <button type='submit'>Submit</button> +</form> + +<script> +function submitForm() { + SpecialPowers.wrap(userField).setUserInput("notifyu1"); + SpecialPowers.wrap(passField).setUserInput("notifyp1"); + form.submit(); +} + +window.onload = submitForm; +var form = document.getElementById("form"); +var userField = document.getElementById("user"); +var passField = document.getElementById("pass"); + +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/browser/subtst_notifications_5.html b/toolkit/components/passwordmgr/test/browser/subtst_notifications_5.html new file mode 100644 index 0000000000..b0c5034272 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/subtst_notifications_5.html @@ -0,0 +1,26 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Subtest for Login Manager notifications - Form with only a username field</title> +</head> +<body> +<h2>Subtest 5</h2> +<form id="form" action="formsubmit.sjs"> + <input id="user" name="user"> + <button type='submit'>Submit</button> +</form> + +<script> +function submitForm() { + SpecialPowers.wrap(userField).setUserInput("notifyu1"); + form.submit(); +} + +window.onload = submitForm; +var form = document.getElementById("form"); +var userField = document.getElementById("user"); + +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/browser/subtst_notifications_6.html b/toolkit/components/passwordmgr/test/browser/subtst_notifications_6.html new file mode 100644 index 0000000000..a90930bb59 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/subtst_notifications_6.html @@ -0,0 +1,27 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Subtest for Login Manager notifications</title> +</head> +<body> +<h2>Subtest 6</h2> +(password-only form) +<form id="form" action="formsubmit.sjs"> + <input id="pass" name="pass" type="password"> + <button type='submit'>Submit</button> +</form> + +<script> +function submitForm() { + SpecialPowers.wrap(passField).setUserInput("notifyp1"); + form.submit(); +} + +window.onload = submitForm; +var form = document.getElementById("form"); +var passField = document.getElementById("pass"); + +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/browser/subtst_notifications_8.html b/toolkit/components/passwordmgr/test/browser/subtst_notifications_8.html new file mode 100644 index 0000000000..7455d15d90 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/subtst_notifications_8.html @@ -0,0 +1,29 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Subtest for Login Manager notifications</title> +</head> +<body> +<h2>Subtest 8</h2> +<form id="form" action="formsubmit.sjs"> + <input id="user" name="user"> + <input id="pass" name="pass" type="password"> + <button type='submit'>Submit</button> +</form> + +<script> +function submitForm() { + SpecialPowers.wrap(userField).setUserInput("notifyu1"); + SpecialPowers.wrap(passField).setUserInput("pass2"); + form.submit(); +} + +window.onload = submitForm; +var form = document.getElementById("form"); +var userField = document.getElementById("user"); +var passField = document.getElementById("pass"); + +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/browser/subtst_notifications_9.html b/toolkit/components/passwordmgr/test/browser/subtst_notifications_9.html new file mode 100644 index 0000000000..404b4f9a26 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/subtst_notifications_9.html @@ -0,0 +1,29 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Subtest for Login Manager notifications</title> +</head> +<body> +<h2>Subtest 9</h2> +<form id="form" action="formsubmit.sjs"> + <input id="user" name="user"> + <input id="pass" name="pass" type="password"> + <button type='submit'>Submit</button> +</form> + +<script> +function submitForm() { + SpecialPowers.wrap(userField).setUserInput(""); + SpecialPowers.wrap(passField).setUserInput("pass2"); + form.submit(); +} + +window.onload = submitForm; +var form = document.getElementById("form"); +var userField = document.getElementById("user"); +var passField = document.getElementById("pass"); + +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/browser/subtst_notifications_change_p.html b/toolkit/components/passwordmgr/test/browser/subtst_notifications_change_p.html new file mode 100644 index 0000000000..8f52fe9682 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/subtst_notifications_change_p.html @@ -0,0 +1,32 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Subtest for Login Manager notifications</title> +</head> +<body> +<h2>Change password</h2> +<form id="form" action="formsubmit.sjs"> + <input id="pass_current" name="pass_current" type="password" value="notifyp1"> + <input id="pass" name="pass" type="password"> + <input id="pass_confirm" name="pass_confirm" type="password"> + <button type='submit'>Submit</button> +</form> + +<script> +function submitForm() { + SpecialPowers.wrap(passField).setUserInput("pass2"); + SpecialPowers.wrap(passConfirmField).setUserInput("pass2"); + + form.submit(); +} + +window.onload = submitForm; +var form = document.getElementById("form"); +var userField = document.getElementById("user"); +var passField = document.getElementById("pass"); +var passConfirmField = document.getElementById("pass_confirm"); + +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/browser/subtst_privbrowsing_1.html b/toolkit/components/passwordmgr/test/browser/subtst_privbrowsing_1.html new file mode 100644 index 0000000000..2ef067ea43 --- /dev/null +++ b/toolkit/components/passwordmgr/test/browser/subtst_privbrowsing_1.html @@ -0,0 +1,16 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Test Login Manager notifications</title> +</head> +<body> +<h2>Test Login Manager notifications</h2> + +<form id="form" action="formsubmit.sjs"> + <input id="user" name="user" type="text"> + <input id="pass" name="pass" type="password"> + <button type='submit'>Submit</button> +</form> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/formsubmit.sjs b/toolkit/components/passwordmgr/test/formsubmit.sjs new file mode 100644 index 0000000000..f519234d36 --- /dev/null +++ b/toolkit/components/passwordmgr/test/formsubmit.sjs @@ -0,0 +1,37 @@ +function handleRequest(request, response) { + try { + reallyHandleRequest(request, response); + } catch (e) { + response.setStatusLine("1.0", 200, "AlmostOK"); + response.write("Error handling request: " + e); + } +} + +function reallyHandleRequest(request, response) { + let match; + + // XXX I bet this doesn't work for POST requests. + let query = request.queryString; + + let user = null, + pass = null; + // user=xxx + match = /user(?:name)?=([^&]*)/.exec(query); + if (match) { + user = match[1]; + } + + // pass=xxx + match = /pass(?:word)?=([^&]*)/.exec(query); + if (match) { + pass = match[1]; + } + + response.setStatusLine("1.0", 200, "OK"); + + response.setHeader("Content-Type", "application/xhtml+xml", false); + response.write("<html xmlns='http://www.w3.org/1999/xhtml'>"); + response.write("<p>User: <span id='user'>" + user + "</span></p>\n"); + response.write("<p>Pass: <span id='pass'>" + pass + "</span></p>\n"); + response.write("</html>"); +} diff --git a/toolkit/components/passwordmgr/test/mochitest/.eslintrc.js b/toolkit/components/passwordmgr/test/mochitest/.eslintrc.js new file mode 100644 index 0000000000..beb8ec4738 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/.eslintrc.js @@ -0,0 +1,17 @@ +"use strict"; + +module.exports = { + globals: { + promptDone: true, + startTest: true, + // Make no-undef happy with our runInParent mixed environments since you + // can't indicate a single function is a new env. + assert: true, + addMessageListener: true, + sendAsyncMessage: true, + Assert: true, + }, + rules: { + "no-var": "off", + }, +}; diff --git a/toolkit/components/passwordmgr/test/mochitest/auth2/authenticate.sjs b/toolkit/components/passwordmgr/test/mochitest/auth2/authenticate.sjs new file mode 100644 index 0000000000..bc11bb29f8 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/auth2/authenticate.sjs @@ -0,0 +1,216 @@ +function handleRequest(request, response) { + try { + reallyHandleRequest(request, response); + } catch (e) { + response.setStatusLine("1.0", 200, "AlmostOK"); + response.write("Error handling request: " + e); + } +} + +function reallyHandleRequest(request, response) { + let match; + let requestAuth = true, + requestProxyAuth = true; + + // Allow the caller to drive how authentication is processed via the query. + // Eg, http://localhost:8888/authenticate.sjs?user=foo&realm=bar + // The extra ? allows the user/pass/realm checks to succeed if the name is + // at the beginning of the query string. + let query = "?" + request.queryString; + + let expected_user = "", + expected_pass = "", + realm = "mochitest"; + let proxy_expected_user = "", + proxy_expected_pass = "", + proxy_realm = "mochi-proxy"; + let huge = false, + plugin = false, + anonymous = false; + let authHeaderCount = 1; + // user=xxx + match = /[^_]user=([^&]*)/.exec(query); + if (match) { + expected_user = match[1]; + } + + // pass=xxx + match = /[^_]pass=([^&]*)/.exec(query); + if (match) { + expected_pass = match[1]; + } + + // realm=xxx + match = /[^_]realm=([^&]*)/.exec(query); + if (match) { + realm = match[1]; + } + + // proxy_user=xxx + match = /proxy_user=([^&]*)/.exec(query); + if (match) { + proxy_expected_user = match[1]; + } + + // proxy_pass=xxx + match = /proxy_pass=([^&]*)/.exec(query); + if (match) { + proxy_expected_pass = match[1]; + } + + // proxy_realm=xxx + match = /proxy_realm=([^&]*)/.exec(query); + if (match) { + proxy_realm = match[1]; + } + + // huge=1 + match = /huge=1/.exec(query); + if (match) { + huge = true; + } + + // plugin=1 + match = /plugin=1/.exec(query); + if (match) { + plugin = true; + } + + // multiple=1 + match = /multiple=([^&]*)/.exec(query); + if (match) { + authHeaderCount = match[1] + 0; + } + + // anonymous=1 + match = /anonymous=1/.exec(query); + if (match) { + anonymous = true; + } + + // Look for an authentication header, if any, in the request. + // + // EG: Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ== + // + // This test only supports Basic auth. The value sent by the client is + // "username:password", obscured with base64 encoding. + + let actual_user = "", + actual_pass = "", + authHeader, + authPresent = false; + if (request.hasHeader("Authorization")) { + authPresent = true; + authHeader = request.getHeader("Authorization"); + match = /Basic (.+)/.exec(authHeader); + if (match.length != 2) { + throw new Error("Couldn't parse auth header: " + authHeader); + } + + let userpass = atob(match[1]); + match = /(.*):(.*)/.exec(userpass); + if (match.length != 3) { + throw new Error("Couldn't decode auth header: " + userpass); + } + actual_user = match[1]; + actual_pass = match[2]; + } + + let proxy_actual_user = "", + proxy_actual_pass = ""; + if (request.hasHeader("Proxy-Authorization")) { + authHeader = request.getHeader("Proxy-Authorization"); + match = /Basic (.+)/.exec(authHeader); + if (match.length != 2) { + throw new Error("Couldn't parse auth header: " + authHeader); + } + + let userpass = atob(match[1]); + match = /(.*):(.*)/.exec(userpass); + if (match.length != 3) { + throw new Error("Couldn't decode auth header: " + userpass); + } + proxy_actual_user = match[1]; + proxy_actual_pass = match[2]; + } + + // Don't request authentication if the credentials we got were what we + // expected. + if (expected_user == actual_user && expected_pass == actual_pass) { + requestAuth = false; + } + if ( + proxy_expected_user == proxy_actual_user && + proxy_expected_pass == proxy_actual_pass + ) { + requestProxyAuth = false; + } + + if (anonymous) { + if (authPresent) { + response.setStatusLine( + "1.0", + 400, + "Unexpected authorization header found" + ); + } else { + response.setStatusLine("1.0", 200, "Authorization header not found"); + } + } else if (requestProxyAuth) { + response.setStatusLine("1.0", 407, "Proxy authentication required"); + for (let i = 0; i < authHeaderCount; ++i) { + response.setHeader( + "Proxy-Authenticate", + 'basic realm="' + proxy_realm + '"', + true + ); + } + } else if (requestAuth) { + response.setStatusLine("1.0", 401, "Authentication required"); + for (let i = 0; i < authHeaderCount; ++i) { + response.setHeader( + "WWW-Authenticate", + 'basic realm="' + realm + '"', + true + ); + } + } else { + response.setStatusLine("1.0", 200, "OK"); + } + + response.setHeader("Content-Type", "application/xhtml+xml", false); + response.write("<html xmlns='http://www.w3.org/1999/xhtml'>"); + response.write( + "<p>Login: <span id='ok'>" + + (requestAuth ? "FAIL" : "PASS") + + "</span></p>\n" + ); + response.write( + "<p>Proxy: <span id='proxy'>" + + (requestProxyAuth ? "FAIL" : "PASS") + + "</span></p>\n" + ); + response.write("<p>Auth: <span id='auth'>" + authHeader + "</span></p>\n"); + response.write("<p>User: <span id='user'>" + actual_user + "</span></p>\n"); + response.write("<p>Pass: <span id='pass'>" + actual_pass + "</span></p>\n"); + + if (huge) { + response.write("<div style='display: none'>"); + for (let i = 0; i < 100000; i++) { + response.write("123456789\n"); + } + response.write("</div>"); + response.write( + "<span id='footnote'>This is a footnote after the huge content fill</span>" + ); + } + + if (plugin) { + response.write( + "<embed id='embedtest' style='width: 400px; height: 100px;' " + + "type='application/x-test'></embed>\n" + ); + } + + response.write("</html>"); +} diff --git a/toolkit/components/passwordmgr/test/mochitest/chrome_timeout.js b/toolkit/components/passwordmgr/test/mochitest/chrome_timeout.js new file mode 100644 index 0000000000..25a797e1d2 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/chrome_timeout.js @@ -0,0 +1,14 @@ +/* eslint-env mozilla/chrome-script */ + +const timer = Cc["@mozilla.org/timer;1"].createInstance(Ci.nsITimer); +addMessageListener("setTimeout", msg => { + timer.init( + _ => { + sendAsyncMessage("timeout"); + }, + msg.delay, + Ci.nsITimer.TYPE_ONE_SHOT + ); +}); + +sendAsyncMessage("ready"); diff --git a/toolkit/components/passwordmgr/test/mochitest/file_history_back.html b/toolkit/components/passwordmgr/test/mochitest/file_history_back.html new file mode 100644 index 0000000000..4e3e071a71 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/file_history_back.html @@ -0,0 +1,14 @@ +<!DOCTYPE html> +<html> + <head> + <meta charset="utf-8"> + </head> + <body> + This page should navigate back in history upon load. + <script> + window.onload = function goBack() { + window.history.back(); + }; + </script> + </body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/form_basic_bfcache.html b/toolkit/components/passwordmgr/test/mochitest/form_basic_bfcache.html new file mode 100644 index 0000000000..e91a88d599 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/form_basic_bfcache.html @@ -0,0 +1,61 @@ +<!DOCTYPE html> +<html> + <head> + <meta charset="utf-8"> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script> + var bc = new BroadcastChannel("form_basic_bfcache"); + bc.onmessage = function(event) { + if (event.data == "nextpage") { + location.href = "https://example.org/tests/toolkit/components/passwordmgr/test/mochitest/file_history_back.html"; + } else if (event.data == "close") { + bc.postMessage("closed"); + bc.close(); + window.close(); + SimpleTest.finish(); + } + } + + function is(val1, val2, msg) { + bc.postMessage({type: "is", value1: val1, value2: val2, message: msg}); + } + + function ok(val, msg) { + bc.postMessage({type: "ok", value: val, message: msg}); + } + </script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <script> + // Need to use waitForExplicitFinish also in this support file to + // stop SimpleTest complaining about missing checks. + // pwmgr_common.js uses internally some helper methods from SimpleTest. + SimpleTest.waitForExplicitFinish(); + + runChecksAfterCommonInit(); + + onpageshow = async function(pageShow) { + if (!pageShow.persisted) { + // This is the initial page load. + let loginAddedPromise = promiseStorageChanged(["addLogin"]); + let origin = window.location.origin; + await addLoginsInParent([origin, "", null, "autofilled", "pass1", "", ""]); + await loginAddedPromise; + } else { + await promiseFormsProcessedInSameProcess(); + let uname = document.getElementById("form-basic-username"); + let pword = document.getElementById("form-basic-password"); + checkLoginForm(uname, "autofilled", pword, "pass1"); + } + + bc.postMessage({type: pageShow.type, persisted: pageShow.persisted}); + } + </script> + </head> + <body> + <form id="form-basic"> + <input id="form-basic-username" name="username"> + <input id="form-basic-password" name="password" type="password"> + <input id="form-basic-submit" type="submit"> + </form> + </body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/form_basic_shadow_DOM_both_fields_together_in_a_shadow_root.html b/toolkit/components/passwordmgr/test/mochitest/form_basic_shadow_DOM_both_fields_together_in_a_shadow_root.html new file mode 100644 index 0000000000..ab558c4955 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/form_basic_shadow_DOM_both_fields_together_in_a_shadow_root.html @@ -0,0 +1,31 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!-- Simple form with username and password fields together in a shadow root with a <form> ancestor --> +<!-- This form is based off of toolkit/components/passwordmgr/test/browser/form_basic.html --> +<form id="both-fields-together-in-a-shadow-root"> + <!-- username and password inputs generated programmatically below --> + <input id="submit" type="submit"> +</form> + +<script> + const form = document.getElementById("both-fields-together-in-a-shadow-root"); + const submitButton = document.getElementById("submit"); + const wrapper = document.createElement("span"); + wrapper.id = "wrapper-un-and-pw"; + const shadow = wrapper.attachShadow({mode: "closed"}); + const fields = ["username", "password"]; + for (let field of fields) { + const inputEle = document.createElement("input"); + inputEle.id = field; + inputEle.name = field; + if (field === "password") { + inputEle.type = field; + } + shadow.append(inputEle); + } + submitButton.before(wrapper); +</script> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/mochitest/form_basic_shadow_DOM_each_field_in_its_own_shadow_root.html b/toolkit/components/passwordmgr/test/mochitest/form_basic_shadow_DOM_each_field_in_its_own_shadow_root.html new file mode 100644 index 0000000000..19edd12330 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/form_basic_shadow_DOM_each_field_in_its_own_shadow_root.html @@ -0,0 +1,31 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!-- Simple form with username and password fields each in their own shadow root --> +<!-- This form is based off of toolkit/components/passwordmgr/test/browser/form_basic.html --> +<form id="each-field-its-own-shadow"> + <!-- username and password inputs generated programmatically below --> + <input id="submit" type="submit"> +</form> + +<script> + const form = document.getElementById("each-field-its-own-shadow"); + const submitButton = document.getElementById("submit"); + const fields = ["username", "password"]; + for (let field of fields) { + const inputEle = document.createElement("input"); + inputEle.id = field; + inputEle.name = field; + if (field === "password") { + inputEle.type = field; + } + const wrapper = document.createElement("span"); + wrapper.id = `wrapper-${field}`; + const shadow = wrapper.attachShadow({mode: "closed"}); + shadow.append(inputEle); + submitButton.before(wrapper); + } +</script> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/mochitest/form_basic_shadow_DOM_form_and_fields_together_in_a_shadow_root.html b/toolkit/components/passwordmgr/test/mochitest/form_basic_shadow_DOM_form_and_fields_together_in_a_shadow_root.html new file mode 100644 index 0000000000..225fb4e7f8 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/form_basic_shadow_DOM_form_and_fields_together_in_a_shadow_root.html @@ -0,0 +1,33 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!-- Simple form with form, username and password fields together in a shadow root --> +<!-- This form is based off of toolkit/components/passwordmgr/test/browser/form_basic.html --> +<span id="wrapper"> + <!-- form and all inputs generated programmatically below --> +</span> + +<script> + const wrapper = document.getElementById("wrapper"); + const shadow = wrapper.attachShadow({mode: "closed"}); + const form = document.createElement("form"); + form.id = "form-and-fields-in-a-shadow-root"; + const submitButton = document.createElement("input"); + submitButton.id = "submit"; + submitButton.type = "submit"; + shadow.append(form); + form.append(submitButton); + const fields = ["username", "password"]; + for (let field of fields) { + const inputEle = document.createElement("input"); + inputEle.id = field; + inputEle.name = field; + if (field === "password") { + inputEle.type = field; + } + submitButton.before(inputEle); + } +</script> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/mochitest/form_nested_shadow_DOM_both_fields_together_in_a_shadow_root.html b/toolkit/components/passwordmgr/test/mochitest/form_nested_shadow_DOM_both_fields_together_in_a_shadow_root.html new file mode 100644 index 0000000000..876c7d3b85 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/form_nested_shadow_DOM_both_fields_together_in_a_shadow_root.html @@ -0,0 +1,34 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!-- Simple form with username and password fields together in nested shadow roots --> +<!-- This form is based off of toolkit/components/passwordmgr/test/browser/form_basic.html --> +<form id="each-field-its-own-shadow"> + <span id="outer-wrapper"> + <!-- username and password inputs generated programmatically below --> + </span> + <input id="submit" type="submit"> +</form> + +<script> + const submitButton = document.getElementById("submit"); + const innerWrapper = document.createElement("span"); + innerWrapper.id = "inner-wrapper"; + const innerShadow = innerWrapper.attachShadow({mode: "closed"}); + const outerWrapper = document.getElementById("outer-wrapper"); + const outerShadow = outerWrapper.attachShadow({mode: "closed"}); + const fields = ["username", "password"]; + for (let field of fields) { + const inputEle = document.createElement("input"); + inputEle.id = field; + inputEle.name = field; + if (field === "password") { + inputEle.type = field; + } + innerShadow.append(inputEle); + } + outerShadow.append(innerWrapper); +</script> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/mochitest/form_nested_shadow_DOM_each_field_in_its_own_shadow_root.html b/toolkit/components/passwordmgr/test/mochitest/form_nested_shadow_DOM_each_field_in_its_own_shadow_root.html new file mode 100644 index 0000000000..9a844f236a --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/form_nested_shadow_DOM_each_field_in_its_own_shadow_root.html @@ -0,0 +1,38 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!-- Simple form with username and password fields each in their own nested shadow roots --> +<!-- This form is based off of toolkit/components/passwordmgr/test/browser/form_basic.html --> +<form id="each-field-its-own-shadow"> + <span id="outer-wrapper-username"> + <!-- username input generated programmatically below --> + </span> + <span id="outer-wrapper-password"> + <!-- password input generated programmatically below --> + </span> + <input id="submit" type="submit"> +</form> + +<script> + const submitButton = document.getElementById("submit"); + const fields = ["username", "password"]; + for (let field of fields) { + const inputEle = document.createElement("input"); + inputEle.id = field; + inputEle.name = field; + if (field === "password") { + inputEle.type = field; + } + const wrapper = document.createElement("span"); + wrapper.id = `wrapper-${field}`; + const shadow = wrapper.attachShadow({mode: "closed"}); + shadow.append(inputEle); + + const outerWrapper = document.getElementById(`outer-wrapper-${field}`); + const outerShadow = outerWrapper.attachShadow({mode: "closed"}); + outerShadow.append(wrapper); + } +</script> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/mochitest/form_nested_shadow_DOM_form_and_fields_together_in_a_shadow_root.html b/toolkit/components/passwordmgr/test/mochitest/form_nested_shadow_DOM_form_and_fields_together_in_a_shadow_root.html new file mode 100644 index 0000000000..79481c4a3a --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/form_nested_shadow_DOM_form_and_fields_together_in_a_shadow_root.html @@ -0,0 +1,37 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!-- Simple form with form, username and password fields together in nested shadow roots --> +<!-- This form is based off of toolkit/components/passwordmgr/test/browser/form_basic.html --> +<span id="outer-wrapper"> + <!-- form and all inputs generated programmatically below --> +</span> + +<script> + const outerWrapper = document.getElementById("outer-wrapper"); + const innerWrapper = document.createElement("span"); + innerWrapper.id = "inner-wrapper"; + const innerShadow = innerWrapper.attachShadow({mode: "closed"}); + const outerShadow = outerWrapper.attachShadow({mode: "closed"}); + const form = document.createElement("form"); + form.id = "form-and-fields-in-a-shadow-root"; + const submitButton = document.createElement("input"); + submitButton.id = "submit"; + submitButton.type = "submit"; + innerShadow.append(form); + form.append(submitButton); + const fields = ["username", "password"]; + for (let field of fields) { + const inputEle = document.createElement("input"); + inputEle.id = field; + inputEle.name = field; + if (field === "password") { + inputEle.type = field; + } + submitButton.before(inputEle); + } + outerShadow.append(innerWrapper); +</script> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/mochitest/formless_basic_shadow_DOM_both_fields_together_in_a_shadow_root.html b/toolkit/components/passwordmgr/test/mochitest/formless_basic_shadow_DOM_both_fields_together_in_a_shadow_root.html new file mode 100644 index 0000000000..ed261af9aa --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/formless_basic_shadow_DOM_both_fields_together_in_a_shadow_root.html @@ -0,0 +1,28 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!-- Simple form with username and password fields together in a shadow root --> +<!-- This form is based off of toolkit/components/passwordmgr/test/browser/formless_basic.html --> +<!-- username and password inputs generated programmatically below --> +<input id="submit" type="submit"> + +<script> + const submitButton = document.getElementById("submit"); + const wrapper = document.createElement("span"); + wrapper.id = "wrapper-un-and-pw"; + const shadow = wrapper.attachShadow({mode: "closed"}); + const fields = ["username", "password"]; + for (let field of fields) { + const inputEle = document.createElement("input"); + inputEle.id = field; + inputEle.name = field; + if (field === "password") { + inputEle.type = field; + } + shadow.append(inputEle); + } + submitButton.before(wrapper); +</script> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/mochitest/formless_basic_shadow_DOM_each_field_in_its_own_shadow_root.html b/toolkit/components/passwordmgr/test/mochitest/formless_basic_shadow_DOM_each_field_in_its_own_shadow_root.html new file mode 100644 index 0000000000..b0ea0dc486 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/formless_basic_shadow_DOM_each_field_in_its_own_shadow_root.html @@ -0,0 +1,28 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!-- Simple form with username and password fields each in their own shadow root --> +<!-- This form is based off of toolkit/components/passwordmgr/test/browser/formless_basic.html --> +<!-- username and password inputs generated programmatically below --> +<input id="submit" type="submit"> + +<script> + const submitButton = document.getElementById("submit"); + const fields = ["username", "password"]; + for (let field of fields) { + const inputEle = document.createElement("input"); + inputEle.id = field; + inputEle.name = field; + if (field === "password") { + inputEle.type = field; + } + const wrapper = document.createElement("span"); + wrapper.id = `wrapper-${field}`; + const shadow = wrapper.attachShadow({mode: "closed"}); + shadow.append(inputEle); + submitButton.before(wrapper); + } +</script> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/mochitest/formless_basic_shadow_DOM_form_and_fields_together_in_a_shadow_root.html b/toolkit/components/passwordmgr/test/mochitest/formless_basic_shadow_DOM_form_and_fields_together_in_a_shadow_root.html new file mode 100644 index 0000000000..a93e5ea752 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/formless_basic_shadow_DOM_form_and_fields_together_in_a_shadow_root.html @@ -0,0 +1,30 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!-- Simple form with form, username and password fields together in a shadow root --> +<!-- This form is based off of toolkit/components/passwordmgr/test/browser/formless_basic.html --> +<span id="wrapper"> +</span> +<!-- username, password and submit inputs generated programmatically below --> + +<script> + const wrapper = document.getElementById("wrapper"); + const shadow = wrapper.attachShadow({mode: "closed"}); + const fields = ["username", "password"]; + for (let field of fields) { + const inputEle = document.createElement("input"); + inputEle.id = field; + inputEle.name = field; + if (field === "password") { + inputEle.type = field; + } + shadow.append(inputEle); + } + const submitButton = document.createElement("input"); + submitButton.id = "submit"; + submitButton.type = "submit"; + shadow.append(submitButton); +</script> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/mochitest/mochitest.ini b/toolkit/components/passwordmgr/test/mochitest/mochitest.ini new file mode 100644 index 0000000000..feb825d412 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/mochitest.ini @@ -0,0 +1,267 @@ +[DEFAULT] +prefs = + signon.rememberSignons=true + signon.autofillForms.http=true + signon.showAutoCompleteFooter=true + signon.showAutoCompleteImport="" + signon.testOnlyUserHasInteractedByPrefValue=true + signon.testOnlyUserHasInteractedWithDocument=true + network.auth.non-web-content-triggered-resources-http-auth-allow=true + # signon.relatedRealms.enabled pref needed until Bug 1699698 lands + signon.relatedRealms.enabled=true + signon.usernameOnlyForm.enabled=true + signon.usernameOnlyForm.lookupThreshold=100 + +support-files = + ../../../prompts/test/chromeScript.js + !/toolkit/components/prompts/test/prompt_common.js + ../../../satchel/test/parent_utils.js + !/toolkit/components/satchel/test/satchel_common.js + ../blank.html + ../browser/form_autofocus_js.html + ../browser/form_basic.html + ../browser/formless_basic.html + ../browser/form_cross_origin_secure_action.html + ../browser/form_same_origin_action.html + auth2/authenticate.sjs + file_history_back.html + form_basic_shadow_DOM_both_fields_together_in_a_shadow_root.html + form_basic_shadow_DOM_each_field_in_its_own_shadow_root.html + form_basic_shadow_DOM_form_and_fields_together_in_a_shadow_root.html + form_nested_shadow_DOM_both_fields_together_in_a_shadow_root.html + form_nested_shadow_DOM_each_field_in_its_own_shadow_root.html + form_nested_shadow_DOM_form_and_fields_together_in_a_shadow_root.html + formless_basic_shadow_DOM_both_fields_together_in_a_shadow_root.html + formless_basic_shadow_DOM_each_field_in_its_own_shadow_root.html + formless_basic_shadow_DOM_form_and_fields_together_in_a_shadow_root.html + multiple_forms_shadow_DOM_all_known_variants.html + pwmgr_common.js + pwmgr_common_parent.js + ../authenticate.sjs +skip-if = toolkit == 'android' # Don't run on GeckoView + +# Note: new tests should use scheme = https unless they have a specific reason not to + +[test_autocomplete_autofill_related_realms_no_dupes.html] +skip-if = + fission && xorigin # Bug 1716412 - New fission platform triage +scheme = https +[test_autocomplete_basic_form.html] +skip-if = + toolkit == 'android' # autocomplete + debug && (os == 'linux' || os == 'win') # Bug 1541945 + os == 'linux' && tsan # Bug 1590928 + fission && xorigin && (!debug || os == "mac") # Bug 1716412 - New fission platform triage +scheme = https +[test_autocomplete_basic_form_insecure.html] +skip-if = + toolkit == 'android' # autocomplete + os == 'linux' # bug 1325778 + fission && xorigin && (os == "win" || os == "mac") # Bug 1716412 - New fission platform triage + win11_2009 # Bug 1781648 +[test_autocomplete_basic_form_formActionOrigin.html] +skip-if = toolkit == 'android' # android:autocomplete. +scheme = https +[test_autocomplete_basic_form_related_realms.html] +skip-if = + fission && xorigin # Bug 1716412 - New fission platform triage +scheme = https +[test_autocomplete_basic_form_subdomain.html] +skip-if = toolkit == 'android' # android:autocomplete. +scheme = https +[test_autocomplete_hasBeenTypePassword.html] +scheme = https +skip-if = toolkit == 'android' # autocomplete +[test_autocomplete_highlight.html] +scheme = https +skip-if = toolkit == 'android' # autocomplete +[test_autocomplete_highlight_non_login.html] +scheme = https +skip-if = toolkit == 'android' # autocomplete +[test_autocomplete_highlight_username_only_form.html] +scheme = https +skip-if = toolkit == 'android' # autocomplete +[test_autocomplete_https_downgrade.html] +scheme = http # Tests downgrading +skip-if = + toolkit == 'android' # autocomplete + os == 'linux' && debug # Bug 1554959 + fission && xorigin # Bug 1716412 - New fission platform triage +[test_autocomplete_https_upgrade.html] +scheme = https +skip-if = verify || toolkit == 'android' || (os == 'linux' && debug) # autocomplete && Bug 1554959 for linux debug disable +[test_autocomplete_password_generation.html] +scheme = https +skip-if = xorigin || toolkit == 'android' # autocomplete +[test_autocomplete_password_generation_confirm.html] +scheme = https +skip-if = toolkit == 'android' # autocomplete +[test_autocomplete_password_open.html] +scheme = https +skip-if = toolkit == 'android' || verify # autocomplete +[test_autocomplete_sandboxed.html] +scheme = https +skip-if = toolkit == 'android' # autocomplete +[test_autocomplete_tab_between_fields.html] +scheme = https +skip-if = + xorigin || toolkit == 'android' # autocomplete +[test_autofill_autocomplete_types.html] +scheme = https +skip-if = toolkit == 'android' # bug 1533965 +[test_autofill_different_formActionOrigin.html] +scheme = https +skip-if = toolkit == 'android' # Bug 1259768 +[test_autofill_different_subdomain.html] +scheme = https +skip-if = + toolkit == 'android' # Bug 1259768 + http3 +[test_autofill_from_bfcache.html] +scheme = https +skip-if = toolkit == 'android' # bug 1527403 +support-files = form_basic_bfcache.html +[test_autofill_hasBeenTypePassword.html] +scheme = https +[test_autofill_highlight.html] +scheme = https +skip-if = toolkit == 'android' # Bug 1531185 +[test_autofill_highlight_empty_username.html] +scheme = https +[test_autofill_highlight_username_only_form.html] +scheme = https +[test_autofill_https_downgrade.html] +scheme = http # we need http to test handling of https logins on http forms +skip-if = + http3 +[test_autofill_https_upgrade.html] +skip-if = + toolkit == 'android' # Bug 1259768 + http3 +[test_autofill_sandboxed.html] +scheme = https +skip-if = toolkit == 'android' +[test_autofill_password-only.html] +[test_autofill_username-only.html] +[test_autofill_username-only_threshold.html] +[test_autofocus_js.html] +scheme = https +skip-if = toolkit == 'android' # autocomplete +[test_basic_form.html] +[test_basic_form_0pw.html] +[test_basic_form_1pw.html] +[test_basic_form_1pw_2.html] +[test_basic_form_2pw_1.html] +[test_basic_form_2pw_2.html] +[test_basic_form_3pw_1.html] +[test_basic_form_honor_autocomplete_off.html] +scheme = https +skip-if = xorigin || toolkit == 'android' # android:autocomplete. +[test_formless_submit_form_removal.html] +skip-if = + http3 +[test_formless_submit_form_removal_negative.html] +skip-if = + http3 +[test_password_field_autocomplete.html] +skip-if = toolkit == 'android' # android:autocomplete. +[test_insecure_form_field_no_saved_login.html] +skip-if = toolkit == 'android' # android:autocomplete. +[test_basic_form_html5.html] +[test_basic_form_pwevent.html] +skip-if = xorigin +[test_basic_form_pwonly.html] +[test_bug_627616.html] +skip-if = + toolkit == 'android' # Tests desktop prompts + http3 +[test_bug_776171.html] +[test_case_differences.html] +skip-if = toolkit == 'android' # autocomplete +scheme = https +[test_dismissed_doorhanger_in_shadow_DOM.html] +skip-if = toolkit == 'android' # Tests desktop prompt +scheme = https +[test_DOMInputPasswordAdded_fired_between_DOMContentLoaded_and_load_events.html] +scheme = https +support-files = + slow_image.sjs + slow_image.html +[test_form_action_1.html] +[test_form_action_2.html] +[test_form_action_javascript.html] +[test_formless_autofill.html] +skip-if = + xorigin + http3 +[test_formless_submit.html] +skip-if = + toolkit == 'android' && debug # bug 1397615 + http3 +[test_formless_submit_navigation.html] +skip-if = + toolkit == 'android' && debug # bug 1397615 + http3 +[test_formless_submit_navigation_negative.html] +skip-if = + toolkit == 'android' && debug # bug 1397615 + http3 +[test_formLike_rootElement_with_Shadow_DOM.html] +scheme = https +[test_input_events.html] +skip-if = xorigin +[test_input_events_for_identical_values.html] +[test_LoginManagerContent_passwordEditedOrGenerated.html] +scheme = https +skip-if = toolkit == 'android' # password generation +[test_primary_password.html] +scheme = https +skip-if = os != 'mac' || verify || xorigin # Tests desktop prompts and bug 1333264 +support-files = + chrome_timeout.js + subtst_primary_pass.html +[test_maxlength.html] +[test_munged_values.html] +scheme = https +skip-if = toolkit == 'android' # bug 1527403 +[test_one_doorhanger_per_un_pw.html] +scheme = https +skip-if = toolkit == 'android' # bug 1535505 +[test_onsubmit_value_change.html] +[test_passwords_in_type_password.html] +[test_prompt.html] +skip-if = os == "linux" || toolkit == 'android' # Tests desktop prompts +[test_prompt_async.html] +skip-if = + toolkit == 'android' # Tests desktop prompts + http3 +support-files = subtst_prompt_async.html +[test_prompt_http.html] +skip-if = + toolkit == 'android' # Tests desktop prompts + os == "linux" + fission && xorigin # Bug 1716412 - New fission platform triage +[test_prompt_noWindow.html] +skip-if = toolkit == 'android' # Tests desktop prompts. +[test_password_length.html] +scheme = https +skip-if = toolkit == 'android' # bug 1527403 +[test_prompt_promptAuth.html] +skip-if = os == "linux" || toolkit == 'android' # Tests desktop prompts +[test_prompt_promptAuth_proxy.html] +skip-if = os == "linux" || toolkit == 'android' # Tests desktop prompts +[test_recipe_login_fields.html] +skip-if = xorigin +[test_submit_without_field_modifications.html] +support-files = + subtst_prefilled_form.html +skip-if = + xorigin + http3 +[test_username_focus.html] +skip-if = xorigin || toolkit == 'android' # android:autocomplete. +[test_xhr.html] +skip-if = toolkit == 'android' # Tests desktop prompts +[test_xhr_2.html] +[test_autofill_tab_between_fields.html] +scheme = https diff --git a/toolkit/components/passwordmgr/test/mochitest/multiple_forms_shadow_DOM_all_known_variants.html b/toolkit/components/passwordmgr/test/mochitest/multiple_forms_shadow_DOM_all_known_variants.html new file mode 100644 index 0000000000..5ba547e671 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/multiple_forms_shadow_DOM_all_known_variants.html @@ -0,0 +1,111 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!-- Page with multiple forms containing the following Shadow DOM variants: --> +<!-- Case 1: Each field (username and password) in its own shadow root --> +<!-- Case 2: Both fields (username and password) together in a shadow root with a form ancestor --> +<!-- Case 3: Form and fields (username and password) together in a shadow root --> +<span id="outer-wrapper"> +</span> + +<script> + const outerWrapper = document.getElementById("outer-wrapper"); + const outerShadow = outerWrapper.attachShadow({mode: "closed"}); + + function makeFormlessOuterForm(scenario) { + const fields = ["username", "password"]; + for (let field of fields) { + const inputEle = document.createElement("input"); + inputEle.id = `${field}-${scenario}`; + inputEle.name = `${field}-${scenario}`; + if (field === "password") { + inputEle.type = field; + } + outerShadow.append(inputEle); + } + const submitButton = document.createElement("input"); + submitButton.id = `submit-${scenario}`; + submitButton.type = "submit"; + outerShadow.append(submitButton); + } + + function makeFormEachFieldInItsOwnShadowRoot(scenario) { + const form = document.createElement("form"); + form.id = scenario; + const submitButton = document.createElement("input"); + submitButton.id = `submit-${scenario}`; + submitButton.type = "submit"; + form.append(submitButton); + const fields = ["username", "password"]; + for (let field of fields) { + const inputEle = document.createElement("input"); + inputEle.id = `${field}-${scenario}`; + inputEle.name = `${field}-${scenario}`; + if (field === "password") { + inputEle.type = field; + } + const wrapper = document.createElement("span"); + wrapper.id = `wrapper-${field}-${scenario}`; + const shadow = wrapper.attachShadow({mode: "closed"}); + shadow.append(inputEle); + submitButton.before(wrapper); + } + outerShadow.append(form); + } + + function makeFormBothFieldsTogetherInAShadowRoot(scenario) { + const form = document.createElement("form"); + form.id = scenario; + const submitButton = document.createElement("input"); + submitButton.id = `submit-${scenario}`; + submitButton.type = "submit"; + form.append(submitButton); + const wrapper = document.createElement("span"); + wrapper.id = `wrapper-${scenario}`; + const shadow = wrapper.attachShadow({mode: "closed"}); + const fields = ["username", "password"]; + for (let field of fields) { + const inputEle = document.createElement("input"); + inputEle.id = `${field}-${scenario}`; + inputEle.name = `${field}-${scenario}`; + if (field === "password") { + inputEle.type = field; + } + shadow.append(inputEle); + } + submitButton.before(wrapper); + outerShadow.append(form); + } + + function makeFormFormAndFieldsTogetherInAShadowRoot(scenario) { + const wrapper = document.createElement("span"); + wrapper.id = `wrapper-${scenario}`; + const shadow = wrapper.attachShadow({mode: "closed"}); + const form = document.createElement("form"); + form.id = scenario; + shadow.append(form); + const submitButton = document.createElement("input"); + submitButton.id = `submit-${scenario}`; + submitButton.type = "submit"; + form.append(submitButton); + const fields = ["username", "password"]; + for (let field of fields) { + const inputEle = document.createElement("input"); + inputEle.id = field; + inputEle.name = field; + if (field === "password") { + inputEle.type = field; + } + submitButton.before(inputEle); + } + outerShadow.append(wrapper); + } + + makeFormlessOuterForm("formless-case-2"); + makeFormEachFieldInItsOwnShadowRoot("form-case-1"); + makeFormBothFieldsTogetherInAShadowRoot("form-case-2"); + makeFormFormAndFieldsTogetherInAShadowRoot("form-case-3"); +</script> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/mochitest/pwmgr_common.js b/toolkit/components/passwordmgr/test/mochitest/pwmgr_common.js new file mode 100644 index 0000000000..81a31b0f4e --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/pwmgr_common.js @@ -0,0 +1,1063 @@ +/** + * Helpers for password manager mochitest-plain tests. + */ + +/* import-globals-from ../../../../../toolkit/components/satchel/test/satchel_common.js */ + +const { LoginTestUtils } = SpecialPowers.ChromeUtils.importESModule( + "resource://testing-common/LoginTestUtils.sys.mjs" +); +const Services = SpecialPowers.Services; + +// Setup LoginTestUtils to report assertions to the mochitest harness. +LoginTestUtils.setAssertReporter( + SpecialPowers.wrapCallback((err, message, stack) => { + SimpleTest.record(!err, err ? err.message : message, null, stack); + }) +); + +const { LoginHelper } = SpecialPowers.ChromeUtils.importESModule( + "resource://gre/modules/LoginHelper.sys.mjs" +); + +const { LENGTH: GENERATED_PASSWORD_LENGTH, REGEX: GENERATED_PASSWORD_REGEX } = + LoginTestUtils.generation; +const LOGIN_FIELD_UTILS = LoginTestUtils.loginField; +const TESTS_DIR = "/tests/toolkit/components/passwordmgr/test/"; + +// Depending on pref state we either show auth prompts as windows or on tab level. +let authPromptModalType = SpecialPowers.Services.prefs.getIntPref( + "prompts.modalType.httpAuth" +); + +// Whether the auth prompt is a commonDialog.xhtml or a TabModalPrompt +let authPromptIsCommonDialog = + authPromptModalType === SpecialPowers.Services.prompt.MODAL_TYPE_WINDOW || + (authPromptModalType === SpecialPowers.Services.prompt.MODAL_TYPE_TAB && + SpecialPowers.Services.prefs.getBoolPref( + "prompts.tabChromePromptSubDialog", + false + )); + +/** + * Recreate a DOM tree using the outerHTML to ensure that any event listeners + * and internal state for the elements are removed. + */ +function recreateTree(element) { + // eslint-disable-next-line no-unsanitized/property, no-self-assign + element.outerHTML = element.outerHTML; +} + +function _checkArrayValues(actualValues, expectedValues, msg) { + is( + actualValues.length, + expectedValues.length, + "Checking array values: " + msg + ); + for (let i = 0; i < expectedValues.length; i++) { + is(actualValues[i], expectedValues[i], msg + " Checking array entry #" + i); + } +} + +/** + * Check autocomplete popup results to ensure that expected + * *labels* are being shown correctly as items in the popup. + */ +function checkAutoCompleteResults(actualValues, expectedValues, hostname, msg) { + if (hostname === null) { + _checkArrayValues(actualValues, expectedValues, msg); + return; + } + + is( + typeof hostname, + "string", + "checkAutoCompleteResults: hostname must be a string" + ); + + isnot( + actualValues.length, + 0, + "There should be items in the autocomplete popup: " + + JSON.stringify(actualValues) + ); + + // Check the footer first. + let footerResult = actualValues[actualValues.length - 1]; + is(footerResult, "View Saved Logins", "the footer text is shown correctly"); + + if (actualValues.length == 1) { + is( + expectedValues.length, + 0, + "If only the footer is present then there should be no expectedValues" + ); + info("Only the footer is present in the popup"); + return; + } + + // Check the rest of the autocomplete item values. + _checkArrayValues(actualValues.slice(0, -1), expectedValues, msg); +} + +function getIframeBrowsingContext(window, iframeNumber = 0) { + let bc = SpecialPowers.wrap(window).windowGlobalChild.browsingContext; + return SpecialPowers.unwrap(bc.children[iframeNumber]); +} + +/** + * Set input values via setUserInput to emulate user input + * and distinguish them from declarative or script-assigned values + */ +function setUserInputValues(parentNode, selectorValues, userInput = true) { + for (let [selector, newValue] of Object.entries(selectorValues)) { + info(`setUserInputValues, selector: ${selector}`); + try { + let field = SpecialPowers.wrap(parentNode.querySelector(selector)); + if (field.value == newValue) { + // we don't get an input event if the new value == the old + field.value += "#"; + } + if (userInput) { + field.setUserInput(newValue); + } else { + field.value = newValue; + } + } catch (ex) { + info(ex.message); + info(ex.stack); + ok( + false, + `setUserInputValues: Couldn't set value of field: ${ex.message}` + ); + } + } +} + +/** + * @param {Function} [aFilterFn = undefined] Function to filter out irrelevant submissions. + * @return {Promise} resolving when a relevant form submission was processed. + */ +function getSubmitMessage(aFilterFn = undefined) { + info("getSubmitMessage"); + return new Promise((resolve, reject) => { + PWMGR_COMMON_PARENT.addMessageListener( + "formSubmissionProcessed", + function processed(...args) { + if (aFilterFn && !aFilterFn(...args)) { + // This submission isn't the one we're waiting for. + return; + } + + info("got formSubmissionProcessed"); + PWMGR_COMMON_PARENT.removeMessageListener( + "formSubmissionProcessed", + processed + ); + resolve(args[0]); + } + ); + }); +} + +/** + * @return {Promise} resolves when a onPasswordEditedOrGenerated message is received at the parent + */ +function getPasswordEditedMessage() { + info("getPasswordEditedMessage"); + return new Promise((resolve, reject) => { + PWMGR_COMMON_PARENT.addMessageListener( + "passwordEditedOrGenerated", + function listener(...args) { + info("got passwordEditedOrGenerated"); + PWMGR_COMMON_PARENT.removeMessageListener( + "passwordEditedOrGenerated", + listener + ); + resolve(args[0]); + } + ); + }); +} + +/** + * Create a login form and insert into contents dom (identified by id + * `content`). If the form (identified by its number) is already present in the + * dom, it gets replaced. + * + * @param {number} [num = 1] - number of the form, used as id, eg `form1` + * @param {string} [action = ""] - action attribute of the form + * @param {string} [autocomplete = null] - forms autocomplete attribute. Default is none + * @param {object} [username = {}] - object describing attributes to the username field: + * @param {string} [username.id = null] - id of the field + * @param {string} [username.name = "uname"] - name attribute + * @param {string} [username.type = "text"] - type of the field + * @param {string} [username.value = null] - initial value of the field + * @param {string} [username.autocomplete = null] - autocomplete attribute + * @param {object} [password = {}] - an object describing attributes to the password field. If falsy, do not create a password field + * @param {string} [password.id = null] - id of the field + * @param {string} [password.name = "pword"] - name attribute + * @param {string} [password.type = "password"] - type of the field + * @param {string} [password.value = null] - initial value of the field + * @param {string} [password.label = null] - if present, wrap field in a label containing its value + * @param {string} [password.autocomplete = null] - autocomplete attribute + * + * @return {HTMLDomElement} the form + */ +function createLoginForm({ + num = 1, + action = "", + autocomplete = null, + username = {}, + password = {}, +} = {}) { + username.id ||= null; + username.name ||= "uname"; + username.type ||= "text"; + username.value ||= null; + username.autocomplete ||= null; + password.id ||= null; + password.name ||= "pword"; + password.type ||= "password"; + password.value ||= null; + password.label ||= null; + password.autocomplete ||= null; + + info( + `Creating login form ${JSON.stringify({ num, action, username, password })}` + ); + + const form = document.createElement("form"); + form.id = `form${num}`; + form.action = action; + form.onsubmit = () => false; + + if (autocomplete != null) { + form.setAttribute("autocomplete", autocomplete); + } + + const usernameInput = document.createElement("input"); + if (username.id != null) { + usernameInput.id = username.id; + } + usernameInput.type = username.type; + usernameInput.name = username.name; + if (username.value != null) { + usernameInput.value = username.value; + } + if (username.autocomplete != null) { + usernameInput.setAttribute("autocomplete", username.autocomplete); + } + form.appendChild(usernameInput); + + if (password) { + const passwordInput = document.createElement("input"); + if (password.id != null) { + passwordInput.id = password.id; + } + passwordInput.type = password.type; + passwordInput.name = password.name; + if (password.value != null) { + passwordInput.value = password.value; + } + if (password.autocomplete != null) { + passwordInput.setAttribute("autocomplete", password.autocomplete); + } + if (password.label != null) { + const passwordLabel = document.createElement("label"); + passwordLabel.innerText = password.label; + passwordLabel.appendChild(passwordInput); + form.appendChild(passwordLabel); + } else { + form.appendChild(passwordInput); + } + } + + const submitButton = document.createElement("button"); + submitButton.type = "submit"; + submitButton.name = "submit"; + submitButton.innerText = "Submit"; + form.appendChild(submitButton); + + const content = document.getElementById("content"); + + const oldForm = document.getElementById(form.id); + if (oldForm) { + content.replaceChild(form, oldForm); + } else { + content.appendChild(form); + } + + return form; +} + +/** + * Check for expected username/password in form. + * @see `checkForm` below for a similar function. + */ +function checkLoginForm( + usernameField, + expectedUsername, + passwordField, + expectedPassword +) { + let formID = usernameField.parentNode.id; + is( + usernameField.value, + expectedUsername, + "Checking " + formID + " username is: " + expectedUsername + ); + is( + passwordField.value, + expectedPassword, + "Checking " + formID + " password is: " + expectedPassword + ); +} + +/** + * Check repeatedly for a while to see if a particular condition still applies. + * This function checks the return value of `condition` repeatedly until either + * the condition has a falsy return value, or `retryTimes` is exceeded. + */ + +function ensureCondition( + condition, + errorMsg = "Condition did not last.", + retryTimes = 10 +) { + return new Promise((resolve, reject) => { + let tries = 0; + let conditionFailed = false; + let interval = setInterval(async function () { + try { + const conditionPassed = await condition(); + conditionFailed ||= !conditionPassed; + } catch (e) { + ok(false, e + "\n" + e.stack); + conditionFailed = true; + } + if (conditionFailed || tries >= retryTimes) { + ok(!conditionFailed, errorMsg); + clearInterval(interval); + if (conditionFailed) { + reject(errorMsg); + } else { + resolve(); + } + } + tries++; + }, 100); + }); +} + +/** + * Wait a while to ensure login form stays filled with username and password + * @see `checkLoginForm` below for a similar function. + * @returns a promise, resolving when done + * + * TODO: eventually get rid of this time based check, and transition to an + * event based approach. See Bug 1811142. + * Filling happens by `_fillForm()` which can report it's decision and we can + * wait for it. One of the options is to have `didFillFormAsync()` from + * https://phabricator.services.mozilla.com/D167214#change-3njWgUgqswws + */ +function ensureLoginFormStaysFilledWith( + usernameField, + expectedUsername, + passwordField, + expectedPassword +) { + return ensureCondition(() => { + return ( + Object.is(usernameField.value, expectedUsername) && + Object.is(passwordField.value, expectedPassword) + ); + }, `Ensuring form ${usernameField.parentNode.id} stays filled with "${expectedUsername}:${expectedPassword}"`); +} + +function checkLoginFormInFrame( + iframeBC, + usernameFieldId, + expectedUsername, + passwordFieldId, + expectedPassword +) { + return SpecialPowers.spawn( + iframeBC, + [usernameFieldId, expectedUsername, passwordFieldId, expectedPassword], + ( + usernameFieldIdF, + expectedUsernameF, + passwordFieldIdF, + expectedPasswordF + ) => { + let usernameField = + this.content.document.getElementById(usernameFieldIdF); + let passwordField = + this.content.document.getElementById(passwordFieldIdF); + + let formID = usernameField.parentNode.id; + Assert.equal( + usernameField.value, + expectedUsernameF, + "Checking " + formID + " username is: " + expectedUsernameF + ); + Assert.equal( + passwordField.value, + expectedPasswordF, + "Checking " + formID + " password is: " + expectedPasswordF + ); + } + ); +} + +async function checkUnmodifiedFormInFrame(bc, formNum) { + return SpecialPowers.spawn(bc, [formNum], formNumF => { + let form = this.content.document.getElementById(`form${formNumF}`); + ok(form, "Locating form " + formNumF); + + for (var i = 0; i < form.elements.length; i++) { + var ele = form.elements[i]; + + // No point in checking form submit/reset buttons. + if (ele.type == "submit" || ele.type == "reset") { + continue; + } + + is( + ele.value, + ele.defaultValue, + "Test to default value of field " + ele.name + " in form " + formNumF + ); + } + }); +} + +/** + * Check a form for expected values even if it is in a different top level window + * or process. If an argument is null, a field's expected value will be the default + * value. + * + * Similar to the checkForm helper, but it works across (cross-origin) frames. + * + * <form id="form#"> + * checkLoginFormInFrameWithElementValues(#, "foo"); + */ +async function checkLoginFormInFrameWithElementValues( + browsingContext, + formNum, + ...values +) { + return SpecialPowers.spawn( + browsingContext, + [formNum, values], + function checkFormWithElementValues(formNumF, valuesF) { + let [val1F, val2F, val3F] = valuesF; + let doc = this.content.document; + let e; + let form = doc.getElementById("form" + formNumF); + ok(form, "Locating form " + formNumF); + + let numToCheck = arguments.length - 1; + + if (!numToCheck--) { + return; + } + e = form.elements[0]; + if (val1F == null) { + is( + e.value, + e.defaultValue, + "Test default value of field " + e.name + " in form " + formNumF + ); + } else { + is( + e.value, + val1F, + "Test value of field " + e.name + " in form " + formNumF + ); + } + + if (!numToCheck--) { + return; + } + + e = form.elements[1]; + if (val2F == null) { + is( + e.value, + e.defaultValue, + "Test default value of field " + e.name + " in form " + formNumF + ); + } else { + is( + e.value, + val2F, + "Test value of field " + e.name + " in form " + formNumF + ); + } + + if (!numToCheck--) { + return; + } + e = form.elements[2]; + if (val3F == null) { + is( + e.value, + e.defaultValue, + "Test default value of field " + e.name + " in form " + formNumF + ); + } else { + is( + e.value, + val3F, + "Test value of field " + e.name + " in form " + formNumF + ); + } + } + ); +} + +/** + * Check a form for expected values. If an argument is null, a field's + * expected value will be the default value. + * + * <form id="form#"> + * checkForm(#, "foo"); + */ +function checkForm(formNum, val1, val2, val3) { + var e, + form = document.getElementById("form" + formNum); + ok(form, "Locating form " + formNum); + + var numToCheck = arguments.length - 1; + + if (!numToCheck--) { + return; + } + e = form.elements[0]; + if (val1 == null) { + is( + e.value, + e.defaultValue, + "Test default value of field " + e.name + " in form " + formNum + ); + } else { + is(e.value, val1, "Test value of field " + e.name + " in form " + formNum); + } + + if (!numToCheck--) { + return; + } + e = form.elements[1]; + if (val2 == null) { + is( + e.value, + e.defaultValue, + "Test default value of field " + e.name + " in form " + formNum + ); + } else { + is(e.value, val2, "Test value of field " + e.name + " in form " + formNum); + } + + if (!numToCheck--) { + return; + } + e = form.elements[2]; + if (val3 == null) { + is( + e.value, + e.defaultValue, + "Test default value of field " + e.name + " in form " + formNum + ); + } else { + is(e.value, val3, "Test value of field " + e.name + " in form " + formNum); + } +} + +/** + * Check a form for unmodified values from when page was loaded. + * + * <form id="form#"> + * checkUnmodifiedForm(#); + */ +function checkUnmodifiedForm(formNum) { + var form = document.getElementById("form" + formNum); + ok(form, "Locating form " + formNum); + + for (var i = 0; i < form.elements.length; i++) { + var ele = form.elements[i]; + + // No point in checking form submit/reset buttons. + if (ele.type == "submit" || ele.type == "reset") { + continue; + } + + is( + ele.value, + ele.defaultValue, + "Test to default value of field " + ele.name + " in form " + formNum + ); + } +} + +/** + * Wait for the document to be ready and any existing password fields on + * forms to be processed. + * + * @param existingPasswordFieldsCount the number of password fields + * that begin on the test page. + */ +function registerRunTests(existingPasswordFieldsCount = 0) { + return new Promise(resolve => { + function onDOMContentLoaded() { + var form = document.createElement("form"); + form.id = "observerforcer"; + var username = document.createElement("input"); + username.name = "testuser"; + form.appendChild(username); + var password = document.createElement("input"); + password.name = "testpass"; + password.type = "password"; + form.appendChild(password); + + let foundForcer = false; + var observer = SpecialPowers.wrapCallback(function ( + subject, + topic, + data + ) { + if (data === "observerforcer") { + foundForcer = true; + } else { + existingPasswordFieldsCount--; + } + + if (!foundForcer || existingPasswordFieldsCount > 0) { + return; + } + + SpecialPowers.removeObserver(observer, "passwordmgr-processed-form"); + form.remove(); + SimpleTest.executeSoon(() => { + var runTestEvent = new Event("runTests"); + window.dispatchEvent(runTestEvent); + resolve(); + }); + }); + SpecialPowers.addObserver(observer, "passwordmgr-processed-form"); + + document.body.appendChild(form); + } + // We provide a general mechanism for our tests to know when they can + // safely run: we add a final form that we know will be filled in, wait + // for the login manager to tell us that it's filled in and then continue + // with the rest of the tests. + if ( + document.readyState == "complete" || + document.readyState == "interactive" + ) { + onDOMContentLoaded(); + } else { + window.addEventListener("DOMContentLoaded", onDOMContentLoaded); + } + }); +} + +function enablePrimaryPassword() { + setPrimaryPassword(true); +} + +function disablePrimaryPassword() { + setPrimaryPassword(false); +} + +function setPrimaryPassword(enable) { + PWMGR_COMMON_PARENT.sendAsyncMessage("setPrimaryPassword", { enable }); +} + +function isLoggedIn() { + return PWMGR_COMMON_PARENT.sendQuery("isLoggedIn"); +} + +function logoutPrimaryPassword() { + runInParent(function parent_logoutPrimaryPassword() { + var sdr = Cc["@mozilla.org/security/sdr;1"].getService( + Ci.nsISecretDecoderRing + ); + sdr.logoutAndTeardown(); + }); +} + +/** + * Resolves when a specified number of forms have been processed for (potential) filling. + * This relies on the observer service which only notifies observers within the same process. + */ +function promiseFormsProcessedInSameProcess(expectedCount = 1) { + var processedCount = 0; + return new Promise((resolve, reject) => { + function onProcessedForm(subject, topic, data) { + processedCount++; + if (processedCount == expectedCount) { + info(`${processedCount} form(s) processed`); + SpecialPowers.removeObserver( + onProcessedForm, + "passwordmgr-processed-form" + ); + resolve(SpecialPowers.Cu.waiveXrays(subject), data); + } + } + SpecialPowers.addObserver(onProcessedForm, "passwordmgr-processed-form"); + }); +} + +/** + * Resolves when a form has been processed for (potential) filling. + * This works across processes. + */ +async function promiseFormsProcessed(expectedCount = 1) { + info(`waiting for ${expectedCount} forms to be processed`); + var processedCount = 0; + return new Promise(resolve => { + PWMGR_COMMON_PARENT.addMessageListener( + "formProcessed", + function formProcessed() { + processedCount++; + info(`processed form ${processedCount} of ${expectedCount}`); + if (processedCount == expectedCount) { + info(`processing of ${expectedCount} forms complete`); + PWMGR_COMMON_PARENT.removeMessageListener( + "formProcessed", + formProcessed + ); + resolve(); + } + } + ); + }); +} + +async function loadFormIntoWindow(origin, html, win, expectedCount = 1, task) { + let loadedPromise = new Promise(resolve => { + win.addEventListener( + "load", + function (event) { + if (event.target.location.href.endsWith("blank.html")) { + resolve(); + } + }, + { once: true } + ); + }); + + let processedPromise = promiseFormsProcessed(expectedCount); + win.location = + origin + "/tests/toolkit/components/passwordmgr/test/mochitest/blank.html"; + info(`Waiting for window to load for origin: ${origin}`); + await loadedPromise; + + await SpecialPowers.spawn( + win, + [html, task?.toString()], + function (contentHtml, contentTask = null) { + // eslint-disable-next-line no-unsanitized/property + this.content.document.documentElement.innerHTML = contentHtml; + // Similar to the invokeContentTask helper in accessible/tests/browser/shared-head.js + if (contentTask) { + // eslint-disable-next-line no-eval + const runnableTask = eval(` + (() => { + return (${contentTask}); + })();`); + runnableTask.call(this); + } + } + ); + + info("Waiting for the form to be processed"); + await processedPromise; +} + +function getTelemetryEvents(options) { + return new Promise(resolve => { + PWMGR_COMMON_PARENT.addMessageListener( + "getTelemetryEvents", + function gotResult(events) { + info( + "CONTENT: getTelemetryEvents gotResult: " + JSON.stringify(events) + ); + PWMGR_COMMON_PARENT.removeMessageListener( + "getTelemetryEvents", + gotResult + ); + resolve(events); + } + ); + PWMGR_COMMON_PARENT.sendAsyncMessage("getTelemetryEvents", options); + }); +} + +function loadRecipes(recipes) { + info("Loading recipes"); + return new Promise(resolve => { + PWMGR_COMMON_PARENT.addMessageListener("loadedRecipes", function loaded() { + PWMGR_COMMON_PARENT.removeMessageListener("loadedRecipes", loaded); + resolve(recipes); + }); + PWMGR_COMMON_PARENT.sendAsyncMessage("loadRecipes", recipes); + }); +} + +function resetRecipes() { + info("Resetting recipes"); + return new Promise(resolve => { + PWMGR_COMMON_PARENT.addMessageListener("recipesReset", function reset() { + PWMGR_COMMON_PARENT.removeMessageListener("recipesReset", reset); + resolve(); + }); + PWMGR_COMMON_PARENT.sendAsyncMessage("resetRecipes"); + }); +} + +function resetWebsitesWithSharedCredential() { + info("Resetting the 'websites-with-shared-credential-backend' collection"); + return new Promise(resolve => { + PWMGR_COMMON_PARENT.addMessageListener( + "resetWebsitesWithSharedCredential", + function reset() { + PWMGR_COMMON_PARENT.removeMessageListener( + "resetWebsitesWithSharedCredential", + reset + ); + resolve(); + } + ); + PWMGR_COMMON_PARENT.sendAsyncMessage("resetWebsitesWithSharedCredential"); + }); +} + +function promiseStorageChanged(expectedChangeTypes) { + return new Promise((resolve, reject) => { + function onStorageChanged({ topic, data }) { + let changeType = expectedChangeTypes.shift(); + is(data, changeType, "Check expected passwordmgr-storage-changed type"); + if (expectedChangeTypes.length === 0) { + PWMGR_COMMON_PARENT.removeMessageListener( + "storageChanged", + onStorageChanged + ); + resolve(); + } + } + PWMGR_COMMON_PARENT.addMessageListener("storageChanged", onStorageChanged); + }); +} + +function promisePromptShown(expectedTopic) { + return new Promise((resolve, reject) => { + function onPromptShown({ topic, data }) { + is(topic, expectedTopic, "Check expected prompt topic"); + PWMGR_COMMON_PARENT.removeMessageListener("promptShown", onPromptShown); + resolve(); + } + PWMGR_COMMON_PARENT.addMessageListener("promptShown", onPromptShown); + }); +} + +/** + * Run a function synchronously in the parent process and destroy it in the test cleanup function. + * @param {Function|String} aFunctionOrURL - either a function that will be stringified and run + * or the URL to a JS file. + * @return {Object} - the return value of loadChromeScript providing message-related methods. + * @see loadChromeScript in specialpowersAPI.js + */ +function runInParent(aFunctionOrURL) { + let chromeScript = SpecialPowers.loadChromeScript(aFunctionOrURL); + SimpleTest.registerCleanupFunction(() => { + chromeScript.destroy(); + }); + return chromeScript; +} + +/** Manage logins in parent chrome process. + * */ +function manageLoginsInParent() { + return runInParent(function addLoginsInParentInner() { + /* eslint-env mozilla/chrome-script */ + addMessageListener("removeAllUserFacingLogins", () => { + Services.logins.removeAllUserFacingLogins(); + }); + + /* eslint-env mozilla/chrome-script */ + addMessageListener("addLogins", async logins => { + let nsLoginInfo = Components.Constructor( + "@mozilla.org/login-manager/loginInfo;1", + Ci.nsILoginInfo, + "init" + ); + + const loginInfos = logins.map(login => new nsLoginInfo(...login)); + try { + await Services.logins.addLogins(loginInfos); + } catch (e) { + assert.ok(false, "addLogins threw: " + e); + } + }); + }); +} + +/** Initialize with a list of logins. The logins are added within the parent chrome process. + * @param {array} aLogins - a list of logins to add. Each login is an array of the arguments + * that would be passed to nsLoginInfo.init(). + */ +async function addLoginsInParent(...aLogins) { + const script = manageLoginsInParent(); + await script.sendQuery("addLogins", aLogins); + return script; +} + +/** Initialize with a list of logins, after removing all user facing logins. + * The logins are added within the parent chrome process. + * @param {array} aLogins - a list of logins to add. Each login is an array of the arguments + * that would be passed to nsLoginInfo.init(). + */ +async function setStoredLoginsAsync(...aLogins) { + const script = manageLoginsInParent(); + script.sendQuery("removeAllUserFacingLogins"); + await script.sendQuery("addLogins", aLogins); + return script; +} + +/* + * gTestDependsOnDeprecatedLogin Set this global to true if your test relies + * on the testuser/testpass login that is created in pwmgr_common.js. New tests + * should not rely on this login. + */ +var gTestDependsOnDeprecatedLogin = false; + +/** + * Replace the content innerHTML with the provided form and wait for autofill to fill in the form. + * + * @param {string} form The form to be appended to the #content element. + * @param {string} fieldSelector The CSS selector for the field to-be-filled + * @param {string} fieldValue The value expected to be filled + * @param {string} formId The ID (excluding the # character) of the form + */ +function setFormAndWaitForFieldFilled( + form, + { fieldSelector, fieldValue, formId } +) { + // eslint-disable-next-line no-unsanitized/property + document.querySelector("#content").innerHTML = form; + return SimpleTest.promiseWaitForCondition(() => { + let ancestor = formId + ? document.querySelector("#" + formId) + : document.documentElement; + return ancestor.querySelector(fieldSelector).value == fieldValue; + }, "Wait for password manager to fill form"); +} + +/** + * Run commonInit synchronously in the parent then run the test function after the runTests event. + * + * @param {Function} aFunction The test function to run + */ +function runChecksAfterCommonInit(aFunction = null) { + SimpleTest.waitForExplicitFinish(); + if (aFunction) { + window.addEventListener("runTests", aFunction); + PWMGR_COMMON_PARENT.addMessageListener("registerRunTests", () => + registerRunTests() + ); + } + PWMGR_COMMON_PARENT.sendAsyncMessage("setupParent", { + testDependsOnDeprecatedLogin: gTestDependsOnDeprecatedLogin, + }); + return PWMGR_COMMON_PARENT; +} + +// Begin code that runs immediately for all tests that include this file. + +const PWMGR_COMMON_PARENT = runInParent( + SimpleTest.getTestFileURL("pwmgr_common_parent.js") +); + +SimpleTest.registerCleanupFunction(() => { + SpecialPowers.flushPrefEnv(); + + PWMGR_COMMON_PARENT.sendAsyncMessage("cleanup"); + + runInParent(function cleanupParent() { + /* eslint-env mozilla/chrome-script */ + // eslint-disable-next-line no-shadow + const { LoginManagerParent } = ChromeUtils.importESModule( + "resource://gre/modules/LoginManagerParent.sys.mjs" + ); + + // Remove all logins and disabled hosts + Services.logins.removeAllUserFacingLogins(); + + let disabledHosts = Services.logins.getAllDisabledHosts(); + disabledHosts.forEach(host => + Services.logins.setLoginSavingEnabled(host, true) + ); + + let authMgr = Cc["@mozilla.org/network/http-auth-manager;1"].getService( + Ci.nsIHttpAuthManager + ); + authMgr.clearAll(); + + // Check that it's not null, instead of truthy to catch it becoming undefined + // in a refactoring. + if (LoginManagerParent._recipeManager !== null) { + LoginManagerParent._recipeManager.reset(); + } + + // Cleanup PopupNotifications (if on a relevant platform) + let chromeWin = Services.wm.getMostRecentWindow("navigator:browser"); + if (chromeWin && chromeWin.PopupNotifications) { + let notes = chromeWin.PopupNotifications._currentNotifications; + if (notes.length) { + dump("Removing " + notes.length + " popup notifications.\n"); + } + for (let note of notes) { + note.remove(); + } + } + + // Clear events last in case the above cleanup records events. + Services.telemetry.clearEvents(); + }); +}); + +/** + * Proxy for Services.logins (nsILoginManager). + * Only supports arguments which support structured clone plus {nsILoginInfo} + * Assumes properties are methods. + */ +this.LoginManager = new Proxy( + {}, + { + get(target, prop, receiver) { + return (...args) => { + let loginInfoIndices = []; + let cloneableArgs = args.map((val, index) => { + if ( + SpecialPowers.call_Instanceof(val, SpecialPowers.Ci.nsILoginInfo) + ) { + loginInfoIndices.push(index); + return LoginHelper.loginToVanillaObject(val); + } + + return val; + }); + + return PWMGR_COMMON_PARENT.sendQuery("proxyLoginManager", { + args: cloneableArgs, + loginInfoIndices, + methodName: prop, + }); + }; + }, + } +); diff --git a/toolkit/components/passwordmgr/test/mochitest/pwmgr_common_parent.js b/toolkit/components/passwordmgr/test/mochitest/pwmgr_common_parent.js new file mode 100644 index 0000000000..00173cf323 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/pwmgr_common_parent.js @@ -0,0 +1,249 @@ +/** + * Loaded as a frame script to do privileged things in mochitest-plain tests. + * See pwmgr_common.js for the content process companion. + */ + +/* eslint-env mozilla/chrome-script */ + +"use strict"; + +var { AppConstants } = ChromeUtils.importESModule( + "resource://gre/modules/AppConstants.sys.mjs" +); +var { LoginHelper } = ChromeUtils.importESModule( + "resource://gre/modules/LoginHelper.sys.mjs" +); +var { LoginManagerParent } = ChromeUtils.importESModule( + "resource://gre/modules/LoginManagerParent.sys.mjs" +); +const { LoginTestUtils } = ChromeUtils.importESModule( + "resource://testing-common/LoginTestUtils.sys.mjs" +); +if (LoginHelper.relatedRealmsEnabled) { + let rsPromise = + LoginTestUtils.remoteSettings.setupWebsitesWithSharedCredentials(); + async () => { + await rsPromise; + }; +} +if (LoginHelper.improvedPasswordRulesEnabled) { + let rsPromise = LoginTestUtils.remoteSettings.setupImprovedPasswordRules({ + rules: "", + }); + async () => { + await rsPromise; + }; +} + +/** + * Init with a common login + * If selfFilling is true or non-undefined, fires an event at the page so that + * the test can start checking filled-in values. Tests that check observer + * notifications might be confused by this. + */ +async function commonInit(selfFilling, testDependsOnDeprecatedLogin) { + var pwmgr = Services.logins; + assert.ok(pwmgr != null, "Access LoginManager"); + + // Check that initial state has no logins + var logins = pwmgr.getAllLogins(); + assert.equal(logins.length, 0, "Not expecting logins to be present"); + var disabledHosts = pwmgr.getAllDisabledHosts(); + if (disabledHosts.length) { + assert.ok(false, "Warning: wasn't expecting disabled hosts to be present."); + for (var host of disabledHosts) { + pwmgr.setLoginSavingEnabled(host, true); + } + } + + if (testDependsOnDeprecatedLogin) { + // Add a login that's used in multiple tests + var login = Cc["@mozilla.org/login-manager/loginInfo;1"].createInstance( + Ci.nsILoginInfo + ); + login.init( + "http://mochi.test:8888", + "http://mochi.test:8888", + null, + "testuser", + "testpass", + "uname", + "pword" + ); + await pwmgr.addLoginAsync(login); + } + + // Last sanity check + logins = pwmgr.getAllLogins(); + assert.equal( + logins.length, + testDependsOnDeprecatedLogin ? 1 : 0, + "Checking for successful init login" + ); + disabledHosts = pwmgr.getAllDisabledHosts(); + assert.equal(disabledHosts.length, 0, "Checking for no disabled hosts"); + + if (selfFilling) { + return; + } + + // Notify the content side that initialization is done and tests can start. + sendAsyncMessage("registerRunTests"); +} + +function dumpLogins() { + let logins = Services.logins.getAllLogins(); + assert.ok(true, "----- dumpLogins: have " + logins.length + " logins. -----"); + for (var i = 0; i < logins.length; i++) { + dumpLogin("login #" + i + " --- ", logins[i]); + } +} + +function dumpLogin(label, login) { + var loginText = ""; + loginText += "origin: "; + loginText += login.origin; + loginText += " / formActionOrigin: "; + loginText += login.formActionOrigin; + loginText += " / realm: "; + loginText += login.httpRealm; + loginText += " / user: "; + loginText += login.username; + loginText += " / pass: "; + loginText += login.password; + loginText += " / ufield: "; + loginText += login.usernameField; + loginText += " / pfield: "; + loginText += login.passwordField; + assert.ok(true, label + loginText); +} + +function onStorageChanged(subject, topic, data) { + sendAsyncMessage("storageChanged", { + topic, + data, + }); +} +Services.obs.addObserver(onStorageChanged, "passwordmgr-storage-changed"); + +function onPrompt(subject, topic, data) { + sendAsyncMessage("promptShown", { + topic, + data, + }); +} +Services.obs.addObserver(onPrompt, "passwordmgr-prompt-change"); +Services.obs.addObserver(onPrompt, "passwordmgr-prompt-save"); + +addMessageListener("cleanup", () => { + Services.obs.removeObserver(onStorageChanged, "passwordmgr-storage-changed"); + Services.obs.removeObserver(onPrompt, "passwordmgr-prompt-change"); + Services.obs.removeObserver(onPrompt, "passwordmgr-prompt-save"); + Services.logins.removeAllUserFacingLogins(); +}); + +// Begin message listeners + +addMessageListener( + "setupParent", + async ({ + selfFilling = false, + testDependsOnDeprecatedLogin = false, + } = {}) => { + await commonInit(selfFilling, testDependsOnDeprecatedLogin); + sendAsyncMessage("doneSetup"); + } +); + +addMessageListener("loadRecipes", async function (recipes) { + var recipeParent = await LoginManagerParent.recipeParentPromise; + await recipeParent.load(recipes); + sendAsyncMessage("loadedRecipes", recipes); +}); + +addMessageListener("resetRecipes", async function () { + let recipeParent = await LoginManagerParent.recipeParentPromise; + await recipeParent.reset(); + sendAsyncMessage("recipesReset"); +}); + +addMessageListener("getTelemetryEvents", options => { + options = Object.assign( + { + filterProps: {}, + clear: false, + }, + options + ); + let snapshots = Services.telemetry.snapshotEvents( + Ci.nsITelemetry.DATASET_PRERELEASE_CHANNELS, + options.clear + ); + let events = options.process in snapshots ? snapshots[options.process] : []; + + // event is array of values like: [22476,"pwmgr","autocomplete_field","generatedpassword"] + let keys = ["id", "category", "method", "object", "value"]; + events = events.filter(entry => { + for (let idx = 0; idx < keys.length; idx++) { + let key = keys[idx]; + if ( + key in options.filterProps && + options.filterProps[key] !== entry[idx] + ) { + return false; + } + } + return true; + }); + sendAsyncMessage("getTelemetryEvents", events); +}); + +addMessageListener("proxyLoginManager", msg => { + // Recreate nsILoginInfo objects from vanilla JS objects. + let recreatedArgs = msg.args.map((arg, index) => { + if (msg.loginInfoIndices.includes(index)) { + return LoginHelper.vanillaObjectToLogin(arg); + } + + return arg; + }); + + let rv = Services.logins[msg.methodName](...recreatedArgs); + if (rv instanceof Ci.nsILoginInfo) { + rv = LoginHelper.loginToVanillaObject(rv); + } else if ( + Array.isArray(rv) && + !!rv.length && + rv[0] instanceof Ci.nsILoginInfo + ) { + rv = rv.map(login => LoginHelper.loginToVanillaObject(login)); + } + return rv; +}); + +addMessageListener("isLoggedIn", () => { + // This can't use the LoginManager proxy in pwmgr_common.js since it's not a method. + return Services.logins.isLoggedIn; +}); + +addMessageListener("setPrimaryPassword", ({ enable }) => { + if (enable) { + LoginTestUtils.primaryPassword.enable(); + } else { + LoginTestUtils.primaryPassword.disable(); + } +}); + +LoginManagerParent.setListenerForTests((msg, { origin, data }) => { + if (msg == "ShowDoorhanger") { + sendAsyncMessage("formSubmissionProcessed", { origin, data }); + } else if (msg == "PasswordEditedOrGenerated") { + sendAsyncMessage("passwordEditedOrGenerated", { origin, data }); + } else if (msg == "FormProcessed") { + sendAsyncMessage("formProcessed", {}); + } +}); + +addMessageListener("cleanup", () => { + LoginManagerParent.setListenerForTests(null); +}); diff --git a/toolkit/components/passwordmgr/test/mochitest/slow_image.html b/toolkit/components/passwordmgr/test/mochitest/slow_image.html new file mode 100644 index 0000000000..172d592633 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/slow_image.html @@ -0,0 +1,9 @@ +<!DOCTYPE html> +<html> + <head> + <meta charset="utf-8"> + </head> + <body> + <img src="slow_image.sjs" /> + </body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/slow_image.sjs b/toolkit/components/passwordmgr/test/mochitest/slow_image.sjs new file mode 100644 index 0000000000..b955e43f5d --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/slow_image.sjs @@ -0,0 +1,25 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +// The delay time will not impact test running time, as the test does +// not wait for the "load" event. We just need to ensure the pwmgr code +// e.g. autofill happens before the delay time elapses. +const DELAY_MS = "5000"; + +let timer; + +function handleRequest(req, resp) { + resp.processAsync(); + resp.setHeader("Cache-Control", "no-cache", false); + resp.setHeader("Content-Type", "image/png", false); + + timer = Cc["@mozilla.org/timer;1"].createInstance(Ci.nsITimer); + timer.init( + () => { + resp.write(""); + resp.finish(); + }, + DELAY_MS, + Ci.nsITimer.TYPE_ONE_SHOT + ); +} diff --git a/toolkit/components/passwordmgr/test/mochitest/subtst_prefilled_form.html b/toolkit/components/passwordmgr/test/mochitest/subtst_prefilled_form.html new file mode 100644 index 0000000000..8a3e0b0240 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/subtst_prefilled_form.html @@ -0,0 +1,18 @@ +<!DOCTYPE html><html><head><meta charset="utf-8"></head><body> +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!-- Form with username and password fields pre-populated. + With a couple elements where .defaultValue !== .value --> +<form id="form-basic"> + <input id="form-basic-username" name="username" value="user"> + <input id="form-basic-password" name="password" type="password" value="pass"> + <select name="picker"> + <option value="foo">0</option> + <option value="bar" selected>1</option> + </select> + <input id="form-basic-submit" type="submit"> + <button id="form-basic-reset" type="reset">Reset</button> +</form> + +</body></html> diff --git a/toolkit/components/passwordmgr/test/mochitest/subtst_primary_pass.html b/toolkit/components/passwordmgr/test/mochitest/subtst_primary_pass.html new file mode 100644 index 0000000000..dc892c50e2 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/subtst_primary_pass.html @@ -0,0 +1,8 @@ +<h2>MP subtest</h2> +This form triggers a MP and gets filled in.<br> +<form> +Username: <input type="text" id="userfield" name="u"><br> +Password: <input type="password" id="passfield" name="p" + oninput="parent.postMessage('filled', '*');"><br> +</form> +<iframe></iframe> diff --git a/toolkit/components/passwordmgr/test/mochitest/subtst_prompt_async.html b/toolkit/components/passwordmgr/test/mochitest/subtst_prompt_async.html new file mode 100644 index 0000000000..39a72add56 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/subtst_prompt_async.html @@ -0,0 +1,12 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Multiple auth request</title> +</head> +<body> + <iframe id="iframe1" src="authenticate.sjs?r=1&user=user3name&pass=user3pass&realm=mochirealm3&proxy_user=proxy_user2&proxy_pass=proxy_pass2&proxy_realm=proxy_realm2"></iframe> + <iframe id="iframe2" src="authenticate.sjs?r=2&user=user3name&pass=user3pass&realm=mochirealm3&proxy_user=proxy_user2&proxy_pass=proxy_pass2&proxy_realm=proxy_realm2"></iframe> + <iframe id="iframe3" src="authenticate.sjs?r=3&user=user3name&pass=user3pass&realm=mochirealm3&proxy_user=proxy_user2&proxy_pass=proxy_pass2&proxy_realm=proxy_realm2"></iframe> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_DOMInputPasswordAdded_fired_between_DOMContentLoaded_and_load_events.html b/toolkit/components/passwordmgr/test/mochitest/test_DOMInputPasswordAdded_fired_between_DOMContentLoaded_and_load_events.html new file mode 100644 index 0000000000..4f4f0fedc2 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_DOMInputPasswordAdded_fired_between_DOMContentLoaded_and_load_events.html @@ -0,0 +1,73 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Test the password manager code called on DOMInputPasswordAdded runs when it occurs between DOMContentLoaded and load events</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="pwmgr_common.js"></script> + <link rel="stylesheet" href="/tests/SimpleTest/test.css" /> +</head> +<body> + <!-- In cases where the "DOMContentLoaded" event for a page has occured but not the "load" event when + "DOMInputPasswordAdded" fires, we want to make sure that the Password Manager code (i.e. + _fetchLoginsFromParentAndFillForm) still runs on the page. + This scenario can happen for example when a page has very little initial HTML, but extensive JS that + adds Custom Elements or other HTML later, or when other subresources, like images, take a while to load. + In this test, we delay the page load with a delayed response for an image source. --> +<script type="application/javascript"> +SimpleTest.waitForExplicitFinish(); + +let DEFAULT_ORIGIN = window.location.origin; +let FILE_PATH = "/tests/toolkit/components/passwordmgr/test/mochitest/slow_image.html"; + +// Bug 1655195: Sometimes saved logins are not removed in between mochitests when this test is run as +// part of a suite +runInParent(function removeAll() { + Services.logins.removeAllUserFacingLogins(); +}); + +let readyPromise = registerRunTests(); + +async function openDocumentInWindow(win) { + let DOMContentLoadedPromise = new Promise((resolve) => { + win.addEventListener("DOMContentLoaded", function() { + resolve(); + }, {once: true}); + }); + win.location = DEFAULT_ORIGIN + FILE_PATH; + await DOMContentLoadedPromise; +} + +async function test_password_autofilled() { + info("Adding one login for the page"); + await addLoginsInParent([DEFAULT_ORIGIN, DEFAULT_ORIGIN, null, "user", "omgsecret!"]); + + let numLogins = await LoginManager.countLogins(DEFAULT_ORIGIN, DEFAULT_ORIGIN, null); + is(numLogins, 1, "Correct number of logins"); + + let win = window.open("about:blank"); + SimpleTest.registerCleanupFunction(() => win.close()); + await openDocumentInWindow(win); + let processedPromise = promiseFormsProcessed(); + await SpecialPowers.spawn(win, [], function() { + let doc = this.content.document; + info("Adding password input field to the page to trigger DOMInputPasswordAdded"); + let passwordField = doc.createElement("input"); + passwordField.type = "password"; + is(doc.readyState, "interactive", "Make sure 'DOMContentLoaded' has fired but not 'load'"); + doc.body.append(passwordField); + }); + info("Waiting for the password field to be autofilled"); + await processedPromise; + let expectedValue = "omgsecret!"; + await SpecialPowers.spawn(win, [expectedValue], expectedValueF => { + is(this.content.document.querySelector("input[type='password']").value, expectedValueF, "Ensure the password field is autofilled"); + }); + + SimpleTest.finish(); +} + +readyPromise.then(async () => test_password_autofilled()); +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_LoginManagerContent_passwordEditedOrGenerated.html b/toolkit/components/passwordmgr/test/mochitest/test_LoginManagerContent_passwordEditedOrGenerated.html new file mode 100644 index 0000000000..3c8c92bd97 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_LoginManagerContent_passwordEditedOrGenerated.html @@ -0,0 +1,160 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test behavior of unmasking in LMC._passwordEditedOrGenerated</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script src="pwmgr_common.js"></script> + <link rel="stylesheet" href="/tests/SimpleTest/test.css"/> +</head> +<body> +<p id="display"></p> +<div id="content"></div> +<pre id="test"></pre> +<script> +const { LoginManagerChild } = SpecialPowers.ChromeUtils.import( + "resource://gre/modules/LoginManagerChild.jsm" +); + +function preventDefaultAndStopProgagation(event) { + event.preventDefault(); + event.stopImmediatePropagation(); +} + +add_setup(async () => { + await SpecialPowers.pushPrefEnv({"set": [ + ["signon.generation.available", true], + ["signon.generation.enabled", true], + ]}); + await setStoredLoginsAsync( + [location.origin, "https://autofill", null, "user1", "pass1"], + [location.origin, "https://autofill", null, "user2", "pass2"] + ); +}); + +add_task(async function prevent_default_and_stop_propagation() { + const form = createLoginForm({ + action: "https://autofill" + }); + await promiseFormsProcessedInSameProcess(); + form.pword.focus(); + + form.pword.addEventListener("focus", preventDefaultAndStopProgagation); + form.pword.addEventListener("focus", preventDefaultAndStopProgagation, true); + form.pword.addEventListener("blur", preventDefaultAndStopProgagation); + form.pword.addEventListener("blur", preventDefaultAndStopProgagation, true); + + SpecialPowers.wrap(form.pword).setUserInput("generatedpass"); + LOGIN_FIELD_UTILS.checkPasswordMasked(form.pword, true, "Before first fill"); + LoginManagerChild.forWindow(window)._passwordEditedOrGenerated(form.pword, { triggeredByFillingGenerated: true }); + LOGIN_FIELD_UTILS.checkPasswordMasked(form.pword, false, "After first fill"); + synthesizeKey("KEY_Tab"); // blur + LOGIN_FIELD_UTILS.checkPasswordMasked(form.pword, true, "After blur"); + synthesizeKey("KEY_Tab", { shiftKey: true }); // focus again + LOGIN_FIELD_UTILS.checkPasswordMasked(form.pword, false, "After shift-tab to focus again"); +}); + +add_task(async function fields_masked_after_saved_login_fill() { + const form = createLoginForm({ + action: "https://autofill" + }); + await promiseFormsProcessedInSameProcess(); + form.pword.focus(); + + SpecialPowers.wrap(form.pword).setUserInput("generatedpass"); + LOGIN_FIELD_UTILS.checkPasswordMasked(form.pword, true, "Before first fill"); + LoginManagerChild.forWindow(window)._passwordEditedOrGenerated(form.pword, { triggeredByFillingGenerated: true }); + LOGIN_FIELD_UTILS.checkPasswordMasked(form.pword, false, "After first fill"); + synthesizeKey("KEY_Tab", { shiftKey: true }); // blur pw, focus un + LOGIN_FIELD_UTILS.checkPasswordMasked(form.pword, true, "After blur"); + + info("Filling username matching saved login"); + sendString("user1"); + + let processedPromise = promiseFormsProcessedInSameProcess(); + synthesizeKey("KEY_Tab"); // focus again and trigger a fill of the matching password + await processedPromise; + is(form.pword.value, "pass1", "Saved password was filled") + LOGIN_FIELD_UTILS.checkPasswordMasked(form.pword, true, "After filling a saved login"); +}); + +add_task(async function fields_masked_after_replacing_whole_value() { + const form = createLoginForm({ + action: "https://autofill" + }); + await promiseFormsProcessedInSameProcess(); + form.pword.focus(); + + SpecialPowers.wrap(form.pword).setUserInput("generatedpass"); + LOGIN_FIELD_UTILS.checkPasswordMasked(form.pword, true, "Before first fill"); + LoginManagerChild.forWindow(window)._passwordEditedOrGenerated(form.pword, { triggeredByFillingGenerated: true }); + LOGIN_FIELD_UTILS.checkPasswordMasked(form.pword, false, "After first fill"); + synthesizeKey("KEY_Tab", { shiftKey: true }); // blur pw, focus un + LOGIN_FIELD_UTILS.checkPasswordMasked(form.pword, true, "After blur"); + + synthesizeKey("KEY_Tab"); // focus again and replace the whole password value + info("Replacing password field value with arbitrary string"); + sendString("some_other_password"); + is(form.pword.value, "some_other_password", "Whole password replaced") + LOGIN_FIELD_UTILS.checkPasswordMasked(form.pword, true, "Replaced password value"); + + synthesizeKey("KEY_Tab"); // blur pw + LOGIN_FIELD_UTILS.checkPasswordMasked(form.pword, true, "After blur"); + synthesizeKey("KEY_Tab", { shiftKey: true }); // focus pw again + LOGIN_FIELD_UTILS.checkPasswordMasked(form.pword, true, "After focus again"); +}); + +add_task(async function fields_unmasked_after_adding_character() { + const form = createLoginForm({ + action: "https://autofill" + }); + await promiseFormsProcessedInSameProcess(); + form.pword.focus(); + + SpecialPowers.wrap(form.pword).setUserInput("generatedpass"); + LOGIN_FIELD_UTILS.checkPasswordMasked(form.pword, true, "Before first fill"); + LoginManagerChild.forWindow(window)._passwordEditedOrGenerated(form.pword, { triggeredByFillingGenerated: true }); + LOGIN_FIELD_UTILS.checkPasswordMasked(form.pword, false, "After first fill"); + synthesizeKey("KEY_Tab", { shiftKey: true }); // blur pw, focus un + LOGIN_FIELD_UTILS.checkPasswordMasked(form.pword, true, "After blur"); + + synthesizeKey("KEY_Tab"); // focus again + synthesizeKey("KEY_ArrowRight"); // Remove the selection + info("Adding a character to the end of the password"); + sendString("@"); + is(form.pword.value, "generatedpass@", "Character was added to the value") + LOGIN_FIELD_UTILS.checkPasswordMasked(form.pword, false, "Added @"); + + synthesizeKey("KEY_Tab"); // blur pw + LOGIN_FIELD_UTILS.checkPasswordMasked(form.pword, true, "After blur after @"); + synthesizeKey("KEY_Tab", { shiftKey: true }); // focus pw again + LOGIN_FIELD_UTILS.checkPasswordMasked(form.pword, false, "After focus after @"); +}); + +add_task(async function type_not_password() { + const form = createLoginForm({ + action: "https://autofill" + }); + await promiseFormsProcessedInSameProcess(); + form.pword.focus(); + + LOGIN_FIELD_UTILS.checkPasswordMasked(form.pword, true, "Before first fill"); + SpecialPowers.wrap(form.pword).setUserInput("generatedpass"); + LoginManagerChild.forWindow(window)._passwordEditedOrGenerated(form.pword, { triggeredByFillingGenerated: true }); + LOGIN_FIELD_UTILS.checkPasswordMasked(form.pword, false, "After first fill"); + + // Simulate a website doing their own unmasking and re-masking + form.pword.type = "text"; + await new Promise(resolve => SimpleTest.executeSoon(resolve)); + form.pword.type = "password"; + + synthesizeKey("KEY_Tab"); // blur + LOGIN_FIELD_UTILS.checkPasswordMasked(form.pword, true, "After blur"); + synthesizeKey("KEY_Tab", { shiftKey: true }); // focus again + LOGIN_FIELD_UTILS.checkPasswordMasked(form.pword, false, "After shift-tab to focus again"); +}); +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_autofill_related_realms_no_dupes.html b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_autofill_related_realms_no_dupes.html new file mode 100644 index 0000000000..243ea9f052 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_autofill_related_realms_no_dupes.html @@ -0,0 +1,92 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test no duplicate logins using autofill/autocomplete with related realms</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" href="/tests/SimpleTest/test.css"/> +</head> +<body> +Login Manager test: no duplicate logins when using autofill and autocomplete with related realms +<p id="display"></p> +<div id="content"></div> +<pre id="test"> +<script class="testbody" type="text/javascript"> + +/** Test for Login Manager: related realms autofill/autocomplete. **/ + +function restoreForm(form) { + form.uname.value = ""; + form.pword.value = ""; + form.uname.focus(); +} + +function sendFakeAutocompleteEvent(element) { + const acEvent = document.createEvent("HTMLEvents"); + acEvent.initEvent("DOMAutoComplete", true, false); + element.dispatchEvent(acEvent); +} + +function spinEventLoop() { + return Promise.resolve(); +} + +async function promiseACPopupClosed() { + return SimpleTest.promiseWaitForCondition(async () => { + const popupState = await getPopupState(); + return !popupState.open; + }, "Wait for AC popup to be closed"); +} + +add_setup(async () => { + await addLoginsInParent( + // Simple related domain relationship where example.com and other-example.com are in the related domains list + ["https://other-example.com", "https://other-example.com", null, "relatedUser1", "relatedPass1", "uname", "pword"], + + // Example.com and example.co.uk are related, so sub.example.co.uk should appear on example.com's autocomplete dropdown + // The intent is to cover the ebay.com/ebay.co.uk and all other country TLD cases + // where the sign in page is actually signin.ebay.com/signin.ebay.co.uk but credentials could have manually been entered + // for ebay.com/ebay.co.uk or automatically stored as signin.ebay.com/sigin.ebay.co.uk + ["https://sub.example.co.uk", "https://sub.example.co.uk", null, "subUser1", "subPass1", "uname", "pword"], + + // Ensures there are no duplicates for the exact domain that the user is on + ["https://example.com", "https://example.com", null, "exactUser1", "exactPass1", "uname", "pword"], + ["https://www.example.com", "https://www.example.com", null, "exactWWWUser1", "exactWWWPass1", "uname", "pword"], + ); + listenForUnexpectedPopupShown(); +}); + +add_task(async function test_no_duplicates_autocomplete_autofill() { + const form = createLoginForm({ + action: "https://www.example.com" + }); + + await promiseFormsProcessedInSameProcess(); + await SimpleTest.promiseFocus(window); + const results = await popupBy(() => { + checkLoginForm(form.uname, "exactUser1", form.pword, "exactPass1") + restoreForm(form); + }); + + const popupState = await getPopupState(); + is(popupState.selectedIndex, -1, "Check no entires are selected upon opening"); + const expectedMenuItems = ["exactUser1", "exactWWWUser1", "relatedUser1", "subUser1"]; + checkAutoCompleteResults(results, expectedMenuItems, window.location.host, "Check all menuitems are displayed correctly"); + + const acEvents = await getTelemetryEvents({ process: "parent", filterProps: TelemetryFilterPropsAC, clear: true }); + is(acEvents.length, 1, "One autocomplete event"); + checkACTelemetryEvent(acEvents[0], form.uname, { + "hadPrevious": "0", + "login": expectedMenuItems.length + "", + "loginsFooter": "1" + }); + restoreForm(form); + synthesizeKey("KEY_Escape"); +}); +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_basic_form.html b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_basic_form.html new file mode 100644 index 0000000000..a061171279 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_basic_form.html @@ -0,0 +1,894 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test basic login autocomplete</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: multiple login autocomplete + +<p id="display"></p> + +<!-- we presumably can't hide the content for this test. --> +<div id="content"></div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> + +/** Test for Login Manager: multiple login autocomplete. **/ + +// Restore the form to the default state. +function restoreForm(form) { + form.uname.value = ""; + form.pword.value = ""; + form.uname.focus(); +} + +function sendFakeAutocompleteEvent(element) { + var acEvent = document.createEvent("HTMLEvents"); + acEvent.initEvent("DOMAutoComplete", true, false); + element.dispatchEvent(acEvent); +} + +function spinEventLoop() { + return Promise.resolve(); +} + +async function promiseACPopupClosed() { + return SimpleTest.promiseWaitForCondition(async () => { + let popupState = await getPopupState(); + return !popupState.open; + }, "Wait for AC popup to be closed"); +} + +add_setup(async () => { + listenForUnexpectedPopupShown(); +}); + +add_task(async function form1_initial_empty() { + const form = createLoginForm({ + action: "https://autocomplete:8888/formtest.js" + }); + await SimpleTest.promiseFocus(window); + + // Make sure initial form is empty. + checkLoginForm(form.uname, "", form.pword, ""); + let popupState = await getPopupState(); + is(popupState.open, false, "Check popup is initially closed"); +}); + +add_task(async function form1_menuitems() { + await setStoredLoginsAsync( + // login 0 has no username, so should be filtered out from the autocomplete list. + [location.origin, "https://autocomplete:8888", null, "", "pass0", "", "pword"], + + [location.origin, "https://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [location.origin, "https://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"], + [location.origin, "https://autocomplete:8888", null, "user-3", "pass-3", "uname", "pword"] + ); + const form = createLoginForm({ + action: "https://autocomplete:8888/formtest.js" + }); + await SimpleTest.promiseFocus(window); + // Trigger autocomplete popup + form.uname.focus(); + const autocompleteItems = await popupByArrowDown(); + + let popupState = await getPopupState(); + is(popupState.selectedIndex, -1, "Check no entries are selected upon opening"); + + let expectedMenuItems = ["user-1", + "user-2", + "user-3"]; + checkAutoCompleteResults(autocompleteItems, expectedMenuItems, + window.location.host, "Check all menuitems are displayed correctly."); + + let acEvents = await getTelemetryEvents({ process: "parent", filterProps: TelemetryFilterPropsAC, clear: true }); + is(acEvents.length, 1, "One autocomplete event"); + checkACTelemetryEvent(acEvents[0], form.uname, { + "hadPrevious": "0", + "login": expectedMenuItems.length + "", + "loginsFooter": "1" + }); + + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update just by opening + synthesizeKey("KEY_Escape"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "", form.pword, ""); +}); + +add_task(async function form1_first_entry() { + await setStoredLoginsAsync( + [origin, "https://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [origin, "https://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "https://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + await SimpleTest.promiseFocus(window); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + let popupState = await getPopupState(); + is(popupState.selectedIndex, -1, "Check no entries are selected upon opening"); + synthesizeKey("KEY_ArrowDown"); // first + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update just by selecting + synthesizeKey("KEY_Enter"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user-1", form.pword, "pass-1"); +}); + +add_task(async function form1_second_entry() { + await setStoredLoginsAsync( + [origin, "https://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [origin, "https://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "https://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + synthesizeKey("KEY_ArrowDown"); // first + synthesizeKey("KEY_ArrowDown"); // second + synthesizeKey("KEY_Enter"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user-2", form.pword, "pass-2"); +}); + +add_task(async function form1_wraparound_first_entry() { + await setStoredLoginsAsync( + [origin, "https://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [origin, "https://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "https://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + synthesizeKey("KEY_ArrowDown"); // first + synthesizeKey("KEY_ArrowDown"); // second + synthesizeKey("KEY_ArrowDown"); // footer + synthesizeKey("KEY_ArrowDown"); // deselects + synthesizeKey("KEY_ArrowDown"); // first + synthesizeKey("KEY_Enter"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user-1", form.pword, "pass-1"); +}); + +add_task(async function form1_wraparound_up_last_entry() { + await setStoredLoginsAsync( + [origin, "https://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [origin, "https://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "https://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + synthesizeKey("KEY_ArrowUp"); // footer + synthesizeKey("KEY_ArrowUp"); // last (fourth) + synthesizeKey("KEY_Enter"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user-2", form.pword, "pass-2"); +}); + +add_task(async function form1_wraparound_down_up_up() { + await setStoredLoginsAsync( + [origin, "https://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [origin, "https://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "https://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + synthesizeKey("KEY_ArrowDown"); // select first entry + synthesizeKey("KEY_ArrowUp"); // selects nothing! + synthesizeKey("KEY_ArrowUp"); // footer + synthesizeKey("KEY_ArrowUp"); // select last entry + synthesizeKey("KEY_Enter"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user-2", form.pword, "pass-2"); +}); + +add_task(async function form1_wraparound_up_last() { + await setStoredLoginsAsync( + [origin, "https://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [origin, "https://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "https://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + synthesizeKey("KEY_ArrowDown"); + synthesizeKey("KEY_ArrowUp"); // deselects + synthesizeKey("KEY_ArrowUp"); // footer + synthesizeKey("KEY_ArrowUp"); // last entry + synthesizeKey("KEY_ArrowUp"); // first entry + synthesizeKey("KEY_ArrowUp"); // deselects + synthesizeKey("KEY_ArrowUp"); // footer + synthesizeKey("KEY_ArrowUp"); // last entry + synthesizeKey("KEY_Enter"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user-2", form.pword, "pass-2"); +}); + +add_task(async function form1_fill_username_without_autofill_right() { + await setStoredLoginsAsync( + [origin, "https://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [origin, "https://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "https://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + // Set first entry w/o triggering autocomplete + synthesizeKey("KEY_ArrowDown"); // first + synthesizeKey("KEY_ArrowRight"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user-1", form.pword, ""); // empty password +}); + +add_task(async function form1_fill_username_without_autofill_left() { + await setStoredLoginsAsync( + [origin, "https://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [origin, "https://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "https://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + // Set first entry w/o triggering autocomplete + synthesizeKey("KEY_ArrowDown"); // first + synthesizeKey("KEY_ArrowLeft"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user-1", form.pword, ""); // empty password +}); + +add_task(async function form1_pageup_first() { + await setStoredLoginsAsync( + [origin, "https://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [origin, "https://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "https://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + // Check first entry (page up) + synthesizeKey("KEY_ArrowDown"); // first + synthesizeKey("KEY_ArrowDown"); // second + synthesizeKey("KEY_PageUp"); // first + synthesizeKey("KEY_Enter"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user-1", form.pword, "pass-1"); +}); + +add_task(async function form1_pagedown_last() { + await setStoredLoginsAsync( + [origin, "https://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [origin, "https://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "https://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + /* test 13 */ + // Check last entry (page down) + synthesizeKey("KEY_ArrowDown"); // first + synthesizeKey("KEY_PageDown"); // footer + synthesizeKey("KEY_ArrowUp"); // last + synthesizeKey("KEY_Enter"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user-2", form.pword, "pass-2"); +}); + +add_task(async function form1_untrusted_event() { + await setStoredLoginsAsync( + [origin, "https://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [origin, "https://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "https://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + // Send a fake (untrusted) event. + checkLoginForm(form.uname, "", form.pword, ""); + form.uname.value = "user-2"; + sendFakeAutocompleteEvent(form.uname); + checkLoginForm(form.uname, "user-2", form.pword, ""); +}); + +add_task(async function form1_delete() { + await setStoredLoginsAsync( + [origin, "https://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [origin, "https://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"], + [origin, "https://autocomplete:8888", null, "user-3", "pass-3", "uname", "pword"] + ); + const form = createLoginForm({ + action: "https://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + + // XXX tried sending character "t" before/during dropdown to test + // filtering, but had no luck. Seemed like the character was getting lost. + // Setting uname.value didn't seem to work either. This works with a human + // driver, so I'm not sure what's up. + + // Delete the first entry (of 3), "user-1" + synthesizeKey("KEY_ArrowDown"); + const numLoginsBeforeDeletion = await LoginManager.countLogins(origin, "https://autocomplete:8888", null); + is(numLoginsBeforeDeletion, 3, "Correct number of logins before deleting one"); + + const countChangedPromise = notifyMenuChanged(3); + const deletionPromise = promiseStorageChanged(["removeLogin"]); + // On OS X, shift-backspace and shift-delete work, just delete does not. + // On Win/Linux, shift-backspace does not work, delete and shift-delete do. + synthesizeKey("KEY_Delete", {shiftKey: true}); + await deletionPromise; + + checkLoginForm(form.uname, "", form.pword, ""); + const numLoginsAfterDeletion = await LoginManager.countLogins(origin, "https://autocomplete:8888", null); + is(numLoginsAfterDeletion, 2, "Correct number of logins after deleting one"); + await countChangedPromise; + synthesizeKey("KEY_Enter"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user-2", form.pword, "pass-2"); +}); + +add_task(async function form1_delete_second() { + await setStoredLoginsAsync( + [origin, "https://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [origin, "https://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"], + [origin, "https://autocomplete:8888", null, "user-3", "pass-3", "uname", "pword"] + ); + const form = createLoginForm({ + action: "https://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + + // Delete the second entry (of 3), "user-2" + synthesizeKey("KEY_ArrowDown"); + synthesizeKey("KEY_ArrowDown"); + synthesizeKey("KEY_Delete", {shiftKey: true}); + checkLoginForm(form.uname, "", form.pword, ""); + const numLoginsAfterDeletion = await LoginManager.countLogins(origin, "https://autocomplete:8888", null); + is(numLoginsAfterDeletion, 2, "Correct number of logins after deleting one"); + synthesizeKey("KEY_Enter"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user-3", form.pword, "pass-3"); +}); + +add_task(async function form1_delete_last() { + await setStoredLoginsAsync( + [origin, "https://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [origin, "https://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"], + [origin, "https://autocomplete:8888", null, "user-3", "pass-3", "uname", "pword"] + ); + const form = createLoginForm({ + action: "https://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + + /* test 54 */ + // Delete the last entry (of 3), "user-3" + synthesizeKey("KEY_ArrowDown"); + synthesizeKey("KEY_ArrowDown"); + synthesizeKey("KEY_ArrowDown"); + const numLoginsBeforeDeletion = await LoginManager.countLogins(origin, "https://autocomplete:8888", null); + is(numLoginsBeforeDeletion, 3, "Correct number of logins before deleting one"); + synthesizeKey("KEY_Delete", {shiftKey: true}); + checkLoginForm(form.uname, "", form.pword, ""); + const numLoginsAfterDeletion = await LoginManager.countLogins(origin, "https://autocomplete:8888", null); + is(numLoginsAfterDeletion, 2, "Correct number of logins after deleting one"); + synthesizeKey("KEY_ArrowDown"); + synthesizeKey("KEY_Enter"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user-1", form.pword, "pass-1"); +}); + +// Tests for single-user forms for ignoring autocomplete=off */ + +add_task(async function form_default() { + await setStoredLoginsAsync( + [location.origin, "https://autocomplete2", null, "user", "pass", "uname", "pword"], + ); + const form = createLoginForm({ + action: "https://autocomplete2" + }); + await promiseFormsProcessedInSameProcess(); + + checkLoginForm(form.uname, "user", form.pword, "pass"); +}); + +add_task(async function password_autocomplete_off() { + await setStoredLoginsAsync( + [location.origin, "https://autocomplete2", null, "user", "pass", "uname", "pword"], + ); + const form = createLoginForm({ + action: "https://autocomplete2", + password: { + autocomplete: "off" + } + }); + await promiseFormsProcessedInSameProcess(); + + checkLoginForm(form.uname, "user", form.pword, "pass"); + + // Trigger autocomplete popup + restoreForm(form); + await popupByArrowDown(); + + // Check first entry + synthesizeKey("KEY_ArrowDown"); + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user", form.pword, "pass"); +}); + +add_task(async function username_autocomplete_off() { + await setStoredLoginsAsync( + [location.origin, "https://autocomplete2", null, "user", "pass", "uname", "pword"], + ); + const form = createLoginForm({ + action: "https://autocomplete2", + username: { + autocomplete: "off" + } + }); + await promiseFormsProcessedInSameProcess(); + checkLoginForm(form.uname, "user", form.pword, "pass"); + + restoreForm(form); + await popupByArrowDown(); + + // Check first entry + synthesizeKey("KEY_ArrowDown"); + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user", form.pword, "pass"); +}); + +add_task(async function form_autocomplete_off() { + await setStoredLoginsAsync( + [location.origin, "https://autocomplete2", null, "user", "pass", "uname", "pword"], + ); + const form = createLoginForm({ + action: "https://autocomplete2", + autocomplete: "off" + }); + await promiseFormsProcessedInSameProcess(); + + checkLoginForm(form.uname, "user", form.pword, "pass"); + restoreForm(form); + await popupByArrowDown(); + + // Check first entry + synthesizeKey("KEY_ArrowDown"); + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user", form.pword, "pass"); +}); + +add_task(async function username_and_password_autocomplete_off() { + await setStoredLoginsAsync( + [location.origin, "https://autocomplete2", null, "user", "pass", "uname", "pword"], + ); + const form = createLoginForm({ + action: "https://autocomplete2", + username: { + autocomplete: "off" + }, + password: { + autocomplete: "off" + } + }); + await promiseFormsProcessedInSameProcess(); + + checkLoginForm(form.uname, "user", form.pword, "pass"); + restoreForm(form); + await popupByArrowDown(); + + // Check first entry + synthesizeKey("KEY_ArrowDown"); + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user", form.pword, "pass"); +}); + +add_task(async function changing_username_does_not_touch_password() { + await setStoredLoginsAsync( + [location.origin, "https://autocomplete2", null, "user", "pass", "uname", "pword"], + ); + const form = createLoginForm({ + action: "https://autocomplete2", + username: { + autocomplete: "off" + }, + password: { + autocomplete: "off" + } + }); + await promiseFormsProcessedInSameProcess(); + + checkLoginForm(form.uname, "user", form.pword, "pass"); + + // Test that the password field remains filled in after changing + // the username. + form.uname.focus(); + synthesizeKey("KEY_ArrowRight"); + synthesizeKey("X", {shiftKey: true}); + // Trigger the 'blur' event on uname + form.pword.focus(); + await spinEventLoop(); + checkLoginForm(form.uname, "userX", form.pword, "pass"); +}); + +add_task(async function form7() { + await setStoredLoginsAsync( + [location.origin, "https://autocomplete3", null, "user-1", "pass-1", "uname", "pword"], + [location.origin, "https://autocomplete3", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "https://autocomplete3" + }); + await promiseFormsProcessedInSameProcess(); + + checkLoginForm(form.uname, "", form.pword, ""); + + // Insert a new username field into the form. We'll then make sure + // that invoking the autocomplete doesn't try to fill the form. + const newField = document.createElement("input"); + newField.setAttribute("type", "text"); + newField.setAttribute("name", "uname2"); + form.insertBefore(newField, form.pword); + await spinEventLoop(); + is(newField.value, "", "Verifying empty uname2"); +}); + +add_task(async function form7_2() { + await setStoredLoginsAsync( + [location.origin, "https://autocomplete3", null, "user", "pass", "uname", "pword"] + ); + const form = createLoginForm({ + action: "https://autocomplete3" + }); + await promiseFormsProcessedInSameProcess(); + + // Insert a new username field into the form. We'll then make sure + // that invoking the autocomplete doesn't try to fill the form. + const newField = document.createElement("input"); + newField.setAttribute("type", "text"); + newField.setAttribute("name", "uname2"); + form.insertBefore(newField, form.pword); + + restoreForm(form); + const autocompleteItems = await popupByArrowDown(); + checkAutoCompleteResults(autocompleteItems, + ["user"], + window.location.host, + "Check dropdown is showing all logins while field is blank"); + + + // Check first entry + synthesizeKey("KEY_ArrowDown"); + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update + synthesizeKey("KEY_Enter"); + // The form changes, so we expect the old username field to get the + // selected autocomplete value, but neither the new username field nor + // the password field should have any values filled in. + await SimpleTest.promiseWaitForCondition(() => form.uname.value == "user", + "Wait for username to get filled"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user", form.pword, ""); + is(newField.value, "", "Verifying empty uname2"); +}); + +add_task(async function form8() { + await setStoredLoginsAsync( + [location.origin, "https://autocomplete", null, "user", "pass", "uname", "pword"] + ); + const form1 = createLoginForm({ + num: 1, + action: "https://autocomplete-other" + }); + const form2 = createLoginForm({ + num: 2, + action: "https://autocomplete" + }); + await promiseFormsProcessedInSameProcess(2); + + checkLoginForm(form2.uname, "user", form2.pword, "pass"); + + restoreForm(form2); + checkLoginForm(form2.uname, "", form2.pword, ""); + + form1.uname.focus(); + checkLoginForm(form2.uname, "", form2.pword, ""); +}); + +add_task(async function form9_filtering() { + await setStoredLoginsAsync( + [location.origin, "https://autocomplete", null, "form9userAB", "pass-1", "uname", "pword"], + [location.origin, "https://autocomplete", null, "form9userAAB", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "https://autocomplete" + }); + await promiseFormsProcessedInSameProcess(); + + let results = await popupBy(() => form.uname.focus()); + checkAutoCompleteResults(results, + ["form9userAAB", "form9userAB"], + window.location.host, + "Check dropdown is showing all logins while field is blank"); + synthesizeKey("KEY_Escape"); // Need to close the popup so we can get another popupshown after sending the string below. + + results = await popupBy(() => sendString("form9userAB")); + checkAutoCompleteResults(results, + ["form9userAB"], + window.location.host, + "Check dropdown is showing login with only one 'A'"); + + checkLoginForm(form.uname, "form9userAB", form.pword, ""); + form.uname.focus(); + synthesizeKey("KEY_ArrowLeft"); + results = await popupBy(() => synthesizeKey("A", {shiftKey: true})); + + checkLoginForm(form.uname, "form9userAAB", form.pword, ""); + checkAutoCompleteResults(results, ["form9userAAB"], + window.location.host, "Check dropdown is updated after inserting 'A'"); + synthesizeKey("KEY_ArrowDown"); + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "form9userAAB", form.pword, "pass-2"); +}); + +add_task(async function form9_autocomplete_cache() { + await setStoredLoginsAsync( + [location.origin, "https://autocomplete", null, "form9userAB", "pass-1", "uname", "pword"], + [location.origin, "https://autocomplete", null, "form9userAAB", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "https://autocomplete" + }); + await promiseFormsProcessedInSameProcess(); + + await popupBy(() => form.uname.focus()); + + await addLoginsInParent( + [location.origin, "https://autocomplete", null, "form9userAABzz", "pass-3", "uname", "pword"] + ); + + const promise1 = notifyMenuChanged(1); + sendString("z"); + const results1 = await promise1; + checkAutoCompleteResults(results1, [], window.location.host, + "Check popup does not have any login items"); + + // check that empty results are cached - bug 496466 + const promise2 = notifyMenuChanged(1); + sendString("z"); + const results2 = await promise2; + checkAutoCompleteResults(results2, [], window.location.host, + "Check popup only has the footer when it opens"); +}); + +add_task(async function form11_formless() { + await setStoredLoginsAsync( + [location.origin, location.origin, null, "user", "pass", "uname", "pword"] + ); + const form = createLoginForm(); + await promiseFormsProcessedInSameProcess(); + + // Test form-less autocomplete + restoreForm(form); + checkLoginForm(form.uname, "", form.pword, ""); + await popupByArrowDown(); + + // Trigger autocomplete + synthesizeKey("KEY_ArrowDown"); + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update + const processedPromise = promiseFormsProcessedInSameProcess(); + synthesizeKey("KEY_Enter"); + await processedPromise; + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user", form.pword, "pass"); +}); + +add_task(async function form11_open_on_trusted_focus() { + await setStoredLoginsAsync( + [location.origin, location.origin, null, "user", "pass", "uname", "pword"] + ); + const form = createLoginForm(); + await promiseFormsProcessedInSameProcess(); + + form.uname.value = ""; + form.pword.value = ""; + + // Move focus to the password field so we can test the first click on the + // username field. + form.pword.focus(); + checkLoginForm(form.uname, "", form.pword, ""); + const firePrivEventPromise = new Promise((resolve) => { + form.uname.addEventListener("click", (e) => { + ok(e.isTrusted, "Ensure event is trusted"); + resolve(); + }); + }); + await popupBy(async () => { + synthesizeMouseAtCenter(form.uname, {}); + await firePrivEventPromise; + }); + synthesizeKey("KEY_ArrowDown"); + const processedPromise = promiseFormsProcessedInSameProcess(); + synthesizeKey("KEY_Enter"); + await processedPromise; + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user", form.pword, "pass"); +}); + +add_task(async function form12_recipes() { + await setStoredLoginsAsync( + [location.origin, "https://autocomplete", null, "user", "pass", "uname", "pword"] + ); + const form = createLoginForm({ + action: "https://autocomplete", + password: { + type: "text" + } + }); + + await loadRecipes({ + siteRecipes: [{ + "hosts": [window.location.host], + "usernameSelector": "input[name='1']", + "passwordSelector": "input[name='2']", + }], + }); + + // First test DOMAutocomplete + // Switch the password field to type=password so _fillForm marks the username + // field for autocomplete. + form.pword.type = "password"; + await promiseFormsProcessedInSameProcess(); + restoreForm(form); + checkLoginForm(form.uname, "", form.pword, ""); + await popupByArrowDown(); + + synthesizeKey("KEY_ArrowDown"); + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user", form.pword, "pass"); + + // Now test recipes with blur on the username field. + restoreForm(form); + checkLoginForm(form.uname, "", form.pword, ""); + form.uname.value = "user"; + checkLoginForm(form.uname, "user", form.pword, ""); + synthesizeKey("KEY_Tab"); + await promiseFormsProcessedInSameProcess(); + checkLoginForm(form.uname, "user", form.pword, "pass"); + await resetRecipes(); +}); + +add_task(async function form13_stays_open_upon_empty_search() { + await setStoredLoginsAsync( + [location.origin, "https://autocomplete:8888", null, "", "pass", "", "pword"], + ); + const form = createLoginForm({ + action: "https://autocomplete:8888", + username: { + value: "prefilled" + }, + password: { + value: "prefilled" + } + }); + await promiseFormsProcessedInSameProcess(); + + checkLoginForm(form.uname, "prefilled", form.pword, "prefilled"); + + form.uname.scrollIntoView(); + await popupBy(() => synthesizeMouseAtCenter(form.uname, {})); + form.uname.select(); + synthesizeKey("KEY_Delete"); + + await spinEventLoop(); + let popupState = await getPopupState(); + is(popupState.open, true, "Check popup is still open"); + checkLoginForm(form.uname, "", form.pword, "prefilled"); + + info("testing password field"); + synthesizeMouseAtCenter(form.pword, {}); + form.pword.select(); + popupState = await getPopupState(); + is(popupState.open, false, "Check popup closed since password field isn't empty"); + await popupBy(() => synthesizeKey("KEY_Delete")); + checkLoginForm(form.uname, "", form.pword, ""); +}); + +add_task(async function form14_username_only() { + await setStoredLoginsAsync( + [location.origin, "https://autocomplete", null, "user", "pass", "uname", "pword"], + ); + const form = createLoginForm({ + action: "https://autocomplete", + autocomplete: "off", + username: { + value: "prefilled", + type: "email", + autocomplete: "username" + } + }); + await promiseFormsProcessedInSameProcess(); + + await SimpleTest.promiseFocus(window); + + const pword = { value: "" }; + checkLoginForm(form.uname, "prefilled", pword, ""); + restoreForm(form); + await popupByArrowDown(); + + // Check first entry + synthesizeKey("KEY_ArrowDown"); + checkLoginForm(form.uname, "", pword, ""); // value shouldn't update + synthesizeKey("KEY_Enter"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user", pword, ""); +}); +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_basic_form_formActionOrigin.html b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_basic_form_formActionOrigin.html new file mode 100644 index 0000000000..587d57215b --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_basic_form_formActionOrigin.html @@ -0,0 +1,75 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test that logins with non-matching formActionOrigin appear in autocomplete dropdown</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: logins with non-matching formActionOrigin appear in autocomplete dropdown + +<script> +const chromeScript = runChecksAfterCommonInit(); +</script> +<p id="display"></p> +<!-- we presumably can't hide the content for this test. --> +<div id="content"></div> +<pre id="test"> +<script class="testbody" type="text/javascript"> +/** Test for Login Manager: multiple login autocomplete. **/ + +add_setup(async () => { + await addLoginsInParent( + [window.location.origin, "https://differentFormSubmitURL", null, "dfsu1", "dfsp1", "uname", "pword"] + ); + listenForUnexpectedPopupShown(); +}); + +add_task(async function test_form1_initial_empty() { + const form = createLoginForm(); + + await SimpleTest.promiseFocus(window); + + // Make sure initial form is empty. + checkLoginForm(form.uname, "", form.pword, ""); + const popupState = await getPopupState(); + is(popupState.open, false, "Check popup is initially closed"); +}); + +/* For this testcase, the only login that exists for this origin + * is one with a different formActionOrigin, so the login will appear + * in the autocomplete popup. + */ +add_task(async function test_form1_menu_shows_logins_for_different_formActionOrigin() { + const form = createLoginForm(); + + await SimpleTest.promiseFocus(window); + + // Trigger autocomplete popup + form.uname.value = ""; + form.pword.value = ""; + form.uname.focus(); + + const autocompleteItems = await popupByArrowDown(); + + const popupState = await getPopupState(); + is(popupState.selectedIndex, -1, "Check no entries are selected upon opening"); + + const expectedMenuItems = ["dfsu1"]; + checkAutoCompleteResults(autocompleteItems, expectedMenuItems, window.location.host, "Check all menuitems are displayed correctly."); + + synthesizeKey("KEY_ArrowDown"); // first item + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update just by selecting + + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + checkLoginForm(form.uname, "dfsu1", form.pword, "dfsp1"); +}); +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_basic_form_insecure.html b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_basic_form_insecure.html new file mode 100644 index 0000000000..13b4e2170b --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_basic_form_insecure.html @@ -0,0 +1,849 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test insecure form field autocomplete</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<p id="display"></p> + +<!-- we presumably can't hide the content for this test. --> +<div id="content"></div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> + +/** Test for Login Manager: multiple login autocomplete. **/ + +// Restore the form to the default state. +function restoreForm(form) { + form.uname.value = ""; + form.pword.value = ""; + form.uname.focus(); +} + +function sendFakeAutocompleteEvent(element) { + var acEvent = document.createEvent("HTMLEvents"); + acEvent.initEvent("DOMAutoComplete", true, false); + element.dispatchEvent(acEvent); +} + +async function promiseACPopupClosed() { + return SimpleTest.promiseWaitForCondition(async () => { + let popupState = await getPopupState(); + return !popupState.open; + }, "Wait for AC popup to be closed"); +} + +add_setup(async () => { + listenForUnexpectedPopupShown(); +}); + +add_task(async function form1_initial_empty() { + const form = createLoginForm({ + action: "http://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + + // Make sure initial form is empty. + checkLoginForm(form.uname, "", form.pword, ""); + const popupState = await getPopupState(); + is(popupState.open, false, "Check popup is initially closed"); +}); + +add_task(async function form1_warning_entry() { + await setStoredLoginsAsync( + // login 0 has no username, so should be filtered out from the autocomplete list. + [location.origin, "http://autocomplete:8888", null, "", "pass0", "", "pword"], + + [location.origin, "http://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [location.origin, "http://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"], + [location.origin, "http://autocomplete:8888", null, "user-3", "pass-3", "uname", "pword"] + ); + const form = createLoginForm({ + action: "http://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + + // Trigger autocomplete popup + form.uname.focus(); + const autocompleteItems = await popupByArrowDown(); + + const popupState = await getPopupState(); + is(popupState.selectedIndex, -1, "Check no entries are selected upon opening"); + + const expectedMenuItems = [ + "This connection is not secure. Logins entered here could be compromised. Learn More", + "user-1", + "user-2", + "user-3" + ]; + checkAutoCompleteResults(autocompleteItems, expectedMenuItems, "mochi.test", "Check all menuitems are displayed correctly."); + + synthesizeKey("KEY_ArrowDown"); // select insecure warning + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update just by selecting + synthesizeKey("KEY_Enter"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "", form.pword, ""); +}); + +add_task(async function form1_first_entry() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [location.origin, "http://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "http://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + + let popupState = await getPopupState(); + is(popupState.selectedIndex, -1, "Check no entries are selected upon opening"); + + synthesizeKey("KEY_ArrowDown"); // skip insecure warning + synthesizeKey("KEY_ArrowDown"); // first + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update just by selecting + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + checkLoginForm(form.uname, "user-1", form.pword, "pass-1"); +}); + +add_task(async function form1_second_entry() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [location.origin, "http://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "http://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + + synthesizeKey("KEY_ArrowDown"); // skip insecure warning + synthesizeKey("KEY_ArrowDown"); // first + synthesizeKey("KEY_ArrowDown"); // second + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + checkLoginForm(form.uname, "user-2", form.pword, "pass-2"); +}); + +add_task(async function form1_wraparound_first_entry() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [location.origin, "http://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "http://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + + synthesizeKey("KEY_ArrowDown"); // skip insecure warning + synthesizeKey("KEY_ArrowDown"); // first + synthesizeKey("KEY_ArrowDown"); // second + synthesizeKey("KEY_ArrowDown"); // footer + synthesizeKey("KEY_ArrowDown"); // deselects + synthesizeKey("KEY_ArrowDown"); // skip insecure warning + synthesizeKey("KEY_ArrowDown"); // first + synthesizeKey("KEY_Enter"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user-1", form.pword, "pass-1"); +}); + +add_task(async function form1_wraparound_up_last_entry() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [location.origin, "http://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "http://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + + synthesizeKey("KEY_ArrowUp"); // footer + synthesizeKey("KEY_ArrowUp"); // last (fourth) + synthesizeKey("KEY_Enter"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user-2", form.pword, "pass-2"); +}); + +add_task(async function form1_wraparound_down_up_up() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [location.origin, "http://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "http://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + + synthesizeKey("KEY_ArrowDown"); // select first entry + synthesizeKey("KEY_ArrowUp"); // selects nothing! + synthesizeKey("KEY_ArrowUp"); // selects footer + synthesizeKey("KEY_ArrowUp"); // select last entry + synthesizeKey("KEY_Enter"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user-2", form.pword, "pass-2"); +}); + +add_task(async function form1_wraparound_up_last() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [location.origin, "http://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "http://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + + synthesizeKey("KEY_ArrowDown"); + synthesizeKey("KEY_ArrowUp"); // deselects + synthesizeKey("KEY_ArrowUp"); // footer + synthesizeKey("KEY_ArrowUp"); // last entry + synthesizeKey("KEY_ArrowUp"); // skip insecure warning + synthesizeKey("KEY_ArrowUp"); // first entry + synthesizeKey("KEY_ArrowUp"); // deselects + synthesizeKey("KEY_ArrowUp"); // footer + synthesizeKey("KEY_ArrowUp"); // last entry + synthesizeKey("KEY_Enter"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user-2", form.pword, "pass-2"); +}); + +add_task(async function form1_fill_username_without_autofill_right() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [location.origin, "http://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "http://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + + // Set first entry w/o triggering autocomplete + synthesizeKey("KEY_ArrowDown"); // skip insecure warning + synthesizeKey("KEY_ArrowDown"); // first + synthesizeKey("KEY_ArrowRight"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user-1", form.pword, ""); // empty password +}); + +add_task(async function form1_fill_username_without_autofill_left() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [location.origin, "http://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "http://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + + // Set first entry w/o triggering autocomplete + synthesizeKey("KEY_ArrowDown"); // skip insecure warning + synthesizeKey("KEY_ArrowDown"); // first + synthesizeKey("KEY_ArrowLeft"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user-1", form.pword, ""); // empty password +}); + +add_task(async function form1_pageup_first() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [location.origin, "http://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "http://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + + // Check first entry (page up) + synthesizeKey("KEY_ArrowDown"); // first + synthesizeKey("KEY_ArrowDown"); // second + synthesizeKey("KEY_PageUp"); // first + synthesizeKey("KEY_ArrowDown"); // skip insecure warning + synthesizeKey("KEY_Enter"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user-1", form.pword, "pass-1"); +}); + +add_task(async function form1_pagedown_last() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [location.origin, "http://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "http://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + + // test 13 + // Check last entry (page down) + synthesizeKey("KEY_ArrowDown"); // first + synthesizeKey("KEY_PageDown"); // last + synthesizeKey("KEY_ArrowUp"); // skip footer + synthesizeKey("KEY_Enter"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user-2", form.pword, "pass-2"); +}); + +add_task(async function form1_untrusted_event() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [location.origin, "http://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "http://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + + // Send a fake (untrusted) event. + checkLoginForm(form.uname, "", form.pword, ""); + form.uname.value = "user-2"; + sendFakeAutocompleteEvent(form.uname); + await ensureLoginFormStaysFilledWith(form.uname, "user-2", form.pword, ""); +}); + +add_task(async function form1_delete() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [location.origin, "http://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"], + [location.origin, "http://autocomplete:8888", null, "user-3", "pass-3", "uname", "pword"] + ); + const form = createLoginForm({ + action: "http://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + // should have 5 menu items by now: 3 logins plus insecure warning + footer + await notifyMenuChanged(5); + + // XXX tried sending character "t" before/during dropdown to test + // filtering, but had no luck. Seemed like the character was getting lost. + // Setting uname.value didn't seem to work either. This works with a human + // driver, so I'm not sure what's up. + + synthesizeKey("KEY_ArrowDown"); // skip insecure warning + // Delete the first entry (of 3), "user-1" + synthesizeKey("KEY_ArrowDown"); + const numLoginsBeforeDeletion = await LoginManager.countLogins(location.origin, "http://autocomplete:8888", null); + is(numLoginsBeforeDeletion, 3, "Correct number of logins before deleting one"); + + const countChangedPromise = notifyMenuChanged(4); + const deletionPromise = promiseStorageChanged(["removeLogin"]); + // On OS X, shift-backspace and shift-delete work, just delete does not. + // On Win/Linux, shift-backspace does not work, delete and shift-delete do. + synthesizeKey("KEY_Delete", {shiftKey: true}); + await deletionPromise; + + checkLoginForm(form.uname, "", form.pword, ""); + const numLoginsAfterDeletion = await LoginManager.countLogins(location.origin, "http://autocomplete:8888", null); + is(numLoginsAfterDeletion, 2, "Correct number of logins after deleting one"); + await countChangedPromise; + synthesizeKey("KEY_Enter"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user-2", form.pword, "pass-2"); +}); + +add_task(async function form1_delete_second() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [location.origin, "http://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"], + [location.origin, "http://autocomplete:8888", null, "user-3", "pass-3", "uname", "pword"] + ); + const form = createLoginForm({ + action: "http://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + + synthesizeKey("KEY_ArrowDown"); // skip insecure warning + // Delete the second entry (of 3), "user-2" + synthesizeKey("KEY_ArrowDown"); + synthesizeKey("KEY_ArrowDown"); + synthesizeKey("KEY_Delete", {shiftKey: true}); + checkLoginForm(form.uname, "", form.pword, ""); + const numLoginsAfterDeletion = await LoginManager.countLogins(location.origin, "http://autocomplete:8888", null); + is(numLoginsAfterDeletion, 2, "Correct number of logins after deleting one"); + synthesizeKey("KEY_Enter"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user-3", form.pword, "pass-3"); +}); + +add_task(async function form1_delete_last() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete:8888", null, "user-1", "pass-1", "uname", "pword"], + [location.origin, "http://autocomplete:8888", null, "user-2", "pass-2", "uname", "pword"], + [location.origin, "http://autocomplete:8888", null, "user-3", "pass-3", "uname", "pword"] + ); + const form = createLoginForm({ + action: "http://autocomplete:8888/formtest.js" + }); + await promiseFormsProcessedInSameProcess(); + // Trigger autocomplete popup + form.uname.focus(); + await popupByArrowDown(); + + /* test 54 */ + // Delete the last entry (of 3), "user-3" + synthesizeKey("KEY_ArrowDown"); // skip insecure warning + synthesizeKey("KEY_ArrowDown"); + synthesizeKey("KEY_ArrowDown"); + synthesizeKey("KEY_ArrowDown"); + const numLoginsBeforeDeletion = await LoginManager.countLogins(location.origin, "http://autocomplete:8888", null); + is(numLoginsBeforeDeletion, 3, "Correct number of logins before deleting one"); + synthesizeKey("KEY_Delete", {shiftKey: true}); + checkLoginForm(form.uname, "", form.pword, ""); + const numLoginsAfterDeletion = await LoginManager.countLogins(location.origin, "http://autocomplete:8888", null); + is(numLoginsAfterDeletion, 2, "Correct number of logins after deleting one"); + synthesizeKey("KEY_ArrowDown"); // skip insecure warning + synthesizeKey("KEY_ArrowDown"); + synthesizeKey("KEY_Enter"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user-1", form.pword, "pass-1"); +}); + +// Tests for single-user forms for ignoring autocomplete=off + +add_task(async function password_autocomplete_off() { + await setStoredLoginsAsync( + [location.origin, "https://autocomplete2", null, "user", "pass", "uname", "pword"], + ); + const form = createLoginForm({ + action: "https://autocomplete2", + password: { + autocomplete: "off" + } + }); + await promiseFormsProcessedInSameProcess(); + + checkLoginForm(form.uname, "user", form.pword, "pass"); + + restoreForm(form); + await popupByArrowDown(); + + synthesizeKey("KEY_ArrowDown"); // skip insecure warning + // Check first entry + synthesizeKey("KEY_ArrowDown"); + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + checkLoginForm(form.uname, "user", form.pword, "pass"); +}); + +add_task(async function username_autocomplete_off() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete2", null, "user", "pass", "uname", "pword"], + ); + const form = createLoginForm({ + action: "http://autocomplete2", + username: { + autocomplete: "off" + } + }); + await promiseFormsProcessedInSameProcess(); + checkLoginForm(form.uname, "user", form.pword, "pass"); + + restoreForm(form); + await popupByArrowDown(); + + synthesizeKey("KEY_ArrowDown"); // skip insecure warning + // Check first entry + synthesizeKey("KEY_ArrowDown"); + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user", form.pword, "pass"); +}); + +add_task(async function form_autocomplete_off() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete2", null, "user", "pass", "uname", "pword"], + ); + const form = createLoginForm({ + action: "http://autocomplete2", + autocomplete: "off" + }); + await promiseFormsProcessedInSameProcess(); + + checkLoginForm(form.uname, "user", form.pword, "pass"); + restoreForm(form); + await popupByArrowDown(); + + synthesizeKey("KEY_ArrowDown"); // skip insecure warning + // Check first entry + synthesizeKey("KEY_ArrowDown"); + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user", form.pword, "pass"); +}); + +add_task(async function username_and_password_autocomplete_off() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete2", null, "user", "pass", "uname", "pword"], + ); + const form = createLoginForm({ + action: "http://autocomplete2", + username: { + autocomplete: "off" + }, + password: { + autocomplete: "off" + } + }); + await promiseFormsProcessedInSameProcess(); + + checkLoginForm(form.uname, "user", form.pword, "pass"); + restoreForm(form); + await popupByArrowDown(); + + synthesizeKey("KEY_ArrowDown"); // skip insecure warning + // Check first entry + synthesizeKey("KEY_ArrowDown"); + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user", form.pword, "pass"); +}); + +add_task(async function changing_username_does_not_touch_password() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete2", null, "user", "pass", "uname", "pword"], + ); + const form = createLoginForm({ + action: "http://autocomplete2", + username: { + autocomplete: "off" + }, + password: { + autocomplete: "off" + } + }); + await promiseFormsProcessedInSameProcess(); + + checkLoginForm(form.uname, "user", form.pword, "pass"); + + // Test that the password field remains filled in after changing + // the username. + form.uname.focus(); + synthesizeKey("KEY_ArrowRight"); + synthesizeKey("X", {shiftKey: true}); + // Trigger the 'blur' event on uname + form.pword.focus(); + await ensureLoginFormStaysFilledWith(form.uname, "userX", form.pword, "pass"); +}); + +add_task(async function form7() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete3", null, "user-1", "pass-1", "uname", "pword"], + [location.origin, "http://autocomplete3", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "http://autocomplete3" + }); + await promiseFormsProcessedInSameProcess(); + + checkLoginForm(form.uname, "", form.pword, ""); + + // Insert a new username field into the form. We'll then make sure + // that invoking the autocomplete doesn't try to fill the form. + const newField = document.createElement("input"); + newField.setAttribute("type", "text"); + newField.setAttribute("name", "uname2"); + form.insertBefore(newField, form.pword); + await ensureLoginFormStaysFilledWith(newField, "", form.pword, ""); +}); + +add_task(async function form7_2() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete3", null, "user", "pass", "uname", "pword"] + ); + const form = createLoginForm({ + action: "http://autocomplete3" + }); + await promiseFormsProcessedInSameProcess(); + + // Insert a new username field into the form. We'll then make sure + // that invoking the autocomplete doesn't try to fill the form. + const newField = document.createElement("input"); + newField.setAttribute("type", "text"); + newField.setAttribute("name", "uname2"); + form.insertBefore(newField, form.pword); + + restoreForm(form); + const autocompleteItems = await popupByArrowDown(); + checkAutoCompleteResults(autocompleteItems, [ + "This connection is not secure. Logins entered here could be compromised. Learn More", + "user" + ], + window.location.host, + "Check dropdown is showing all logins while field is blank"); + + + synthesizeKey("KEY_ArrowDown"); // skip insecure warning + // Check first entry + synthesizeKey("KEY_ArrowDown"); + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update + synthesizeKey("KEY_Enter"); + // The form changes, so we expect the old username field to get the + // selected autocomplete value, but neither the new username field nor + // the password field should have any values filled in. + await SimpleTest.promiseWaitForCondition(() => form.uname.value == "user", + "Wait for username to get filled"); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user", form.pword, ""); + is(newField.value, "", "Verifying empty uname2"); +}); + +add_task(async function form8() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete", null, "user", "pass", "uname", "pword"] + ); + const form1 = createLoginForm({ + num: 1, + action: "http://autocomplete-other" + }); + const form2 = createLoginForm({ + num: 2, + action: "http://autocomplete" + }); + await promiseFormsProcessedInSameProcess(2); + + checkLoginForm(form2.uname, "user", form2.pword, "pass"); + + restoreForm(form2); + checkLoginForm(form2.uname, "", form2.pword, ""); + + form1.uname.focus(); + checkLoginForm(form2.uname, "", form2.pword, ""); +}); + +add_task(async function form9_filtering() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete", null, "form9userAB", "pass-1", "uname", "pword"], + [location.origin, "http://autocomplete", null, "form9userAAB", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "http://autocomplete" + }); + await promiseFormsProcessedInSameProcess(); + + let results = await popupBy(() => form.uname.focus()); + checkAutoCompleteResults(results, [ + "This connection is not secure. Logins entered here could be compromised. Learn More", + "form9userAAB", + "form9userAB" + ], + window.location.host, + "Check dropdown is showing all logins while field is blank"); + synthesizeKey("KEY_Escape"); // Need to close the popup so we can get another popupshown after sending the string below. + + results = await popupBy(() => sendString("form9userAB")); + checkAutoCompleteResults(results, [ + "This connection is not secure. Logins entered here could be compromised. Learn More", + "form9userAB" + ], + window.location.host, + "Check dropdown is showing login with only one 'A'"); + + checkLoginForm(form.uname, "form9userAB", form.pword, ""); + form.uname.focus(); + synthesizeKey("KEY_ArrowLeft"); + results = await popupBy(() => synthesizeKey("A", {shiftKey: true})); + + checkLoginForm(form.uname, "form9userAAB", form.pword, ""); + checkAutoCompleteResults(results, [ + "This connection is not secure. Logins entered here could be compromised. Learn More", + "form9userAAB" + ], + window.location.host, "Check dropdown is updated after inserting 'A'"); + synthesizeKey("KEY_ArrowDown"); // skip insecure warning + synthesizeKey("KEY_ArrowDown"); + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "form9userAAB", form.pword, "pass-2"); +}); + +add_task(async function form9_autocomplete_cache() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete", null, "form9userAB", "pass-1", "uname", "pword"], + [location.origin, "http://autocomplete", null, "form9userAAB", "pass-2", "uname", "pword"] + ); + const form = createLoginForm({ + action: "http://autocomplete" + }); + await promiseFormsProcessedInSameProcess(); + + await popupBy(() => form.uname.focus()); + + await addLoginsInParent( + [location.origin, "http://autocomplete", null, "form9userAABzz", "pass-3", "uname", "pword"] + ); + + const promise1 = notifyMenuChanged(2); + sendString("z"); + const results1 = await promise1; + checkAutoCompleteResults(results1, [ + "This connection is not secure. Logins entered here could be compromised. Learn More", + ], window.location.host, + "Check popup does not have any login items"); + + // check that empty results are cached - bug 496466 + const promise2 = notifyMenuChanged(2); + sendString("z"); + const results2 = await promise2; + checkAutoCompleteResults(results2, [ + "This connection is not secure. Logins entered here could be compromised. Learn More", + ], window.location.host, + "Check popup only has the footer when it opens"); +}); + +add_task(async function form12_recipes() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete", null, "user", "pass", "uname", "pword"] + ); + const form = createLoginForm({ + action: "http://autocomplete", + password: { + type: "text" + } + }); + + await loadRecipes({ + siteRecipes: [{ + "hosts": [window.location.host], + "usernameSelector": "input[name='1']", + "passwordSelector": "input[name='2']", + }], + }); + + // First test DOMAutocomplete + // Switch the password field to type=password so _fillForm marks the username + // field for autocomplete. + form.pword.type = "password"; + await promiseFormsProcessedInSameProcess(); + restoreForm(form); + checkLoginForm(form.uname, "", form.pword, ""); + await popupByArrowDown(); + + synthesizeKey("KEY_ArrowDown"); // skip insecure warning + synthesizeKey("KEY_ArrowDown"); + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + await promiseACPopupClosed(); + checkLoginForm(form.uname, "user", form.pword, "pass"); + + // Now test recipes with blur on the username field. + restoreForm(form); + checkLoginForm(form.uname, "", form.pword, ""); + form.uname.value = "user"; + checkLoginForm(form.uname, "user", form.pword, ""); + synthesizeKey("KEY_Tab"); + await promiseFormsProcessedInSameProcess(); + checkLoginForm(form.uname, "user", form.pword, "pass"); + await resetRecipes(); +}); + +add_task(async function form11_formless() { + await setStoredLoginsAsync( + [location.origin, location.origin, null, "user", "pass", "uname", "pword"] + ); + const form = createLoginForm(); + await promiseFormsProcessedInSameProcess(); + + // Test form-less autocomplete + restoreForm(form); + checkLoginForm(form.uname, "", form.pword, ""); + await popupByArrowDown(); + + synthesizeKey("KEY_ArrowDown"); // skip insecure warning + // Trigger autocomplete + synthesizeKey("KEY_ArrowDown"); + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + checkLoginForm(form.uname, "user", form.pword, "pass"); +}); + +add_task(async function form13_stays_open_upon_empty_search() { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete:8888", null, "", "pass", "", "pword"], + ); + const form = createLoginForm({ + action: "http://autocomplete:8888", + username: { + value: "prefilled" + }, + password: { + value: "prefilled" + } + }); + await promiseFormsProcessedInSameProcess(); + + checkLoginForm(form.uname, "prefilled", form.pword, "prefilled"); + + form.uname.scrollIntoView(); + await popupBy(() => synthesizeMouseAtCenter(form.uname, {})); + form.uname.select(); + synthesizeKey("KEY_Delete"); + + await ensureLoginFormStaysFilledWith(form.uname, "", form.pword, "prefilled"); + let popupState = await getPopupState(); + is(popupState.open, true, "Check popup is still open"); + + info("testing password field"); + synthesizeMouseAtCenter(form.pword, {}); + form.pword.select(); + popupState = await getPopupState(); + is(popupState.open, false, "Check popup closed since password field isn't empty"); + await popupBy(() => synthesizeKey("KEY_Delete")); + checkLoginForm(form.uname, "", form.pword, ""); +}); +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_basic_form_related_realms.html b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_basic_form_related_realms.html new file mode 100644 index 0000000000..988cd05954 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_basic_form_related_realms.html @@ -0,0 +1,106 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test login autocomplete with related realms</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" href="/tests/SimpleTest/test.css"/> +</head> +<body> +Login Manager test: related realms autocomplete +<p id="display"></p> +<div id="content"></div> +<pre id="test"> +<script class="testbody" type="text/javascript"> +/** Test for Login Manager: related realms autocomplete. **/ + +function sendFakeAutocompleteEvent(element) { + var acEvent = document.createEvent("HTMLEvents"); + acEvent.initEvent("DOMAutoComplete", true, false); + element.dispatchEvent(acEvent); +} + +async function promiseACPopupClosed() { + return SimpleTest.promiseWaitForCondition(async () => { + const popupState = await getPopupState(); + return !popupState.open; + }, "Wait for AC popup to be closed"); +} + +add_setup(async () => { + await setStoredLoginsAsync( + // Simple related domain relationship where example.com and other-example.com are in the related domains list + ["https://other-example.com", "https://other-example.com", null, "relatedUser1", "relatedPass1", "uname", "pword"], + + // Example.com and example.co.uk are related, so sub.example.co.uk should appear on example.com's autocomplete dropdown + // The intent is to cover the ebay.com/ebay.co.uk and all other country TLD cases + // where the sign in page is actually signin.ebay.com/signin.ebay.co.uk but credentials could have manually been entered + // for ebay.com/ebay.co.uk or automatically stored as signin.ebay.com/sigin.ebay.co.uk + ["https://sub.example.co.uk", "https://sub.example.co.uk", null, "subUser1", "subPass1", "uname", "pword"], + ); + listenForUnexpectedPopupShown(); +}); + +add_task(async function test_form1_initial_empty() { + const form = createLoginForm(); + await promiseFormsProcessedInSameProcess(); + + // Make sure initial form is empty. + checkLoginForm(form.uname, "", form.pword, ""); + const popupState = await getPopupState(); + is(popupState.open, false, "Check popup is initially closed"); +}); + +add_task(async function test_form_related_domain_menuitems() { + const form = createLoginForm(); + await promiseFormsProcessedInSameProcess(); + + form.uname.focus(); + + const autocompleteItems = await popupByArrowDown(); + const popupState = await getPopupState(); + + is(popupState.selectedIndex, -1, "Check no entires are selected upon opening"); + + const expectedMenuItems = ["relatedUser1", "subUser1"]; + checkAutoCompleteResults(autocompleteItems, expectedMenuItems, window.location.host, "Check all menuitems are displayed correctly"); + + const acEvents = await getTelemetryEvents({ process: "parent", filterProps: TelemetryFilterPropsAC, clear: true }); + is(acEvents.length, 1, "One autocomplete event"); + checkACTelemetryEvent(acEvents[0], form.uname, { + "hadPrevious": "0", + "login": expectedMenuItems.length + "", + "loginsFooter": "1" + }); + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update just by opening + + synthesizeKey("KEY_ArrowDown"); // first item + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update just by selecting + + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + is(form.pword.value, "relatedPass1", "password should match the login that was selected"); + checkLoginForm(form.uname, "relatedUser1", form.pword, "relatedPass1"); + + form.uname.value = ""; + form.pword.value = ""; + form.uname.focus(); + + await popupByArrowDown(); + + synthesizeKey("KEY_ArrowDown"); // first item + synthesizeKey("KEY_ArrowDown"); // second item + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update just by selecting + + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + is(form.pword.value, "subPass1", "password should match the login that was selected"); + checkLoginForm(form.uname, "subUser1", form.pword, "subPass1"); +}); +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_basic_form_subdomain.html b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_basic_form_subdomain.html new file mode 100644 index 0000000000..685c2044c8 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_basic_form_subdomain.html @@ -0,0 +1,117 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test that logins with non-exact match origin appear in autocomplete dropdown</title> + <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: logins with non-exact match origin appear in autocomplete dropdown +<p id="display"></p> + +<!-- we presumably can't hide the content for this test. --> +<div id="content"></div> +<pre id="test"> +<script class="testbody" type="text/javascript"> +const setupScript = runInParent(function setup() { + addMessageListener("getDateString", () => { + const dateAndTimeFormatter = new Services.intl.DateTimeFormat(undefined, { dateStyle: "medium" }); + return dateAndTimeFormatter.format(new Date()); + }); +}); + +add_setup(async () => { + const origin = window.location.origin; + const lastDot = origin.lastIndexOf("."); + const suffix = origin.slice(lastDot); + + const baseHost = "http://example" + suffix; + const baseSecureHost = "https://example" + suffix; + const oldHost = "http://old.example" + suffix; + const oldSecureHost = "https://old.example" + suffix; + const newHost = "https://new.example" + suffix; + + await addLoginsInParent( + // The first two logins should never be visible on https: versions of + // *.example.com since the login is for http: and an https: login exists for this username. + [oldHost, oldSecureHost, null, "dsdu1", "dsdp1new", "uname", "pword"], + [baseHost, baseSecureHost, null, "dsdu1", "dsdp1", "uname", "pword"], + [oldSecureHost, oldSecureHost, null, "dsdu1", "dsdp1", "uname", "pword"], + [baseSecureHost, baseSecureHost, null, "dsdu1", "dsdp1", "uname", "pword"], + [newHost, newHost, null, "dsdu1", "dsdp1prime", "uname", "pword"] + ); + + await SpecialPowers.pushPrefEnv({ + set: [ + ["signon.includeOtherSubdomainsInLookup", true], + ], + }); + listenForUnexpectedPopupShown(); +}); + +add_task(async function test_form1_initial_empty() { + const form = createLoginForm({ + action: "https://otherexample.com/formtest.js" + }); + + // Make sure initial form is empty. + checkLoginForm(form.uname, "", form.pword, ""); + const popupState = await getPopupState(); + is(popupState.open, false, "Check popup is initially closed"); +}); + +/* For this testcase, there exists two logins for this origin + * on different subdomains but with different passwords. Both logins + * should appear in the autocomplete popup. + */ +add_task(async function test_form1_menu_shows_two_logins_same_usernames_for_different_subdomain() { + const form = createLoginForm({ + action: "https://otherexample.com/formtest.js" + }); + + // Trigger autocomplete popup + form.uname.focus(); + + const autocompleteItems = await popupByArrowDown(); + + const popupState = await getPopupState(); + is(popupState.selectedIndex, -1, "Check no entries are selected upon opening"); + + // The logins are added "today" and since they are duplicates, the date that they were last + // changed will be appended. + const dateString = await setupScript.sendQuery("getDateString"); + const username = `dsdu1 (${dateString})`; + + checkAutoCompleteResults(autocompleteItems, [username, username], window.location.host, "Check all menuitems are displayed correctly."); + + synthesizeKey("KEY_ArrowDown"); // first item + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update just by selecting + + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + is(form.pword.value, "dsdp1", "password should match the login that was selected"); + checkLoginForm(form.uname, "dsdu1", form.pword, "dsdp1"); + + form.uname.value = ""; + form.pword.value = ""; + form.uname.focus(); + + await popupByArrowDown(); + + synthesizeKey("KEY_ArrowDown"); // first item + synthesizeKey("KEY_ArrowDown"); // second item + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update just by selecting + + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + is(form.pword.value, "dsdp1prime", "Password should match the login that was selected"); + checkLoginForm(form.uname, "dsdu1", form.pword, "dsdp1prime"); +}); +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_hasBeenTypePassword.html b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_hasBeenTypePassword.html new file mode 100644 index 0000000000..6e520952b2 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_hasBeenTypePassword.html @@ -0,0 +1,101 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test that passwords are autocompleted into fields that were previously type=password</title> + <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: Test that passwords are autocompleted into fields that were previously type=password +<p id="display"></p> + +<!-- we presumably can't hide the content for this test. --> +<div id="content"></div> +<pre id="test"> +<script class="testbody" type="text/javascript"> + +// Restore the form to the default state. +function restoreForm(form) { + form.uname.value = ""; + form.pword.value = ""; + form.uname.focus(); +} + +function spinEventLoop() { + return Promise.resolve(); +} + +add_setup(async () => { + const origin = window.location.origin; + await addLoginsInParent( + [origin, origin, null, "user1", "pass1"], + [origin, origin, null, "user2", "pass2"] + ); + listenForUnexpectedPopupShown(); +}); + +add_task(async function test_form1_initial_empty() { + const form = createLoginForm({ + action: "https://www.example.com/formtest.js" + }); + + await SimpleTest.promiseFocus(window); + + // Make sure initial form is empty. + checkLoginForm(form.uname, "", form.pword, ""); + const popupState = await getPopupState(); + is(popupState.open, false, "Check popup is initially closed"); +}); + +add_task(async function test_form1_password_to_type_text() { + const form = createLoginForm({ + action: "https://www.example.com/formtest.js" + }); + + await SimpleTest.promiseFocus(window); + info("Setting the password field type to text"); + // This is similar to a site implementing their own password visibility/unmasking toggle + form.pword.type = "text"; + + // Trigger autocomplete popup + restoreForm(form); + const autocompleteItems = await popupByArrowDown(); + + const popupState = await getPopupState(); + is(popupState.selectedIndex, -1, "Check no entries are selected upon opening"); + + checkAutoCompleteResults(autocompleteItems, ["user1", "user2"], window.location.host, + "Check all menuitems are displayed correctly."); + + synthesizeKey("KEY_ArrowDown"); // first item + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update just by selecting + + synthesizeKey("KEY_Enter"); + + await promiseFormsProcessedInSameProcess(); + is(form.uname.value, "user1", "username should match the login, not the password"); + is(form.pword.value, "pass1", "password should match the login, not the username"); + checkLoginForm(form.uname, "user1", form.pword, "pass1"); + + restoreForm(form); + info("Focusing the password field"); + form.pword.focus(); + + await popupByArrowDown(); + + synthesizeKey("KEY_ArrowDown"); // first item + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update just by selecting + + synthesizeKey("KEY_Enter"); + await spinEventLoop(); + is(form.pword.value, "pass1", "Password should match the login that was selected"); + checkLoginForm(form.uname, "", form.pword, "pass1"); +}); +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_highlight.html b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_highlight.html new file mode 100644 index 0000000000..dfde95e1e4 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_highlight.html @@ -0,0 +1,87 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test form field autofill highlight</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/> +</head> +<body> +<p id="display"></p> +<div id="content"></div> +<pre id="test"> +<script> +const { ContentTaskUtils } = SpecialPowers.ChromeUtils.import( + "resource://testing-common/ContentTaskUtils.jsm" +); + +add_setup(async () => { + const origin = window.location.origin; + await addLoginsInParent( + [origin, "https://autocomplete", null, "user1", "pass1", "", ""], + [origin, "https://autocomplete", null, "user2", "pass2", "", ""] + ); +}); + +add_task(async function test_field_highlight_on_autocomplete() { + const form = createLoginForm({ + action: "https://autocomplete" + }); + + await openPopupOn(form.uname); + synthesizeKey("KEY_ArrowDown"); + await synthesizeKey("KEY_Enter"); + + await ContentTaskUtils.waitForCondition(() => { + return form.uname.matches(":autofill") + }, "Highlight was successfully applied to the username field on username autocomplete"); + + ok(form.pword.matches(":autofill"), + "Highlight was successfully applied to the password field on username autocomplete"); + + // Clear existing highlight on login fields. We check by pressing the tab key after backspace + // (by shifting focus to the next element) because the tab key was known to cause a bug where the + // highlight is applied once again. See Bug 1526522. + form.uname.focus(); + synthesizeKey("KEY_Backspace"); + synthesizeKey("KEY_Tab"); + ok(!form.uname.matches(":autofill"), + "Highlight was successfully removed on the username field"); + + synthesizeKey("KEY_Backspace"); + synthesizeKey("KEY_Tab"); + ok(!form.pword.matches(":autofill"), + "Highlight was successfully removed on the password field"); + + // Clear login fields. + form.uname.value = ""; + form.pword.value = ""; + + // Test password field autocomplete. + await openPopupOn(form.pword); + synthesizeKey("KEY_ArrowDown"); + synthesizeKey("KEY_Enter"); + + await ContentTaskUtils.waitForCondition(() => { + return form.pword.matches(":autofill"); + }, "Highlight was successfully applied to the password field on password autocomplete"); + + // Clear existing highlight on the password field. We check by pressing the tab key after backspace + // (by shifting focus to the next element) because the tab key was known to cause a bug where the + // highlight is applied once again. See Bug 1526522. + synthesizeKey("KEY_Backspace"); + synthesizeKey("KEY_Tab"); + + ok(!form.pword.matches(":autofill"), + "Highlight was successfully removed on the password field"); + + // Clear login fields. + form.uname.value = ""; + form.pword.value = ""; +}); +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_highlight_non_login.html b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_highlight_non_login.html new file mode 100644 index 0000000000..eb82e90656 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_highlight_non_login.html @@ -0,0 +1,91 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test form field autofill highlight</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/> +</head> +<body> +<p id="display"></p> +<div id="content"></div> +<pre id="test"> +<script> +function closeCurrentTab() { + runInParent(function cleanUpWindow() { + let window = Services.wm.getMostRecentWindow("navigator:browser"); + window.gBrowser.removeTab(window.gBrowser.selectedTab); + }); +} + +add_setup(async () => { + await setStoredLoginsAsync( + [location.origin, "http://autocomplete", null, "user1", "pass1", "", ""], + [location.origin, "http://autocomplete", null, "user2", "pass2", "", ""] + ); +}); + +add_task(async function test_field_highlight_on_pw_field_autocomplete_insecureWarning() { + const form = createLoginForm({ + action: "http://autocomplete" + }); + await promiseFormsProcessedInSameProcess(); + + // Press enter on insecure warning and check. + form.pword.focus(); + await popupByArrowDown(); + synthesizeKey("KEY_ArrowDown"); // insecure warning + synthesizeKey("KEY_Enter"); + + is(document.defaultView.getComputedStyle(form.pword).getPropertyValue("filter"), "none", + "Highlight is not applied to the password field if enter key is pressed on the insecure warning item"); + is(document.defaultView.getComputedStyle(form.uname).getPropertyValue("filter"), "none", + "Highlight is not applied to the username field if enter key is pressed on the insecure warning item"); + + // Press tab on insecure warning and check. + await openPopupOn(form.pword); + synthesizeKey("KEY_ArrowDown"); // insecure warning + synthesizeKey("KEY_Tab"); + + is(document.defaultView.getComputedStyle(form.pword).getPropertyValue("filter"), "none", + "Highlight is not applied to the password field if tab key is pressed on the insecure warning item"); + is(document.defaultView.getComputedStyle(form.uname).getPropertyValue("filter"), "none", + "Highlight is not applied to the username field if tab key is pressed on the insecure warning item"); +}); + +add_task(async function test_field_highlight_on_pw_field_autocomplete_footer() { + const form = createLoginForm({ + action: "http://autocomplete" + }); + await promiseFormsProcessedInSameProcess(); + + // Press enter on the footer and check. + await openPopupOn(form.pword); + synthesizeKey("KEY_ArrowUp"); // footer + synthesizeKey("KEY_Enter"); + + is(document.defaultView.getComputedStyle(form.pword).getPropertyValue("filter"), "none", + "Highlight is not applied to the password field if enter key is pressed on the footer item"); + is(document.defaultView.getComputedStyle(form.uname).getPropertyValue("filter"), "none", + "Highlight is not applied to the username field if enter key is pressed on the footer item"); + + closeCurrentTab(); + + // Press tab on the footer and check. + await openPopupOn(form.pword); + synthesizeKey("KEY_ArrowUp"); // footer + synthesizeKey("KEY_Tab"); + + is(document.defaultView.getComputedStyle(form.pword).getPropertyValue("filter"), "none", + "Highlight is not applied to the password field if tab key is pressed on the footer item"); + is(document.defaultView.getComputedStyle(form.uname).getPropertyValue("filter"), "none", + "Highlight is not applied to the username field if tab key is pressed on the insecure warning item"); + + closeCurrentTab(); +}); +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_highlight_username_only_form.html b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_highlight_username_only_form.html new file mode 100644 index 0000000000..884bdc66d3 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_highlight_username_only_form.html @@ -0,0 +1,56 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test form field autofill highlight</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/> +</head> +<body> +<p id="display"></p> +<div id="content"></div> +<pre id="test"> +<script> +const { ContentTaskUtils } = SpecialPowers.ChromeUtils.import( + "resource://testing-common/ContentTaskUtils.jsm" +); + +add_setup(async () => { + await addLoginsInParent( + [location.origin, "https://autocomplete", null, "user1", "pass1", "", ""], + [location.origin, "https://autocomplete", null, "user2", "pass2", "", ""] + ); +}); + +add_task(async function test_username_field_in_username_only_form_highlight_on_autocomplete() { + const form = createLoginForm({ + action: "https://autocomplete", + username: { + autocomplete: "username" + }, + password: false + }); + + await openPopupOn(form.uname); + synthesizeKey("KEY_ArrowDown"); + await synthesizeKey("KEY_Enter"); + + await ContentTaskUtils.waitForCondition(() => { + return form.uname.matches(":autofill"); + }, "Highlight was successfully applied to the username field on username autocomplete"); + + // Clear existing highlight on login fields. We check by pressing the tab key after backspace + // (by shifting focus to the next element) because the tab key was known to cause a bug where the + // highlight is applied once again. See Bug 1526522. + form.uname.focus(); + synthesizeKey("KEY_Backspace"); + synthesizeKey("KEY_Tab"); + ok(!form.uname.matches(":autofill"), + "Highlight was successfully removed on the username field"); +}); +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_https_downgrade.html b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_https_downgrade.html new file mode 100644 index 0000000000..109b3e91c6 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_https_downgrade.html @@ -0,0 +1,105 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test autocomplete on an HTTPS page using upgraded HTTP logins</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<p id="display"></p> + +<!-- we presumably can't hide the content for this test. --> +<div id="content"> + <iframe></iframe> +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> +const origin = "http://" + window.location.host; +const secureOrigin = "https://" + window.location.host; +const iframe = document.getElementsByTagName("iframe")[0]; +let iframeDoc, hostname; +let uname; +let pword; + +// Restore the form to the default state. +function restoreForm() { + return SpecialPowers.spawn(getIframeBrowsingContext(window), [], function() { + this.content.document.getElementById("form-basic-password").focus(); + this.content.document.getElementById("form-basic-username").value = ""; + this.content.document.getElementById("form-basic-password").value = ""; + this.content.document.getElementById("form-basic-username").focus(); + }); +} + +const HTTP_FORM_URL = origin + "/tests/toolkit/components/passwordmgr/test/mochitest/form_basic.html"; + +add_setup(async () => { + await setStoredLoginsAsync( + // We have two actual HTTPS to avoid autofill before the schemeUpgrades pref flips to true. + [secureOrigin, secureOrigin, null, "name", "pass", "uname", "pword"], + [secureOrigin, secureOrigin, null, "name1", "pass1", "uname", "pword"], + // Same as above but HTTP instead of HTTPS (to test de-duping) + [origin, origin, null, "name1", "pass1", "uname", "pword"], + // Different HTTP login to upgrade with secure formActionOrigin + [origin, secureOrigin, null, "name2", "passHTTPtoHTTPS", "uname", "pword"] + ); +}); + +async function setup(formUrl) { + await SpecialPowers.pushPrefEnv({"set": [["signon.schemeUpgrades", true]]}); + + let processedPromise = promiseFormsProcessed(); + iframe.src = formUrl; + await new Promise(resolve => { + iframe.addEventListener("load", function() { + resolve(); + }, {once: true}); + }); + + await processedPromise; + + hostname = await SpecialPowers.spawn(getIframeBrowsingContext(window), [], function() { + return this.content.document.documentURIObject.host; + }); +} + +add_task(async function test_autocomplete_https_downgrade() { + info("test_autocomplete_http, setup with " + HTTP_FORM_URL); + await setup(HTTP_FORM_URL); + + LoginManager.getAllLogins().then(logins => { + info("got logins: " + logins.map(l => l.origin)); + }); + // from a HTTP page, look for matching logins, we should never offer a login with an HTTPS scheme + // we're expecting just login2 as a match + let isCrossOrigin = false; + try { + // If this is a cross-origin test, the parent will be inaccessible. The fields + // should not be filled in. + window.parent.windowGlobalChild; + } catch(ex) { + isCrossOrigin = true; + } + + await checkLoginFormInFrame(iframe, "form-basic-username", isCrossOrigin ? "" : "name1", + "form-basic-password", isCrossOrigin ? "" : "pass1"); + + // Trigger autocomplete popup + await restoreForm(); + let popupState = await getPopupState(); + is(popupState.open, false, "Check popup is initially closed"); + const autocompleteItems = await popupByArrowDown(); + info("got results: " + autocompleteItems.join(", ")); + popupState = await getPopupState(); + is(popupState.selectedIndex, -1, "Check no entries are selected"); + checkAutoCompleteResults(autocompleteItems, ["This connection is not secure. Logins entered here could be compromised. Learn More", "name1", "name2"], hostname, "initial"); +}); +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_https_upgrade.html b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_https_upgrade.html new file mode 100644 index 0000000000..a0a81a8c88 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_https_upgrade.html @@ -0,0 +1,191 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test autocomplete on an HTTPS page using upgraded HTTP logins</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<p id="display"></p> + +<!-- we presumably can't hide the content for this test. --> +<div id="content"> + <iframe></iframe> +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> +const originSecure = "https://" + window.location.host; +const originNonSecure = "http://" + window.location.host; +const iframe = document.getElementsByTagName("iframe")[0]; +let iframeDoc, hostname; + +// Restore the form to the default state. +function restoreForm() { + return SpecialPowers.spawn(getIframeBrowsingContext(window), [], function() { + this.content.document.getElementById("form-basic-password").focus(); + this.content.document.getElementById("form-basic-username").value = ""; + this.content.document.getElementById("form-basic-password").value = ""; + this.content.document.getElementById("form-basic-username").focus(); + }); +} + +const HTTPS_FORM_URL = originSecure + "/tests/toolkit/components/passwordmgr/test/mochitest/form_basic.html"; + +async function setup(formUrl = HTTPS_FORM_URL) { + await SpecialPowers.pushPrefEnv({"set": [["signon.schemeUpgrades", true]]}); + + let processedPromise = promiseFormsProcessed(); + iframe.src = formUrl; + await new Promise(resolve => { + iframe.addEventListener("load", function() { + resolve(); + }, {once: true}); + }); + + await processedPromise; + + hostname = await SpecialPowers.spawn(getIframeBrowsingContext(window), [], function() { + return this.content.document.documentURIObject.host; + }); +} + +add_setup(async () => { + await setStoredLoginsAsync( + // We have two actual HTTPS to avoid autofill before the schemeUpgrades pref flips to true. + [originSecure, originSecure, null, "name", "pass", "uname", "pword"], + [originSecure, originSecure, null, "name1", "pass1", "uname", "pword"], + + // Same as above but HTTP instead of HTTPS (to test de-duping) + [originNonSecure, originNonSecure, null, "name1", "pass1", "uname", "pword"], + + // Different HTTP login to upgrade with secure formActionOrigin + [originNonSecure, originSecure, null, "name2", "passHTTPtoHTTPS", "uname", "pword"] + ); +}); + +add_task(async function setup_https_frame() { + await setup(HTTPS_FORM_URL); +}); + +add_task(async function test_empty_first_entry() { + // Make sure initial form is empty. + await checkLoginFormInFrame(getIframeBrowsingContext(window, 0), "form-basic-username", "", "form-basic-password", ""); + // Trigger autocomplete popup + await restoreForm(); + let popupState = await getPopupState(); + is(popupState.open, false, "Check popup is initially closed"); + let autocompleteItems = await popupBy(); + popupState = await getPopupState(); + is(popupState.selectedIndex, -1, "Check no entries are selected"); + checkAutoCompleteResults(autocompleteItems, ["name", "name1", "name2"], hostname, "initial"); + + // Check first entry + let index0Promise = notifySelectedIndex(0); + synthesizeKey("KEY_ArrowDown"); + await index0Promise; + await checkLoginFormInFrame(getIframeBrowsingContext(window, 0), "form-basic-username", "", "form-basic-password", ""); // value shouldn't update + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + await checkLoginFormInFrame(getIframeBrowsingContext(window, 0), "form-basic-username", "name", "form-basic-password", "pass"); +}); + +add_task(async function test_empty_second_entry() { + await restoreForm(); + await popupBy(); + synthesizeKey("KEY_ArrowDown"); // first + synthesizeKey("KEY_ArrowDown"); // second + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + await checkLoginFormInFrame(getIframeBrowsingContext(window, 0), "form-basic-username", "name1", "form-basic-password", "pass1"); +}); + +add_task(async function test_search() { + await restoreForm(); + let results = await popupBy(async () => { + // We need to blur for the autocomplete controller to notice the forced value below. + await SpecialPowers.spawn(getIframeBrowsingContext(window), [], function() { + let uname = this.content.document.getElementById("form-basic-username"); + uname.blur(); + uname.value = "name"; + uname.focus(); + }); + + sendChar("1"); + synthesizeKey("KEY_ArrowDown"); // open + }); + checkAutoCompleteResults(results, ["name1"], hostname, "check result deduping for 'name1'"); + synthesizeKey("KEY_ArrowDown"); // first + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + await checkLoginFormInFrame(getIframeBrowsingContext(window, 0), "form-basic-username", "name1", "form-basic-password", "pass1"); + + let popupState = await getPopupState(); + is(popupState.open, false, "Check popup is now closed"); +}); + +add_task(async function test_delete_first_entry() { + await restoreForm(); + await popupBy(); + + let index0Promise = notifySelectedIndex(0); + synthesizeKey("KEY_ArrowDown"); + await index0Promise; + + let deletionPromise = promiseStorageChanged(["removeLogin"]); + // On OS X, shift-backspace and shift-delete work, just delete does not. + // On Win/Linux, shift-backspace does not work, delete and shift-delete do. + synthesizeKey("KEY_Delete", {shiftKey: true}); + await deletionPromise; + await checkLoginFormInFrame(getIframeBrowsingContext(window, 0), "form-basic-username", "", "form-basic-password", ""); + + let results = await notifyMenuChanged(3, "name1"); + + checkAutoCompleteResults(results, ["name1", "name2"], hostname, "two logins should remain after deleting the first"); + let popupState = await getPopupState(); + is(popupState.open, true, "Check popup stays open after deleting"); + synthesizeKey("KEY_Escape"); + popupState = await getPopupState(); + is(popupState.open, false, "Check popup closed upon ESC"); +}); + +add_task(async function test_delete_duplicate_entry() { + await restoreForm(); + await popupBy(); + + let index0Promise = notifySelectedIndex(0); + synthesizeKey("KEY_ArrowDown"); + await index0Promise; + + let deletionPromise = promiseStorageChanged(["removeLogin"]); + // On OS X, shift-backspace and shift-delete work, just delete does not. + // On Win/Linux, shift-backspace does not work, delete and shift-delete do. + synthesizeKey("KEY_Delete", {shiftKey: true}); + await deletionPromise; + await checkLoginFormInFrame(getIframeBrowsingContext(window, 0), "form-basic-username", "", "form-basic-password", ""); + + is(await LoginManager.countLogins(originNonSecure, originNonSecure, null), 1, + "Check that the HTTP login remains"); + is(await LoginManager.countLogins(originSecure, originSecure, null), 0, + "Check that the HTTPS login was deleted"); + + // Two menu items should remain as the HTTPS login should have been deleted but + // the HTTP would remain. + let results = await notifyMenuChanged(2, "name2"); + + checkAutoCompleteResults(results, ["name2"], hostname, "one login should remain after deleting the HTTPS name1"); + let popupState = await getPopupState(); + is(popupState.open, true, "Check popup stays open after deleting"); + synthesizeKey("KEY_Escape"); + popupState = await getPopupState(); + is(popupState.open, false, "Check popup closed upon ESC"); +}); + +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_password_generation.html b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_password_generation.html new file mode 100644 index 0000000000..3555b9173d --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_password_generation.html @@ -0,0 +1,574 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test autofill and autocomplete on autocomplete=new-password fields</title> + <!-- This test assumes that telemetry events are not cleared after the `setup` task. --> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script src="pwmgr_common.js"></script> + <script src="../../../satchel/test/satchel_common.js"></script> + <link rel="stylesheet" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: autofill with autocomplete=new-password fields + +<p id="display"></p> + +<!-- we presumably can't hide the content for this test. --> +<div id="content"></div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> +const { ContentTaskUtils } = SpecialPowers.ChromeUtils.import( + "resource://testing-common/ContentTaskUtils.jsm" +); +const { TestUtils } = SpecialPowers.ChromeUtils.import( + "resource://testing-common/TestUtils.jsm" +); + +let dateAndTimeFormatter = new SpecialPowers.Services.intl.DateTimeFormat(undefined, { + dateStyle: "medium", +}); + +const TelemetryFilterPropsUsed = Object.freeze({ + category: "pwmgr", + method: "autocomplete_field", + object: "generatedpassword", +}); + +const TelemetryFilterPropsShown = Object.freeze({ + category: "pwmgr", + method: "autocomplete_shown", + object: "generatedpassword", +}); + +async function waitForTelemetryEventsCondition(cond, options = {}, + errorMsg = "waitForTelemetryEventsCondition timed out", maxTries = 200) { + return TestUtils.waitForCondition(async () => { + let events = await getTelemetryEvents(options); + let result; + try { + result = cond(events); + info("waitForTelemetryEventsCondition, result: " + result); + } catch (e) { + info("waitForTelemetryEventsCondition caught exception, got events: " + JSON.stringify(events)); + ok(false, `${e}\n${e.stack}`); + } + return result ? events : null; + }, errorMsg, maxTries); +} + +async function promiseACPopupClosed() { + return SimpleTest.promiseWaitForCondition(async () => { + let popupState = await getPopupState(); + return !popupState.open; + }, "Wait for AC popup to be closed"); +} + +async function showACPopup(formNumber, expectedACLabels) { + const autocompleteItems = await popupByArrowDown(); + checkAutoCompleteResults(autocompleteItems, expectedACLabels, + window.location.host, "Check all rows are correct"); +} + +async function checkTelemetryEventsPWGenShown(expectedPWGenTelemetryEvents) { + info(`showed generated password option, check there are now ${expectedPWGenTelemetryEvents} generatedpassword telemetry events`); + await waitForTelemetryEventsCondition(events => { + return events.length == expectedPWGenTelemetryEvents; + }, { process: "parent", filterProps: TelemetryFilterPropsShown }, `Wait for there to be ${expectedPWGenTelemetryEvents} shown telemetry events`); +} + +async function checkTelemetryEventsPWGenUsed(expectedPWGenTelemetryEvents) { + info("filled generated password again, ensure we don't record another generatedpassword autocomplete telemetry event"); + let telemetryEvents; + try { + telemetryEvents = await waitForTelemetryEventsCondition(events => events.length == expectedPWGenTelemetryEvents + 1, + { process: "parent", filterProps: TelemetryFilterPropsUsed }, + `Wait for there to be ${expectedPWGenTelemetryEvents + 1} used events`, 50); + } catch (ex) {} + ok(!telemetryEvents, `Expected to timeout waiting for there to be ${expectedPWGenTelemetryEvents + 1} events`); +} + +function clearGeneratedPasswords() { + const { LoginManagerParent } = ChromeUtils.import("resource://gre/modules/LoginManagerParent.jsm"); + if (LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin()) { + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().clear(); + } +} + +add_setup(async () => { + let useEvents = await getTelemetryEvents({ process: "parent", filterProps: TelemetryFilterPropsUsed, clear: true }); + is(useEvents.length, 0, "Expect 0 use events"); + let showEvents = await getTelemetryEvents({ process: "parent", filterProps: TelemetryFilterPropsShown, clear: true }); + is(showEvents.length, 0, "Expect 0 show events"); + let acEvents = await getTelemetryEvents({ process: "parent", filterProps: TelemetryFilterPropsAC, clear: true }); + is(acEvents.length, 0, "Expect 0 autocomplete events"); + + await SpecialPowers.pushPrefEnv({"set": [ + ["signon.generation.available", true], + ["signon.generation.enabled", true], + ]}); +}); + +add_task(async function test_autofillAutocompleteUsername_noGeneration() { + await SpecialPowers.pushPrefEnv({"set": [ + ["signon.generation.available", false], + ["signon.generation.enabled", false], + ]}); + await setStoredLoginsAsync([location.origin, "https://autofill", null, "user1", "pass1"]); + + createLoginForm({ + num: 1, + action: "https://autofill", + password: { + name: "p" + } + }); + const form2 = createLoginForm({ + num: 2, + action: "https://autofill", + password: { + name: "password", + autocomplete: "new-password" + } + }); + await promiseFormsProcessedInSameProcess(2); + + // reference form was filled as expected? + checkForm(1, "user1", "pass1"); + + // 2nd form should not be filled + checkForm(2, "", ""); + + form2.uname.focus(); + await showACPopup(2, ["user1"]); + + let acEvents = await waitForTelemetryEventsCondition(events => { + return events.length == 1; + }, { process: "parent", filterProps: TelemetryFilterPropsAC, clear: true }, `Wait for there to be 1 autocomplete telemetry event`); + checkACTelemetryEvent(acEvents[0], form2.uname, { + "hadPrevious": "0", + "login": "1", + "loginsFooter": "1" + }); + + synthesizeKey("KEY_ArrowDown"); + synthesizeKey("KEY_Enter"); + + await promiseFormsProcessedInSameProcess(); + checkForm(2, "user1", "pass1"); + + await SpecialPowers.popPrefEnv(); +}); + +add_task(async function test_autofillAutocompletePassword_noGeneration() { + await SpecialPowers.pushPrefEnv({"set": [ + ["signon.generation.available", false], + ["signon.generation.enabled", false], + ]}); + await setStoredLoginsAsync([location.origin, "https://autofill", null, "user1", "pass1"]); + + const form = createLoginForm({ + num: 2, + action: "https://autofill", + password: { + name: "password", + autocomplete: "new-password" + } + }); + await promiseFormsProcessedInSameProcess(); + + // 2nd form should not be filled + checkForm(2, "", ""); + + form.password.focus(); + await showACPopup(2, ["user1"]); + let acEvents = await waitForTelemetryEventsCondition(events => { + return events.length == 1; + }, { process: "parent", filterProps: TelemetryFilterPropsAC, clear: true }, `Wait for there to be 1 autocomplete telemetry event`); + checkACTelemetryEvent(acEvents[0], form.password, { + "hadPrevious": "0", + "login": "1", + "loginsFooter": "1" + }); + + synthesizeKey("KEY_ArrowDown"); + synthesizeKey("KEY_Enter"); + // Can't use promiseFormsProcessedInSameProcess() when autocomplete fills the field directly. + await SimpleTest.promiseWaitForCondition(() => form.password.value == "pass1", "Check pw filled"); + checkForm(2, "", "pass1"); + + // No autocomplete results should appear for non-empty pw fields. + await noPopupByArrowDown(); + + await SpecialPowers.popPrefEnv(); +}); + +add_task(async function test_autofillAutocompleteUsername_noGeneration2() { + await setStoredLoginsAsync([location.origin, "https://autofill", null, "user1", "pass1"]); + + const form = createLoginForm({ + num: 2, + action: "https://autofill", + password: { + name: "password", + autocomplete: "new-password" + } + }); + await promiseFormsProcessedInSameProcess(); + + // 2nd form should not be filled + checkForm(2, "", ""); + + form.uname.focus(); + // No generation option on username fields. + await showACPopup(2, ["user1"]); + let acEvents = await waitForTelemetryEventsCondition(events => { + return events.length == 1; + }, { process: "parent", filterProps: TelemetryFilterPropsAC, clear: true }, `Wait for there to be 1 autocomplete telemetry event`); + checkACTelemetryEvent(acEvents[0], form.uname, { + "hadPrevious": "0", + "login": "1", + "loginsFooter": "1" + }); + + synthesizeKey("KEY_ArrowDown"); + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + checkForm(2, "user1", "pass1"); +}); + +add_task(async function test_autofillAutocompletePassword_withGeneration() { + const formAttributesToTest = [ + { + num: 2, + action: "https://autofill", + password: { + name: "password", + autocomplete: "new-password" + } + }, + { + num: 3, + action: "https://autofill", + username: { + name: "username" + }, + password: { + name: "password", + label: "New password" + } + } + ]; + + // Bug 1616356 and Bug 1548878: Recorded once per origin + let expectedPWGenTelemetryEvents = 0; + // Bug 1619498: Recorded once every time the autocomplete popup is shown + let expectedACShownTelemetryEvents = 0; + + for (const formAttributes of formAttributesToTest) { + runInParent(clearGeneratedPasswords); + await setStoredLoginsAsync([location.origin, "https://autofill", null, "user1", "pass1"]); + + const formNumber = formAttributes.num; + + const form = createLoginForm(formAttributes); + await promiseFormsProcessedInSameProcess(); + form.reset(); + + // This form should be filled + checkForm(formNumber, "", ""); + + form.password.focus(); + + await showACPopup(formNumber, [ + "user1", + "Use a Securely Generated Password", + ]); + expectedPWGenTelemetryEvents++; + expectedACShownTelemetryEvents++; + + await checkTelemetryEventsPWGenShown(expectedPWGenTelemetryEvents); + let acEvents = await waitForTelemetryEventsCondition(events => { + return events.length == expectedACShownTelemetryEvents; + }, { process: "parent", filterProps: TelemetryFilterPropsAC }, `Wait for there to be ${expectedACShownTelemetryEvents} autocomplete telemetry event(s)`); + checkACTelemetryEvent(acEvents[expectedACShownTelemetryEvents - 1], form.password, { + "generatedPasswo": "1", + "hadPrevious": "0", + "login": "1", + "loginsFooter": "1" + }); + + synthesizeKey("KEY_ArrowDown"); + synthesizeKey("KEY_Enter"); + // Can't use promiseFormsProcessedInSameProcess() when autocomplete fills the field directly. + await SimpleTest.promiseWaitForCondition(() => form.password.value == "pass1", "Check pw filled"); + checkForm(formNumber, "", "pass1"); + + // No autocomplete results should appear for non-empty pw fields. + await noPopupByArrowDown(); + + info("Removing all logins to test auto-saving of generated passwords"); + await LoginManager.removeAllUserFacingLogins(); + + while (form.password.value) { + synthesizeKey("KEY_Backspace"); + } + LOGIN_FIELD_UTILS.checkPasswordMasked(form.password, true, "Blanked field"); + + info("This time select the generated password"); + await showACPopup(formNumber, [ + "Use a Securely Generated Password", + ]); + expectedACShownTelemetryEvents++; + + await checkTelemetryEventsPWGenShown(expectedPWGenTelemetryEvents); + acEvents = await waitForTelemetryEventsCondition(events => { + return events.length == expectedACShownTelemetryEvents; + }, { process: "parent", filterProps: TelemetryFilterPropsAC }, `Wait for there to be ${expectedACShownTelemetryEvents} autocomplete telemetry event(s)`); + checkACTelemetryEvent(acEvents[expectedACShownTelemetryEvents - 1], form.password, { + "generatedPasswo": "1", + "hadPrevious": "0", + "loginsFooter": "1" + }); + + synthesizeKey("KEY_ArrowDown"); + let storageAddPromise = promiseStorageChanged(["addLogin"]); + LOGIN_FIELD_UTILS.checkPasswordMasked(form.password, true, "Before first fill of generated pw"); + synthesizeKey("KEY_Enter"); + + info("waiting for the password field to be filled with the generated password"); + await SimpleTest.promiseWaitForCondition(() => !!form.password.value, "Check generated pw filled"); + LOGIN_FIELD_UTILS.checkPasswordMasked(form.password, false, "After first fill of generated pw"); + info("Wait for generated password to be added to storage"); + await storageAddPromise; + + let logins = await LoginManager.getAllLogins(); + let timePasswordChanged = logins[logins.length - 1].timePasswordChanged; + let time = dateAndTimeFormatter.format(new Date(timePasswordChanged)); + const LABEL_NO_USERNAME = "No username (" + time + ")"; + + let generatedPW = form.password.value; + is(generatedPW.length, GENERATED_PASSWORD_LENGTH, "Check generated password length"); + ok(generatedPW.match(GENERATED_PASSWORD_REGEX), "Check generated password format"); + LOGIN_FIELD_UTILS.checkPasswordMasked(form.password, false, "After fill"); + + info("Check field is masked upon blurring"); + synthesizeKey("KEY_Tab"); // blur + LOGIN_FIELD_UTILS.checkPasswordMasked(form.password, true, "After blur"); + synthesizeKey("KEY_Tab", { shiftKey: true }); // focus again + LOGIN_FIELD_UTILS.checkPasswordMasked(form.password, false, "After shift-tab to focus again"); + // Remove selection for OS where the whole value is selected upon focus. + synthesizeKey("KEY_ArrowRight"); + + while (form.password.value) { + LOGIN_FIELD_UTILS.checkPasswordMasked(form.password, false, form.password.value); + synthesizeKey("KEY_Backspace"); + } + LOGIN_FIELD_UTILS.checkPasswordMasked(form.password, true, "Blanked field"); + + info("Blur the empty field to trigger a 'change' event"); + synthesizeKey("KEY_Tab"); // blur + LOGIN_FIELD_UTILS.checkPasswordMasked(form.password, true, "Blur after blanking"); + synthesizeKey("KEY_Tab", { shiftKey: true }); // focus again + LOGIN_FIELD_UTILS.checkPasswordMasked(form.password, true, "Focus again after blanking"); + + info("Type a single character after blanking"); + synthesizeKey("@"); + + info("Blur the single-character field to trigger a 'change' event"); + synthesizeKey("KEY_Tab"); // blur + LOGIN_FIELD_UTILS.checkPasswordMasked(form.password, true, "Blur after backspacing"); + synthesizeKey("KEY_Tab", { shiftKey: true }); // focus again + LOGIN_FIELD_UTILS.checkPasswordMasked(form.password, true, "Focus again after backspacing"); + synthesizeKey("KEY_Backspace"); // Blank the field again + + await showACPopup(formNumber, [ + LABEL_NO_USERNAME, + "Use a Securely Generated Password", + ]); + expectedACShownTelemetryEvents++; + + synthesizeKey("KEY_ArrowDown"); + synthesizeKey("KEY_ArrowDown"); + synthesizeKey("KEY_Enter"); + await SimpleTest.promiseWaitForCondition(() => !!form.password.value, "Check generated pw filled"); + // Same generated password should be used, even despite the 'change' to @ earlier. + checkForm(formNumber, "", generatedPW); + LOGIN_FIELD_UTILS.checkPasswordMasked(form.password, false, "Second fill of the generated pw"); + + await checkTelemetryEventsPWGenUsed(expectedPWGenTelemetryEvents); + + logins = await LoginManager.getAllLogins(); + is(logins.length, 1, "Still 1 login after filling the generated password a 2nd time"); + is(logins[0].timePasswordChanged, timePasswordChanged, "Saved login wasn't changed"); + is(logins[0].password, generatedPW, "Password is the same"); + + info("filling the saved login to ensure the field is masked again"); + + while (form.password.value) { + LOGIN_FIELD_UTILS.checkPasswordMasked(form.password, false, form.password.value); + synthesizeKey("KEY_Backspace"); + } + LOGIN_FIELD_UTILS.checkPasswordMasked(form.password, true, "Blanked field again"); + + info("Blur the field to trigger a 'change' event again"); + synthesizeKey("KEY_Tab"); // blur + LOGIN_FIELD_UTILS.checkPasswordMasked(form.password, true, "Blur after blanking again"); + synthesizeKey("KEY_Tab", { shiftKey: true }); // focus again + LOGIN_FIELD_UTILS.checkPasswordMasked(form.password, true, "Focus again after blanking again"); + // Remove selection for OS where the whole value is selected upon focus. + synthesizeKey("KEY_ArrowRight"); + + await showACPopup(formNumber, [ + LABEL_NO_USERNAME, + "Use a Securely Generated Password", + ]); + expectedACShownTelemetryEvents++; + + synthesizeKey("KEY_ArrowDown"); + synthesizeKey("KEY_Enter"); + await SimpleTest.promiseWaitForCondition(() => !!form.password.value, "Check saved generated pw filled"); + // Same generated password should be used but from storage + checkForm(formNumber, "", generatedPW); + // Passwords from storage should always be masked. + LOGIN_FIELD_UTILS.checkPasswordMasked(form.password, true, "after fill from storage"); + synthesizeKey("KEY_Tab"); // blur + LOGIN_FIELD_UTILS.checkPasswordMasked(form.password, true, "after blur"); + synthesizeKey("KEY_Tab", { shiftKey: true }); // focus + LOGIN_FIELD_UTILS.checkPasswordMasked(form.password, true, "after shift-tab to focus again"); + } +}); + +add_task(async function test_autofillAutocompletePassword_saveLoginDisabled() { + await setStoredLoginsAsync([location.origin, "https://autofill", null, "user1", "pass1"]); + + const form = createLoginForm({ + num: 2, + action: "https://autofill", + password: { + name: "password", + autocomplete: "new-password" + } + }); + await promiseFormsProcessedInSameProcess(); + + // form should not be filled + checkForm(2, "", ""); + + let formOrigin = new URL(document.documentURI).origin; + is(formOrigin, location.origin, "Expected form origin"); + + await LoginManager.setLoginSavingEnabled(location.origin, false); + + form.password.focus(); + // when login-saving is disabled for an origin, we expect no generated password row here + await showACPopup(2, ["user1"]); + + // close any open menu + synthesizeKey("KEY_Escape"); + await promiseACPopupClosed(); + + await LoginManager.setLoginSavingEnabled(location.origin, true); +}); + +add_task(async function test_deleteAndReselectGeneratedPassword() { + await setStoredLoginsAsync([location.origin, "https://autofill", null, "user1", "pass1"]); + + const form = createLoginForm({ + num: 2, + action: "https://autofill", + password: { + name: "password", + autocomplete: "new-password" + } + }); + await promiseFormsProcessedInSameProcess(); + + info("Removing all logins to test auto-saving of generated passwords"); + await LoginManager.removeAllUserFacingLogins(); + + // form should not be filled + checkForm(2, "", ""); + + async function showAndSelectACPopupItem(index) { + form.password.focus(); + if (form.password.value) { + form.password.select(); + synthesizeKey("KEY_Backspace"); + } + const autocompleteItems = await popupByArrowDown(); + if (index < 0) { + index = autocompleteItems.length + index; + } + for (let i=0; i<=index; i++) { + synthesizeKey("KEY_ArrowDown"); + } + await TestUtils.waitForTick(); + return autocompleteItems[index]; + } + + let storagePromise, menuLabel, itemIndex, savedLogins; + + // fill the password field with the generated password via auto-complete menu + storagePromise = promiseStorageChanged(["addLogin"]); + // select last-but-2 item - the one before the footer + menuLabel = await showAndSelectACPopupItem(-2); + is(menuLabel, "Use a Securely Generated Password", "Check item label"); + synthesizeKey("KEY_Enter"); + info("waiting for the password field to be filled with the generated password"); + await SimpleTest.promiseWaitForCondition(() => !!form.password.value, "Check generated pw filled"); + info("Wait for generated password to be added to storage"); + await storagePromise; + + form.uname.focus(); + await TestUtils.waitForTick(); + + is(form.password.value.length, LoginTestUtils.generation.LENGTH, "Check password looks generated"); + const GENERATED_PASSWORD = form.password.value; + + savedLogins = await LoginManager.getAllLogins(); + is(savedLogins.length, 1, "Check saved logins count"); + + info("clear the password field and delete the saved login using the AC menu") + storagePromise = promiseStorageChanged(["removeLogin"]); + + itemIndex = 0; + menuLabel = await showAndSelectACPopupItem(itemIndex); + ok(menuLabel.includes("No username"), "Check first item is the auto-saved login"); + // Send delete to remove the auto-saved login from storage + // On OS X, shift-backspace and shift-delete work, just delete does not. + // On Win/Linux, shift-backspace does not work, delete and shift-delete do. + synthesizeKey("KEY_Delete", {shiftKey: true}); + await storagePromise; + + form.uname.focus(); + await TestUtils.waitForTick(); + + savedLogins = await LoginManager.getAllLogins(); + is(savedLogins.length, 0, "Check saved logins count"); + + info("Re-fill with the generated password"); + // select last-but-2 item - the one before the footer + menuLabel = await showAndSelectACPopupItem(-2); + is(menuLabel, "Use a Securely Generated Password", "Check item label"); + synthesizeKey("KEY_Enter"); + info("waiting for the password field to be filled with the generated password"); + await SimpleTest.promiseWaitForCondition(() => !!form.password.value, "Check generated pw filled"); + + form.uname.focus(); + await TestUtils.waitForTick(); + is(form.password.value, GENERATED_PASSWORD, "Generated password has not changed"); +}); + +// add_task(async function test_passwordGenerationShownTelemetry() { +// // Should only be recorded once per principal origin per session, but the cache is cleared each time ``initLogins`` is called. +// await waitForTelemetryEventsCondition(events => { +// return events.length == 3; +// }, { process: "parent", filterProps: TelemetryFilterPropsShown }, "Expect 3 shown telemetry events"); +// }); +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_password_generation_confirm.html b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_password_generation_confirm.html new file mode 100644 index 0000000000..cd5d5952f6 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_password_generation_confirm.html @@ -0,0 +1,518 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test filling generated passwords into confirm password fields</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script src="pwmgr_common.js"></script> + <script src="../../../satchel/test/satchel_common.js"></script> + <link rel="stylesheet" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: filling generated passwords into confirm password fields + +<p id="display"></p> + +<!-- we presumably can't hide the content for this test. --> +<div id="content"> + + <!-- form1 has new-password followed by confirm-password fields --> + <form id="form1" action="https://example.com" onsubmit="return false;"> + <input type="text" name="uname"> + <input type="password" name="pword" autocomplete="new-password"> + <input type="password" name="pword-next"> + <button type="submit">Submit</button> + </form> + + <!-- form2 has 2 new-password fields --> + <form id="form2" action="https://example.com" onsubmit="return false;"> + <input type="text" name="uname"> + <input type="password" name="pword" autocomplete="new-password"> + <input type="password" name="pword-between"> + <input type="password" name="pword-next" autocomplete="new-password"> + <button type="submit">Submit</button> + </form> + + <!-- form3 has lots of junk fields before the confirm-password field --> + <form id="form3" action="https://example.com" onsubmit="return false;"> + <input type="text" name="uname"> + <input type="password" name="pword" autocomplete="new-password"> + <input type="text" name="junk0"> + <input type="text" name="junk1"> + <input type="text" name="junk2"> + <input type="text" name="junk3"> + <input type="text" name="junk4"> + <input type="password" name="pword-next"> + <button type="submit">Submit</button> + </form> + + <!-- form4 has a password field after the confirm-password field we don't want to fill into --> + <form id="form4" action="https://example.com" onsubmit="return false;"> + <input type="text" name="uname"> + <input type="password" name="pword" autocomplete="new-password"> + <input type="password" name="pword-next" autocomplete="new-password"> + <input type="password" name="pword-extra" autocomplete="new-password"> + <button type="submit">Submit</button> + </form> +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> +const { ContentTaskUtils } = SpecialPowers.ChromeUtils.import( + "resource://testing-common/ContentTaskUtils.jsm" +); +const { TestUtils } = SpecialPowers.ChromeUtils.import( + "resource://testing-common/TestUtils.jsm" +); + +const setupScript = runInParent(function parentTestSetup() { + const { LoginTestUtils } = ChromeUtils.import( + "resource://testing-common/LoginTestUtils.jsm" + ); + + addMessageListener( + "resetLoginsAndGeneratedPasswords", () => { + LoginTestUtils.clearData(); + LoginTestUtils.resetGeneratedPasswordsCache(); + } + ); +}); + +function testReset() { + return setupScript.sendAsyncMessage("resetLoginsAndGeneratedPasswords"); +} + +function generateDateString(date) { + let dateAndTimeFormatter = new Services.intl.DateTimeFormat(undefined, + { dateStyle: "medium" }); + return dateAndTimeFormatter.format(date); +} + +const DATE_NOW_STRING = generateDateString(new Date()); + +async function promiseACPopupClosed() { + return SimpleTest.promiseWaitForCondition(async () => { + // FIXME(bug 1721900): previously `promiseWaitForCondition` wouldn't await + // on async functions, so the condition would always immediately resolve as + // `true`. + return true; + // let popupState = await getPopupState(); + // return !popupState.open; + }, "Wait for AC popup to be closed"); +} + +async function fillWithGeneratedPassword(input, expectedResults = ["Use a Securely Generated Password"]) { + info("Opening the AC menu"); + const { items } = await openPopupOn(input); + checkAutoCompleteResults(items, expectedResults, + window.location.host, "Check all rows are correct"); + + for (let autocompleteItem of items) { + synthesizeKey("KEY_ArrowDown"); + if (autocompleteItem == "Use a Securely Generated Password") { + synthesizeKey("KEY_Enter"); + break; + } + } + await TestUtils.waitForTick(); +} + +async function testConfirmPasswordFieldFilledWithGeneratedPassword({ + formNumber, + passwordInputName = "pword", + confirmInputName = "pword-next", + expectedACResults, + expectedFilled = [], // the names of the inputs which should be filled + // field-name: expected-value for any non-filled inputs which should have values other than their .defaultValue + expectedNonDefaultValues = {}, + expectedMasked = [], // the names of the inputs which should be masked + beforeFn, + afterFn +}) { + // form should not be initially filled + checkForm(formNumber, "", ""); + + if (beforeFn) { + await beforeFn(document.getElementById(`form${formNumber}`)); + document.documentElement.scrollTop; // Flush pending reflows which may be caused by beforeFn. + } + let pword = getFormElementByName(formNumber, passwordInputName || "pword"); + let pword2 = getFormElementByName(formNumber, confirmInputName || "pword-next"); + + await fillWithGeneratedPassword(pword, expectedACResults); + + info("waiting for the password field to be filled with the generated password"); + await SimpleTest.promiseWaitForCondition(() => !!pword.value, "Check generated pw filled"); + await TestUtils.waitForTick(); + + let generatedPW = pword.value; + is(generatedPW.length, GENERATED_PASSWORD_LENGTH, "Check generated password length"); + ok(generatedPW.match(GENERATED_PASSWORD_REGEX), "Check generated password format"); + LOGIN_FIELD_UTILS.checkPasswordMasked(pword, false, "After fill"); + + info("Check the expected password fields are filled"); + for (let input of pword.form.querySelectorAll("input")) { + // check field filling & highlights + if (expectedFilled.includes(input.name)) { + await ContentTaskUtils.waitForCondition(() => { + return input.matches(":autofill"); + }, `Highlight was successfully applied to the (${input.name}) field`); + + is(input.value, generatedPW, `Field (${input.name}) has the generated password value`); + } else { + await ContentTaskUtils.waitForCondition(() => { + return !input.matches(":autofill"); + }, `Highlight was not applied to field (${input.name})`); + + let expectedValue = (input.name in expectedNonDefaultValues) ? expectedNonDefaultValues[input.name] : input.defaultValue; + is(input.value, expectedValue, `Field (${input.name}) field has the expected value`); + } + + if (expectedMasked.includes(input.name)) { + LOGIN_FIELD_UTILS.checkPasswordMasked(input, true, `Field (${input.name}) should be masked`); + } + } + + if (expectedFilled.includes(pword2.name)) { + info("Check the 2 field values aren't mirrored"); + // changing the password field value should result in a message sent to the parent process + let messageSentPromise = getPasswordEditedMessage(); + + pword.focus(); + // add a character. We don't expect the confirm password field to get the same change + synthesizeKey("KEY_End"); + synthesizeKey("@"); + await TestUtils.waitForTick(); + is(pword.value.length, GENERATED_PASSWORD_LENGTH + 1, "Value of the first password field changed"); + is(pword2.value, generatedPW, "Value of the confirm field did not change"); + + // focusing the 2nd password field blurs the first and results in a "change" event + pword2.focus(); + info("Waiting for edit message"); + await messageSentPromise; + + LOGIN_FIELD_UTILS.checkPasswordMasked(pword, true, "Generated password is masked when blurred"); + if (expectedMasked.includes(pword2.name)) { + LOGIN_FIELD_UTILS.checkPasswordMasked(pword2, false, "Confirm password should be be unmasked"); + } + + // remove a character from the confirm field. + // We don't expect the filled password field to get the same change + synthesizeKey("KEY_End"); + synthesizeKey("KEY_Backspace"); + await TestUtils.waitForTick(); + is(pword2.value, generatedPW.substring(0, GENERATED_PASSWORD_LENGTH - 1), "Value of the confirm field changed"); + is(pword.value.length, GENERATED_PASSWORD_LENGTH + 1, "Value of the first password field didn't change"); + + // the confirm field has its highlight cleared when emptied + pword2.focus(); + pword2.select(); + synthesizeKey("KEY_Backspace"); + await TestUtils.waitForTick(); + await ContentTaskUtils.waitForCondition(() => { + return !pword2.matches(":autofill"); + }, "Highlight was successfully cleared from the confirm-password field"); + + // if it got originally masked (i.e. was a password field) verify the focused confirm field now masks + // its input like a normal, non-generated password field after being emptied + if (expectedMasked.includes(pword2.name)) { + pword2.focus(); + synthesizeKey("a"); + LOGIN_FIELD_UTILS.checkPasswordMasked(pword2, true, "Confirm password gets masked again when focused"); + } + } else { + let expectedValue = (pword2.name in expectedNonDefaultValues) ? expectedNonDefaultValues[pword2.name] : pword2.defaultValue; + is(pword2.value, expectedValue, "Value of the confirm-password field is unchanged"); + + if (pword2.type == "password" && !pword2.disabled && !pword2.readOnly) { + // make sure we didn't change the behavior of a non-generated password field + // it should remain masked when it has focus + pword2.focus(); + LOGIN_FIELD_UTILS.checkPasswordMasked(pword, true, "Non-generataed password field remains masked when focused"); + } + } + + if (afterFn) { + await afterFn(document.getElementById(`form${formNumber}`)); + document.documentElement.scrollTop; // Flush pending reflows which may be caused by afterFn. + } + + // close any open menu + synthesizeKey("KEY_Escape"); + await promiseACPopupClosed(); + + recreateTree(document.getElementById(`form${formNumber}`)); +} + +add_task(async function test_fillNextPasswordField() { + const formNumber = 1; + await testReset(); + await testConfirmPasswordFieldFilledWithGeneratedPassword({ + formNumber, + // the next password field should be filled with the generated password + expectedFilled: ["pword", "pword-next"], + // all fields should either be filled or have their .defaultValue + expectedNonDefaultValues: {}, + // the confirm field should be masked, the filled field has focus and should not be masked + expectedMasked: ["pword-next"], + }); +}); + +add_task(async function test_fillNextPasswordFieldWasPasswordType() { + const formNumber = 1; + await testReset(); + await testConfirmPasswordFieldFilledWithGeneratedPassword({ + formNumber, + beforeFn(form) { + let pword2 = form.querySelector("input[name='pword-next']"); + is(pword2.type, "password", "confirm field is of password type"); + pword2.type = "text"; + }, + // the next hasBeenTypePassword field should be filled with the generated password + expectedFilled: ["pword", "pword-next"], + // all fields should either be filled or have their .defaultValue + expectedNonDefaultValues: {}, + // the confirm field should is currently type=text so will not be masked + expectedMasked: [], + afterFn(form) { + let pword2 = form.querySelector("input[name='pword-next']"); + pword2.type = "password"; + } + }); +}); + +add_task(async function test_dontFillNonEmptyPasswordField() { + const formNumber = 1; + await testReset(); + await testConfirmPasswordFieldFilledWithGeneratedPassword({ + formNumber, + beforeFn(form) { + let pword2 = form.querySelector("input[name='pword-next']"); + pword2.setAttribute("value", "previous value"); + }, + // the would-be confirm field is not empty so will not be filled + expectedFilled: ["pword"], + // all fields should either be filled or have their .defaultValue + expectedNonDefaultValues: {}, + // pword is filled by the test, but has focus so isn't masked. Its masking behavior is tested elsewhere. + expectedMasked: [], + afterFn(form) { + let pword2 = form.querySelector("input[name='pword-next']"); + pword2.setAttribute("value", ""); + } + }); +}); + +add_task(async function test_dontFillEditedNewPasswordField() { + const formNumber = 2; + await testReset(); + await testConfirmPasswordFieldFilledWithGeneratedPassword({ + formNumber, + beforeFn(form) { + let pword2 = form.querySelector("input[name='pword-next']"); + pword2.focus() + sendString("edited value"); + }, + // the would-be confirm field is not empty so will not be filled + expectedFilled: ["pword"], + expectedNonDefaultValues: { + "pword-next": "edited value", + }, + // pword is filled by the test, but has focus so isn't masked. Its masking behavior is tested elsewhere. + expectedMasked: [], + afterFn(form) { + let pword2 = form.querySelector("input[name='pword-next']"); + pword2.setAttribute("value", ""); + } + }); +}); + +add_task(async function test_ignoreReadOnlyField() { + const formNumber = 1; + await testReset(); + await testConfirmPasswordFieldFilledWithGeneratedPassword({ + formNumber, + beforeFn(form) { + let pword2 = form.querySelector("input[name='pword-next']"); + pword2.readOnly = true; + }, + // the confirm field candidate is read-only so will not be filled + expectedFilled: ["pword"], + // all fields should either be filled or have their .defaultValue + expectedNonDefaultValues: {}, + // pword is filled by the test, but has focus so isn't masked. Its masking behavior is tested elsewhere. + expectedMasked: [], + afterFn(form) { + let pword2 = form.querySelector("input[name='pword-next']"); + pword2.readOnly = false; + } + }); +}); + +add_task(async function test_ignoreDisabledField() { + const formNumber = 1; + await testReset(); + await testConfirmPasswordFieldFilledWithGeneratedPassword({ + formNumber, + beforeFn(form) { + let pword2 = form.querySelector("input[name='pword-next']"); + pword2.disabled = true; + }, + // the confirm field candidate is read-only so will not be filled + expectedFilled: ["pword"], + // all fields should either be filled or have their .defaultValue + expectedNonDefaultValues: {}, + // pword is filled by the test, but has focus so isn't masked. Its masking behavior is tested elsewhere. + expectedMasked: [], + afterFn(form) { + let pword2 = form.querySelector("input[name='pword-next']"); + pword2.disabled = false; + } + }); +}); + +add_task(async function test_preferMatchingAutoCompleteInfoPasswordField() { + const formNumber = 2; + await testReset(); + await testConfirmPasswordFieldFilledWithGeneratedPassword({ + formNumber, + expectedFilled: ["pword", "pword-next"], + // all fields should either be filled or have their .defaultValue + expectedNonDefaultValues: {}, + expectedMasked: ["pword-next"], + }); +}); + +add_task(async function test_ignoreDisabledMatchingAutoCompleteInfoPasswordField() { + const formNumber = 2; + await testReset(); + await testConfirmPasswordFieldFilledWithGeneratedPassword({ + formNumber, + beforeFn(form) { + let pword2 = form.querySelector("input[name='pword-next']"); + pword2.disabled = true; + }, + // it should fill the next password field, not the disabled one + confirmInputName: "pword-between", + expectedFilled: ["pword", "pword-between"], + // all fields should either be filled or have their .defaultValue + expectedNonDefaultValues: {}, + expectedMasked: ["pword-between"], + afterFn(form) { + let pword2 = form.querySelector("input[name='pword-next']"); + pword2.disabled = false; + }, + }); +}); + +add_task(async function test_ignoreTooDistantPasswordField() { + const formNumber = 3; + await testReset(); + await testConfirmPasswordFieldFilledWithGeneratedPassword({ + formNumber, + expectedFilled: ["pword"], + // all fields should either be filled or have their .defaultValue + expectedNonDefaultValues: {}, + expectedMasked: [], + }); +}); + +add_task(async function test_tooManyDisabledFields() { + // we don't fill into disabled fields, + // but they do count towards the distance from the first password field + const formNumber = 3; + await testReset(); + await testConfirmPasswordFieldFilledWithGeneratedPassword({ + formNumber, + beforeFn(form) { + for(let inp of form.querySelectorAll("input[name*='junk']")) { + inp.disabled = true; + } + }, + expectedFilled: ["pword"], + // all fields should either be filled or have their .defaultValue + expectedNonDefaultValues: {}, + expectedMasked: [], + afterFn(form) { + for(let inp of form.querySelectorAll("input[name*='junk']")) { + inp.disabled = false; + } + }, + }); +}); + +add_task(async function test_skipOverHiddenFields() { + // hidden fields do not count towards the distance from the first password field + const formNumber = 3; + await testReset(); + await testConfirmPasswordFieldFilledWithGeneratedPassword({ + formNumber, + beforeFn(form) { + for(let inp of form.querySelectorAll("input[name*='junk']")) { + inp.type = "hidden"; + } + }, + expectedFilled: ["pword", "pword-next"], + // all fields should either be filled or have their .defaultValue + expectedNonDefaultValues: {}, + expectedMasked: ["pword-next"], + afterFn(form) { + for(let inp of form.querySelectorAll("input[name*='junk']")) { + inp.type = "text"; + } + }, + }); +}); + +add_task(async function test_dontFill3rdPasswordField() { + // if a generated password field was previously filled on a form + // don't look for a confirm-password field when filling another field with a generated password + const formNumber = 4; + await testReset(); + + let pword = getFormElementByName(formNumber, "pword"); + let pword2 = getFormElementByName(formNumber, "pword-next"); + let pword3 = getFormElementByName(formNumber, "pword-extra"); + await testConfirmPasswordFieldFilledWithGeneratedPassword({ + formNumber, + async beforeFn(form) { + // disable the following password fields so they dont get filled just yet + pword2.disabled = true; + pword3.disabled = true; + + info("beforeFn, filling the pword field"); + await fillWithGeneratedPassword(pword); + info("beforeFn: waiting for the password field to be filled with the generated password"); + await SimpleTest.promiseWaitForCondition(() => !!pword.value, "Check generated pw filled"); + + pword2.disabled = false; + pword3.disabled = false; + is(pword2.value, "", "The pword-next field was not filled"); + is(pword3.value, "", "The pword-extra field was not filled"); + }, + // Fill into the confirm-password field, + // we want to confirm this doesnt now try and fill another nearby "confirm" field + passwordInputName: "pword-next", + confirmInputName: "pword-extra", + // we already generated a password in this test, so the AC menu will have the auto-saved login + expectedACResults: [ + "No username (" + DATE_NOW_STRING + ")", + "Use a Securely Generated Password", + ], + // we've manually filled both fields, + // we don't expect the third 'pword-extr' field to be filled + expectedFilled: ["pword", "pword-next"], + // all fields should either be filled or have their .defaultValue + expectedNonDefaultValues: {}, + expectedMasked: [ + "pword", // pword was filled in the beforeFn and is blurred so it should be masked + // pword-next was filled by the test and is focused so should not be masked + ], + }); +}); + +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_password_open.html b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_password_open.html new file mode 100644 index 0000000000..e792aa19af --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_password_open.html @@ -0,0 +1,90 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test password field autocomplete footer with and without logins</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<p id="display"></p> + +<div id="content"></div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> + +/** Test for Login Manager: Test password field autocomplete footer with and without logins **/ + +add_task(async function test_no_autofill() { + await setStoredLoginsAsync( + [location.origin, "", null, "user-1", "pass-1", "uname", "pword"], + [location.origin, "", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm(); + await promiseFormsProcessedInSameProcess(); + + // Make sure initial form is empty as autofill shouldn't happen in the sandboxed frame. + checkLoginForm(form.uname, "", form.pword, ""); + let popupState = await getPopupState(); + is(popupState.open, false, "Check popup is initially closed"); +}); + +add_task(async function test_two_logins() { + await setStoredLoginsAsync( + [location.origin, "", null, "user-1", "pass-1", "uname", "pword"], + [location.origin, "", null, "user-2", "pass-2", "uname", "pword"] + ); + const form = createLoginForm(); + await promiseFormsProcessedInSameProcess(); + + await popupBy(() => form.uname.focus()); + + // popup on the password field should open upon focus + let results = await popupBy(() => synthesizeKey("KEY_Tab")); + + let popupState = await getPopupState(); + is(popupState.selectedIndex, -1, "Check no entries are selected upon opening"); + + let expectedMenuItems = [ + "user-1", + "user-2", + ]; + checkAutoCompleteResults(results, expectedMenuItems, window.location.host, "Check all menuitems are displayed correctly."); + + checkLoginForm(form.uname, "", form.pword, ""); +}); + +add_task(async function test_zero_logins() { + // no logins stored + await setStoredLoginsAsync(); + const form = createLoginForm(); + await promiseFormsProcessedInSameProcess(); + + form.uname.focus(); + + let shownPromise = popupBy().then(() => ok(false, "Should not have shown")); + // Popup on the password field should NOT automatically open upon focus when there are no saved logins. + synthesizeKey("KEY_Tab"); // focus the password field + SimpleTest.requestFlakyTimeout("Giving a chance for the unexpected popup to show"); + let autocompleteItems = await Promise.race([ + shownPromise, + new Promise(resolve => setTimeout(resolve, 2000)), // Wait 2s for the popup to appear + ]); + + let popupState = await getPopupState(); + is(popupState.open, false, "Check popup is still closed"); + + checkLoginForm(form.uname, "", form.pword, ""); + info("arrow down should still open the popup"); + autocompleteItems = await popupByArrowDown(); + checkAutoCompleteResults(autocompleteItems, [], window.location.host, "Check only footer is displayed."); + checkLoginForm(form.uname, "", form.pword, ""); +}); +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_sandboxed.html b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_sandboxed.html new file mode 100644 index 0000000000..229791109a --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_sandboxed.html @@ -0,0 +1,70 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test form field autocomplete in sandboxed documents (null principal)</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<p id="display"></p> + +<!-- we presumably can't hide the content for this test. --> +<div id="content"> + <iframe id="sandboxed" + sandbox="" + src="form_basic.html"></iframe> +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> + +/** Test for Login Manager: form field autocomplete in sandboxed documents (null principal) **/ + +let sandboxed = document.getElementById("sandboxed"); +let uname; +let pword; +let hostname; + +add_setup(async () => { + await setStoredLoginsAsync( + [window.location.origin, "", null, "tempuser1", "temppass1", "uname", "pword"] + ); + let frameWindow = SpecialPowers.wrap(sandboxed).contentWindow; + // Can't use SimpleTest.promiseFocus as it doesn't work with the sandbox. + await SimpleTest.promiseWaitForCondition(() => { + return frameWindow.document.readyState == "complete" && frameWindow.location.href != "about:blank"; + }, "Check frame is loaded"); + let frameDoc = SpecialPowers.wrap(sandboxed).contentDocument; + uname = frameDoc.getElementById("form-basic-username"); + pword = frameDoc.getElementById("form-basic-password"); + hostname = frameDoc.documentURIObject.host; +}); + +add_task(async function test_no_autofill() { + // Make sure initial form is empty as autofill shouldn't happen in the sandboxed frame. + checkLoginForm(uname, "", pword, ""); + let popupState = await getPopupState(); + is(popupState.open, false, "Check popup is initially closed"); +}); + +add_task(async function test_autocomplete_warning_no_logins() { + const { items } = await openPopupOn(pword); + + let popupState = await getPopupState(); + is(popupState.selectedIndex, -1, "Check no entries are selected upon opening"); + + let expectedMenuItems = [ + "This connection is not secure. Logins entered here could be compromised. Learn More", + ]; + checkAutoCompleteResults(items, expectedMenuItems, hostname, "Check all menuitems are displayed correctly."); + + checkLoginForm(uname, "", pword, ""); +}); +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_tab_between_fields.html b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_tab_between_fields.html new file mode 100644 index 0000000000..9df3467621 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autocomplete_tab_between_fields.html @@ -0,0 +1,167 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test autocomplete behavior when tabbing between form fields</title> + <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<p id="display"></p> + +<!-- we presumably can't hide the content for this test. --> +<div id="content"></div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> +const { TestUtils } = SpecialPowers.ChromeUtils.import( + "resource://testing-common/TestUtils.jsm" +); + +const availableLogins = { + "exampleUser1": [location.origin, "https://autofill", null, "user1", "pass1", "uname", "pword"], + "subdomainUser1": ["https://sub." + location.host, "https://autofill", null, "user1", "pass1", "uname", "pword"], + "emptyUsername": [location.origin, "https://autofill", null, "", "pass2", "uname", "pword"], +} + +const tests = [ + { + name: "single_login_exact_origin_no_inputs", + logins: ["exampleUser1"], + expectedAutofillUsername: "user1", + expectedAutofillPassword: "pass1", + expectedACLabels: ["user1"], + typeUsername: null, + expectedTabbedUsername: "", + expectedTabbedPassword: "", + }, + { + name: "single_login_exact_origin_initial_letter", + logins: ["exampleUser1"], + expectedAutofillUsername: "user1", + expectedAutofillPassword: "pass1", + expectedACLabels: ["user1"], + typeUsername: "u", + expectedTabbedUsername: "u", + expectedTabbedPassword: "", + }, + { + name: "single_login_exact_origin_type_username", + logins: ["exampleUser1"], + expectedAutofillUsername: "user1", + expectedAutofillPassword: "pass1", + expectedACLabels: ["user1"], + typeUsername: "user1", + expectedTabbedUsername: "user1", + expectedTabbedPassword: "pass1", + }, + { + name: "single_login_subdomain_no_inputs", + logins: ["subdomainUser1"], + expectedAutofillUsername: "", + expectedAutofillPassword: "", + expectedACLabels: ["user1"], + typeUsername: null, + expectedTabbedUsername: "", + expectedTabbedPassword: "", + }, + { + name: "single_login_subdomain_type_username", + logins: ["subdomainUser1"], + expectedAutofillUsername: "", + expectedAutofillPassword: "", + expectedACLabels: ["user1"], + typeUsername: "user1", + expectedTabbedUsername: "user1", + expectedTabbedPassword: "", + }, + { + name: "two_logins_one_with_empty_username", + logins: ["exampleUser1", "emptyUsername"], + expectedAutofillUsername: "user1", + expectedAutofillPassword: "pass1", + expectedACLabels: ["user1"], + typeUsername: "", + expectedTabbedUsername: "", + expectedTabbedPassword: "", + }, +]; + +add_setup(async () => { + await SpecialPowers.pushPrefEnv({"set": [["signon.includeOtherSubdomainsInLookup", true]]}); +}); + +async function testResultOfTabInteractions(testData) { + const logins = testData.logins.map(name => availableLogins[name]); + await setStoredLoginsAsync(...logins); + + const form = createLoginForm({ + action: "https://autofill" + }); + await promiseFormsProcessedInSameProcess(); + + await SimpleTest.promiseFocus(window); + + // check autofill results + checkForm(1, testData.expectedAutofillUsername, testData.expectedAutofillPassword); + + SpecialPowers.wrap(form.pword).setUserInput(""); + SpecialPowers.wrap(form.uname).setUserInput(""); + + info("Placing focus in the password field"); + form.pword.focus(); + await synthesizeKey("KEY_Tab", { shiftKey: true }); // blur pw, focus un + + // moving focus shouldn't change anything + await ensureLoginFormStaysFilledWith(form.uname, "", form.pword, ""); + + info("waiting for AC results"); + const results = await popupByArrowDown(); + info("checking results"); + checkAutoCompleteResults(results, testData.expectedACLabels, + window.location.host, "Check all rows are correct"); + + if (testData.typeUsername) { + await sendString(testData.typeUsername); + } + + // don't select anything from the AC menu + await synthesizeKey("KEY_Escape"); + await TestUtils.waitForCondition(async () => { + let popupState = await getPopupState(); + return !popupState.open; + }, "AutoComplete popup should have closed"); + + await synthesizeKey("KEY_Tab"); + + // wait until username and password are automatically filled in with the + // expected values... + await TestUtils.waitForCondition(() => { + return form.uname.value === testData.expectedTabbedUsername & form.pword.value === testData.expectedTabbedPassword; + }, "Username and password field should be filled"); + + // ...and if the value is not different from the original value in the form, + // make sure that the form keeps its values + if (testData.expectedTabbedPassword === "") { + await ensureLoginFormStaysFilledWith(form.uname, testData.expectedTabbedUsername, form.pword, testData.expectedTabbedPassword); + } + + ok(form.pword.matches("input:focus"), "pword field is focused"); +} + +for (const testData of tests) { + const tmp = { + async [testData.name]() { + await testResultOfTabInteractions(testData); + }, + }; + add_task(tmp[testData.name]); +} + +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autofill_autocomplete_types.html b/toolkit/components/passwordmgr/test/mochitest/test_autofill_autocomplete_types.html new file mode 100644 index 0000000000..c44d5a25ef --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autofill_autocomplete_types.html @@ -0,0 +1,112 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test autofilling with autocomplete types (username, off, cc-type, etc.)</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Test autofilling with autocomplete types (username, off, cc-type, etc.) + +<p id="display"></p> +<div id="content"></div> +<pre id="test"> +<script class="testbody" type="text/javascript"> +/* + Test for Login Manager: Skip over inappropriate autcomplete types when finding username field + */ + +const win = window.open("about:blank"); +const loadPromise = loadFormIntoWindow(location.origin, ` + <form id="form0" action="https://autocomplete"> + <input type="text" name="uname"> + <input type="text" autocomplete=""> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <form id="form1" action="https://autocomplete"> + <input type="text" name="uname"> + <input type="text" autocomplete="username"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <form id="form2" action="https://autocomplete"> + <input type="text" name="uname"> + <input type="text" autocomplete="off" name="acfield"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <form id="form3" action="https://autocomplete"> + <input type="text" name="uname"> + <input type="text" autocomplete="on" name="acfield"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <form id="form4" action="https://autocomplete"> + <input type="text" name="uname"> + <input type="text" autocomplete="nosuchtype" name="acfield"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <form id="form5" action="https://autocomplete"> + <input type="text" name="uname"> + <input type="text" autocomplete="email" name="acfield"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <form id="form6" action="https://autocomplete"> + <input type="text" name="uname"> + <input type="text" autocomplete="tel" name="acfield"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <form id="form7" action="https://autocomplete"> + <input type="text" name="uname"> + <input type="text" autocomplete="tel-national" name="acfield"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <!-- Begin forms where the first field is skipped for the username --> + + <form id="form101" action="https://autocomplete"> + <input type="text" name="uname"> + <input type="text" autocomplete="cc-number" name="acfield"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form>`, win, 8); + +add_setup(async () => { + await setStoredLoginsAsync( + [window.location.origin, "https://autocomplete", null, "testuser@example.com", "testpass1", "", ""] + ); + SimpleTest.registerCleanupFunction(() => win.close()); +}); + +/* Tests for autofill of single-user forms with various autocomplete types */ +add_task(async function test_autofill_autocomplete_types() { + await loadPromise; + await checkLoginFormInFrameWithElementValues(win, 0, null, "testuser@example.com", "testpass1"); + await checkLoginFormInFrameWithElementValues(win, 1, null, "testuser@example.com", "testpass1"); + await checkLoginFormInFrameWithElementValues(win, 2, null, "testuser@example.com", "testpass1"); + await checkLoginFormInFrameWithElementValues(win, 3, null, "testuser@example.com", "testpass1"); + await checkLoginFormInFrameWithElementValues(win, 4, null, "testuser@example.com", "testpass1"); + await checkLoginFormInFrameWithElementValues(win, 5, null, "testuser@example.com", "testpass1"); + await checkLoginFormInFrameWithElementValues(win, 6, null, "testuser@example.com", "testpass1"); + await checkLoginFormInFrameWithElementValues(win, 7, null, "testuser@example.com", "testpass1"); + await checkLoginFormInFrameWithElementValues(win, 101, "testuser@example.com", null, "testpass1"); +}); + +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autofill_different_formActionOrigin.html b/toolkit/components/passwordmgr/test/mochitest/test_autofill_different_formActionOrigin.html new file mode 100644 index 0000000000..240e250a19 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autofill_different_formActionOrigin.html @@ -0,0 +1,91 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test autofill on an HTTPS page using upgraded HTTP logins with different formActionOrigin</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<script> +const MISSING_ACTION_PATH = TESTS_DIR + "mochitest/form_basic.html"; + +const chromeScript = runChecksAfterCommonInit(false); + +let nsLoginInfo = SpecialPowers.wrap(SpecialPowers.Components).Constructor("@mozilla.org/login-manager/loginInfo;1", + SpecialPowers.Ci.nsILoginInfo, + "init"); +</script> +<p id="display"></p> + +<!-- we presumably can't hide the content for this test. --> +<div id="content"> +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> +let origin = window.location.origin; +let suborigin = "http://sub." + window.location.host; + +let win = window.open("about:blank"); +SimpleTest.registerCleanupFunction(() => win.close()); + +async function prepareLoginsAndProcessForm(url, logins = []) { + await LoginManager.removeAllUserFacingLogins(); + + let dates = Date.now(); + for (let login of logins) { + SpecialPowers.do_QueryInterface(login, SpecialPowers.Ci.nsILoginMetaInfo); + // Force all dates to be the same so they don't affect things like deduping. + login.timeCreated = login.timePasswordChanged = login.timeLastUsed = dates; + await LoginManager.addLogin(login); + } + + let processedPromise = promiseFormsProcessed(); + win.location = url; + await processedPromise; +} + +add_task(async function test_formActionOrigin_wildcard_should_autofill() { + await prepareLoginsAndProcessForm(origin + MISSING_ACTION_PATH, [ + new nsLoginInfo(origin, "", null, + "name2", "pass2", "uname", "pword"), + ]); + + await checkLoginFormInFrame(win, "form-basic-username", "name2", "form-basic-password", "pass2"); +}); + +add_task(async function test_formActionOrigin_different_shouldnt_autofill() { + await prepareLoginsAndProcessForm(origin + MISSING_ACTION_PATH, [ + new nsLoginInfo(origin, "https://example.net", null, + "name2", "pass2", "uname", "pword"), + ]); + + + await checkLoginFormInFrame(win, "form-basic-username", "", "form-basic-password", ""); +}); + +add_task(async function test_formActionOrigin_subdomain_should_autofill() { + await prepareLoginsAndProcessForm(origin + MISSING_ACTION_PATH, [ + new nsLoginInfo(origin, suborigin, null, + "name2", "pass2", "uname", "pword"), + ]); + + await checkLoginFormInFrame(win, "form-basic-username", "name2", "form-basic-password", "pass2"); +}); + +add_task(async function test_origin_subdomain_should_not_autofill() { + await prepareLoginsAndProcessForm(origin + MISSING_ACTION_PATH, [ + new nsLoginInfo(suborigin, origin, null, + "name2", "pass2", "uname", "pword"), + ]); + + await checkLoginFormInFrame(win, "form-basic-username", "", "form-basic-password", ""); +}); + +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autofill_different_subdomain.html b/toolkit/components/passwordmgr/test/mochitest/test_autofill_different_subdomain.html new file mode 100644 index 0000000000..b914968d43 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autofill_different_subdomain.html @@ -0,0 +1,150 @@ +xcod<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test autofill on an HTTPS page using logins with different eTLD+1</title> + <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<script> +const MISSING_ACTION_PATH = TESTS_DIR + "mochitest/form_basic.html"; + +const chromeScript = runChecksAfterCommonInit(false); + +let nsLoginInfo = SpecialPowers.wrap(SpecialPowers.Components).Constructor("@mozilla.org/login-manager/loginInfo;1", + SpecialPowers.Ci.nsILoginInfo, + "init"); +</script> +<p id="display"></p> + +<!-- we presumably can't hide the content for this test. --> +<div id="content"> + <iframe></iframe> +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> +let iframe = SpecialPowers.wrap(document.getElementsByTagName("iframe")[0]); +let win = window.open("about:blank"); +SimpleTest.registerCleanupFunction(() => win.close()); + +let origin = window.location.origin; +let otherOrigin = "https://foobar." + window.location.host; +let oldOrigin = "https://old." + window.location.host; + +async function checkWindowLoginForm(expectedUsername, expectedPassword) { + return SpecialPowers.spawn(win, [expectedUsername, expectedPassword], function(un, pw) { + let doc = this.content.document; + Assert.equal(doc.querySelector("#form-basic-username").value, un, "Check username value"); + Assert.equal(doc.querySelector("#form-basic-password").value, pw, "Check password value"); + }); +} + +async function prepareLogins(logins = []) { + await LoginManager.removeAllUserFacingLogins(); + + let dates = Date.now(); + for (let login of logins) { + SpecialPowers.do_QueryInterface(login, SpecialPowers.Ci.nsILoginMetaInfo); + // Force all dates to be the same so they don't affect things like deduping. + login.timeCreated = login.timePasswordChanged = login.timeLastUsed = dates; + await LoginManager.addLogin(login); + } +} + +async function formReadyInFrame(url) { + let processedPromise = promiseFormsProcessed(); + iframe.src = url; + return processedPromise; +} + +async function formReadyInWindow(url) { + let processedPromise = promiseFormsProcessedInSameProcess(); + win.location = url; + return processedPromise; +} + +add_task(async function test_login_with_different_subdomain_shouldnt_autofill_wildcard_formActionOrigin() { + await prepareLogins([ + new nsLoginInfo(otherOrigin, "", null, + "name2", "pass2", "uname", "pword"), + ]); + await formReadyInWindow(origin + MISSING_ACTION_PATH); + + await checkWindowLoginForm("", ""); +}); + +add_task(async function test_login_with_different_subdomain_shouldnt_autofill_same_domain_formActionOrigin() { + await prepareLogins([ + new nsLoginInfo(otherOrigin, origin, null, + "name2", "pass2", "uname", "pword"), + ]); + await formReadyInWindow(origin + MISSING_ACTION_PATH); + + await checkWindowLoginForm("", ""); +}); + +add_task(async function test_matching_logins_with_different_subdomain_and_matching_domain_should_autofill() { + await prepareLogins([ + new nsLoginInfo(origin, origin, null, + "name2", "pass2", "uname", "pword"), + new nsLoginInfo(oldOrigin, origin, null, + "name2", "pass2", "uname", "pword"), + ]); + await formReadyInWindow(origin + MISSING_ACTION_PATH); + + await checkWindowLoginForm("name2", "pass2"); +}); + +add_task(async function test_login_with_different_subdomain_shouldnt_autofill_different_subdomain_formActionOrigin() { + await prepareLogins([ + new nsLoginInfo(otherOrigin, otherOrigin, null, + "name2", "pass2", "uname", "pword"), + ]); + await formReadyInWindow(origin + MISSING_ACTION_PATH); + + await checkWindowLoginForm("", ""); +}); + +add_task(async function test_login_with_different_subdomain_shouldnt_autofill_different_domain_formActionOrigin() { + await prepareLogins([ + new nsLoginInfo(otherOrigin, "https://example.net", null, + "name2", "pass2", "uname", "pword"), + ]); + await formReadyInWindow(origin + MISSING_ACTION_PATH); + + await checkWindowLoginForm("", ""); +}); + +add_task(async function test_login_with_same_origin_shouldnt_autofill_cross_origin_iframe() { + await SimpleTest.promiseFocus(window); + + async function checkIframeLoginForm(expectedUsername, expectedPassword) { + return SpecialPowers.spawn(getIframeBrowsingContext(window, 0), [expectedUsername, expectedPassword], function(un, pw) { + var u = this.content.document.getElementById("form-basic-username"); + var p = this.content.document.getElementById("form-basic-password"); + Assert.equal(u.value, un, "Check username value"); + Assert.equal(p.value, pw, "Check password value"); + }); + } + + // We need an origin that is supported by the test framework to be able to load the + // cross-origin form into the iframe. + let crossOrigin = "https://test1.example.com"; + info(`Top level frame origin: ${origin}. Iframe and login origin: ${crossOrigin}.`); + await prepareLogins([ + new nsLoginInfo(crossOrigin, crossOrigin, null, + "name2", "pass2", "uname", "pword"), + ]); + await formReadyInFrame(crossOrigin + MISSING_ACTION_PATH); + + await checkIframeLoginForm("", ""); +}); + +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autofill_from_bfcache.html b/toolkit/components/passwordmgr/test/mochitest/test_autofill_from_bfcache.html new file mode 100644 index 0000000000..d0fcb16e18 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autofill_from_bfcache.html @@ -0,0 +1,58 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test autofilling documents restored from the back/forward cache (bfcache)</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body onload="test_crossOriginBfcacheRestore();"> +<p id="display"></p> + +<div id="content"> + <a id="next" href="https://example.org/tests/toolkit/components/passwordmgr/test/mochitest/file_history_back.html" target="loginWin">Next</a> +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> + +SimpleTest.waitForExplicitFinish(); + +/* + * The test opens a new window and updates login information. Then + * a new page is loaded and it goes immediately back. The initial page + * should be coming out from the bfcache and the form control values should be + * the ones filled during the initial load. + */ +async function test_crossOriginBfcacheRestore() { + // If Fission is disabled, the pref is no-op. + await SpecialPowers.pushPrefEnv({set: [["fission.bfcacheInParent", true]]}); + + var bc = new BroadcastChannel("form_basic_bfcache"); + window.open("form_basic_bfcache.html", "", "noopener"); + var pageshowCount = 0; + bc.onmessage = function(event) { + if (event.data.type == "pageshow") { + ++pageshowCount; + if (pageshowCount == 1) { + is(event.data.persisted, false, "Initial load"); + bc.postMessage("nextpage"); + } else if (pageshowCount == 2) { + is(event.data.persisted, true, "Should have persisted the page."); + bc.postMessage("close"); + } + } else if (event.data.type == "is") { + is(event.data.value1, event.data.value2, event.data.message); + } else if (event.data.type == "ok") { + is(event.data.value, event.data.message); + } else if (event.data == "closed") { + bc.close(); + SimpleTest.finish(); + } + } + +} +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autofill_hasBeenTypePassword.html b/toolkit/components/passwordmgr/test/mochitest/test_autofill_hasBeenTypePassword.html new file mode 100644 index 0000000000..2139d30e61 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autofill_hasBeenTypePassword.html @@ -0,0 +1,64 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test no autofill into a password field that is no longer type=password</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="pwmgr_common.js"></script> + <link rel="stylesheet" href="/tests/SimpleTest/test.css"/> +</head> +<body> +Login Manager test: Test no autofill into a password field that is no longer type=password + +<script> +let DEFAULT_ORIGIN = window.location.origin; + +/** Test for Login Manager: Test no autofill into a password field that is no longer type=password **/ + +add_setup(async () => { + await setStoredLoginsAsync( + [DEFAULT_ORIGIN, "https://autofill", null, "user1", "pass1"] + ); +}); + + +// As a control, test that autofill is working on this page. +add_task(async function test_autofill_control() { + let win = window.open("about:blank"); + SimpleTest.registerCleanupFunction(() => win.close()); + await loadFormIntoWindow(DEFAULT_ORIGIN, ` + <form id="form1" action="https://autofill"> + <p>This is form 1.</p> + <input id="username-1" type="text" name="uname"> + <input id="password-1" type="password" name="pword"> + + <button type="submit">Submit</button> + </form>`, win); + await checkLoginFormInFrame(win, "username-1", "user1", "password-1", "pass1"); +}); + +add_task(async function test_no_autofill() { + let win = window.open("about:blank"); + SimpleTest.registerCleanupFunction(() => win.close()); + // Synchronously change the password field type to text before the fill happens. + await loadFormIntoWindow(DEFAULT_ORIGIN, ` + <form id="form1" action="https://autofill"> + <p>This is form 1.</p> + <input id="username-1" type="text" name="uname"> + <input id="password-1" type="password" name="pword"> + + <button type="submit">Submit</button> + </form>`, win, 1, () => { + this.content.document.getElementById("password-1").type = "text"; + }); + await checkLoginFormInFrame(win, "username-1", "", "password-1", ""); +}); +</script> + +<p id="display"></p> + +<div id="content"></div> + +<pre id="test"></pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autofill_highlight.html b/toolkit/components/passwordmgr/test/mochitest/test_autofill_highlight.html new file mode 100644 index 0000000000..3ca214841c --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autofill_highlight.html @@ -0,0 +1,58 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test form field autofill highlight</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/> +</head> +<body> +<p id="display"></p> +<div id="content"> +<pre id="test"> +<script> +add_setup(async () => { + await setStoredLoginsAsync( + [window.location.origin, "https://autofill", null, "user1", "pass1", "", ""] + ); +}); + +add_task(async function test_field_highlight_on_autofill() { + let win = window.open("about:blank"); + SimpleTest.registerCleanupFunction(() => win.close()); + await loadFormIntoWindow(window.location.origin, ` + <form id="form1" action="https://autofill" onsubmit="return false;"> + <input type="text" id="uname"> + <input type="password" id="pword"> + <button type="submit">Submit</button> + </form>`, win); + + await SpecialPowers.spawn(win, [], async function() { + let EventUtils = ContentTaskUtils.getEventUtils(this.content); + let doc = this.content.document; + let username = doc.getElementById("uname"); + let password = doc.getElementById("pword"); + ok(username.matches(":autofill"), + "Highlight was successfully applied to the username field on page load autofill"); + ok(password.matches(":autofill"), + "Highlight was successfully applied to the password field on page load autofill"); + + // Test that initiating a change on the input value will remove the highlight. We check by pressing + // the tab key after backspace(by shifting focus to the next element) because the tab key is known to + // cause a bug where the highlight is applied once again. + username.focus(); + await EventUtils.synthesizeKey("KEY_Backspace", {}, this.content); + await EventUtils.synthesizeKey("KEY_Tab", {}, this.content); + + ok(!username.matches(":autofill"), "Highlight was successfully removed on change in value of username input element"); + + await EventUtils.synthesizeKey("KEY_Backspace", {}, this.content); + await EventUtils.synthesizeKey("KEY_Tab", {}, this.content); + ok(!password.matches(":autofill"), "Highlight was successfully removed on change in value of password input element"); + }); +}); +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autofill_highlight_empty_username.html b/toolkit/components/passwordmgr/test/mochitest/test_autofill_highlight_empty_username.html new file mode 100644 index 0000000000..36fffb480b --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autofill_highlight_empty_username.html @@ -0,0 +1,60 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test that filling an empty username into a form does not highlight the username element</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/> +</head> +<script> +</script> +<body> +<p id="display"></p> +<div id="content"> +<pre id="test"> +<script> +add_setup(async () => { + await setStoredLoginsAsync( + [window.location.origin, "https://autofill", null, "", "pass1", "", ""] + ); +}); + +add_task(async function test_field_highlight_on_autofill() { + let win = window.open("about:blank"); + SimpleTest.registerCleanupFunction(() => win.close()); + await loadFormIntoWindow(window.location.origin, ` + <form id="form1" action="https://autofill" onsubmit="return false;"> + <input type="text" id="uname"> + <input type="password" id="pword"> + <button type="submit">Submit</button> + </form>`, win); + + await SpecialPowers.spawn(win, [], async function() { + let EventUtils = ContentTaskUtils.getEventUtils(this.content); + let doc = this.content.document; + let username = doc.getElementById("uname"); + let password = doc.getElementById("pword"); + ok(!username.matches(":autofill"), + "Highlight was not applied to the username field on page load autofill"); + ok(password.matches(":autofill"), + "Highlight was successfully applied to the password field on page load autofill"); + + // Test that initiating a change on the input value will remove the highlight. We check by pressing + // the tab key after backspace(by shifting focus to the next element) because the tab key is known to + // cause a bug where the highlight is applied once again. + username.focus(); + await EventUtils.synthesizeKey("U", {}, this.content); + await EventUtils.synthesizeKey("KEY_Tab", {}, this.content); + + ok(!username.matches(":autofill"), "Highlight is still not present on username element"); + + await EventUtils.synthesizeKey("KEY_Backspace", {}, this.content); + await EventUtils.synthesizeKey("KEY_Tab", {}, this.content); + ok(!password.matches(":autofill"), "Highlight was successfully removed on change in value of password input element"); + }); +}); +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autofill_highlight_username_only_form.html b/toolkit/components/passwordmgr/test/mochitest/test_autofill_highlight_username_only_form.html new file mode 100644 index 0000000000..67892a9ea4 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autofill_highlight_username_only_form.html @@ -0,0 +1,50 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test that filling a username into a username-only form does highlight the username element</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/> +</head> +<body> +<p id="display"></p> +<div id="content"> +<pre id="test"> +<script> +add_setup(async () => { + await setStoredLoginsAsync( + [window.location.origin, "https://autofill", null, "user1", "pass1", "", ""] + ); +}); + +add_task(async function test_field_highlight_on_autofill() { + let win = window.open("about:blank"); + SimpleTest.registerCleanupFunction(() => win.close()); + await loadFormIntoWindow(window.location.origin, ` + <form id="form1" action="https://autofill" onsubmit="return false;"> + <input type="text" id="uname" autocomplete="username"> + <button type="submit">Submit</button> + </form>`, win); + + await SpecialPowers.spawn(win, [], async function() { + let EventUtils = ContentTaskUtils.getEventUtils(this.content); + let doc = this.content.document; + let username = doc.getElementById("uname"); + ok(username.matches(":autofill"), + "Highlight was successfully applied to the username field on page load autofill"); + + // Test that initiating a change on the input value will remove the highlight. We check by pressing + // the tab key after backspace(by shifting focus to the next element) because the tab key is known to + // cause a bug where the highlight is applied once again. + username.focus(); + await EventUtils.synthesizeKey("KEY_Backspace", {}, this.content); + await EventUtils.synthesizeKey("KEY_Tab", {}, this.content); + + ok(!username.matches(":autofill"), "Highlight was successfully removed on change in value of username input element"); + }); +}); +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autofill_https_downgrade.html b/toolkit/components/passwordmgr/test/mochitest/test_autofill_https_downgrade.html new file mode 100644 index 0000000000..cf7c8ca450 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autofill_https_downgrade.html @@ -0,0 +1,118 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test we don't autofill on an HTTP page using HTTPS logins</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<script> +const MISSING_ACTION_PATH = TESTS_DIR + "mochitest/form_basic.html"; +const SAME_ORIGIN_ACTION_PATH = TESTS_DIR + "mochitest/form_same_origin_action.html"; + +const chromeScript = runChecksAfterCommonInit(false); + +let nsLoginInfo = SpecialPowers.wrap(SpecialPowers.Components).Constructor("@mozilla.org/login-manager/loginInfo;1", + SpecialPowers.Ci.nsILoginInfo, + "init"); +</script> +<p id="display"></p> + +<!-- we presumably can't hide the content for this test. --> +<div id="content"> +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> +let win = window.open("about:blank"); +SimpleTest.registerCleanupFunction(() => win.close()); + +async function prepareAndProcessForm(url, login) { + let processedPromise = promiseFormsProcessed(); + win.location = url; + info("prepareAndProcessForm, assigned window location: " + url); + await processedPromise; +} + +async function checkFormsWithLogin(formUrls, login, expectedUsername, expectedPassword) { + await LoginManager.removeAllUserFacingLogins(); + await LoginManager.addLogin(login); + + for (let url of formUrls) { + info("start test_checkNoAutofillOnDowngrade w. url: " + url); + + await prepareAndProcessForm(url); + info("form was processed"); + + await SpecialPowers.spawn(win, [url, expectedUsername, expectedPassword], + function(urlContent, expectedUsernameContent, expectedPasswordContent) { + let doc = this.content.document; + let uname = doc.getElementById("form-basic-username"); + let pword = doc.getElementById("form-basic-password"); + Assert.equal(uname.value, expectedUsernameContent, `username ${expectedUsernameContent ? "filled" : "not filled"} on ${urlContent}`); + Assert.equal(pword.value, expectedPasswordContent, `password ${expectedPasswordContent ? "filled" : "not filled"} on ${urlContent}`); + }); + } +} + +add_setup(async () => { + await SpecialPowers.pushPrefEnv({"set": [ + ["signon.schemeUpgrades", true], + ["dom.security.https_first", false], + ]}); +}); + +add_task(async function test_sanityCheckHTTPS() { + let login = new nsLoginInfo("https://example.com", "https://example.com", null, + "name1", "pass1", "uname", "pword"); + + await checkFormsWithLogin([ + `https://example.com${MISSING_ACTION_PATH}`, + `https://example.com${SAME_ORIGIN_ACTION_PATH}`, + ], login, "name1", "pass1"); +}); + +add_task(async function test_checkNoAutofillOnDowngrade() { + let login = new nsLoginInfo("https://example.com", "https://example.com", null, + "name1", "pass1", "uname", "pword"); + await checkFormsWithLogin([ + `http://example.com${MISSING_ACTION_PATH}`, + `http://example.com${SAME_ORIGIN_ACTION_PATH}`, + ], login, "", ""); +}); + +add_task(async function test_checkNoAutofillOnDowngradeSubdomain() { + let login = new nsLoginInfo("https://sub.example.com", "https://example.com", null, + "name1", "pass1", "uname", "pword"); + todo(false, "await promiseFormsProcessed timesout when test is run with scheme=https"); + await checkFormsWithLogin([ + `http://example.com${MISSING_ACTION_PATH}`, + `http://example.com${SAME_ORIGIN_ACTION_PATH}`, + ], login, "", ""); +}); + + +add_task(async function test_checkNoAutofillOnDowngradeDifferentPort() { + let login = new nsLoginInfo("https://example.com:8080", "https://example.com", null, + "name1", "pass1", "uname", "pword"); + await checkFormsWithLogin([ + `http://example.com${MISSING_ACTION_PATH}`, + `http://example.com${SAME_ORIGIN_ACTION_PATH}`, + ], login, "", ""); +}); + +add_task(async function test_checkNoAutofillOnDowngradeSubdomainDifferentPort() { + let login = new nsLoginInfo("https://sub.example.com:8080", "https://example.com", null, + "name1", "pass1", "uname", "pword"); + await checkFormsWithLogin([ + `https://example.com${MISSING_ACTION_PATH}`, + `https://example.com${SAME_ORIGIN_ACTION_PATH}`, + ], login, "", ""); +}); +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autofill_https_upgrade.html b/toolkit/components/passwordmgr/test/mochitest/test_autofill_https_upgrade.html new file mode 100644 index 0000000000..104f4ef144 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autofill_https_upgrade.html @@ -0,0 +1,148 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test autofill on an HTTPS page using upgraded HTTP logins</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<script> +const MISSING_ACTION_PATH = TESTS_DIR + "mochitest/form_basic.html"; +const CROSS_ORIGIN_SECURE_PATH = TESTS_DIR + "mochitest/form_cross_origin_secure_action.html"; + +const chromeScript = runChecksAfterCommonInit(false); + +let nsLoginInfo = SpecialPowers.wrap(SpecialPowers.Components).Constructor("@mozilla.org/login-manager/loginInfo;1", + SpecialPowers.Ci.nsILoginInfo, + "init"); +</script> +<p id="display"></p> + +<!-- we presumably can't hide the content for this test. --> +<div id="content"> +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> +let win = window.open("about:blank"); +SimpleTest.registerCleanupFunction(() => win.close()); + +async function prepareLoginsAndProcessForm(url, logins = []) { + await LoginManager.removeAllUserFacingLogins(); + + let dates = Date.now(); + for (let login of logins) { + SpecialPowers.do_QueryInterface(login, SpecialPowers.Ci.nsILoginMetaInfo); + // Force all dates to be the same so they don't affect things like deduping. + login.timeCreated = login.timePasswordChanged = login.timeLastUsed = dates; + await LoginManager.addLogin(login); + } + + let processedPromise = promiseFormsProcessed(); + win.location = url; + await processedPromise; +} + +add_setup(async () => { + await SpecialPowers.pushPrefEnv({"set": [ + ["signon.schemeUpgrades", true], + ["signon.includeOtherSubdomainsInLookup", true], + ]}); +}); + +add_task(async function test_simpleNoDupesNoAction() { + await prepareLoginsAndProcessForm("https://example.com" + MISSING_ACTION_PATH, [ + new nsLoginInfo("http://example.com", "http://example.com", null, + "name2", "pass2", "uname", "pword"), + ]); + + await checkLoginFormInFrame(win, + "form-basic-username", "name2", + "form-basic-password", "pass2"); +}); + +add_task(async function test_simpleNoDupesUpgradeOriginAndAction() { + await prepareLoginsAndProcessForm("https://example.com" + CROSS_ORIGIN_SECURE_PATH, [ + new nsLoginInfo("http://example.com", "http://example.org", null, + "name2", "pass2", "uname", "pword"), + ]); + + await checkLoginFormInFrame(win, "form-basic-username", "name2", + "form-basic-password", "pass2"); +}); + +add_task(async function test_simpleNoDupesUpgradeOriginOnly() { + await prepareLoginsAndProcessForm("https://example.com" + CROSS_ORIGIN_SECURE_PATH, [ + new nsLoginInfo("http://example.com", "https://example.org", null, + "name2", "pass2", "uname", "pword"), + ]); + + await checkLoginFormInFrame(win, "form-basic-username", "name2", + "form-basic-password", "pass2"); +}); + +add_task(async function test_simpleNoDupesUpgradeActionOnly() { + await prepareLoginsAndProcessForm("https://example.com" + CROSS_ORIGIN_SECURE_PATH, [ + new nsLoginInfo("https://example.com", "http://example.org", null, + "name2", "pass2", "uname", "pword"), + ]); + + await checkLoginFormInFrame(win, "form-basic-username", "name2", + "form-basic-password", "pass2"); +}); + +add_task(async function test_dedupe() { + await prepareLoginsAndProcessForm("https://example.com" + MISSING_ACTION_PATH, [ + new nsLoginInfo("https://example.com", "https://example.com", null, + "name1", "passHTTPStoHTTPS", "uname", "pword"), + new nsLoginInfo("http://example.com", "http://example.com", null, + "name1", "passHTTPtoHTTP", "uname", "pword"), + new nsLoginInfo("http://example.com", "https://example.com", null, + "name1", "passHTTPtoHTTPS", "uname", "pword"), + new nsLoginInfo("https://example.com", "http://example.com", null, + "name1", "passHTTPStoHTTP", "uname", "pword"), + ]); + + await checkLoginFormInFrame(win, "form-basic-username", "name1", + "form-basic-password", "passHTTPStoHTTPS"); +}); + +add_task(async function test_dedupe_subdomain() { + // subdomain match (should be autofilled) + let loginToFill = new nsLoginInfo("http://test1.example.com", "http://test1.example.com", null, + "name1", "pass1"); + const loginToFillGUID = "subdomain-match" + // Assign a GUID to this login so we can ensure this is the login that gets + // filled later. + loginToFill.QueryInterface(SpecialPowers.Ci.nsILoginMetaInfo).guid = loginToFillGUID; + + await prepareLoginsAndProcessForm("https://test1.example.com" + MISSING_ACTION_PATH, [ + // All logins have the same username and password: + // https: (scheme match) + new nsLoginInfo("https://example.com", "https://example.com", null, + "name1", "pass1"), + loginToFill, + // formActionOrigin match + new nsLoginInfo("http://example.com", "https://test1.example.com", null, + "name1", "pass1"), + ]); + + await checkLoginFormInFrame(win, "form-basic-username", "name1", + "form-basic-password", "pass1"); + + let filledGUID = await SpecialPowers.spawn(win, [], function getFilledGUID() { + let LMC = this.content.windowGlobalChild.getActor("LoginManager"); + let doc = this.content.document; + let form = doc.getElementById("form-basic"); + let { login: filledLogin } = LMC.stateForDocument(doc).fillsByRootElement.get(form); + return filledLogin && filledLogin.guid; + }); + is(filledGUID, loginToFillGUID, "Check the correct login was filled"); +}); +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autofill_password-only.html b/toolkit/components/passwordmgr/test/mochitest/test_autofill_password-only.html new file mode 100644 index 0000000000..755a1f3f1d --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autofill_password-only.html @@ -0,0 +1,135 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test password-only forms should prefer a password-only login when present</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: Bug 444968 +<script> +PWMGR_COMMON_PARENT.sendAsyncMessage("setupParent", { selfFilling: true }); + +SimpleTest.waitForExplicitFinish(); + +const chromeScript = runInParent(async function chromeSetup() { + const login1A = Cc["@mozilla.org/login-manager/loginInfo;1"].createInstance(Ci.nsILoginInfo); + const login1B = Cc["@mozilla.org/login-manager/loginInfo;1"].createInstance(Ci.nsILoginInfo); + const login2A = Cc["@mozilla.org/login-manager/loginInfo;1"].createInstance(Ci.nsILoginInfo); + const login2B = Cc["@mozilla.org/login-manager/loginInfo;1"].createInstance(Ci.nsILoginInfo); + const login2C = Cc["@mozilla.org/login-manager/loginInfo;1"].createInstance(Ci.nsILoginInfo); + + login1A.init("http://mochi.test:8888", "http://bug444968-1", null, "testuser1A", "testpass1A", "", ""); + login1B.init("http://mochi.test:8888", "http://bug444968-1", null, "", "testpass1B", "", ""); + + login2A.init("http://mochi.test:8888", "http://bug444968-2", null, "testuser2A", "testpass2A", "", ""); + login2B.init("http://mochi.test:8888", "http://bug444968-2", null, "", "testpass2B", "", ""); + login2C.init("http://mochi.test:8888", "http://bug444968-2", null, "testuser2C", "testpass2C", "", ""); + + await Services.logins.addLogins([ + login1A, + login1B, + login2A, + login2B, + login2C, + ]); + + addMessageListener("removeLogins", function removeLogins() { + Services.logins.removeLogin(login1A); + Services.logins.removeLogin(login1B); + Services.logins.removeLogin(login2A); + Services.logins.removeLogin(login2B); + Services.logins.removeLogin(login2C); + }); +}); + +SimpleTest.registerCleanupFunction(() => chromeScript.sendAsyncMessage("removeLogins")); + +registerRunTests(); +</script> + +<p id="display"></p> +<div id="content" style="display: none"> +</div> +<pre id="test"> +<script class="testbody" type="text/javascript"> +const DEFAULT_ORIGIN = window.location.origin; + +/* Test for Login Manager: 444968 (password-only forms should prefer a + * password-only login when present ) + */ +async function startTest() { + const win = window.open("about:blank"); + SimpleTest.registerCleanupFunction(() => win.close()); + await loadFormIntoWindow(DEFAULT_ORIGIN, ` + <!-- first 3 forms have matching user+pass and pass-only logins --> + + <!-- user+pass form. --> + <form id="form1" action="http://bug444968-1"> + <input type="text" name="uname"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <!-- password-only form. --> + <form id="form2" action="http://bug444968-1"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <!-- user+pass form, username prefilled --> + <form id="form3" action="http://bug444968-1"> + <input type="text" name="uname" value="testuser1A"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + + <!-- next 4 forms have matching user+pass (2x) and pass-only (1x) logins --> + + <!-- user+pass form. --> + <form id="form4" action="http://bug444968-2"> + <input type="text" name="uname"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <!-- password-only form. --> + <form id="form5" action="http://bug444968-2"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <!-- user+pass form, username prefilled --> + <form id="form6" action="http://bug444968-2"> + <input type="text" name="uname" value="testuser2A"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <!-- user+pass form, username prefilled --> + <form id="form7" action="http://bug444968-2"> + <input type="text" name="uname" value="testuser2C"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form>`, win, 7); + + await checkLoginFormInFrameWithElementValues(win, 1, "testuser1A", "testpass1A"); + await checkLoginFormInFrameWithElementValues(win, 2, "testpass1B"); + await checkLoginFormInFrameWithElementValues(win, 3, "testuser1A", "testpass1A"); + + checkUnmodifiedFormInFrame(win, 4); // 2 logins match + await checkLoginFormInFrameWithElementValues(win, 5, "testpass2B"); + await checkLoginFormInFrameWithElementValues(win, 6, "testuser2A", "testpass2A"); + await checkLoginFormInFrameWithElementValues(win, 7, "testuser2C", "testpass2C"); + + SimpleTest.finish(); +} + +window.addEventListener("runTests", startTest); +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autofill_sandboxed.html b/toolkit/components/passwordmgr/test/mochitest/test_autofill_sandboxed.html new file mode 100644 index 0000000000..8fd6debd5c --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autofill_sandboxed.html @@ -0,0 +1,100 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test form field autofill in sandboxed documents (null principal)</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<p id="display"></p> + +<div id="content"> + <iframe id="sandboxed" + sandbox=""></iframe> +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> + +const { TestUtils } = SpecialPowers.ChromeUtils.import( + "resource://testing-common/TestUtils.jsm" +); + +/** Test for Login Manager: form field autofill in sandboxed documents (null principal) **/ + +const sandboxed = document.getElementById("sandboxed"); +let uname; +let pword; + +add_setup(async () => { + await setStoredLoginsAsync(["https://example.com", "", null, "tempuser1", "temppass1", "uname", "pword"]); +}); + +add_task(async function test_no_autofill_in_form() { + sandboxed.src = "form_basic.html"; + const frameWindow = SpecialPowers.wrap(sandboxed).contentWindow; + const DOMFormHasPasswordPromise = new Promise(resolve => { + SpecialPowers.addChromeEventListener("DOMFormHasPassword", function onDFHP() { + SpecialPowers.removeChromeEventListener("DOMFormHasPassword", onDFHP); + resolve(); + }); + }); + // Can't use SimpleTest.promiseFocus as it doesn't work with the sandbox. + await SimpleTest.promiseWaitForCondition(() => { + return frameWindow.document.readyState == "complete" && + frameWindow.location.href.endsWith("form_basic.html"); + }, "Check frame is loaded"); + info("frame loaded"); + await DOMFormHasPasswordPromise; + const frameDoc = SpecialPowers.wrap(sandboxed).contentDocument; + + uname = frameDoc.getElementById("form-basic-username"); + pword = frameDoc.getElementById("form-basic-password"); + + // Autofill shouldn't happen in the sandboxed frame but would have happened by + // now since DOMFormHasPassword was observed above. + await ensureLoginFormStaysFilledWith(uname, "", pword, ""); + + info("blurring the username field after typing the username"); + uname.focus(); + uname.setUserInput("tempuser1"); + synthesizeKey("VK_TAB", {}, frameWindow); + + await TestUtils.waitForCondition(() => { + return uname.value === "tempuser1" & pword.value === ""; + }, "Username and password field should be filled"); +}); + +add_task(async function test_no_autofill_outside_form() { + sandboxed.src = "formless_basic.html"; + const frameWindow = SpecialPowers.wrap(sandboxed).contentWindow; + const DOMInputPasswordAddedPromise = new Promise(resolve => { + SpecialPowers.addChromeEventListener("DOMInputPasswordAdded", function onDIPA() { + SpecialPowers.removeChromeEventListener("DOMInputPasswordAdded", onDIPA); + resolve(); + }); + }); + // Can't use SimpleTest.promiseFocus as it doesn't work with the sandbox. + await SimpleTest.promiseWaitForCondition(() => { + return frameWindow.document.readyState == "complete" && + frameWindow.location.href.endsWith("formless_basic.html"); + }, "Check frame is loaded"); + info("frame loaded"); + await DOMInputPasswordAddedPromise; + const frameDoc = SpecialPowers.wrap(sandboxed).contentDocument; + + uname = frameDoc.getElementById("form-basic-username"); + pword = frameDoc.getElementById("form-basic-password"); + + // Autofill shouldn't happen in the sandboxed frame but would have happened by + // now since DOMInputPasswordAdded was observed above. + await ensureLoginFormStaysFilledWith(uname, "", pword, ""); +}); +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autofill_tab_between_fields.html b/toolkit/components/passwordmgr/test/mochitest/test_autofill_tab_between_fields.html new file mode 100644 index 0000000000..53eb959d7b --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autofill_tab_between_fields.html @@ -0,0 +1,154 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test autocomplete behavior when tabbing between form fields</title> + <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<script> +let nsLoginInfo = SpecialPowers.wrap(SpecialPowers.Components).Constructor("@mozilla.org/login-manager/loginInfo;1", + SpecialPowers.Ci.nsILoginInfo, + "init"); +let readyPromise = registerRunTests(); +</script> +<p id="display"></p> + +<!-- we presumably can't hide the content for this test. --> +<div id="content"> +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> +let DEFAULT_ORIGIN = window.location.origin; +let win; +let html = ` + <form id="form1" action="https://autofill" onsubmit="return false;"> + <input type="text" name="uname"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form>`; + +async function prepareLogins(logins = []) { + await LoginManager.removeAllUserFacingLogins(); + + for (let login of logins) { + let storageAddPromise = promiseStorageChanged(["addLogin"]); + await LoginManager.addLogin(login); + await storageAddPromise; + } + let count = (await LoginManager.getAllLogins()).length; + is(count, logins.length, "All logins were added"); +} + +const availableLogins = { + "exampleUser1": new nsLoginInfo(DEFAULT_ORIGIN, "https://autofill", null, + "user1", "pass1", "uname", "pword"), +} + +async function recreateTreeInWindow(formNum) { + await SpecialPowers.spawn(win, [formNum], (formNumF) => { + // eslint-disable-next-line no-unsanitized/property + let form = this.content.document.querySelector(`#form${formNumF}`); + // eslint-disable-next-line no-unsanitized/property, no-self-assign + form.outerHTML = form.outerHTML; + }); +} + +const tests = [ + { + name: "autofill_disabled_exact_username", + autofillEnabled: false, + logins: ["exampleUser1"], + expectedAutofillUsername: "", + expectedAutofillPassword: "", + typeUsername: "user1", + expectedTabbedUsername: "user1", + expectedTabbedPassword: "", + }, + { + name: "autofill_enabled_exact_username", + autofillEnabled: true, + logins: ["exampleUser1"], + expectedAutofillUsername: "user1", + expectedAutofillPassword: "pass1", + typeUsername: "user1", + expectedTabbedUsername: "user1", + expectedTabbedPassword: "pass1", + }, +]; + +add_setup(async () => { + ok(readyPromise, "check promise is available"); + await readyPromise; + win = window.open("about:blank"); + SimpleTest.registerCleanupFunction(() => win.close()); + await loadFormIntoWindow(DEFAULT_ORIGIN, html, win); +}); + +async function testResultOfTabInteractions(testData) { + await SpecialPowers.pushPrefEnv({"set": [ + ["signon.autofillForms", testData.autofillEnabled], + ]}); + + await SimpleTest.promiseFocus(win); + let logins = testData.logins.map(name => availableLogins[name]); + await prepareLogins(logins); + + info("recreating form"); + let processed = promiseFormsProcessed(); + await recreateTreeInWindow(1); + info("waiting for form processed"); + await processed; + // check autofill results + await checkLoginFormInFrameWithElementValues(win, 1, testData.expectedAutofillUsername, testData.expectedAutofillPassword); + + await SpecialPowers.spawn(win, [testData.typeUsername], async (typeUsername) => { + let doc = this.content.document; + let pword = doc.querySelector("[name='pword']"); + let uname = doc.querySelector("[name='uname']"); + + pword.setUserInput(""); + uname.setUserInput(""); + + info("Placing focus in the username field"); + uname.focus(); + + if (typeUsername) { + info("Filling username field"); + EventUtils.sendString(typeUsername, this.content); + } + + EventUtils.synthesizeKey("KEY_Tab", {}, this.content); // blur un, focus pw + await new Promise(resolve => SpecialPowers.executeSoon(resolve)); + + ok(pword.matches("input:focus"), "pword field is focused"); + }); + + await checkLoginFormInFrameWithElementValues(win, 1, testData.expectedTabbedUsername, testData.expectedTabbedPassword); + + await recreateTreeInWindow(1); + await promiseFormsProcessed(); + + await SpecialPowers.spawn(win, [], () => { + EventUtils.synthesizeKey("KEY_Escape", {}, this.content); + }); +} + +for (let testData of tests) { + let tmp = { + async [testData.name]() { + await testResultOfTabInteractions(testData); + }, + }; + add_task(tmp[testData.name]); +} + +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autofill_username-only.html b/toolkit/components/passwordmgr/test/mochitest/test_autofill_username-only.html new file mode 100644 index 0000000000..860c317409 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autofill_username-only.html @@ -0,0 +1,107 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test autofill on username-form</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Test autofill on username-form + +<script> +add_setup(async () => { + await setStoredLoginsAsync( + [window.location.origin, "https://autofill", null, "user1", "pass1"] + ); +}); + +add_task(async function test_autofill_username_only_form() { + await loadRecipes({ + siteRecipes: [{ + hosts: ["mochi.test:8888"], + notUsernameSelector: "input[name='shouldnotfill']", + }], + }); + + let win = window.open("about:blank"); + SimpleTest.registerCleanupFunction(() => win.close()); + + // 5 out of the 7 forms should be autofilled + await loadFormIntoWindow(window.location.origin, ` + <!-- no password field, 1 username field --> + <form id='form1' action='https://autofill'> 1 + <input type='text' name='uname' autocomplete='username' value=''> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form> + + <!-- no password field, 1 username field, with a value set --> + <form id='form2' action='https://autofill'> 2 + <input type='text' name='uname' autocomplete='username' value='someuser'> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form> + + <!-- no password field, 2 username fields, should be ignored --> + <form id='form3' action='https://autofill'> 3 + <input type='text' name='uname1' autocomplete='username' value=''> + <input type='text' name='uname2' autocomplete='username' value=''> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form> + + <!-- no password field, 1 username field, too small for the username login --> + <form id='form4' action='https://autofill'> 4 + <input type='text' name='uname' value='' maxlength="4" autocomplete='username'> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form> + + <!-- no password field, 1 username field, too small for the username login --> + <form id='form5' action='https://autofill'> 5 + <input type='text' name='uname' value='' maxlength="0" autocomplete='username'> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form> + + <!-- no password field, 1 text input field (not a username-only form), should be ignored --> + <form id='form6' action='https://autofill'> 6 + <input type='text' name='uname' value=''> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form> + + <!-- no password field, 1 username field that matches notUsernameSelector recipe --> + <form id='form7' action='https://autofill'> 7 + <input type='text' name='shouldnotfill' autocomplete='username' value=''> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form>`, win, 5); + + await checkLoginFormInFrameWithElementValues(win, 1, "user1"); + await checkLoginFormInFrameWithElementValues(win, 2, "someuser"); + await checkUnmodifiedFormInFrame(win, 3); + await checkUnmodifiedFormInFrame(win, 4); + await checkUnmodifiedFormInFrame(win, 5); + await checkUnmodifiedFormInFrame(win, 6); + await checkUnmodifiedFormInFrame(win, 7); + + await resetRecipes(); +}); +</script> + +<p id="display"></p> +<div id="content"></div> +<pre id="test"></pre> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autofill_username-only_threshold.html b/toolkit/components/passwordmgr/test/mochitest/test_autofill_username-only_threshold.html new file mode 100644 index 0000000000..d9a2e08095 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autofill_username-only_threshold.html @@ -0,0 +1,83 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test autofill on username-form when the number of form exceeds the lookup threshold</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Test not autofill on username-form when the number of form exceeds the lookup threshold + +<script> +add_setup(async () => { + await SpecialPowers.pushPrefEnv({"set": [["signon.usernameOnlyForm.lookupThreshold", 5]]}); + + await setStoredLoginsAsync( + [window.location.origin, "https://autofill", null, "user1", "pass1"] + ); +}); + +add_task(async function test_autofill_username_only_form() { + const win = window.open("about:blank"); + SimpleTest.registerCleanupFunction(() => win.close()); + + await loadFormIntoWindow(window.location.origin, ` + <!-- no password field, 1 username field --> + <form id='form1' action='https://autofill'> 1 + <input type='text' name='uname' autocomplete='username' value=''> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form> + + <form id='form2' action='https://autofill'> 2 + <input type='text' name='uname' autocomplete='username' value=''> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form> + + <form id='form3' action='https://autofill'> 3 + <input type='text' name='uname' autocomplete='username' value=''> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form> + + <form id='form4' action='https://autofill'> 4 + <input type='text' name='uname' autocomplete='username' value=''> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form> + + <form id='form5' action='https://autofill'> 5 + <input type='text' name='uname' autocomplete='username' value=''> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form> + + <form id='form6' action='https://autofill'> 6 + <input type='text' name='uname' autocomplete='username' value=''> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form>`, win, 5); + + await checkLoginFormInFrameWithElementValues(win, 1, "user1"); + await checkLoginFormInFrameWithElementValues(win, 2, "user1"); + await checkLoginFormInFrameWithElementValues(win, 3, "user1"); + await checkLoginFormInFrameWithElementValues(win, 4, "user1"); + await checkLoginFormInFrameWithElementValues(win, 5, "user1"); + await checkUnmodifiedFormInFrame(win, 6); +}); +</script> + +<p id="display"></p> +<div id="content"></div> +<pre id="test"></pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_autofocus_js.html b/toolkit/components/passwordmgr/test/mochitest/test_autofocus_js.html new file mode 100644 index 0000000000..803197c2a2 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_autofocus_js.html @@ -0,0 +1,114 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test login autocomplete is activated when focused by js on load</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<p id="display"></p> + +<div id="content"> + <iframe></iframe> +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> +const iframe = document.getElementsByTagName("iframe")[0]; +let iframeDoc, hostname; + +add_setup(async () => { + const origin = window.location.origin; + await setStoredLoginsAsync( + [origin, origin, null, "name", "pass"], + [origin, origin, null, "name1", "pass1"] + ); + + const processedPromise = promiseFormsProcessed(); + iframe.src = "/tests/toolkit/components/passwordmgr/test/mochitest/form_autofocus_js.html"; + await new Promise(resolve => { + iframe.addEventListener("load", function() { + resolve(); + }, {once: true}); + }); + + await processedPromise; + + hostname = await SpecialPowers.spawn(getIframeBrowsingContext(window), [], function() { + return this.content.document.documentURIObject.host; + }); + + SimpleTest.requestFlakyTimeout("Giving a chance for the unexpected popupshown to occur"); +}); + +add_task(async function test_initial_focus() { + let results = await notifyMenuChanged(3, "name"); + checkAutoCompleteResults(results, ["name", "name1"], hostname, "Two login results"); + synthesizeKey("KEY_ArrowDown"); + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + await SpecialPowers.spawn(getIframeBrowsingContext(window), [], function() { + Assert.equal(this.content.document.getElementById("form-basic-password").value, "pass", "Check first password filled"); + }); + let popupState = await getPopupState(); + is(popupState.open, false, "Check popup is now closed"); +}); + +// This depends on the filling from the previous test. +add_task(async function test_not_reopened_if_filled() { + listenForUnexpectedPopupShown(); + await SpecialPowers.spawn(getIframeBrowsingContext(window), [], function() { + this.content.document.getElementById("form-basic-username").focus(); + }); + info("Waiting to see if a popupshown occurs"); + await new Promise(resolve => setTimeout(resolve, 1000)); + + // cleanup + gPopupShownExpected = true; + await SpecialPowers.spawn(getIframeBrowsingContext(window), [], function() { + this.content.document.getElementById("form-basic-submit").focus(); + }); +}); + +add_task(async function test_reopened_after_edit_not_matching_saved() { + await SpecialPowers.spawn(getIframeBrowsingContext(window), [], function() { + this.content.document.getElementById("form-basic-username").value = "nam"; + }); + await popupBy(async () => { + await SpecialPowers.spawn(getIframeBrowsingContext(window), [], function() { + this.content.document.getElementById("form-basic-username").focus(); + }); + }); + await SpecialPowers.spawn(getIframeBrowsingContext(window), [], function() { + this.content.document.getElementById("form-basic-submit").focus(); + }); +}); + +add_task(async function test_not_reopened_after_selecting() { + await SpecialPowers.spawn(getIframeBrowsingContext(window), [], function() { + this.content.document.getElementById("form-basic-username").value = ""; + this.content.document.getElementById("form-basic-password").value = ""; + }); + listenForUnexpectedPopupShown(); + + await SpecialPowers.spawn(getIframeBrowsingContext(window), [], function() { + let formFillController = SpecialPowers.getFormFillController(); + let usernameField = this.content.document.getElementById("form-basic-username"); + formFillController.markAsLoginManagerField(usernameField); + }); + + info("Waiting to see if a popupshown occurs"); + await new Promise(resolve => setTimeout(resolve, 1000)); + + // Cleanup + gPopupShownExpected = true; +}); + +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_basic_form.html b/toolkit/components/passwordmgr/test/mochitest/test_basic_form.html new file mode 100644 index 0000000000..d13fd1369f --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_basic_form.html @@ -0,0 +1,48 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test basic autofill</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: simple form fill + +<script> +gTestDependsOnDeprecatedLogin = true; +runChecksAfterCommonInit(startTest); + +let DEFAULT_ORIGIN = window.location.origin; + +/** Test for Login Manager: form fill, multiple forms. **/ + +async function startTest() { + let win = window.open("about:blank"); + SimpleTest.registerCleanupFunction(() => win.close()); + await loadFormIntoWindow(DEFAULT_ORIGIN, ` + <form id="form1" action="formtest.js"> + <p>This is form 1.</p> + <input id="username-1" type="text" name="uname"> + <input id="password-1" type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form>`, win); + await checkLoginFormInFrame(win, "username-1", "testuser", "password-1", "testpass"); + + SimpleTest.finish(); +} +</script> + +<p id="display"></p> + +<div id="content" style="display: none"> + + +</div> + +<pre id="test"></pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_basic_form_0pw.html b/toolkit/components/passwordmgr/test/mochitest/test_basic_form_0pw.html new file mode 100644 index 0000000000..64450300d6 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_basic_form_0pw.html @@ -0,0 +1,70 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test forms with no password fields</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: forms with no password fields +<p id="display"></p> + +<div id="content" style="display: none"> + + <!-- Form with no user field or password field --> + <form id="form1" action="formtest.js"> + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- Form with no user field or password field, but one other field --> + <form id="form2" action="formtest.js"> + <input type="checkbox"> + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- Form with no user field or password field, but one other field --> + <form id="form3" action="formtest.js"> + <input type="checkbox" name="uname" value=""> + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- Form with a text field, but no password field --> + <form id="form4" action="formtest.js"> + <input type="text" name="yyyyy"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- Form with a user field, but no password field --> + <form id="form5" action="formtest.js"> + <input type="text" name="uname"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> + +function startTest() { + is(getFormElementByName(3, "uname").value, "", "Checking for unfilled checkbox (form 3)"); + is(getFormElementByName(4, "yyyyy").value, "", "Checking for unfilled text field (form 4)"); + is(getFormElementByName(5, "uname").value, "", "Checking for unfilled text field (form 5)"); + + SimpleTest.finish(); +} + +runChecksAfterCommonInit(startTest); +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_basic_form_1pw.html b/toolkit/components/passwordmgr/test/mochitest/test_basic_form_1pw.html new file mode 100644 index 0000000000..bb91d9cf3e --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_basic_form_1pw.html @@ -0,0 +1,171 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test autofill for forms with 1 password field</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: forms with 1 password field +<script> +gTestDependsOnDeprecatedLogin = true; +runChecksAfterCommonInit(() => startTest()); + +let DEFAULT_ORIGIN = window.location.origin; +</script> +<p id="display"></p> + +<div id="content" style="display: none"> +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> + +/** Test for Login Manager: simple form fill **/ + +async function startTest() { + let win = window.open("about:blank"); + SimpleTest.registerCleanupFunction(() => win.close()); + await loadFormIntoWindow(DEFAULT_ORIGIN, ` + <!-- no username fields --> + + <form id='form1' action='formtest.js'> 1 + <!-- Blank, so fill in the password --> + <input type='password' name='pname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form2' action='formtest.js'> 2 + <!-- Already contains the password, so nothing to do. --> + <input type='password' name='pname' value='testpass'> + <button type='submit'>Submit</button> + </form> + + <form id='form3' action='formtest.js'> 3 + <!-- Contains unknown password, so don't change it --> + <input type='password' name='pname' value='xxxxxxxx'> + <button type='submit'>Submit</button> + </form> + + + <!-- username fields --> + + <form id='form4' action='formtest.js'> 4 + <!-- Blanks, so fill in login --> + <input type='text' name='uname' value=''> + <input type='password' name='pname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form5' action='formtest.js'> 5 + <!-- Username already set, so fill in password --> + <input type='text' name='uname' value='testuser'> + <input type='password' name='pname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form6' action='formtest.js'> 6 + <!-- Unknown username, so don't fill in password --> + <input type='text' name='uname' value='xxxxxxxx'> + <input type='password' name='pname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form7' action='formtest.js'> 7 + <!-- Password already set, could fill in username but that's weird so we don't --> + <input type='text' name='uname' value=''> + <input type='password' name='pname' value='testpass'> + <button type='submit'>Submit</button> + </form> + + <form id='form8' action='formtest.js'> 8 + <!-- Unknown password, so don't fill in a username --> + <input type='text' name='uname' value=''> + <input type='password' name='pname' value='xxxxxxxx'> + <button type='submit'>Submit</button> + </form> + + + + <!-- extra text fields --> + + <form id='form9' action='formtest.js'> 9 + <!-- text field _after_ password should never be treated as a username field --> + <input type='password' name='pname' value=''> + <input type='text' name='uname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form10' action='formtest.js'> 10 + <!-- only the first text field before the password should be for username --> + <input type='text' name='other' value=''> + <input type='text' name='uname' value=''> + <input type='password' name='pname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form11' action='formtest.js'> 11 + <!-- variation just to make sure extra text field is still ignored --> + <input type='text' name='uname' value=''> + <input type='password' name='pname' value=''> + <input type='text' name='other' value=''> + <button type='submit'>Submit</button> + </form> + + + + <!-- same as last bunch, but with xxxx in the extra field. --> + + <form id='form12' action='formtest.js'> 12 + <!-- text field _after_ password should never be treated as a username field --> + <input type='password' name='pname' value=''> + <input type='text' name='uname' value='xxxxxxxx'> + <button type='submit'>Submit</button> + </form> + + <form id='form13' action='formtest.js'> 13 + <!-- only the first text field before the password should be for username --> + <input type='text' name='other' value='xxxxxxxx'> + <input type='text' name='uname' value=''> + <input type='password' name='pname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form14' action='formtest.js'> 14 + <!-- variation just to make sure extra text field is still ignored --> + <input type='text' name='uname' value=''> + <input type='password' name='pname' value=''> + <input type='text' name='other' value='xxxxxxxx'> + <button type='submit'>Submit</button> + </form>`, win, 14); + + var f = 1; + + // 1-3 + await checkLoginFormInFrameWithElementValues(win, f++, "testpass"); + await checkLoginFormInFrameWithElementValues(win, f++, "testpass"); + await checkLoginFormInFrameWithElementValues(win, f++, "xxxxxxxx"); + + // 4-8 + await checkLoginFormInFrameWithElementValues(win, f++, "testuser", "testpass"); + await checkLoginFormInFrameWithElementValues(win, f++, "testuser", "testpass"); + await checkLoginFormInFrameWithElementValues(win, f++, "xxxxxxxx", ""); + await checkLoginFormInFrameWithElementValues(win, f++, "", "testpass"); + await checkLoginFormInFrameWithElementValues(win, f++, "", "xxxxxxxx"); + + // 9-14 + await checkLoginFormInFrameWithElementValues(win, f++, "testpass", ""); + await checkLoginFormInFrameWithElementValues(win, f++, "", "testuser", "testpass"); + await checkLoginFormInFrameWithElementValues(win, f++, "testuser", "testpass", ""); + await checkLoginFormInFrameWithElementValues(win, f++, "testpass", "xxxxxxxx"); + await checkLoginFormInFrameWithElementValues(win, f++, "xxxxxxxx", "testuser", "testpass"); + await checkLoginFormInFrameWithElementValues(win, f++, "testuser", "testpass", "xxxxxxxx"); + + SimpleTest.finish(); +} +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_basic_form_1pw_2.html b/toolkit/components/passwordmgr/test/mochitest/test_basic_form_1pw_2.html new file mode 100644 index 0000000000..d7aaadc895 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_basic_form_1pw_2.html @@ -0,0 +1,115 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test forms with 1 password field, part 2</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: forms with 1 password field, part 2 +<script> +gTestDependsOnDeprecatedLogin = true; +runChecksAfterCommonInit(() => startTest()); + +let DEFAULT_ORIGIN = window.location.origin; +</script> +<p id="display"></p> + +<div id="content" style="display: none"> +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> + +/** Test for Login Manager: simple form fill, part 2 **/ + +async function startTest() { + let win = window.open("about:blank"); + SimpleTest.registerCleanupFunction(() => win.close()); + await loadFormIntoWindow(DEFAULT_ORIGIN, ` + <form id='form1' action='formtest.js'> 1 + <input type='password' name='pname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form2' action='formtest.js'> 2 + <input type='password' name='pname' value='' disabled> + <button type='submit'>Submit</button> + </form> + + <form id='form3' action='formtest.js'> 3 + <input type='password' name='pname' value='' readonly> + <button type='submit'>Submit</button> + </form> + + <form id='form4' action='formtest.js'> 4 + <input type='text' name='uname' value=''> + <input type='password' name='pname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form5' action='formtest.js'> 5 + <input type='text' name='uname' value='' disabled> + <input type='password' name='pname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form6' action='formtest.js'> 6 + <input type='text' name='uname' value='' readonly> + <input type='password' name='pname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form7' action='formtest.js'> 7 + <input type='text' name='uname' value=''> + <input type='password' name='pname' value='' disabled> + <button type='submit'>Submit</button> + </form> + + <form id='form8' action='formtest.js'> 8 + <input type='text' name='uname' value=''> + <input type='password' name='pname' value='' readonly> + <button type='submit'>Submit</button> + </form> + + <form id='form9' action='formtest.js'> 9 + <input type='text' name='uname' value='TESTUSER'> + <input type='password' name='pname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form10' action='formtest.js'> 10 + <input type='text' name='uname' value='TESTUSER' readonly> + <input type='password' name='pname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form11' action='formtest.js'> 11 + <input type='text' name='uname' value='TESTUSER' disabled> + <input type='password' name='pname' value=''> + <button type='submit'>Submit</button> + </form>`, win, 11); + + var f; + + // Test various combinations of disabled/readonly inputs + await checkLoginFormInFrameWithElementValues(win, 1, "testpass"); // control + await checkUnmodifiedFormInFrame(win, 2); + await checkUnmodifiedFormInFrame(win, 3); + await checkLoginFormInFrameWithElementValues(win, 4, "testuser", "testpass"); // control + for (f = 5; f <= 8; f++) { + await checkUnmodifiedFormInFrame(win, f); + } + // Test case-insensitive comparison of username field + await checkLoginFormInFrameWithElementValues(win, 9, "testuser", "testpass"); + await checkLoginFormInFrameWithElementValues(win, 10, "TESTUSER", "testpass"); + await checkLoginFormInFrameWithElementValues(win, 11, "TESTUSER", "testpass"); + + SimpleTest.finish(); +} +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_basic_form_2pw_1.html b/toolkit/components/passwordmgr/test/mochitest/test_basic_form_2pw_1.html new file mode 100644 index 0000000000..1d9224a819 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_basic_form_2pw_1.html @@ -0,0 +1,190 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test autofill for forms with 2 password fields</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: forms with 2 password fields +<script> +gTestDependsOnDeprecatedLogin = true; +runChecksAfterCommonInit(() => startTest()); + +let DEFAULT_ORIGIN = window.location.origin; +</script> +<p id="display"></p> + +<div id="content" style="display: none"> +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> + +/** Test for Login Manager: simple form fill **/ + +async function startTest() { + let win = window.open("about:blank"); + SimpleTest.registerCleanupFunction(() => win.close()); + await loadFormIntoWindow(DEFAULT_ORIGIN, ` + <!-- no username fields --> + + <form id='form1' action='formtest.js'> 1 + <!-- simple form, fill in first pw --> + <input type='password' name='pname' value=''> + <input type='password' name='qname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form2' action='formtest.js'> 2 + <!-- same but reverse pname and qname, field names are ignored. --> + <input type='password' name='qname' value=''> + <input type='password' name='pname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form3' action='formtest.js'> 3 + <!-- text field after password fields should be ignored, no username. --> + <input type='password' name='pname' value=''> + <input type='password' name='qname' value=''> + <input type='text' name='uname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form4' action='formtest.js'> 4 + <!-- nothing to do, password already present --> + <input type='password' name='pname' value='testpass'> + <input type='password' name='qname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form5' action='formtest.js'> 5 + <!-- don't clobber an existing unrecognized password --> + <input type='password' name='pname' value='xxxxxxxx'> + <input type='password' name='qname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form6' action='formtest.js'> 6 + <!-- fill in first field, 2nd field shouldn't be touched anyway. --> + <input type='password' name='pname' value=''> + <input type='password' name='qname' value='xxxxxxxx'> + <button type='submit'>Submit</button> + </form> + + + + <!-- with username fields --> + + + + <form id='form7' action='formtest.js'> 7 + <!-- simple form, should fill in username and first pw --> + <input type='text' name='uname' value=''> + <input type='password' name='pname' value=''> + <input type='password' name='qname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form8' action='formtest.js'> 8 + <!-- reverse pname and qname, field names are ignored. --> + <input type='text' name='uname' value=''> + <input type='password' name='qname' value=''> + <input type='password' name='pname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form9' action='formtest.js'> 9 + <!-- username already filled, so just fill first password --> + <input type='text' name='uname' value='testuser'> + <input type='password' name='pname' value=''> + <input type='password' name='qname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form10' action='formtest.js'> 10 + <!-- unknown username, don't fill in a password --> + <input type='text' name='uname' value='xxxxxxxx'> + <input type='password' name='pname' value=''> + <input type='password' name='qname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form11' action='formtest.js'> 11 + <!-- don't clobber unknown password --> + <input type='text' name='uname' value='testuser'> + <input type='password' name='pname' value='xxxxxxxx'> + <input type='password' name='qname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form12' action='formtest.js'> 12 + <!-- fill in 1st pass, don't clobber 2nd pass --> + <input type='text' name='uname' value='testuser'> + <input type='password' name='pname' value=''> + <input type='password' name='qname' value='xxxxxxxx'> + <button type='submit'>Submit</button> + </form> + + <form id='form13' action='formtest.js'> 13 + <!-- nothing to do, user and pass prefilled. life is easy. --> + <input type='text' name='uname' value='testuser'> + <input type='password' name='pname' value='testpass'> + <input type='password' name='qname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form14' action='formtest.js'> 14 + <!-- shouldn't fill in username because 1st pw field is unknown. --> + <input type='text' name='uname' value=''> + <input type='password' name='pname' value='xxxxxxxx'> + <input type='password' name='qname' value='testpass'> + <button type='submit'>Submit</button> + </form> + + <form id='form15' action='formtest.js'> 15 + <!-- textfield in the middle of pw fields should be ignored --> + <input type='password' name='pname' value=''> + <input type='text' name='uname' value=''> + <input type='password' name='qname' value=''> + <button type='submit'>Submit</button> + </form> + + <form id='form16' action='formtest.js'> 16 + <!-- same, and don't clobber existing unknown password --> + <input type='password' name='pname' value='xxxxxxxx'> + <input type='text' name='uname' value=''> + <input type='password' name='qname' value=''> + <button type='submit'>Submit</button> + </form>`, win, 16); + + var f = 1; + + // 1-6 no username + await checkLoginFormInFrameWithElementValues(win, f++, "testpass", ""); + await checkLoginFormInFrameWithElementValues(win, f++, "testpass", ""); + await checkLoginFormInFrameWithElementValues(win, f++, "testpass", "", ""); + await checkLoginFormInFrameWithElementValues(win, f++, "testpass", ""); + await checkLoginFormInFrameWithElementValues(win, f++, "xxxxxxxx", ""); + await checkLoginFormInFrameWithElementValues(win, f++, "testpass", "xxxxxxxx"); + + // 7-15 with username + await checkLoginFormInFrameWithElementValues(win, f++, "testuser", "testpass", ""); + await checkLoginFormInFrameWithElementValues(win, f++, "testuser", "testpass", ""); + await checkLoginFormInFrameWithElementValues(win, f++, "testuser", "testpass", ""); + await checkLoginFormInFrameWithElementValues(win, f++, "xxxxxxxx", "", ""); + await checkLoginFormInFrameWithElementValues(win, f++, "testuser", "xxxxxxxx", ""); + await checkLoginFormInFrameWithElementValues(win, f++, "testuser", "testpass", "xxxxxxxx"); + await checkLoginFormInFrameWithElementValues(win, f++, "testuser", "testpass", ""); + await checkLoginFormInFrameWithElementValues(win, f++, "", "xxxxxxxx", "testpass"); + await checkLoginFormInFrameWithElementValues(win, f++, "testpass", "", ""); + await checkLoginFormInFrameWithElementValues(win, f++, "xxxxxxxx", "", ""); + + SimpleTest.finish(); +} +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_basic_form_2pw_2.html b/toolkit/components/passwordmgr/test/mochitest/test_basic_form_2pw_2.html new file mode 100644 index 0000000000..a2c60e5964 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_basic_form_2pw_2.html @@ -0,0 +1,111 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test for form fill with 2 password fields</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: form fill, 2 password fields +<p id="display"></p> + +<pre id="test"> +<script class="testbody" type="text/javascript"> + +/** Test for Login Manager: form fill, 2 password fields **/ + +/* + * If a form has two password fields, other things may be going on.... + * + * 1 - The user might be creating a new login (2nd field for typo checking) + * 2 - The user is changing a password (old and new password each have field) + * + * This test is for case #1. + */ + +var numSubmittedForms = 0; +var numStartingLogins = 0; + +function startTest() { + // Check for unfilled forms + is(getFormElementByName(1, "uname").value, "", "Checking username 1"); + is(getFormElementByName(1, "pword").value, "", "Checking password 1A"); + is(getFormElementByName(1, "qword").value, "", "Checking password 1B"); + + // Fill in the username and password fields, for account creation. + // Form 1 + SpecialPowers.wrap(getFormElementByName(1, "uname")).setUserInput("newuser1"); + SpecialPowers.wrap(getFormElementByName(1, "pword")).setUserInput("newpass1"); + SpecialPowers.wrap(getFormElementByName(1, "qword")).setUserInput("newpass1"); + + // eslint-disable-next-line no-unused-vars + var button = getFormSubmitButton(1); + + todo(false, "form submission disabled, can't auto-accept dialog yet"); + SimpleTest.finish(); +} + + +// Called by each form's onsubmit handler. +function checkSubmit(formNum) { + numSubmittedForms++; + + // End the test at the last form. + if (formNum == 999) { + is(numSubmittedForms, 999, "Ensuring all forms submitted for testing."); + + (async () => { + var numEndingLogins = await LoginManager.countLogins("", "", ""); + + ok(numEndingLogins > 0, "counting logins at end"); + is(numStartingLogins, numEndingLogins + 222, "counting logins at end"); + + SimpleTest.finish(); + })(); + return false; // return false to cancel current form submission + } + + // submit the next form. + var button = getFormSubmitButton(formNum + 1); + button.click(); + + return false; // return false to cancel current form submission +} + + +function getFormSubmitButton(formNum) { + var form = $("form" + formNum); // by id, not name + ok(form != null, "getting form " + formNum); + + // we can't just call form.submit(), because that doesn't seem to + // invoke the form onsubmit handler. + var button = form.firstChild; + while (button && button.type != "submit") { + button = button.nextSibling; + } + ok(button != null, "getting form submit button"); + + return button; +} + +runChecksAfterCommonInit(startTest); + +</script> +</pre> +<div id="content" style="display: none"> + <form id="form1" onsubmit="return checkSubmit(1)" action="http://newuser.com"> + <input type="text" name="uname"> + <input type="password" name="pword"> + <input type="password" name="qword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + +</div> + +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_basic_form_3pw_1.html b/toolkit/components/passwordmgr/test/mochitest/test_basic_form_3pw_1.html new file mode 100644 index 0000000000..59aec20612 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_basic_form_3pw_1.html @@ -0,0 +1,259 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test autofill for forms with 3 password fields</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: forms with 3 password fields (form filling) +<script> +gTestDependsOnDeprecatedLogin = true; +runChecksAfterCommonInit(() => startTest()); + +let DEFAULT_ORIGIN = window.location.origin; +</script> +<p id="display"></p> + +<div id="content" style="display: none"> +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> + +/** Test for Login Manager: form fill, 3 password fields **/ + +// Test to make sure 3-password forms are filled properly. + +async function startTest() { + let win = window.open("about:blank"); + SimpleTest.registerCleanupFunction(() => win.close()); + await loadFormIntoWindow(DEFAULT_ORIGIN, ` + <p>The next three forms are <b>user/pass/passB/passC</b>, as all-empty, preuser(only), and preuser/pass</p> + <form id="form1" action="formtest.js"> + <input type="text" name="uname"> + <input type="password" name="pword"> + <input type="password" name="qword"> + <input type="password" name="rword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <form id="form2" action="formtest.js"> + <input type="text" name="uname" value="testuser"> + <input type="password" name="pword"> + <input type="password" name="qword"> + <input type="password" name="rword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <form id="form3" action="formtest.js"> + <input type="text" name="uname" value="testuser"> + <input type="password" name="pword" value="testpass"> + <input type="password" name="qword"> + <input type="password" name="rword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + + <p>The next three forms are <b>user/passB/pass/passC</b>, as all-empty, preuser(only), and preuser/pass</p> + <form id="form4" action="formtest.js"> + <input type="text" name="uname"> + <input type="password" name="qword"> + <input type="password" name="pword"> + <input type="password" name="rword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <form id="form5" action="formtest.js"> + <input type="text" name="uname" value="testuser"> + <input type="password" name="qword"> + <input type="password" name="pword"> + <input type="password" name="rword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <form id="form6" action="formtest.js"> + <input type="text" name="uname" value="testuser"> + <input type="password" name="qword"> + <input type="password" name="pword" value="testpass"> + <input type="password" name="rword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <p>The next three forms are <b>user/passB/passC/pass</b>, as all-empty, preuser(only), and preuser/pass</p> + <form id="form7" action="formtest.js"> + <input type="text" name="uname"> + <input type="password" name="qword"> + <input type="password" name="rword"> + <input type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <form id="form8" action="formtest.js"> + <input type="text" name="uname" value="testuser"> + <input type="password" name="qword"> + <input type="password" name="rword"> + <input type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <form id="form9" action="formtest.js"> + <input type="text" name="uname" value="testuser"> + <input type="password" name="qword"> + <input type="password" name="rword"> + <input type="password" name="pword" value="testpass"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form>`, win, 9); + + let TESTCASES = [ + // Check form 1 + { + formNum: 1, + isAssertionTuples: [ + ["uname", "testuser", "Checking username 1"], + ["pword", "testpass", "Checking password 1"], + ["qword", "", "Checking password 1 (q)"], + ["rword", "", "Checking password 1 (r)"], + ], + }, + // Check form 2 + { + formNum: 2, + isAssertionTuples: [ + ["uname", "testuser", "Checking username 2"], + ["pword", "testpass", "Checking password 2"], + ["qword", "", "Checking password 2 (q)"], + ["rword", "", "Checking password 2 (r)"], + ], + }, + // Check form 3 + { + formNum: 3, + isAssertionTuples: [ + ["uname", "testuser", "Checking username 3"], + ["pword", "testpass", "Checking password 3"], + ["qword", "", "Checking password 3 (q)"], + ["rword", "", "Checking password 3 (r)"], + ], + }, + // Check form 4 + { + formNum: 4, + isAssertionTuples: [ + ["uname", "testuser", "Checking username 4"], + ["rword", "", "Checking password 4 (r)"], + ], + todoIsAssertionTuples: [ + ["qword", "", "Checking password 4 (q)"], + ["pword", "testpass", "Checking password 4"], + ], + }, + // Check form 5 + { + formNum: 5, + isAssertionTuples: [ + ["uname", "testuser", "Checking username 5"], + ["rword", "", "Checking password 5 (r)"], + ], + todoIsAssertionTuples: [ + ["qword", "", "Checking password 5 (q)"], + ["pword", "testpass", "Checking password 5"], + ], + }, + // Check form 6 + { + formNum: 6, + isAssertionTuples: [ + ["uname", "testuser", "Checking username 6"], + ["pword", "testpass", "Checking password 6"], + ["rword", "", "Checking password 6 (r)"], + ], + todoIsAssertionTuples: [ + ["qword", "", "Checking password 6 (q)"], + ], + }, + // Check form 7 + { + formNum: 7, + isAssertionTuples: [ + ["uname", "testuser", "Checking username 7"], + ["rword", "", "Checking password 7 (r)"], + ], + todoIsAssertionTuples: [ + ["qword", "", "Checking password 7 (q)"], + ["pword", "testpass", "Checking password 7"], + ], + }, + // Check form 8 + { + formNum: 8, + isAssertionTuples: [ + ["uname", "testuser", "Checking username 8"], + ["rword", "", "Checking password 8 (r)"], + ], + todoIsAssertionTuples: [ + ["qword", "", "Checking password 8 (q)"], + ["pword", "testpass", "Checking password 8"], + ], + }, + // Check form 9 + { + formNum: 9, + isAssertionTuples: [ + ["uname", "testuser", "Checking username 9"], + ["rword", "", "Checking password 9 (r)"], + ["pword", "testpass", "Checking password 9"], + ], + todoIsAssertionTuples: [ + ["qword", "", "Checking password 9 (q)"], + ], + }, + ]; + + await SpecialPowers.spawn(win, [TESTCASES], (testcasesF) => { + let doc = this.content.document; + for (let testcase of testcasesF) { + let { formNum } = testcase; + for (let tuple of testcase.isAssertionTuples) { + let [name, value, message] = tuple; + is(doc.querySelector(`#form${formNum} input[name=${name}]`).value, value, message); + } + if (!testcase.todoIsAssertionTuples) { + continue; + } + // TODO: Bug 1669614 + // for (let tuple of testcase.todoIsAssertionTuples) { + // let [name, value, message] = tuple; + // todo_is(doc.querySelector(`#form${formNum} input[name=${name}]`).value, value, message); + // } + } + }); + + // TODO: as with the 2-password cases, add tests to check for creating new + // logins and changing passwords. + SimpleTest.finish(); +} +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_basic_form_honor_autocomplete_off.html b/toolkit/components/passwordmgr/test/mochitest/test_basic_form_honor_autocomplete_off.html new file mode 100644 index 0000000000..746c6cc923 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_basic_form_honor_autocomplete_off.html @@ -0,0 +1,153 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test login autofill autocomplete when signon.autofillForms.autocompleteOff is false</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: autofilling when autocomplete=off +<p id="display"></p> + +<!-- we presumably can't hide the content for this test. --> +<div id="content"></div> +<pre id="test"> +<script class="testbody" type="text/javascript"> +/** Test for Login Manager: multiple login autocomplete. **/ + +let { ContentTaskUtils } = SpecialPowers.ChromeUtils.import( + "resource://testing-common/ContentTaskUtils.jsm" +); + +// Check for expected username/password in form. +function checkFormValues(form, expectedUsername, expectedPassword) { + let uname = form.querySelector("[name='uname']"); + let pword = form.querySelector("[name='pword']"); + is(uname.value, expectedUsername, `Checking ${form.id} username is: ${expectedUsername}`); + is(pword.value, expectedPassword, `Checking ${form.id} password is: ${expectedPassword}`); +} + +async function autoCompleteFieldsFromFirstMatch(form) { + // trigger autocomplete from the username field + await SimpleTest.promiseFocus(form.ownerGlobal); + let uname = form.querySelector("[name='uname']"); + await popupBy(() => uname.focus()); + + let formFilled = promiseFormsProcessedInSameProcess(); + await synthesizeKey("KEY_ArrowDown"); // open + await synthesizeKey("KEY_Enter"); + await formFilled; + await Promise.resolve(); +} + +add_setup(async () => { + // Set the pref before the document loads. + SpecialPowers.setBoolPref("signon.autofillForms.autocompleteOff", false); + SimpleTest.registerCleanupFunction(() => { + SpecialPowers.clearUserPref("signon.autofillForms.autocompleteOff"); + }); + + await setStoredLoginsAsync( + [window.location.origin, "https://autocomplete", null, "singleuser", "singlepass", "uname", "pword"] + ); + listenForUnexpectedPopupShown(); +}); + +/* Tests for autofill of single-user forms for when we honor autocomplete=off on password fields */ +add_task(async function honor_password_autocomplete_off() { + const form = createLoginForm({ + action: "https://autocomplete", + password: { + autocomplete: "off" + } + }); + await promiseFormsProcessedInSameProcess(); + await SimpleTest.promiseFocus(window); + // With the pref toggled off, and with autocomplete=off on the password field, + // we expect not to have autofilled this form + checkFormValues(form, "", ""); + // ..but it should autocomplete just fine + await autoCompleteFieldsFromFirstMatch(form); + checkFormValues(form, "singleuser", "singlepass"); +}); + +add_task(async function honor_username_autocomplete_off() { + const form = createLoginForm({ + action: "https://autocomplete", + username: { + autocomplete: "off" + } + }); + await promiseFormsProcessedInSameProcess(); + await SimpleTest.promiseFocus(window); + // With the pref toggled off, and with autocomplete=off on the username field, + // we expect to have autofilled this form + checkFormValues(form, "singleuser", "singlepass"); +}); + +add_task(async function honor_form_autocomplete_off() { + const form = createLoginForm({ + action: "https://autocomplete", + autocomplete: "off" + }); + await promiseFormsProcessedInSameProcess(); + await SimpleTest.promiseFocus(window); + // With the pref toggled off, and with autocomplete=off on the form, + // we expect to have autofilled this form + checkFormValues(form, "singleuser", "singlepass"); +}); + +add_task(async function honor_username_and_password_autocomplete_off() { + const form = createLoginForm({ + action: "https://autocomplete", + username: { + autocomplete: "off" + }, + password: { + autocomplete: "off" + } + }); + await promiseFormsProcessedInSameProcess(); + await SimpleTest.promiseFocus(window); + // With the pref toggled off, and autocomplete=off on the username and password field, + // we expect not to have autofilled this form + checkFormValues(form, "", ""); + // ..but it should autocomplete just fine + await autoCompleteFieldsFromFirstMatch(form); + checkFormValues(form, "singleuser", "singlepass"); +}); + +add_task(async function reference_form() { + const form = createLoginForm({ + action: "https://autocomplete" + }); + await promiseFormsProcessedInSameProcess(); + await SimpleTest.promiseFocus(window); + // (this is a control, w/o autocomplete=off, to ensure the login + // that was being suppressed would have been filled in otherwise) + checkFormValues(form, "singleuser", "singlepass"); +}); + +add_task(async function honor_username_autocomplete_off_without_password() { + const form = createLoginForm({ + action: "https://autocomplete", + username: { + id: "username", + autocomplete: "off" + }, + password: false + }); + await promiseFormsProcessedInSameProcess(); + await SimpleTest.promiseFocus(window); + // With the pref toggled off, and with autocomplete=off on the username field + // in a username-only form, we expect to have autofilled this form + is(form.uname.value, "singleuser", `Checking form6 username is: singleuser`); +}); +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_basic_form_html5.html b/toolkit/components/passwordmgr/test/mochitest/test_basic_form_html5.html new file mode 100644 index 0000000000..12aeb0bab3 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_basic_form_html5.html @@ -0,0 +1,165 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test for html5 input types (email, tel, url, etc.)</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: html5 input types (email, tel, url, etc.) +<script> +runChecksAfterCommonInit(() => startTest()); + +const DEFAULT_ORIGIN = window.location.origin; + +runInParent(async function setup() { + const login1 = Cc["@mozilla.org/login-manager/loginInfo;1"].createInstance(Ci.nsILoginInfo); + const login2 = Cc["@mozilla.org/login-manager/loginInfo;1"].createInstance(Ci.nsILoginInfo); + const login3 = Cc["@mozilla.org/login-manager/loginInfo;1"].createInstance(Ci.nsILoginInfo); + const login4 = Cc["@mozilla.org/login-manager/loginInfo;1"].createInstance(Ci.nsILoginInfo); + const login5 = Cc["@mozilla.org/login-manager/loginInfo;1"].createInstance(Ci.nsILoginInfo); + + login1.init("http://mochi.test:8888", "http://bug600551-1", null, + "testuser@example.com", "testpass1", "", ""); + login2.init("http://mochi.test:8888", "http://bug600551-2", null, + "555-555-5555", "testpass2", "", ""); + login3.init("http://mochi.test:8888", "http://bug600551-3", null, + "http://mozilla.org", "testpass3", "", ""); + login4.init("http://mochi.test:8888", "http://bug600551-4", null, + "123456789", "testpass4", "", ""); + login5.init("http://mochi.test:8888", "http://bug600551-5", null, + "test", "test", "", ""); + + await Services.logins.addLogins([ + login1, + login2, + login3, + login4, + login5, + ]); +}); +</script> + +<p id="display"></p> +<div id="content" style="display: none"> +</div> +<pre id="test"> +<script class="testbody" type="text/javascript"> + +/* Test for Login Manager: 600551 + (Password manager not working with input type=email) + */ +async function startTest() { + const win = window.open("about:blank"); + SimpleTest.registerCleanupFunction(() => win.close()); + await loadFormIntoWindow(DEFAULT_ORIGIN, ` + <form id="form1" action="http://bug600551-1"> + <input type="email" name="uname"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <form id="form2" action="http://bug600551-2"> + <input type="tel" name="uname"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <form id="form3" action="http://bug600551-3"> + <input type="url" name="uname"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <form id="form4" action="http://bug600551-4"> + <input type="number" name="uname"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <form id="form5" action="http://bug600551-5"> + <input type="search" name="uname"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <!-- The following forms should not be filled with usernames --> + <form id="form6" action="formtest.js"> + <input type="datetime" name="uname"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <form id="form7" action="formtest.js"> + <input type="date" name="uname"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <form id="form8" action="formtest.js"> + <input type="month" name="uname"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <form id="form9" action="formtest.js"> + <input type="week" name="uname"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <form id="form10" action="formtest.js"> + <input type="time" name="uname"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <form id="form11" action="formtest.js"> + <input type="datetime-local" name="uname"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <form id="form12" action="formtest.js"> + <input type="range" name="uname"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <form id="form13" action="formtest.js"> + <input type="color" name="uname"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form>`, win, 13); + + await checkLoginFormInFrameWithElementValues(win, 1, "testuser@example.com", "testpass1"); + await checkLoginFormInFrameWithElementValues(win, 2, "555-555-5555", "testpass2"); + await checkLoginFormInFrameWithElementValues(win, 3, "http://mozilla.org", "testpass3"); + await checkLoginFormInFrameWithElementValues(win, 4, "123456789", "testpass4"); + await checkLoginFormInFrameWithElementValues(win, 5, "test", "test"); + + info("type=datetime should not be considered a username"); + await checkLoginFormInFrameWithElementValues(win, 6, ""); + info("type=date should not be considered a username"); + await checkLoginFormInFrameWithElementValues(win, 7, ""); + info("type=month should not be considered a username"); + await checkLoginFormInFrameWithElementValues(win, 8, ""); + info("type=week should not be considered a username"); + await checkLoginFormInFrameWithElementValues(win, 9, ""); + info("type=time should not be considered a username"); + await checkLoginFormInFrameWithElementValues(win, 10, ""); + info("type=datetime-local should not be considered a username"); + await checkLoginFormInFrameWithElementValues(win, 11, ""); + info("type=range should not be considered a username"); + await checkLoginFormInFrameWithElementValues(win, 12, "50"); + info("type=color should not be considered a username"); + await checkLoginFormInFrameWithElementValues(win, 13, "#000000"); + + SimpleTest.finish(); +} +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_basic_form_pwevent.html b/toolkit/components/passwordmgr/test/mochitest/test_basic_form_pwevent.html new file mode 100644 index 0000000000..4a202a7c05 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_basic_form_pwevent.html @@ -0,0 +1,50 @@ +<!DOCTYPE HTML> +<html> +<!-- +https://bugzilla.mozilla.org/show_bug.cgi?id=355063 +--> +<head> + <meta charset="utf-8"/> + <title>Test for Bug 355063</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/> + <script type="text/javascript" src="pwmgr_common.js"></script> + <script type="application/javascript"> + /** Test for Bug 355063 **/ + gTestDependsOnDeprecatedLogin = true; + runChecksAfterCommonInit(async function startTest() { + info("startTest"); + // Password Manager's own listener should always have been added first, so + // the test's listener should be called after the pwmgr's listener fills in + // a login. + // + SpecialPowers.addChromeEventListener("DOMFormHasPassword", function eventFired() { + SpecialPowers.removeChromeEventListener("DOMFormHasPassword", eventFired); + var passField = $("p1"); + passField.addEventListener("input", checkForm); + }); + await setFormAndWaitForFieldFilled("<form id=form1>form1: <input id=u1><input type=password id=p1></form><br>", + {fieldSelector: "#u1", fieldValue: "testuser"}); + }); + + function checkForm() { + info("checkForm"); + var userField = document.getElementById("u1"); + var passField = document.getElementById("p1"); + is(userField.value, "testuser", "checking filled username"); + is(passField.value, "testpass", "checking filled password"); + + SimpleTest.finish(); + } +</script> +</head> +<body> +<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=355063">Mozilla Bug 355063</a> +<p id="display"></p> +<div id="content"> +forms go here! +</div> +<pre id="test"> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_basic_form_pwonly.html b/toolkit/components/passwordmgr/test/mochitest/test_basic_form_pwonly.html new file mode 100644 index 0000000000..05e07983f1 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_basic_form_pwonly.html @@ -0,0 +1,212 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test forms and logins without a username</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: forms and logins without a username. +<script> +gTestDependsOnDeprecatedLogin = true; +runChecksAfterCommonInit(async () => { + // The first login uses a unique formActionOrigin, to check forms where no other logins + // will apply. The second login uses the normal formActionOrigin, so that we can test + // forms with a mix of username and non-username logins that might apply. + // + // Note: the second login is deleted at the end of the test. + await addLoginsInParent( + ["http://mochi.test:8888", "http://mochi.test:1111", null, "", "1234"], + ["http://mochi.test:8888", "http://mochi.test:8888", null, "", "1234"] + ); + await startTest(); +}); +</script> +<p id="display"></p> + +<div id="content" style="display: none"> +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> +const DEFAULT_ORIGIN = window.location.origin; + +/** Test for Login Manager: password-only logins **/ +async function startTest() { + const win = window.open("about:blank"); + SimpleTest.registerCleanupFunction(() => win.close()); + await loadFormIntoWindow(DEFAULT_ORIGIN, ` + <!-- simple form: no username field, 1 password field --> + <form id='form1' action='http://mochi.test:1111/formtest.js'> 1 + <input type='password' name='pname' value=''> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form> + + <!-- simple form: no username field, 2 password fields --> + <form id='form2' action='http://mochi.test:1111/formtest.js'> 2 + <input type='password' name='pname1' value=''> + <input type='password' name='pname2' value=''> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form> + + <!-- simple form: no username field, 3 password fields --> + <form id='form3' action='http://mochi.test:1111/formtest.js'> 3 + <input type='password' name='pname1' value=''> + <input type='password' name='pname2' value=''> + <input type='password' name='pname3' value=''> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form> + + <!-- simple form: no username field, 5 password fields --> + <form id='form4' action='http://mochi.test:1111/formtest.js'> 4 + <input type='password' name='pname1' value=''> + <input type='password' name='pname2' value=''> + <input type='password' name='pname3' value=''> + <input type='password' name='pname4' value=''> + <input type='password' name='pname5' value=''> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form> + + <!-- 6 password fields, should be ignored. --> + <form id='form5' action='http://mochi.test:1111/formtest.js'> 5 + <input type='password' name='pname1' value=''> + <input type='password' name='pname2' value=''> + <input type='password' name='pname3' value=''> + <input type='password' name='pname4' value=''> + <input type='password' name='pname5' value=''> + <input type='password' name='pname6' value=''> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form> + + + + <!-- 1 username field --> + <form id='form6' action='http://mochi.test:1111/formtest.js'> 6 + <input type='text' name='uname' value=''> + <input type='password' name='pname' value=''> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form> + + + <!-- 1 username field, with a value set --> + <form id='form7' action='http://mochi.test:1111/formtest.js'> 7 + <input type='text' name='uname' value='someuser'> + <input type='password' name='pname' value=''> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form> + + + + <!-- + (The following forms have 2 potentially-matching logins, on is + password-only, the other is username+password) + --> + + + + <!-- 1 username field, with value set. Fill in the matching U+P login --> + <form id='form8' action='formtest.js'> 8 + <input type='text' name='uname' value='testuser'> + <input type='password' name='pname' value=''> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form> + + <!-- 1 username field, with value set. Don't fill in U+P login--> + <form id='form9' action='formtest.js'> 9 + <input type='text' name='uname' value='someuser'> + <input type='password' name='pname' value=''> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form> + + + + <!-- 1 username field, too small for U+P login --> + <form id='form10' action='formtest.js'> 10 + <input type='text' name='uname' value='' maxlength="4"> + <input type='password' name='pname' value=''> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form> + + <!-- 1 username field, too small for U+P login --> + <form id='form11' action='formtest.js'> 11 + <input type='text' name='uname' value='' maxlength="0"> + <input type='password' name='pname' value=''> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form> + + <!-- 1 username field, too small for U+P login --> + <form id='form12' action='formtest.js'> 12 + <input type='text' name='uname' value=''> + <input type='password' name='pname' value='' maxlength="4"> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form> + + <!-- 1 username field, too small for either login --> + <form id='form13' action='formtest.js'> 13 + <input type='text' name='uname' value=''> + <input type='password' name='pname' value='' maxlength="1"> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form> + + <!-- 1 username field, too small for either login --> + <form id='form14' action='formtest.js'> 14 + <input type='text' name='uname' value=''> + <input type='password' name='pname' value='' maxlength="0"> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form>`, win, 14); + + await checkLoginFormInFrameWithElementValues(win, 1, "1234"); + await checkLoginFormInFrameWithElementValues(win, 2, "1234", ""); + await checkLoginFormInFrameWithElementValues(win, 3, "1234", "", ""); + await checkLoginFormInFrameWithElementValues(win, 4, "1234"); + await checkUnmodifiedFormInFrame(win, 5); + + await checkLoginFormInFrameWithElementValues(win, 6, "testuser", "testpass"); + await checkLoginFormInFrameWithElementValues(win, 7, "someuser", ""); + + await checkLoginFormInFrameWithElementValues(win, 8, "testuser", "testpass"); + await checkLoginFormInFrameWithElementValues(win, 9, "someuser", ""); + + await checkLoginFormInFrameWithElementValues(win, 10, "", "1234"); + await checkLoginFormInFrameWithElementValues(win, 11, "", "1234"); + await checkLoginFormInFrameWithElementValues(win, 12, "", "1234"); + + await checkUnmodifiedFormInFrame(win, 13); + await checkUnmodifiedFormInFrame(win, 14); + + SimpleTest.finish(); +} +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_bug_627616.html b/toolkit/components/passwordmgr/test/mochitest/test_bug_627616.html new file mode 100644 index 0000000000..63ff775aab --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_bug_627616.html @@ -0,0 +1,161 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test bug 627616 related to proxy authentication</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<script class="testbody" type="text/javascript"> + SimpleTest.waitForExplicitFinish(); + + var Ci = SpecialPowers.Ci; + + function makeXHR(expectedStatus, expectedText, extra) { + var xhr = new XMLHttpRequest(); + xhr.open("GET", "authenticate.sjs?" + + "proxy_user=proxy_user&" + + "proxy_pass=proxy_pass&" + + "proxy_realm=proxy_realm&" + + "user=user1name&" + + "pass=user1pass&" + + "realm=mochirealm&" + + extra || ""); + xhr.onloadend = function() { + is(xhr.status, expectedStatus, "xhr.status"); + is(xhr.statusText, expectedText, "xhr.statusText"); + runNextTest(); + }; + return xhr; + } + + function testNonAnonymousCredentials() { + var xhr = makeXHR(200, "OK"); + xhr.send(); + } + + function testAnonymousCredentials() { + // Test that an anonymous request correctly performs proxy authentication + var xhr = makeXHR(401, "Authentication required"); + SpecialPowers.wrap(xhr).channel.loadFlags |= Ci.nsIChannel.LOAD_ANONYMOUS; + xhr.send(); + } + + function testAnonymousNoAuth() { + // Next, test that an anonymous request still does not include any non-proxy + // authentication headers. + var xhr = makeXHR(200, "Authorization header not found", "anonymous=1"); + SpecialPowers.wrap(xhr).channel.loadFlags |= Ci.nsIChannel.LOAD_ANONYMOUS; + xhr.send(); + } + + var gExpectedDialogs = 0; + var gCurrentTest; + function runNextTest() { + is(gExpectedDialogs, 0, "received expected number of auth dialogs"); + mm.sendAsyncMessage("prepareForNextTest"); + mm.addMessageListener("prepareForNextTestDone", function prepared(msg) { + mm.removeMessageListener("prepareForNextTestDone", prepared); + if (pendingTests.length) { + ({expectedDialogs: gExpectedDialogs, + test: gCurrentTest} = pendingTests.shift()); + gCurrentTest.call(this); + } else { + mm.sendAsyncMessage("cleanup"); + mm.addMessageListener("cleanupDone", () => { + // mm.destroy() is called as a cleanup function by runInParent(), no + // need to do it here. + SimpleTest.finish(); + }); + } + }); + } + + var pendingTests = [{expectedDialogs: 2, test: testNonAnonymousCredentials}, + {expectedDialogs: 1, test: testAnonymousCredentials}, + {expectedDialogs: 0, test: testAnonymousNoAuth}]; + + const mm = runInParent(() => { + const { classes: parentCc, interfaces: parentCi } = Components; + + const {NetUtil} = ChromeUtils.import("resource://gre/modules/NetUtil.jsm"); + + const channel = NetUtil.newChannel({ + uri: "http://example.com", + loadUsingSystemPrincipal: true, + }); + + const pps = parentCc["@mozilla.org/network/protocol-proxy-service;1"]. + getService(parentCi.nsIProtocolProxyService); + pps.asyncResolve(channel, 0, { + async onProxyAvailable(req, uri, pi, status) { + const mozproxy = "moz-proxy://" + pi.host + ":" + pi.port; + const login1 = parentCc["@mozilla.org/login-manager/loginInfo;1"]. + createInstance(parentCi.nsILoginInfo); + login1.init(mozproxy, null, "proxy_realm", "proxy_user", "proxy_pass", + "", ""); + + const login2 = parentCc["@mozilla.org/login-manager/loginInfo;1"]. + createInstance(parentCi.nsILoginInfo); + login2.init("http://mochi.test:8888", null, "mochirealm", "user1name", + "user1pass", "", ""); + await Services.logins.addLogins([login1, login2]); + + sendAsyncMessage("setupDone"); + }, + QueryInterface: ChromeUtils.generateQI([parentCi.nsIProtocolProxyCallback]), + }); + + addMessageListener("prepareForNextTest", message => { + parentCc["@mozilla.org/network/http-auth-manager;1"]. + getService(parentCi.nsIHttpAuthManager). + clearAll(); + sendAsyncMessage("prepareForNextTestDone"); + }); + + const modalType = Services.prefs.getIntPref( + "prompts.modalType.httpAuth" + ); + const authPromptIsCommonDialog = + modalType === Services.prompt.MODAL_TYPE_WINDOW + || (modalType === Services.prompt.MODAL_TYPE_TAB + && Services.prefs.getBoolPref( + "prompts.tabChromePromptSubDialog", + false + )); + + const dialogObserverTopic = authPromptIsCommonDialog + ? "common-dialog-loaded" : "tabmodal-dialog-loaded"; + + function dialogObserver(subj, topic, data) { + if (authPromptIsCommonDialog) { + subj.Dialog.ui.prompt.document + .getElementById("commonDialog") + .acceptDialog(); + } else { + const prompt = subj.ownerGlobal.gBrowser.selectedBrowser + .tabModalPromptBox.getPrompt(subj); + prompt.Dialog.ui.button0.click(); // Accept button + } + sendAsyncMessage("promptAccepted"); + } + + Services.obs.addObserver(dialogObserver, dialogObserverTopic); + + addMessageListener("cleanup", message => { + Services.obs.removeObserver(dialogObserver, dialogObserverTopic); + sendAsyncMessage("cleanupDone"); + }); + }); + + mm.addMessageListener("promptAccepted", msg => { + gExpectedDialogs--; + }); + mm.addMessageListener("setupDone", msg => { + runNextTest(); + }); +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_bug_776171.html b/toolkit/components/passwordmgr/test/mochitest/test_bug_776171.html new file mode 100644 index 0000000000..f7de66a01d --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_bug_776171.html @@ -0,0 +1,57 @@ +<!DOCTYPE HTML> +<html> +<!-- +https://bugzilla.mozilla.org/show_bug.cgi?id=776171 +--> +<head> + <meta charset="utf-8"> + <title>Test for Bug 776171 related to HTTP auth</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body onload="startTest()"> +<script class="testbody" type="text/javascript"> + +/** + * This test checks we correctly ignore authentication entry + * for a subpath and use creds from the URL when provided when XHR + * is used with filled user name and password. + * + * 1. connect auth2/authenticate.sjs that expects user1:pass1 password + * 2. connect a dummy URL at the same path + * 3. connect authenticate.sjs that again expects user1:pass1 password + * in this case, however, we have an entry without an identity + * for this path (that is a parent for auth2 path in the first step) + */ + +SimpleTest.waitForExplicitFinish(); + +function doxhr(URL, user, pass, next) { + var xhr = new XMLHttpRequest(); + if (user && pass) { + xhr.open("POST", URL, true, user, pass); + } else { + xhr.open("POST", URL, true); + } + xhr.onload = function() { + is(xhr.status, 200, "Got status 200"); + next(); + }; + xhr.onerror = function() { + ok(false, "request passed"); + SimpleTest.finish(); + }; + xhr.send(); +} + +function startTest() { + doxhr("auth2/authenticate.sjs?user=user1&pass=pass1&realm=realm1", "user1", "pass1", function() { + doxhr("auth2", null, null, function() { + doxhr("authenticate.sjs?user=user1&pass=pass1&realm=realm1", "user1", "pass1", SimpleTest.finish); + }); + }); +} +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_case_differences.html b/toolkit/components/passwordmgr/test/mochitest/test_case_differences.html new file mode 100644 index 0000000000..fd0d5b39f8 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_case_differences.html @@ -0,0 +1,100 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test autocomplete due to multiple matching logins</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: autocomplete due to multiple matching logins +<p id="display"></p> +<!-- we presumably can't hide the content for this test. --> +<div id="content"></div> +<pre id="test"> +<script class="testbody" type="text/javascript"> +/** Test for Login Manager: autocomplete due to multiple matching logins **/ + +add_setup(async () => { + await addLoginsInParent( + [location.origin, "https://autocomplete:8888", null, "name", "pass", "uname", "pword"], + [location.origin, "https://autocomplete:8888", null, "Name", "Pass", "uname", "pword"], + [location.origin, "https://autocomplete:8888", null, "USER", "PASS", "uname", "pword"] + ); +}) + +add_task(async function test_empty_first_entry() { + const form = createLoginForm({ + action: "https://autocomplete:8888" + }); + + // Make sure initial form is empty. + checkLoginForm(form.uname, "", form.pword, ""); + + // Trigger autocomplete popup + form.uname.focus(); + + let popupState = await getPopupState(); + is(popupState.open, false, "Check popup is initially closed"); + const { items } = await openPopupOn(form.uname); + popupState = await getPopupState(); + is(popupState.selectedIndex, -1, "Check no entries are selected"); + checkAutoCompleteResults(items, ["name", "Name", "USER"], "example.com", "initial"); + + // Check first entry + const index0Promise = notifySelectedIndex(0); + synthesizeKey("KEY_ArrowDown"); + await index0Promise; + checkLoginForm(form.uname, "", form.pword, ""); // value shouldn't update + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + checkLoginForm(form.uname, "name", form.pword, "pass"); +}); + +add_task(async function test_empty_second_entry() { + const form = createLoginForm({ + action: "https://autocomplete:8888" + }); + + await openPopupOn(form.uname); + synthesizeKey("KEY_ArrowDown"); // first + synthesizeKey("KEY_ArrowDown"); // second + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + checkLoginForm(form.uname, "Name", form.pword, "Pass"); +}); + +add_task(async function test_empty_third_entry() { + const form = createLoginForm({ + action: "https://autocomplete:8888" + }); + + await openPopupOn(form.uname); + synthesizeKey("KEY_ArrowDown"); // first + synthesizeKey("KEY_ArrowDown"); // second + synthesizeKey("KEY_ArrowDown"); // third + synthesizeKey("KEY_Enter"); + await promiseFormsProcessedInSameProcess(); + checkLoginForm(form.uname, "USER", form.pword, "PASS"); +}); + +add_task(async function test_preserve_matching_username_case() { + const form = createLoginForm({ + action: "https://autocomplete:8888" + }); + await promiseFormsProcessedInSameProcess(); + + await openPopupOn(form.uname, { inputValue: "user" }); + // Check that we don't clobber user-entered text when tabbing away + // (even with no autocomplete entry selected) + synthesizeKey("KEY_Tab"); + await promiseFormsProcessedInSameProcess(); + checkLoginForm(form.uname, "user", form.pword, "PASS"); +}); +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_dismissed_doorhanger_in_shadow_DOM.html b/toolkit/components/passwordmgr/test/mochitest/test_dismissed_doorhanger_in_shadow_DOM.html new file mode 100644 index 0000000000..37ddbaae42 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_dismissed_doorhanger_in_shadow_DOM.html @@ -0,0 +1,112 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Test the password manager dismissed doorhanger can detect username and password fields in a Shadow DOM.</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="pwmgr_common.js"></script> + <link rel="stylesheet" href="/tests/SimpleTest/test.css" /> +</head> +<body> + +<iframe></iframe> + +<script type="application/javascript"> +const { LoginManagerChild } = SpecialPowers.ChromeUtils.import( + "resource://gre/modules/LoginManagerChild.jsm" +); + +add_setup(async () => { + const readyPromise = registerRunTests(); + info("Waiting for setup and page load"); + await readyPromise; + + // assert that there are no logins + const allLogins = await LoginManager.getAllLogins(); + is(allLogins.length, 0, "There are no logins"); +}); + +const IFRAME = document.querySelector("iframe"); +const PASSWORD_VALUE = "!@$*"; +const TESTCASES = [ + // Check that the Shadow DOM version of form_basic.html works + { + name: "test_form_each_field_in_its_own_shadow_root", + filename: "form_basic_shadow_DOM_each_field_in_its_own_shadow_root.html", + }, + // Check that the Shadow DOM version of formless_basic.html works + { + name: "test_formless_each_field_in_its_own_shadow_root", + filename: "formless_basic_shadow_DOM_each_field_in_its_own_shadow_root.html", + }, + // Check that the nested Shadow DOM version of form_basic.html works + { + name: "test_form_nested_each_field_in_its_own_shadow_root", + filename: "form_nested_shadow_DOM_each_field_in_its_own_shadow_root.html", + } +]; + +async function editPasswordFieldInShadowDOM() { + info("Editing the input field in the form with a Shadow DOM"); + await SpecialPowers.spawn(getIframeBrowsingContext(window, 0), [PASSWORD_VALUE], function(val) { + const doc = this.content.document; + // Grab the wrapper element to get the shadow root containing the password field + let wrapper = doc.getElementById("wrapper-password"); + if (!wrapper) { + // This is a nested Shadow DOM test case + const outerWrapper = doc.getElementById("outer-wrapper-password"); + const outerShadowRoot = outerWrapper.openOrClosedShadowRoot; + wrapper = outerShadowRoot.querySelector("#wrapper-password"); + } + // If the ShadowRoot's mode is "closed", it can only be accessed from a chrome-privileged + // (Bug 1421568) or addon context (Bug 1439153) + const shadowRoot = wrapper.openOrClosedShadowRoot; + const passwordField = shadowRoot.querySelector("[name='password']"); + Assert.equal(passwordField.value, "", "Check password didn't get autofilled"); + passwordField.setUserInput(val); + Assert.equal(passwordField.value, val, "Checking for filled password"); + } + ); +} + +async function testForm(testcase) { + const iframeLoaded = new Promise(resolve => { + IFRAME.addEventListener( + "load", + function(e) { + resolve(true); + }, + { once: true } + ); + }); + + // This could complete before the page finishes loading. + const formsProcessed = promiseFormsProcessed(); + + IFRAME.src = testcase.filename; + info("Waiting for test page to load in the iframe"); + await iframeLoaded; + + info("Waiting for 'input' event listener to be added to the form before editing"); + await formsProcessed; + + const passwordEditProcessed = getPasswordEditedMessage(); + + await editPasswordFieldInShadowDOM(); + + info("Waiting for parent process to receive input field edit message from content"); + await passwordEditProcessed; +} + +for (let testcase of TESTCASES) { + const taskName = testcase.name; + const tmp = { + async [taskName]() { + await testForm(testcase); + } + } + add_task(tmp[taskName]); +} +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_formLike_rootElement_with_Shadow_DOM.html b/toolkit/components/passwordmgr/test/mochitest/test_formLike_rootElement_with_Shadow_DOM.html new file mode 100644 index 0000000000..2e9b0039ca --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_formLike_rootElement_with_Shadow_DOM.html @@ -0,0 +1,151 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Test that FormLike.rootElement points to right element when the page has Shadow DOM</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="pwmgr_common.js"></script> + <link rel="stylesheet" href="/tests/SimpleTest/test.css" /> +</head> +<body> + +<iframe></iframe> + +<script type="application/javascript"> +const { LoginFormFactory } = SpecialPowers.ChromeUtils.import( + "resource://gre/modules/LoginFormFactory.jsm" +); + +add_setup(async () => { + const readyPromise = registerRunTests(); + info("Waiting for setup and page load"); + await readyPromise; + + // assert that there are no logins + const allLogins = await LoginManager.getAllLogins(); + is(allLogins.length, 0, "There are no logins"); +}); + +const IFRAME = document.querySelector("iframe"); +const TESTCASES = [ + // Check that the Shadow DOM version of form_basic.html works + { + name: "test_form_each_field_in_its_own_shadow_root", + filename: "form_basic_shadow_DOM_each_field_in_its_own_shadow_root.html", + hostAndRootElementSelectorTuples: [["span#wrapper-password", "form"]], + }, + { + name: "test_form_both_fields_together_in_a_shadow_root", + filename: "form_basic_shadow_DOM_both_fields_together_in_a_shadow_root.html", + hostAndRootElementSelectorTuples: [["span#wrapper-un-and-pw", "form"]], + }, + { + name: "test_form_form_and_fields_together_in_a_shadow_root", + filename: "form_basic_shadow_DOM_form_and_fields_together_in_a_shadow_root.html", + hostAndRootElementSelectorTuples: [["span#wrapper", "form"]], + }, + // Check that the Shadow DOM version of formless_basic.html works + { + name: "test_formless_each_field_in_its_own_shadow_root", + filename: "formless_basic_shadow_DOM_each_field_in_its_own_shadow_root.html", + hostAndRootElementSelectorTuples: [["span#wrapper-password", "html"]], + }, + { + name: "test_formless_both_fields_together_in_a_shadow_root", + filename: "formless_basic_shadow_DOM_both_fields_together_in_a_shadow_root.html", + hostAndRootElementSelectorTuples: [["span#wrapper-un-and-pw", "html"]], + }, + { + name: "test_formless_form_and_fields_together_in_a_shadow_root.html", + filename: "formless_basic_shadow_DOM_form_and_fields_together_in_a_shadow_root.html", + hostAndRootElementSelectorTuples: [["span#wrapper", "html"]], + }, + // Check that the nested Shadow DOM version of form_basic.html works + { + name: "test_form_nested_each_field_in_its_own_shadow_root", + filename: "form_nested_shadow_DOM_each_field_in_its_own_shadow_root.html", + hostAndRootElementSelectorTuples: [["span#wrapper-password", "form"]], + outerHostElementSelector: "span#outer-wrapper-password", + }, + { + name: "test_form_nested_both_fields_together_in_a_shadow_root", + filename: "form_nested_shadow_DOM_both_fields_together_in_a_shadow_root.html", + hostAndRootElementSelectorTuples: [["span#inner-wrapper", "form"]], + outerHostElementSelector: "span#outer-wrapper", + }, + { + name: "test_form_nested_form_and_fields_together_in_a_shadow_root", + filename: "form_nested_shadow_DOM_form_and_fields_together_in_a_shadow_root.html", + hostAndRootElementSelectorTuples: [["span#inner-wrapper", "form"]], + outerHostElementSelector: "span#outer-wrapper", + }, + { + name: "test_multiple_forms_shadow_DOM_all_known_variants", + filename: "multiple_forms_shadow_DOM_all_known_variants.html", + hostAndRootElementSelectorTuples: [ + ["span#outer-wrapper", "html"], + ["span#wrapper-password-form-case-1", "form#form-case-1"], + ["span#wrapper-form-case-2", "form#form-case-2"], + ["span#wrapper-form-case-3", "form#form-case-3"], + ], + outerHostElementSelector: "span#outer-wrapper", + } +]; + +async function testForm(testcase) { + const iframeLoaded = new Promise(resolve => { + IFRAME.addEventListener( + "load", + function(e) { + resolve(true); + }, + { once: true } + ); + }); + + // This could complete before the page finishes loading. + const numForms = testcase.hostAndRootElementSelectorTuples.length; + const formsProcessed = promiseFormsProcessedInSameProcess(numForms); + + IFRAME.src = testcase.filename; + info("Waiting for test page to load in the iframe"); + await iframeLoaded; + + info(`Wait for ${numForms} form(s) to be processed.`); + await formsProcessed; + + const iframeDoc = SpecialPowers.wrap(IFRAME.contentWindow).document; + for (let [hostElementSelector, rootElementSelector] of testcase.hostAndRootElementSelectorTuples) { + info("Get the expected rootElement from the document"); + let hostElement = iframeDoc.querySelector(hostElementSelector); + let outerShadowRoot = null; + if (!hostElement) { + // Nested Shadow DOM testcase + const outerHostElement = iframeDoc.querySelector(testcase.outerHostElementSelector); + outerShadowRoot = outerHostElement.openOrClosedShadowRoot; + hostElement = outerShadowRoot.querySelector(hostElementSelector); + } + const shadowRoot = hostElement.openOrClosedShadowRoot; + let expectedRootElement = iframeDoc.querySelector(rootElementSelector); + if (!expectedRootElement) { + // The form itself is inside a ShadowRoot and/or there is a ShadowRoot in between the field and form + expectedRootElement = + shadowRoot.querySelector(rootElementSelector) || + outerShadowRoot.querySelector(rootElementSelector); + } + ok(LoginFormFactory.getRootElementsWeakSetForDocument(iframeDoc).has(expectedRootElement), "Ensure formLike.rootElement has the expected value"); + } +} + +for (let testcase of TESTCASES) { + const taskName = testcase.name; + const tmp = { + async [taskName]() { + await testForm(testcase); + } + } + add_task(tmp[taskName]); +} +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_form_action_1.html b/toolkit/components/passwordmgr/test/mochitest/test_form_action_1.html new file mode 100644 index 0000000000..21f5f18904 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_form_action_1.html @@ -0,0 +1,140 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test for considering form action</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: Bug 360493 +<script> +gTestDependsOnDeprecatedLogin = true; +runChecksAfterCommonInit(() => startTest()); + +let DEFAULT_ORIGIN = window.location.origin; +</script> +<p id="display"></p> +<div id="content" style="display: none"> +</div> +<pre id="test"> +<script class="testbody" type="text/javascript"> + +/** Test for Login Manager: 360493 (Cross-Site Forms + Password + Manager = Security Failure) **/ + +// This test is designed to make sure variations on the form's |action| +// and |method| continue to work with the fix for 360493. + +async function startTest() { + let win = window.open("about:blank"); + SimpleTest.registerCleanupFunction(() => win.close()); + await loadFormIntoWindow(DEFAULT_ORIGIN, ` + <!-- normal form with normal relative action. --> + <form id="form1" action="formtest.js"> + <input type="text" name="uname"> + <input type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- fully specify the action URL --> + <form id="form2" action="http://mochi.test:8888/tests/toolkit/components/passwordmgr/test/formtest.js"> + <input type="text" name="uname"> + <input type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- fully specify the action URL, and change the path --> + <form id="form3" action="http://mochi.test:8888/zomg/wtf/bbq/passwordmgr/test/formtest.js"> + <input type="text" name="uname"> + <input type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- fully specify the action URL, and change the path and filename --> + <form id="form4" action="http://mochi.test:8888/zomg/wtf/bbq/passwordmgr/test/not_a_test.js"> + <input type="text" name="uname"> + <input type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- specify the action URL relative to the current document--> + <form id="form5" action="./formtest.js"> + <input type="text" name="uname"> + <input type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- specify the action URL relative to the current server --> + <form id="form6" action="/tests/toolkit/components/passwordmgr/test/formtest.js"> + <input type="text" name="uname"> + <input type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- Change the method from get to post --> + <form id="form7" action="formtest.js" method="POST"> + <input type="text" name="uname"> + <input type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- Blank action URL specified --> + <form id="form8" action=""> + <input type="text" name="uname"> + <input type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- |action| attribute entirely missing --> + <form id="form9" > + <input type="text" name="uname"> + <input type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- action url as javascript --> + <form id="form10" action="javascript:alert('this form is not submitted so this alert should not be invoked');"> + <input type="text" name="uname"> + <input type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form>`, win, 10); + + // TODO: action=IP.ADDRESS instead of HOSTNAME? + // TODO: test with |base href="http://othersite//"| ? + + for (var i = 1; i <= 9; i++) { + // Check form i + await checkLoginFormInFrameWithElementValues(win, i, "testuser", "testpass"); + } + + // The login's formActionOrigin isn't "javascript:", so don't fill it in. + await checkLoginFormInFrameWithElementValues(win, 10, "", ""); + + SimpleTest.finish(); +} +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_form_action_2.html b/toolkit/components/passwordmgr/test/mochitest/test_form_action_2.html new file mode 100644 index 0000000000..2eae0958ca --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_form_action_2.html @@ -0,0 +1,173 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test for considering form action</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: Bug 360493 +<script> +gTestDependsOnDeprecatedLogin = true; +runChecksAfterCommonInit(() => startTest()); + +let DEFAULT_ORIGIN = window.location.origin; +</script> +<p id="display"></p> +<div id="content" style="display: none"> +</div> +<pre id="test"> +<script class="testbody" type="text/javascript"> + +/** Test for Login Manager: 360493 (Cross-Site Forms + Password Manager = Security Failure) **/ + +async function startTest() { + let win = window.open("about:blank"); + SimpleTest.registerCleanupFunction(() => win.close()); + await loadFormIntoWindow(DEFAULT_ORIGIN, ` + <!-- The tests in this page exercise things that shouldn't work. --> + + <!-- Change port # of action URL from 8888 to 7777 --> + <form id="form1" action="http://localhost:7777/tests/toolkit/components/passwordmgr/test/formtest.js"> + <input type="text" name="uname"> + <input type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- No port # in action URL --> + <form id="form2" action="http://localhost/tests/toolkit/components/passwordmgr/test/formtest.js"> + <input type="text" name="uname"> + <input type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- Change protocol from http:// to ftp://, include the expected 8888 port # --> + <form id="form3" action="ftp://localhost:8888/tests/toolkit/components/passwordmgr/test/formtest.js"> + <input type="text" name="uname"> + <input type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- Change protocol from http:// to ftp://, no port # specified --> + <form id="form4" action="ftp://localhost/tests/toolkit/components/passwordmgr/test/formtest.js"> + <input type="text" name="uname"> + <input type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- Try a weird URL. --> + <form id="form5" action="about:blank"> + <input type="text" name="uname"> + <input type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- Try a weird URL. (If the normal embedded action URL doesn't work, that should mean other URLs won't either) --> + <form id="form6" action="view-source:http://localhost:8888/tests/toolkit/components/passwordmgr/test/formtest.js"> + <input type="text" name="uname"> + <input type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- Try a weird URL. --> + <form id="form7" action="view-source:formtest.js"> + <input type="text" name="uname"> + <input type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- Action URL points to a different host (this is the archetypical exploit) --> + <form id="form8" action="http://www.cnn.com/"> + <input type="text" name="uname"> + <input type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- Action URL points to a different host, user field prefilled --> + <form id="form9" action="http://www.cnn.com/"> + <input type="text" name="uname" value="testuser"> + <input type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- Try wrapping a evil form around a good form, to see if we can confuse the parser. --> + <form id="form10-A" action="http://www.cnn.com/"> + <form id="form10-B" action="formtest.js"> + <input type="text" name="uname"> + <input type="password" name="pword"> + + <button type="submit">Submit (inner)</button> + <button type="reset"> Reset (inner)</button> + </form> + <button type="submit" id="neutered_submit10">Submit (outer)</button> + <button type="reset">Reset (outer)</button> + </form> + + <!-- Try wrapping a good form around an evil form, to see if we can confuse the parser. --> + <form id="form11-A" action="formtest.js"> + <form id="form11-B" action="http://www.cnn.com/"> + <input type="text" name="uname"> + <input type="password" name="pword"> + + <button type="submit">Submit (inner)</button> + <button type="reset"> Reset (inner)</button> + </form> + <button type="submit" id="neutered_submit11">Submit (outer)</button> + <button type="reset">Reset (outer)</button> + </form>`, win, 11); + + // TODO: probably should have some accounts which have no port # in the action url. + // JS too. And different host/proto. + // TODO: www.site.com vs. site.com? + // TODO: foo.site.com vs. bar.site.com? + + for (var i = 1; i <= 8; i++) { + // Check form i + await checkLoginFormInFrameWithElementValues(win, i, "", ""); + } + + await checkLoginFormInFrameWithElementValues(win, 9, "testuser", ""); + + await checkLoginFormInFrameWithElementValues(win, "10-A", "", ""); + + // The DOM indicates this form could be filled, as the evil inner form + // is discarded. And yet pwmgr seems not to fill it. Not sure why. + todo(false, "Mangled form combo not being filled when maybe it could be?"); + await checkLoginFormInFrameWithElementValues(win, "11-A", "testuser", "testpass"); + + // Verify this by making sure there are no extra forms in the document, and + // that the submit button for the neutered forms don't do anything. + // If the test finds extra forms the submit() causes the test to timeout, then + // there may be a security issue. + await SpecialPowers.spawn(win, [], async function submitForms() { + is(this.content.document.forms.length, 11, "Checking for unexpected forms"); + this.content.document.getElementById("neutered_submit10").click(); + this.content.document.getElementById("neutered_submit11").click(); + }); + + SimpleTest.finish(); +} +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_form_action_javascript.html b/toolkit/components/passwordmgr/test/mochitest/test_form_action_javascript.html new file mode 100644 index 0000000000..3bb52ef8df --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_form_action_javascript.html @@ -0,0 +1,47 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test forms with a JS submit action</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: form with JS submit action +<script> +runChecksAfterCommonInit(() => startTest()); + +const origin = window.location.origin; + +/** Test for Login Manager: JS action URL **/ + +async function startTest() { + await addLoginsInParent( + [origin, "javascript:", null, "jsuser", "jspass123", "uname", "pword"] + ); + const win = window.open("about:blank"); + SimpleTest.registerCleanupFunction(() => win.close()); + await loadFormIntoWindow(origin, ` + <form id='form1' action='javascript:alert("never shows")'> 1 + <input name="uname"> + <input name="pword" type="password"> + + <button type='submit'>Submit</button> + <button type='reset'> Reset </button> + </form>`, win); + + await checkLoginFormInFrameWithElementValues(win, 1, "jsuser", "jspass123"); + + SimpleTest.finish(); +} +</script> + +<p id="display"></p> + +<div id="content" style="display: none"> +</div> + +<pre id="test"></pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_formless_autofill.html b/toolkit/components/passwordmgr/test/mochitest/test_formless_autofill.html new file mode 100644 index 0000000000..3422fa893a --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_formless_autofill.html @@ -0,0 +1,144 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Test autofilling of fields outside of a form</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<script type="application/javascript"> +document.addEventListener("DOMContentLoaded", () => { + document.getElementById("loginFrame").addEventListener("load", (evt) => { + // Tell the parent to setup test logins. + PWMGR_COMMON_PARENT.sendAsyncMessage("setupParent", { selfFilling: true, testDependsOnDeprecatedLogin: true }); + }); +}); + +let doneSetupPromise = new Promise(resolve => { + // When the setup is done, load a recipe for this test. + PWMGR_COMMON_PARENT.addMessageListener("doneSetup", function doneSetup() { + resolve(); + }); +}); + +add_setup(async () => { + info("Waiting for loads and setup"); + await doneSetupPromise; + + await loadRecipes({ + siteRecipes: [{ + hosts: ["mochi.test:8888"], + usernameSelector: "input[name='recipeuname']", + passwordSelector: "input[name='recipepword']", + }], + }); +}); + + +const DEFAULT_ORIGIN = "http://mochi.test:8888"; +const TESTCASES = [ + { + // Inputs + document: `<input type=password>`, + + // Expected outputs + expectedInputValues: ["testpass"], + }, + { + document: `<input> + <input type=password>`, + expectedInputValues: ["testuser", "testpass"], + }, + { + document: `<input> + <input type=password> + <input type=password>`, + expectedInputValues: ["testuser", "testpass", ""], + }, + { + document: `<input> + <input type=password> + <input type=password> + <input type=password>`, + expectedInputValues: ["testuser", "testpass", "", ""], + }, + { + document: `<input> + <input type=password form="form1"> + <input type=password> + <form id="form1"> + <input> + <input type=password> + </form>`, + expectedFormCount: 2, + expectedInputValues: ["testuser", "testpass", "testpass", "", ""], + }, + { + document: `<!-- formless password field selector recipe test --> + <input> + <input type=password> + <input> + <input type=password name="recipepword">`, + expectedInputValues: ["", "", "testuser", "testpass"], + }, + { + document: `<!-- formless username and password field selector recipe test --> + <input name="recipeuname"> + <input> + <input type=password> + <input type=password name="recipepword">`, + expectedInputValues: ["testuser", "", "", "testpass"], + }, + { + document: `<!-- form and formless recipe field selector test --> + <input name="recipeuname"> + <input> + <input type=password form="form1"> <!-- not filled since recipe affects both FormLikes --> + <input type=password> + <input type=password name="recipepword"> + <form id="form1"> + <input> + <input type=password> + </form>`, + expectedFormCount: 2, + expectedInputValues: ["testuser", "", "", "", "testpass", "", ""], + }, +]; + +add_task(async function test() { + let loginFrame = document.getElementById("loginFrame"); + let frameDoc = loginFrame.contentWindow.document; + + for (let tc of TESTCASES) { + info("Starting testcase: " + JSON.stringify(tc)); + + let numFormLikesExpected = tc.expectedFormCount || 1; + + let processedFormPromise = promiseFormsProcessedInSameProcess(numFormLikesExpected); + + // eslint-disable-next-line no-unsanitized/property + frameDoc.documentElement.innerHTML = tc.document; + info("waiting for " + numFormLikesExpected + " processed form(s)"); + await processedFormPromise; + + let testInputs = frameDoc.documentElement.querySelectorAll("input"); + is(testInputs.length, tc.expectedInputValues.length, "Check number of inputs"); + for (let i = 0; i < tc.expectedInputValues.length; i++) { + let expectedValue = tc.expectedInputValues[i]; + is(testInputs[i].value, expectedValue, `Check expected input value ${i} : ${expectedValue}`); + } + } +}); + +</script> + +<p id="display"></p> + +<div id="content"> + <iframe id="loginFrame" src="http://mochi.test:8888/tests/toolkit/components/passwordmgr/test/blank.html"></iframe> +</div> +<pre id="test"></pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_formless_submit.html b/toolkit/components/passwordmgr/test/mochitest/test_formless_submit.html new file mode 100644 index 0000000000..cf1e82a85e --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_formless_submit.html @@ -0,0 +1,243 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Test capturing of fields outside of a form</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="pwmgr_common.js"></script> + <link rel="stylesheet" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<script type="application/javascript"> +const { LoginFormFactory } = SpecialPowers.ChromeUtils.import( + "resource://gre/modules/LoginFormFactory.jsm" +); +const { LoginManagerChild } = SpecialPowers.ChromeUtils.import( + "resource://gre/modules/LoginManagerChild.jsm" +); + +function loadFrame() { + return new Promise(resolve => { + document.getElementById("loginFrame").addEventListener("load", (evt) => { + if (evt.target.contentWindow.location.href.includes("blank.html")) { + resolve(); + } + }); + }); +} + +let loadPromise = new Promise(resolve => { + document.addEventListener("DOMContentLoaded", () => { + resolve(loadFrame()); + }); +}); + +add_setup(async () => { + info("Waiting for page and frame loads"); + await loadPromise; + + await loadRecipes({ + siteRecipes: [{ + hosts: ["mochi.test:8888"], + usernameSelector: "input[name='recipeuname']", + passwordSelector: "input[name='recipepword']", + }], + }); +}); + +const DEFAULT_ORIGIN = "http://mochi.test:8888"; +const TESTCASES = [ + { + // Inputs + document: `<input type=password value="">`, + selectorValues: { + "[type=password]": "pass1", + }, + inputIndexForFormLike: 0, + expectedFormsCount: 1, + + // Expected outputs similar to PasswordManager:onFormSubmit + origin: DEFAULT_ORIGIN, + formActionOrigin: DEFAULT_ORIGIN, + usernameFieldValue: null, + newPasswordFieldValue: "pass1", + oldPasswordFieldValue: null, + }, + { + document: `<input id="u1" value=""> + <input type=password value="">`, + selectorValues: { + "#u1": "user1", + "[type=password]": "pass1", + }, + inputIndexForFormLike: 0, + expectedFormsCount: 1, + origin: DEFAULT_ORIGIN, + formActionOrigin: DEFAULT_ORIGIN, + usernameFieldValue: "user1", + newPasswordFieldValue: "pass1", + oldPasswordFieldValue: null, + }, + { + document: `<input id="u1" value=""> + <input type=password value="">`, + selectorValues: { + "#u1": "user1", + "[type=password]": "pass1", + }, + inputIndexForFormLike: 1, + expectedFormsCount: 1, + origin: DEFAULT_ORIGIN, + formActionOrigin: DEFAULT_ORIGIN, + usernameFieldValue: "user1", + newPasswordFieldValue: "pass1", + oldPasswordFieldValue: null, + }, + { + document: `<input id="u1" value=""> + <input id="p1" type=password value=""> + <input id="p2" type=password value="">`, + selectorValues: { + "#u1": "user1", + "#p1": "pass1", + "#p2": "pass2", + }, + inputIndexForFormLike: 2, + expectedFormsCount: 1, + origin: DEFAULT_ORIGIN, + formActionOrigin: DEFAULT_ORIGIN, + usernameFieldValue: "user1", + newPasswordFieldValue: "pass2", + oldPasswordFieldValue: "pass1", + }, + { + document: `<input id="u1" value=""> + <input id="p1" type=password value=""> + <input id="p2" type=password value=""> + <input id="p3" type=password value="">`, + selectorValues: { + "#u1": "user1", + "#p1": "pass1", + "#p2": "pass2", + "#p3": "pass2", + }, + inputIndexForFormLike: 3, + expectedFormsCount: 1, + origin: DEFAULT_ORIGIN, + formActionOrigin: DEFAULT_ORIGIN, + usernameFieldValue: "user1", + newPasswordFieldValue: "pass2", + oldPasswordFieldValue: "pass1", + }, + { + document: `<input id="u1" value=""> + <input id="p1" type=password value="" form="form1"> + <input id="p2" type=password value=""> + <form id="form1"> + <input id="u2" value=""> + <input id="p3" type=password value=""> + </form>`, + selectorValues: { + "#u1": "user1", + "#p1": "user2", + "#p2": "pass1", + "#u2": "user3", + "#p3": "pass2", + }, + inputIndexForFormLike: 2, + expectedFormsCount: 2, + origin: DEFAULT_ORIGIN, + formActionOrigin: DEFAULT_ORIGIN, + usernameFieldValue: "user1", + newPasswordFieldValue: "pass1", + oldPasswordFieldValue: null, + }, + { + document: `<!-- recipe field override --> + <input name="recipeuname" value=""> + <input id="u1" value=""> + <input id="p1" type=password value=""> + <input name="recipepword" type=password value="">`, + selectorValues: { + "[name='recipeuname']": "username from recipe", + "#u1": "default field username", + "#p1": "pass1", + "[name='recipepword']": "pass2", + }, + inputIndexForFormLike: 2, + expectedFormsCount: 1, + origin: DEFAULT_ORIGIN, + formActionOrigin: DEFAULT_ORIGIN, + usernameFieldValue: "username from recipe", + newPasswordFieldValue: "pass2", + oldPasswordFieldValue: null, + }, +]; + +let count = 0; +async function testFormlessSubmit(tc) { + let loginFrame = document.getElementById("loginFrame"); + + let frameDoc = SpecialPowers.wrap(loginFrame.contentWindow).document; + info("Starting testcase: " + JSON.stringify(tc)); + + let formsProcessed = promiseFormsProcessedInSameProcess(tc.expectedFormsCount); + // eslint-disable-next-line no-unsanitized/property + frameDoc.documentElement.innerHTML = tc.document; + await formsProcessed; + // We eliminate no user input as a reason for not capturing by modifying the value + setUserInputValues(frameDoc.documentElement, tc.selectorValues); + + let inputForFormLike = frameDoc.querySelectorAll("input")[tc.inputIndexForFormLike]; + + let formLike = LoginFormFactory.createFromField(inputForFormLike); + + info("Calling _onFormSubmit with FormLike"); + let submitProcessed = getSubmitMessage(); + LoginManagerChild.forWindow(frameDoc.defaultView)._onFormSubmit(formLike); + + let { origin, data } = await submitProcessed; + + // Check data sent via PasswordManager:onFormSubmit + is(origin, tc.origin, "Check origin"); + is(data.formActionOrigin, tc.formActionOrigin, "Check formActionOrigin"); + + if (tc.usernameFieldValue === null) { + is(data.usernameField, tc.usernameFieldValue, "Check usernameField"); + } else { + is(data.usernameField.value, tc.usernameFieldValue, "Check usernameField"); + } + + is(data.newPasswordField.value, tc.newPasswordFieldValue, "Check newPasswordFieldValue"); + + if (tc.oldPasswordFieldValue === null) { + is(data.oldPasswordField, tc.oldPasswordFieldValue, "Check oldPasswordFieldValue"); + } else { + is(data.oldPasswordField.value, tc.oldPasswordFieldValue, "Check oldPasswordFieldValue"); + } + + loadPromise = loadFrame(); + loginFrame.contentWindow.location = + "http://mochi.test:8888/tests/toolkit/components/passwordmgr/test/mochitest/blank.html?" + count++; + await loadPromise; +} + +for (let tc of TESTCASES) { + let taskName = "testcase-" + count++; + let tmp = { + async [taskName]() { + await testFormlessSubmit(tc); + }, + }; + add_task(tmp[taskName]); +} +</script> + +<p id="display"></p> + +<div id="content"> + <iframe id="loginFrame" src="http://mochi.test:8888/tests/toolkit/components/passwordmgr/test/mochitest/blank.html"></iframe> +</div> +<pre id="test"></pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_formless_submit_form_removal.html b/toolkit/components/passwordmgr/test/mochitest/test_formless_submit_form_removal.html new file mode 100644 index 0000000000..56fc428ec3 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_formless_submit_form_removal.html @@ -0,0 +1,292 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Test capturing of fields due to form removal</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="pwmgr_common.js"></script> + <link rel="stylesheet" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<script type="application/javascript"> +const { LoginManagerChild } = SpecialPowers.ChromeUtils.import( + "resource://gre/modules/LoginManagerChild.jsm" +); + +let loadPromise = new Promise(resolve => { + document.addEventListener("DOMContentLoaded", () => { + document.getElementById("loginFrame").addEventListener("load", (evt) => { + resolve(); + }); + }); +}); + +add_setup(async () => { + info("Waiting for page and frame loads"); + await loadPromise; + + await loadRecipes({ + siteRecipes: [{ + hosts: ["test1.mochi.test:8888"], + usernameSelector: "input[name='recipeuname']", + passwordSelector: "input[name='recipepword']", + }], + }); +}); + +const DEFAULT_ORIGIN = "http://test1.mochi.test:8888"; +const SCRIPTS = { + // Test removing the form(or form-less password field), their parent node, and the top-level node. + REMOVE_FORM: `let e = document.querySelector("form"); e.parentNode.removeChild(e);`, + REMOVE_PASSWORD: `let e = document.querySelector("[type=password]"); e.parentNode.removeChild(e);`, + REMOVE_FORM_PARENT: `let e = document.querySelector("form").parentNode; e.parentNode.removeChild(e);`, + REMOVE_PASSWORD_PARENT: `let e = document.querySelector("[type=password]").parentNode; e.parentNode.removeChild(e);`, + REMOVE_TOP: `let e = document.querySelector("html"); e.parentNode.removeChild(e);`, + + // Add testcases related to page navigation here to ensure these cases still work + // when we have set up form removal observer. + PUSHSTATE: `history.pushState({}, "Pushed state", "?pushed");`, + WINDOW_LOCATION: `window.location = "data:text/html;charset=utf-8,window.location";`, +}; +const TESTCASES = [ + { + // Inputs + document: `<input type=password value="">`, + selectorValues: { + "[type=password]": "pass1", + }, + expectedFormsCount: 1, + + // Expected outputs similar to PasswordManager:onFormSubmit + origin: DEFAULT_ORIGIN, + formActionOrigin: DEFAULT_ORIGIN, + usernameFieldValue: null, + newPasswordFieldValue: "pass1", + oldPasswordFieldValue: null, + }, + { + document: `<input id="u1" value=""> + <input type=password value="">`, + selectorValues: { + "#u1": "user1", + "[type=password]": "pass1", + }, + + expectedFormsCount: 1, + origin: DEFAULT_ORIGIN, + formActionOrigin: DEFAULT_ORIGIN, + usernameFieldValue: "user1", + newPasswordFieldValue: "pass1", + oldPasswordFieldValue: null, + }, + { + document: `<input id="u1" value=""> + <input id="p1" type=password value=""> + <input id="p2" type=password value="">`, + selectorValues: { + "#u1": "user1", + "#p1": "pass1", + "#p2": "pass2", + }, + + expectedFormsCount: 1, + origin: DEFAULT_ORIGIN, + formActionOrigin: DEFAULT_ORIGIN, + usernameFieldValue: "user1", + newPasswordFieldValue: "pass2", + oldPasswordFieldValue: "pass1", + }, + { + document: `<input id="u1" value=""> + <input id="p1" type=password value=""> + <input id="p2" type=password value=""> + <input id="p3" type=password value="">`, + selectorValues: { + "#u1": "user1", + "#p1": "pass1", + "#p2": "pass2", + "#p3": "pass2", + }, + + expectedFormsCount: 1, + origin: DEFAULT_ORIGIN, + formActionOrigin: DEFAULT_ORIGIN, + usernameFieldValue: "user1", + newPasswordFieldValue: "pass2", + oldPasswordFieldValue: "pass1", + }, + { + // Since there are two FormLikes to auto-submit in this case we mark + // one FormLike's password fields with a magic "ignore-form-submission" + // value so we can just focus on the other form. We then repeat the testcase + // below with the other FormLike ignored. + document: `<input id="u1" value=""> + <input type=password id="p1" value="" form="form1"> + <input type=password id="p2" value=""> + <form id="form1"> + <input id="u2" value=""> + <input id="p3" type=password value=""> + </form>`, + selectorValues: { + "#u1": "user1", + "#p1": "ignore-form-submission", + "#p2": "pass1", + "#u2": "user3", + "#p3": "ignore-form-submission", + }, + expectedFormsCount: 2, + origin: DEFAULT_ORIGIN, + formActionOrigin: DEFAULT_ORIGIN, + usernameFieldValue: "user1", + newPasswordFieldValue: "pass1", + oldPasswordFieldValue: null, + removePassword: true, + }, + { // Same as above but with the other form ignored. + document: `<input id="u1" value=""> + <input id="p1" type=password value="" form="form1"> + <input id="p2" type=password value=""> + <form id="form1"> + <input id="u2" value=""> + <input id="p3" type=password value=""> + </form>`, + selectorValues: { + "#u1": "user1", + "#p1": "pass2", + "#p2": "ignore-form-submission", + "#u2": "user3", + "#p3": "pass2", + }, + + expectedFormsCount: 2, + origin: DEFAULT_ORIGIN, + formActionOrigin: DEFAULT_ORIGIN, + usernameFieldValue: null, + newPasswordFieldValue: "pass2", + oldPasswordFieldValue: null, + }, + /* + XXX - Bug 1698498 : + This test case fails because when we call querySelector in LoginRecipes.jsm + after the form is removed, querySelector can't find the element. + { + document: `<!-- recipe field override --> + <input name="recipeuname" value=""> + <input id="u1" value=""> + <input id="p1" type=password value=""> + <input name="recipepword" type=password value="">`, + selectorValues: { + "[name='recipeuname']": "username from recipe", + "#u1": "default field username", + "#p1": "pass1", + "[name='recipepword']": "pass2", + }, + + expectedFormsCount: 1, + origin: DEFAULT_ORIGIN, + formActionOrigin: DEFAULT_ORIGIN, + usernameFieldValue: "username from recipe", + newPasswordFieldValue: "pass2", + oldPasswordFieldValue: null, + },*/ +]; + +function filterFormSubmissions({ origin, data }) { + return data.newPasswordField.value != "ignore-form-submission"; +} + +async function testFormlesSubmitFormRemoval(tc, testDoc, scriptName) { + let loginFrame = document.getElementById("loginFrame"); + let loadedPromise = new Promise((resolve) => { + loginFrame.addEventListener("load", function() { + resolve(); + }, {once: true}); + }); + loginFrame.src = DEFAULT_ORIGIN + "/tests/toolkit/components/passwordmgr/test/mochitest/blank.html"; + await loadedPromise; + + let frameDoc = SpecialPowers.wrap(loginFrame.contentWindow).document; + + let formsProcessed = promiseFormsProcessed(tc.expectedFormsCount); + // eslint-disable-next-line no-unsanitized/property + frameDoc.documentElement.innerHTML = testDoc; + await formsProcessed; + // We eliminate no user input as a reason for not capturing by modifying the value + setUserInputValues(frameDoc.documentElement, tc.selectorValues) + + await SpecialPowers.spawn(frameDoc.defaultView, [], async () => { + await content.fetch("http://test1.mochi.test:8888/tests/toolkit/components/passwordmgr/test/mochitest/blank.html"); + }); + + let submitProcessed = getSubmitMessage(filterFormSubmissions); + info("Running " + scriptName + " script to cause a submission"); + frameDoc.defaultView.eval(SCRIPTS[scriptName]); + + info("Waiting for formSubmissionProcsssed message"); + let { origin, data } = await submitProcessed; + info("Got for formSubmissionProcsssed message"); + + // Check data sent via PasswordManager:onFormSubmit + is(origin, tc.origin, "Check origin"); + is(data.formActionOrigin, tc.formActionOrigin, "Check formActionOrigin"); + + if (tc.usernameFieldValue === null) { + is(data.usernameField, tc.usernameFieldValue, "Check usernameField"); + } else { + is(data.usernameField.value, tc.usernameFieldValue, "Check usernameField"); + } + + is(data.newPasswordField.value, tc.newPasswordFieldValue, "Check newPasswordFieldValue"); + + if (tc.oldPasswordFieldValue === null) { + is(data.oldPasswordField, tc.oldPasswordFieldValue, "Check oldPasswordFieldValue"); + } else { + is(data.oldPasswordField.value, tc.oldPasswordFieldValue, "Check oldPasswordFieldValue"); + } +}; + +let count = 0; +for (let tc of TESTCASES) { + for (let scriptName of Object.keys(SCRIPTS)) { + for (let surroundDocumentWithForm of [false, true]) { + let testDoc = tc.document; + if (surroundDocumentWithForm) { + if (testDoc.includes("<form")) { + info("Skipping surroundDocumentWithForm case since document already contains a <form>"); + continue; + } + testDoc = "<form>" + testDoc + "</form>"; + } + + if (["REMOVE_FORM", "REMOVE_FORM_PARENT"].includes(scriptName) && + (!testDoc.includes("<form") || tc.removePassword)) { + continue; + } else if (["REMOVE_PASSWORD","REMOVE_PASSWORD_PARENT"].includes(scriptName) && + testDoc.includes("<form")) { + continue; + } + + let taskName = `testcase-${count}-${scriptName}${surroundDocumentWithForm ? '-formWrapped' : ''}`; + let tmp = { + async [taskName]() { + info("Starting testcase with script " + scriptName + " and " + + (surroundDocumentWithForm ? "a" : "no") + " form wrapper: " + JSON.stringify(tc)); + await testFormlesSubmitFormRemoval(tc, testDoc, scriptName); + }, + }; + add_task(tmp[taskName]); + } + } + count++; +} + +</script> + +<p id="display"></p> + +<div id="content"> + <iframe id="loginFrame" src="http://test1.mochi.test:8888/tests/toolkit/components/passwordmgr/test/mochitest/blank.html"></iframe> +</div> +<pre id="test"></pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_formless_submit_form_removal_negative.html b/toolkit/components/passwordmgr/test/mochitest/test_formless_submit_form_removal_negative.html new file mode 100644 index 0000000000..8a91553c85 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_formless_submit_form_removal_negative.html @@ -0,0 +1,205 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Test no capturing of fields outside of a form due to navigation</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="pwmgr_common.js"></script> + <link rel="stylesheet" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<script type="application/javascript"> +SimpleTest.requestFlakyTimeout("Testing that a message doesn't arrive"); + +let loadPromise = new Promise(resolve => { + document.addEventListener("DOMContentLoaded", () => { + document.getElementById("loginFrame").addEventListener("load", (evt) => { + resolve(); + }); + }); +}); + +function submissionProcessed(...args) { + ok(false, "No formSubmissionProcessed should occur in this test"); + info("got: " + JSON.stringify(args)); +} + +add_setup(async () => { + await SpecialPowers.pushPrefEnv({ + set: [ + ["signon.formRemovalCapture.enabled", true], + ], + }); + + info("Waiting for page and frame loads"); + await loadPromise; + + PWMGR_COMMON_PARENT.addMessageListener("formSubmissionProcessed", submissionProcessed); + + SimpleTest.registerCleanupFunction(() => { + PWMGR_COMMON_PARENT.removeMessageListener("formSubmissionProcessed", submissionProcessed); + }); +}); + +const DEFAULT_ORIGIN = "http://test1.mochi.test:8888"; +const SCRIPTS = { + // Test form submission is not triggered when there is no user interaction and + // no ajax request fired previously. + REMOVE_TOP: `let e = document.querySelector("html"); e.parentNode.removeChild(e);`, + + // Test the following scripts don't trigger form submissions because of the + // form removal heuristics + PUSHSTATE: `history.pushState({}, "Pushed state", "?pushed");`, + WINDOW_LOCATION: `window.location = "data:text/html;charset=utf-8,window.location";`, + WINDOW_LOCATION_RELOAD: `window.location.reload();`, + HISTORY_BACK: `history.back();`, + HISTORY_GO_MINUS1: `history.go(-1);`, +}; + +const HEURISTICS = [ + { + userInput: true, + ajaxSuccess: true, + }, + { + userInput: false, + ajaxSuccess: true, + }, + { + userInput: true, + ajaxSuccess: false, + }, + { + userInput: false, + ajaxSuccess: false, + }, +]; + +const TESTCASES = [ + // Begin test cases that shouldn't trigger capture. + { + // Empty password field in a form + document: `<form><input type=password value="xxx"></form>`, + selectorValues: { + "[type=password]": "", + }, + }, + { + // Empty password field + document: `<input type=password value="">`, + selectorValues: { + "[type=password]": "", + }, + }, + { + // Test with an input that would normally be captured but with SCRIPTS that + // shouldn't trigger capture. + document: `<input type=password value="">`, + selectorValues: { + "[type=password]": "pass2", + }, + wouldCapture: true, + }, + { + // Test with an input that would normally be captured but with SCRIPTS that + // shouldn't trigger capture. + document: `<form><input type=password value=""></form>`, + selectorValues: { + "[type=password]": "pass2", + }, + wouldCapture: true, + }, +]; + +async function testFormlesSubmitNavigationNegative(tc, scriptName, heuristic) { + let loginFrame = document.getElementById("loginFrame"); + let waitTime; + let android = navigator.appVersion.includes("Android"); + if (android) { + // intermittent failures on Android Debug at 5 seconds + waitTime = 10000; + } else { + waitTime = 5000; + } + + let loadedPromise = new Promise((resolve) => { + loginFrame.addEventListener("load", function() { + resolve(); + }, {once: true}); + }); + + loginFrame.src = DEFAULT_ORIGIN + "/tests/toolkit/components/passwordmgr/test/mochitest/blank.html"; + await loadedPromise; + + let frameDoc = SpecialPowers.wrap(loginFrame.contentWindow).document; + let formsProcessed = promiseFormsProcessed(); + // eslint-disable-next-line no-unsanitized/property + frameDoc.documentElement.innerHTML = tc.document; + await formsProcessed; + + // We eliminate no user input as a reason for not capturing by modifying the value + setUserInputValues(frameDoc.documentElement, tc.selectorValues, heuristic.userInput); + + if (heuristic.ajaxSuccess) { + await SpecialPowers.spawn(frameDoc.defaultView, [], async () => { + await content.fetch("http://test1.mochi.test:8888/tests/toolkit/components/passwordmgr/test/mochitest/blank.html"); + }); + } + + info("Running " + scriptName + " script to check for a submission"); + frameDoc.defaultView.eval(SCRIPTS[scriptName]); + + info("Running " + scriptName + " script to check for a submission 1"); + // Wait to see if the promise above resolves. + await new Promise(resolve => setTimeout(resolve, waitTime)); + info("Running " + scriptName + " script to check for a submission 2"); + ok(true, "Done waiting for captures"); + +} + +let count = 0; +for (let tc of TESTCASES) { + for (let scriptName of Object.keys(SCRIPTS)) { + for (let heuristic of HEURISTICS) { + let shouldCaptureAFormRemoval = heuristic.ajaxSuccess && heuristic.userInput; + // Only run the following scripts when we are going to observeform removal change + // to save some time running this whole test. + if (["PUSHSTATE", "WINDOW_LOCATION", "WINDOW_LOCATION_RELOAD", "HISTORY_BACK", "HISTORY_GO_MINUS1"].includes(scriptName)) { + if(!shouldCaptureAFormRemoval) { + continue; + } + + if (tc.wouldCapture && ["PUSHSTATE", "WINDOW_LOCATION"].includes(scriptName)) { + // Don't run scripts that should actually capture for this testcase. + continue; + } + } else if (["REMOVE_TOP"].includes(scriptName)) { + if (shouldCaptureAFormRemoval) { + // Don't run scripts that should actually capture for this testcase. + continue; + } + } + + let taskName = `testcase-${count}-${scriptName}`; + let tmp = { + async [taskName]() { + info("Starting testcase with script " + scriptName + ": " + JSON.stringify(tc) + ": " + JSON.stringify(heuristic)); + await testFormlesSubmitNavigationNegative(tc, scriptName, heuristic); + }, + }; + add_task(tmp[taskName]); + } + } +} + + +</script> + +<p id="display"></p> + +<div id="content"> + <iframe id="loginFrame" src="http://test1.mochi.test:8888/tests/toolkit/components/passwordmgr/test/mochitest/blank.html"></iframe> +</div> +<pre id="test"></pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_formless_submit_navigation.html b/toolkit/components/passwordmgr/test/mochitest/test_formless_submit_navigation.html new file mode 100644 index 0000000000..22fce4561e --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_formless_submit_navigation.html @@ -0,0 +1,272 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Test capturing of fields outside of a form due to navigation</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="pwmgr_common.js"></script> + <link rel="stylesheet" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<script type="application/javascript"> +const { LoginManagerChild } = SpecialPowers.ChromeUtils.import( + "resource://gre/modules/LoginManagerChild.jsm" +); + +let loadPromise = new Promise(resolve => { + document.addEventListener("DOMContentLoaded", () => { + document.getElementById("loginFrame").addEventListener("load", (evt) => { + resolve(); + }); + }); +}); + +add_setup(async () => { + await SpecialPowers.pushPrefEnv({ + set: [ + ["signon.formlessCapture.enabled", true], + ], + }); + + info("Waiting for page and frame loads"); + await loadPromise; + + await loadRecipes({ + siteRecipes: [{ + hosts: ["test1.mochi.test:8888"], + usernameSelector: "input[name='recipeuname']", + passwordSelector: "input[name='recipepword']", + }], + }); +}); + +const DEFAULT_ORIGIN = "http://test1.mochi.test:8888"; +const SCRIPTS = { + PUSHSTATE: `history.pushState({}, "Pushed state", "?pushed");`, + WINDOW_LOCATION: `window.location = "data:text/html;charset=utf-8,window.location";`, +}; +const TESTCASES = [ + { + // Inputs + document: `<input type=password value="">`, + selectorValues: { + "[type=password]": "pass1", + }, + expectedFormsCount: 1, + + // Expected outputs similar to PasswordManager:onFormSubmit + origin: DEFAULT_ORIGIN, + formActionOrigin: DEFAULT_ORIGIN, + usernameFieldValue: null, + newPasswordFieldValue: "pass1", + oldPasswordFieldValue: null, + }, + { + document: `<input id="u1" value=""> + <input type=password value="">`, + selectorValues: { + "#u1": "user1", + "[type=password]": "pass1", + }, + + expectedFormsCount: 1, + origin: DEFAULT_ORIGIN, + formActionOrigin: DEFAULT_ORIGIN, + usernameFieldValue: "user1", + newPasswordFieldValue: "pass1", + oldPasswordFieldValue: null, + }, + { + document: `<input id="u1" value=""> + <input id="p1" type=password value=""> + <input id="p2" type=password value="">`, + selectorValues: { + "#u1": "user1", + "#p1": "pass1", + "#p2": "pass2", + }, + + expectedFormsCount: 1, + origin: DEFAULT_ORIGIN, + formActionOrigin: DEFAULT_ORIGIN, + usernameFieldValue: "user1", + newPasswordFieldValue: "pass2", + oldPasswordFieldValue: "pass1", + }, + { + document: `<input id="u1" value=""> + <input id="p1" type=password value=""> + <input id="p2" type=password value=""> + <input id="p3" type=password value="">`, + selectorValues: { + "#u1": "user1", + "#p1": "pass1", + "#p2": "pass2", + "#p3": "pass2", + }, + + expectedFormsCount: 1, + origin: DEFAULT_ORIGIN, + formActionOrigin: DEFAULT_ORIGIN, + usernameFieldValue: "user1", + newPasswordFieldValue: "pass2", + oldPasswordFieldValue: "pass1", + }, + { + // Since there are two FormLikes to auto-submit in this case we mark + // one FormLike's password fields with a magic "ignore-form-submission" + // value so we can just focus on the other form. We then repeat the testcase + // below with the other FormLike ignored. + document: `<input id="u1" value=""> + <input type=password id="p1" value="" form="form1"> + <input type=password id="p2" value=""> + <form id="form1"> + <input id="u2" value=""> + <input id="p3" type=password value=""> + </form>`, + selectorValues: { + "#u1": "user1", + "#p1": "ignore-form-submission", + "#p2": "pass1", + "#u2": "user3", + "#p3": "ignore-form-submission", + }, + expectedFormsCount: 2, + origin: DEFAULT_ORIGIN, + formActionOrigin: DEFAULT_ORIGIN, + usernameFieldValue: "user1", + newPasswordFieldValue: "pass1", + oldPasswordFieldValue: null, + }, + { // Same as above but with the other form ignored. + document: `<input id="u1" value=""> + <input id="p1" type=password value="" form="form1"> + <input id="p2" type=password value=""> + <form id="form1"> + <input id="u2" value=""> + <input id="p3" type=password value=""> + </form>`, + selectorValues: { + "#u1": "user1", + "#p1": "pass2", + "#p2": "ignore-form-submission", + "#u2": "user3", + "#p3": "pass2", + }, + + expectedFormsCount: 2, + origin: DEFAULT_ORIGIN, + formActionOrigin: DEFAULT_ORIGIN, + usernameFieldValue: null, + newPasswordFieldValue: "pass2", + oldPasswordFieldValue: null, + }, + { + document: `<!-- recipe field override --> + <input name="recipeuname" value=""> + <input id="u1" value=""> + <input id="p1" type=password value=""> + <input name="recipepword" type=password value="">`, + selectorValues: { + "[name='recipeuname']": "username from recipe", + "#u1": "default field username", + "#p1": "pass1", + "[name='recipepword']": "pass2", + }, + + expectedFormsCount: 1, + origin: DEFAULT_ORIGIN, + formActionOrigin: DEFAULT_ORIGIN, + usernameFieldValue: "username from recipe", + newPasswordFieldValue: "pass2", + oldPasswordFieldValue: null, + }, +]; + +function filterFormSubmissions({ origin, data }) { + return data.newPasswordField.value != "ignore-form-submission"; +} + +async function testFormlesSubmitNavigation(tc, testDoc, scriptName) { + + let loginFrame = document.getElementById("loginFrame"); + let loadedPromise = new Promise((resolve) => { + loginFrame.addEventListener("load", function() { + resolve(); + }, {once: true}); + }); + loginFrame.src = DEFAULT_ORIGIN + "/tests/toolkit/components/passwordmgr/test/mochitest/blank.html"; + await loadedPromise; + + let frameDoc = SpecialPowers.wrap(loginFrame.contentWindow).document; + + let formsProcessed = promiseFormsProcessed(tc.expectedFormsCount); + // eslint-disable-next-line no-unsanitized/property + frameDoc.documentElement.innerHTML = testDoc; + await formsProcessed; + // We eliminate no user input as a reason for not capturing by modifying the value + setUserInputValues(frameDoc.documentElement, tc.selectorValues) + + let submitProcessed = getSubmitMessage(filterFormSubmissions); + info("Running " + scriptName + " script to cause a submission"); + frameDoc.defaultView.eval(SCRIPTS[scriptName]); + + info("Waiting for formSubmissionProcsssed message"); + let { origin, data } = await submitProcessed; + info("Got for formSubmissionProcsssed message"); + + // Check data sent via PasswordManager:onFormSubmit + is(origin, tc.origin, "Check origin"); + is(data.formActionOrigin, tc.formActionOrigin, "Check formActionOrigin"); + + if (tc.usernameFieldValue === null) { + is(data.usernameField, tc.usernameFieldValue, "Check usernameField"); + } else { + is(data.usernameField.value, tc.usernameFieldValue, "Check usernameField"); + } + + is(data.newPasswordField.value, tc.newPasswordFieldValue, "Check newPasswordFieldValue"); + + if (tc.oldPasswordFieldValue === null) { + is(data.oldPasswordField, tc.oldPasswordFieldValue, "Check oldPasswordFieldValue"); + } else { + is(data.oldPasswordField.value, tc.oldPasswordFieldValue, "Check oldPasswordFieldValue"); + } +}; + +let count = 0; +for (let tc of TESTCASES) { + for (let scriptName of Object.keys(SCRIPTS)) { + for (let surroundDocumentWithForm of [false, true]) { + let testDoc = tc.document; + if (surroundDocumentWithForm) { + if (testDoc.includes("<form")) { + info("Skipping surroundDocumentWithForm case since document already contains a <form>"); + continue; + } + testDoc = "<form>" + testDoc + "</form>"; + } + let taskName = `testcase-${count}-${scriptName}${surroundDocumentWithForm ? '-formWrapped' : ''}`; + let tmp = { + async [taskName]() { + info("Starting testcase with script " + scriptName + " and " + + (surroundDocumentWithForm ? "a" : "no") + " form wrapper: " + JSON.stringify(tc)); + await testFormlesSubmitNavigation(tc, testDoc, scriptName); + }, + }; + add_task(tmp[taskName]); + } + } + count++; +} + +</script> + +<p id="display"></p> + +<div id="content"> + <iframe id="loginFrame" src="http://test1.mochi.test:8888/tests/toolkit/components/passwordmgr/test/mochitest/blank.html"></iframe> +</div> +<pre id="test"></pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_formless_submit_navigation_negative.html b/toolkit/components/passwordmgr/test/mochitest/test_formless_submit_navigation_negative.html new file mode 100644 index 0000000000..4b437ced1b --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_formless_submit_navigation_negative.html @@ -0,0 +1,149 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Test no capturing of fields outside of a form due to navigation</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="pwmgr_common.js"></script> + <link rel="stylesheet" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<script type="application/javascript"> +SimpleTest.requestFlakyTimeout("Testing that a message doesn't arrive"); + +let loadPromise = new Promise(resolve => { + document.addEventListener("DOMContentLoaded", () => { + document.getElementById("loginFrame").addEventListener("load", (evt) => { + resolve(); + }); + }); +}); + +function submissionProcessed(...args) { + ok(false, "No formSubmissionProcessed should occur in this test"); + info("got: " + JSON.stringify(args)); +} + +add_setup(async () => { + await SpecialPowers.pushPrefEnv({ + set: [ + ["signon.formlessCapture.enabled", true], + ], + }); + + info("Waiting for page and frame loads"); + await loadPromise; + + PWMGR_COMMON_PARENT.addMessageListener("formSubmissionProcessed", submissionProcessed); + + SimpleTest.registerCleanupFunction(() => { + PWMGR_COMMON_PARENT.removeMessageListener("formSubmissionProcessed", submissionProcessed); + }); +}); + +const DEFAULT_ORIGIN = "http://test1.mochi.test:8888"; +const SCRIPTS = { + PUSHSTATE: `history.pushState({}, "Pushed state", "?pushed");`, + WINDOW_LOCATION: `window.location = "data:text/html;charset=utf-8,window.location";`, + WINDOW_LOCATION_RELOAD: `window.location.reload();`, + HISTORY_BACK: `history.back();`, + HISTORY_GO_MINUS1: `history.go(-1);`, +}; +const TESTCASES = [ + // Begin test cases that shouldn't trigger capture. + { + // Empty password field in a form + document: `<form><input type=password value="xxx"></form>`, + selectorValues: { + "[type=password]": "", + }, + }, + { + // Empty password field + document: `<input type=password value="">`, + selectorValues: { + "[type=password]": "", + }, + }, + { + // Test with an input that would normally be captured but with SCRIPTS that + // shouldn't trigger capture. + document: `<input type=password value="">`, + selectorValues: { + "[type=password]": "pass2", + }, + wouldCapture: true, + }, + { + // Test with an input that would normally be captured but with SCRIPTS that + // shouldn't trigger capture. + document: `<form><input type=password value=""></form>`, + selectorValues: { + "[type=password]": "pass2", + }, + wouldCapture: true, + }, +]; + +async function testFormlesSubmitNavigationNegative(tc, scriptName) { + let loginFrame = document.getElementById("loginFrame"); + let waitTime; + let android = navigator.appVersion.includes("Android"); + if (android) { + // intermittent failures on Android Debug at 5 seconds + waitTime = 10000; + } else { + waitTime = 5000; + } + + let loadedPromise = new Promise((resolve) => { + loginFrame.addEventListener("load", function() { + resolve(); + }, {once: true}); + }); + loginFrame.src = DEFAULT_ORIGIN + "/tests/toolkit/components/passwordmgr/test/mochitest/blank.html"; + await loadedPromise; + + let frameDoc = SpecialPowers.wrap(loginFrame.contentWindow).document; + // eslint-disable-next-line no-unsanitized/property + frameDoc.documentElement.innerHTML = tc.document; + // We eliminate no user input as a reason for not capturing by modifying the value + setUserInputValues(frameDoc.documentElement, tc.selectorValues); + + info("Running " + scriptName + " script to check for a submission"); + frameDoc.defaultView.eval(SCRIPTS[scriptName]); + + // Wait to see if the promise above resolves. + await new Promise(resolve => setTimeout(resolve, waitTime)); + ok(true, "Done waiting for captures"); +} + +let count = 0; +for (let tc of TESTCASES) { + for (let scriptName of Object.keys(SCRIPTS)) { + if (tc.wouldCapture && ["PUSHSTATE", "WINDOW_LOCATION"].includes(scriptName)) { + // Don't run scripts that should actually capture for this testcase. + continue; + } + let taskName = `testcase-${count}-${scriptName}`; + let tmp = { + async [taskName]() { + info("Starting testcase with script " + scriptName + ": " + JSON.stringify(tc)); + await testFormlesSubmitNavigationNegative(tc, scriptName); + }, + }; + add_task(tmp[taskName]); + } +} + + +</script> + +<p id="display"></p> + +<div id="content"> + <iframe id="loginFrame" src="http://test1.mochi.test:8888/tests/toolkit/components/passwordmgr/test/mochitest/blank.html"></iframe> +</div> +<pre id="test"></pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_input_events.html b/toolkit/components/passwordmgr/test/mochitest/test_input_events.html new file mode 100644 index 0000000000..2560c212d8 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_input_events.html @@ -0,0 +1,56 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test for input events in Login Manager</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: input events should fire. +<p id="display"></p> +<div id="content" style="display: none"></div> +<pre id="test"></pre> +<script> + add_setup(async () => { + await setStoredLoginsAsync( + [location.origin, location.origin, null, "testuser", "testpass", "uname", "pword"] + ); + }) + + add_task(async function username_events() { + return new Promise(resolve => { + let inputFired = false; + const form = createLoginForm(); + form.uname.oninput = e => { + is(e.target.value, "testuser", "Should get 'testuser' as value in input event"); + inputFired = true; + }; + form.uname.onchange = e => { + ok(inputFired, "Should get input event before change event for username field."); + is(e.target.value, "testuser", "Should get 'testuser' as value in change event"); + resolve(); + }; + }) + }) + + add_task(async function password_events() { + return new Promise(resolve => { + let inputFired = false; + const form = createLoginForm(); + form.pword.oninput = e => { + is(e.target.value, "testpass", "Should get 'testpass' as value in input event"); + inputFired = true; + }; + form.pword.onchange = e => { + ok(inputFired, "Should get input event before change event for password field."); + is(e.target.value, "testpass", "Should get 'testpass' as value in change event"); + resolve(); + }; + }) + }) +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_input_events_for_identical_values.html b/toolkit/components/passwordmgr/test/mochitest/test_input_events_for_identical_values.html new file mode 100644 index 0000000000..c6e378a516 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_input_events_for_identical_values.html @@ -0,0 +1,52 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test for input events in Login Manager when username/password are filled in already</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body onload="onNewEvent(event)"> +Login Manager test: input events should fire. + +<script> +runChecksAfterCommonInit(); + +SimpleTest.requestFlakyTimeout("untriaged"); + +/** Test for Login Manager: form fill when form is already filled, should not get input events. **/ + +var onloadFired = false; + +function onNewEvent(e) { + console.error("Got " + e.type + " event."); + if (e.type == "load") { + onloadFired = true; + getFormElementByName(1, "uname").focus(); + sendKey("Tab"); + } else { + ok(false, "Got an input event for " + e.target.name + " field, which shouldn't happen."); + } +} +</script> + +<p id="display"></p> + +<div id="content"> + + <form id="form1" action="formtest.js"> + <p>This is form 1.</p> + <input type="text" name="uname" oninput="onNewEvent(event)" value="testuser"> + <input type="password" name="pword" oninput="onNewEvent(event)" onfocus="setTimeout(function() { SimpleTest.finish() }, 1000);" value="testpass"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + +</div> +<pre id="test"></pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_insecure_form_field_no_saved_login.html b/toolkit/components/passwordmgr/test/mochitest/test_insecure_form_field_no_saved_login.html new file mode 100644 index 0000000000..8fcb9df6f6 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_insecure_form_field_no_saved_login.html @@ -0,0 +1,91 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test basic login, contextual inscure password warning without saved logins</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: contextual inscure password warning without saved logins + +<script> +let chromeScript = runChecksAfterCommonInit(); +</script> +<p id="display"></p> + +<!-- we presumably can't hide the content for this test. --> +<div id="content"> + + <form id="form1" action="http://autocomplete:8888/formtest.js" onsubmit="return false;"> + <input type="text" name="uname"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> + +/** Test for Login Manager: contextual insecure password warning without saved logins. **/ + +let uname = getFormElementByName(1, "uname"); +let pword = getFormElementByName(1, "pword"); + +// Restore the form to the default state. +function restoreForm() { + uname.value = ""; + pword.value = ""; + uname.focus(); +} + +function spinEventLoop() { + return Promise.resolve(); +} + +add_setup(async () => { + listenForUnexpectedPopupShown(); +}); + +add_task(async function test_form1_initial_empty() { + await SimpleTest.promiseFocus(window); + + // Make sure initial form is empty. + checkLoginForm(uname, "", pword, ""); + let popupState = await getPopupState(); + is(popupState.open, false, "Check popup is initially closed"); +}); + +add_task(async function test_form1_warning_entry() { + await SimpleTest.promiseFocus(window); + // Trigger autocomplete popup + restoreForm(); + await popupBy(); + + let popupState = await getPopupState(); + is(popupState.open, true, "Check popup is opened"); + is(popupState.selectedIndex, -1, "Check no entries are selected upon opening"); + + let acEvents = await getTelemetryEvents({ process: "parent", filterProps: TelemetryFilterPropsAC, clear: true }); + is(acEvents.length, 1, "One autocomplete event"); + checkACTelemetryEvent(acEvents[0], uname, { + "hadPrevious": "0", + "insecureWarning": "1", + "loginsFooter": "1" + }); + + synthesizeKey("KEY_ArrowDown"); // select insecure warning + checkLoginForm(uname, "", pword, ""); // value shouldn't update just by selecting + synthesizeKey("KEY_Enter"); + await spinEventLoop(); // let focus happen + checkLoginForm(uname, "", pword, ""); +}); + +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_maxlength.html b/toolkit/components/passwordmgr/test/mochitest/test_maxlength.html new file mode 100644 index 0000000000..a61812f6d3 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_maxlength.html @@ -0,0 +1,144 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test for maxlength attributes</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: Bug 391514 +<script> +gTestDependsOnDeprecatedLogin = true; +runChecksAfterCommonInit(() => startTest()); + +let DEFAULT_ORIGIN = window.location.origin; +</script> +<p id="display"></p> +<div id="content" style="display: none"> +</div> +<pre id="test"> +<script class="testbody" type="text/javascript"> + +/* Test for Login Manager: 391514 (Login Manager gets confused with + * password/PIN on usaa.com) + */ + +async function startTest() { + let win = window.open("about:blank"); + SimpleTest.registerCleanupFunction(() => win.close()); + await loadFormIntoWindow(DEFAULT_ORIGIN, ` + <!-- normal form. --> + <form id="form1" action="formtest.js"> + <input type="text" name="uname"> + <input type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- limited username --> + <form id="form2" action="formtest.js"> + <input type="text" name="uname" maxlength="4"> + <input type="password" name="pword"> + </form> + + <!-- limited password --> + <form id="form3" action="formtest.js"> + <input type="text" name="uname"> + <input type="password" name="pword" maxlength="4"> + </form> + + <!-- limited username and password --> + <form id="form4" action="formtest.js"> + <input type="text" name="uname" maxlength="4"> + <input type="password" name="pword" maxlength="4"> + </form> + + + <!-- limited username --> + <form id="form5" action="formtest.js"> + <input type="text" name="uname" maxlength="0"> + <input type="password" name="pword"> + </form> + + <!-- limited password --> + <form id="form6" action="formtest.js"> + <input type="text" name="uname"> + <input type="password" name="pword" maxlength="0"> + </form> + + <!-- limited username and password --> + <form id="form7" action="formtest.js"> + <input type="text" name="uname" maxlength="0"> + <input type="password" name="pword" maxlength="0"> + </form> + + + <!-- limited, but ok, username --> + <form id="form8" action="formtest.js"> + <input type="text" name="uname" maxlength="999"> + <input type="password" name="pword"> + </form> + + <!-- limited, but ok, password --> + <form id="form9" action="formtest.js"> + <input type="text" name="uname"> + <input type="password" name="pword" maxlength="999"> + </form> + + <!-- limited, but ok, username and password --> + <form id="form10" action="formtest.js"> + <input type="text" name="uname" maxlength="999"> + <input type="password" name="pword" maxlength="999"> + </form> + + + <!-- limited, but ok, username --> + <!-- (note that filled values are exactly 8 characters) --> + <form id="form11" action="formtest.js"> + <input type="text" name="uname" maxlength="8"> + <input type="password" name="pword"> + </form> + + <!-- limited, but ok, password --> + <!-- (note that filled values are exactly 8 characters) --> + <form id="form12" action="formtest.js"> + <input type="text" name="uname"> + <input type="password" name="pword" maxlength="8"> + </form> + + <!-- limited, but ok, username and password --> + <!-- (note that filled values are exactly 8 characters) --> + <form id="form13" action="formtest.js"> + <input type="text" name="uname" maxlength="8"> + <input type="password" name="pword" maxlength="8"> + </form>`, win, 13); + + var i; + + await checkLoginFormInFrameWithElementValues(win, 1, "testuser", "testpass"); + + for (i = 2; i < 8; i++) { + await checkLoginFormInFrameWithElementValues(win, i, "", ""); + } + + for (i = 8; i < 14; i++) { + await checkLoginFormInFrameWithElementValues(win, i, "testuser", "testpass"); + } + + // Note that tests 11-13 are limited to exactly the expected value. + // Assert this lest someone change the login we're testing with. + await SpecialPowers.spawn(win, [11, 8], (formNum, length) => { + let form = this.content.document.getElementById(`form${formNum}`); + let field = form.querySelector("[name='uname']"); + is(field.value.length, length, "asserting test assumption is valid."); + }); + + SimpleTest.finish(); +} +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_munged_values.html b/toolkit/components/passwordmgr/test/mochitest/test_munged_values.html new file mode 100644 index 0000000000..5afac7348b --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_munged_values.html @@ -0,0 +1,364 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Test handling of possibly-manipulated username values</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script src="pwmgr_common.js"></script> + <link rel="stylesheet" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<script type="application/javascript"> +const readyPromise = registerRunTests(); + +const DEFAULT_ORIGIN = window.location.origin; + +function removeAllUserFacingLoginsInParent() { + runInParent(function removeAllUserFacingLogins() { + Services.logins.removeAllUserFacingLogins(); + }); +} + +async function add2logins() { + removeAllUserFacingLoginsInParent(); + await addLoginsInParent([DEFAULT_ORIGIN, DEFAULT_ORIGIN, null, "real••••user", "pass1", "", ""], [DEFAULT_ORIGIN, DEFAULT_ORIGIN, null, "user2", "pass2", "", ""]); +} + +async function addSingleLogin() { + removeAllUserFacingLoginsInParent(); + await addLoginsInParent([DEFAULT_ORIGIN, DEFAULT_ORIGIN, null, "real••••user", "pass1", "", ""]) +} + +/** + * For any test including the character "!", generate a version of that test for every known munge + * character. + **/ + function generateTestCases(test) { + const MUNGE_CHARS = ["*", ".", "•"]; + + const nothingToReplace = Object.values(test).every(value => typeof value !== "string" || !value.includes("!")); + if (nothingToReplace) { + return test; + }; + + return MUNGE_CHARS.map(char => { + const newTest = {}; + for (const [propName, val] of Object.entries(test)) { + if (typeof val === "string") { + newTest[propName] = val.replace(/!/g, char); + } else { + newTest[propName] = val; + } + }; + return newTest; +})}; + +const loadPromise = new Promise(resolve => { + document.addEventListener("DOMContentLoaded", () => { + resolve(); + }); +}); + +add_setup(async () => { + info("Waiting for setup and page and window loads"); + await readyPromise; + await loadPromise; +}); + +add_task(async function test_new_logins() { + const TEST_CASES = [ + // ! is replaced with characters commonly used for munging + { + testName: "test_middle!MaskedUsername", + username: "so!!!ne", + expected: null, + }, + { + testName: "test_start!MaskedUsername", + username: "!!!eone", + expected: null, + }, + { + testName: "test_end!MaskedUsername", + username: "some!!!", + expected: null, + }, + { + testName: "test_ok!Username", + username: "obelixand!", + expected: "obelixand!", + }, + { + testName: "test_ok!Username2", + username: "!!username!!", + expected: "!!username!!", + }, + { + // We should only consider a username munged if it repeats of the same character + testName: "test_combinedMungeCharacters", + username: "*.•*.•*.•*.•*.•*.•", + expected: "*.•*.•*.•*.•*.•*.•", + }, +].flatMap(generateTestCases); + for (const tc of TEST_CASES) { + info("Starting testcase: " + JSON.stringify(tc)); + // Create a new window for each test case, because if we instead try to use + // the same window and change the page using window.location, that will trigger + // an onLocationChange event, which can trigger unwanted FormSubmit outside of + // clicking the submit button in each test document. + const win = window.open("about:blank"); + const html = ` + <form id="form1" onsubmit="return false;"> + <input type="text" name="uname" value="${tc.username}"> + <input type="password" name="pword" value="thepassword"> + <button type="submit" id="submitBtn">Submit</button> + </form>`; + await loadFormIntoWindow(DEFAULT_ORIGIN, html, win); + await SpecialPowers.spawn(win, [html], function(contentHtml) { + const doc = this.content.document; + for (const field of doc.querySelectorAll("input")) { + const actualValue = field.value; + field.value = ""; + SpecialPowers.wrap(field).setUserInput(actualValue); + } + }); + await SpecialPowers.spawn(win, [tc], function(testcase) { + const doc = this.content.document; + Assert.equal(doc.querySelector("[name='uname']").value, testcase.username, "Checking for filled username"); + }); + + // Check data sent via PasswordManager:onFormSubmit + const processedPromise = getSubmitMessage(); + await SpecialPowers.spawn(win, [], function() { + this.content.document.getElementById("submitBtn").click(); + }); + + const { data } = await processedPromise; + info("Got submitted result: " + JSON.stringify(data)); + + if (tc.expected === null) { + is(data.usernameField, tc.expected, "Check usernameField"); + } else { + is(data.usernameField.value, tc.expected, "Check usernameField"); + } + + win.close(); + await SimpleTest.promiseFocus(window); + } +}); + +add_task(async function test_no_save_dialog_when_password_is_fully_munged() { + const TEST_CASES = [ + { + testName: "test_passFullyMungedBy!", + password: "!!!!!!!!!", + shouldShowPrompt: false, + }, + { + testName: "test_passStartsMungedBy!", + password: "!!!!!!!butThenAPassword", + shouldShowPrompt: true, + }, + { + testName: "test_passEndsMungedBy!", + password: "aRealPasswordAndThen!!!!!!!", + shouldShowPrompt: true, + }, + { + testName: "test_passMostlyMungedBy!", + password: "!!!a!!!!", + shouldShowPrompt: true, + }, + { + testName: "test_combinedMungedCharacters", + password: "*.•*.•*.•*.•", + shouldShowPrompt: true, + }, + ].flatMap(generateTestCases); + + for (const tc of TEST_CASES) { + info("Starting testcase: " + tc.testName) + // Create a new window for each test case, because if we instead try to use + // the same window and change the page using window.location, that will trigger + // an onLocationChange event, which can trigger unwanted FormSubmit outside of + // clicking the submit button in each test document. + const win = window.open("about:blank"); + const html = ` + <form id="form1" onsubmit="return false;"> + <input type="text" name="uname" value="username"> + <input type="password" name="pword" value="${tc.password}"> + <button type="submit" id="submitBtn">Submit</button> + </form>`; + await loadFormIntoWindow(DEFAULT_ORIGIN, html, win); + await SpecialPowers.spawn(win, [html], function(contentHtml) { + const doc = this.content.document; + for (const field of doc.querySelectorAll("input")) { + const actualValue = field.value; + field.value = ""; + SpecialPowers.wrap(field).setUserInput(actualValue); + } + }); + await SpecialPowers.spawn(win, [tc], function(testcase) { + const doc = this.content.document; + Assert.equal(doc.querySelector("[name='pword']").value, testcase.password, "Checking for filled password"); + }); + + const formSubmitListener = SpecialPowers.spawn(win, [], function() { + return new Promise(resolve => { + this.content.windowRoot.addEventListener( + "PasswordManager:ShowDoorhanger", + event => { + info(`PasswordManager:ShowDoorhanger called. Event: ${JSON.stringify(event)}`); + resolve(event.detail.messageSent); + } + ); + }); + }); + + await SpecialPowers.spawn(win, [], function() { + this.content.document.getElementById("submitBtn").click(); + }); + + const dialogRequested = await formSubmitListener; + + is(dialogRequested, tc.shouldShowPrompt, "Verify 'show save/update prompt' message sent to parent process"); + + win.close(); + await SimpleTest.promiseFocus(window); + } +}); + +add_task(async function test_no_autofill_munged_username_matching_password() { + // run this test with 2 matching logins from this origin so we don't autofill + await add2logins(); + const allLogins = await LoginManager.getAllLogins(); + const matchingLogins = Array.prototype.filter.call(allLogins, l => l.origin == DEFAULT_ORIGIN); + is(matchingLogins.length, 2, "Expected number of matching logins"); + + const bulletLogin = matchingLogins.find(l => l.username == "real••••user"); + ok(bulletLogin, "Found the real••••user login"); + + const timesUsed = bulletLogin.timesUsed; + const guid = bulletLogin.guid; + + const win = window.open("about:blank"); + const html = + `<form id="form1" onsubmit="return false;"> + <input type="text" name="uname" value=""> + <input type="password" name="pword" value=""> + <button type="submit" id="submitBtn">Submit</button> + </form>`; + await loadFormIntoWindow(DEFAULT_ORIGIN, html, win); + await SpecialPowers.spawn(win, [html], function(contentHtml) { + const doc = this.content.document; + for (const field of doc.querySelectorAll("input")) { + const actualValue = field.value; + field.value = ""; + SpecialPowers.wrap(field).setUserInput(actualValue); + } + }); + await SpecialPowers.spawn(win, [], function() { + const doc = this.content.document; + Assert.equal(doc.querySelector("[name='uname']").value, "", "Check username didn't get autofilled"); + SpecialPowers.wrap(doc.querySelector("[name='uname']")).setUserInput("real••••user"); + SpecialPowers.wrap(doc.querySelector("[name='pword']")).setUserInput("pass1"); + }); + + // we shouldn't get the save password doorhanger... + const popupShownPromise = noPopupBy(); + + // Check data sent via PasswordManager:onFormSubmit + const processedPromise = getSubmitMessage(); + await SpecialPowers.spawn(win, [], function() { + this.content.document.getElementById("submitBtn").click(); + }); + + const { data } = await processedPromise; + info("Got submitted result: " + JSON.stringify(data)); + + is(data.usernameField, null, "Check usernameField"); + + const updatedLogins = await LoginManager.getAllLogins(); + const updatedLogin = Array.prototype.find.call(updatedLogins, l => l.guid == guid); + ok(updatedLogin, "Got the login via guid"); + is(updatedLogin.timesUsed, timesUsed + 1, "timesUsed was incremented"); + + await popupShownPromise; + + win.close(); + await SimpleTest.promiseFocus(window); +}); + + +add_task(async function test_autofill_munged_username_matching_password() { + // only a single matching login so we autofill the username + await addSingleLogin(); + + const allLogins = await LoginManager.getAllLogins(); + const matchingLogins = Array.prototype.filter.call(allLogins, l => l.origin == DEFAULT_ORIGIN); + is(matchingLogins.length, 1, "Expected number of matching logins"); + + info("matched login: " + matchingLogins[0].username); + const bulletLogin = matchingLogins.find(l => l.username == "real••••user"); + ok(bulletLogin, "Found the real••••user login"); + + const timesUsed = bulletLogin.timesUsed; + const guid = bulletLogin.guid; + + const win = window.open("about:blank"); + const html = + `<form id="form1" onsubmit="return false;"> + <input type="text" name="uname" value=""> + <input type="password" name="pword" value=""> + <button type="submit" id="submitBtn">Submit</button> + </form>`; + await loadFormIntoWindow(DEFAULT_ORIGIN, html, win); + await SpecialPowers.spawn(win, [html], function(contentHtml) { + const doc = this.content.document; + for (const field of doc.querySelectorAll("input")) { + const actualValue = field.value; + field.value = ""; + SpecialPowers.wrap(field).setUserInput(actualValue); + } + }); + await SpecialPowers.spawn(win, [], function() { + const doc = this.content.document; + Assert.equal(doc.querySelector("[name='uname']").value, "real••••user", "Check username did get autofilled"); + doc.querySelector("[name='pword']").setUserInput("pass1"); + }); + + // we shouldn't get the save/update password doorhanger as it didn't change + const popupShownPromise = noPopupBy(); + + // Check data sent via PasswordManager:onFormSubmit + const processedPromise = getSubmitMessage(); + await SpecialPowers.spawn(win, [], function() { + this.content.document.getElementById("submitBtn").click(); + }); + + const { data } = await processedPromise; + info("Got submitted result: " + JSON.stringify(data)); + + is(data.usernameField, null, "Check usernameField"); + + const updatedLogins = await LoginManager.getAllLogins(); + const updatedLogin = Array.prototype.find.call(updatedLogins, l => l.guid == guid); + ok(updatedLogin, "Got the login via guid"); + is(updatedLogin.timesUsed, timesUsed + 1, "timesUsed was incremented"); + + await popupShownPromise; + + win.close(); + await SimpleTest.promiseFocus(window); +}); + +</script> + +<p id="display"></p> + +<div id="content"> +</div> +<pre id="test"></pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_one_doorhanger_per_un_pw.html b/toolkit/components/passwordmgr/test/mochitest/test_one_doorhanger_per_un_pw.html new file mode 100644 index 0000000000..4d8dfd1fee --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_one_doorhanger_per_un_pw.html @@ -0,0 +1,59 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Don't repeatedly prompt to save the same username and password + combination in the same document</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<script> + let chromeScript = runChecksAfterCommonInit(); + + SimpleTest.requestFlakyTimeout("Giving a chance for the unexpected popupshown to occur"); +</script> +<p id="display"></p> + +<div id="content" style="display: none"> + <form id="form1" onsubmit="return false;"> + <input type="text" name="uname" id="ufield"> + <input type="password" name="pword" id="pfield"> + <button type="submit" id="submitBtn">Submit</button> + </form> +</div> + +<pre id="test"></pre> +<script> + /** Test for Login Manager: Don't repeatedly prompt to save the + same username and password combination in the same document **/ + + add_task(async function test_prompt_does_not_reappear() { + let username = document.getElementById("ufield"); + let password = document.getElementById("pfield"); + let submitButton = document.getElementById("submitBtn"); + + SpecialPowers.wrap(username).setUserInput("user"); + SpecialPowers.wrap(password).setUserInput("pass"); + + let processedPromise = getSubmitMessage(); + let promptShownPromise = promisePromptShown("passwordmgr-prompt-save"); + submitButton.click(); + await processedPromise; + await promptShownPromise; + + is(username.value, "user", "Checking for filled username"); + is(password.value, "pass", "Checking for filled password"); + + let promptShown = false; + promptShownPromise = promisePromptShown("passwordmgr-prompt-save").then(value => { + promptShown = true; + }); + submitButton.click(); + await new Promise(resolve => setTimeout(resolve, 1000)); + ok(!promptShown, "Prompt is not shown for the same login values a second time"); + }); +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_onsubmit_value_change.html b/toolkit/components/passwordmgr/test/mochitest/test_onsubmit_value_change.html new file mode 100644 index 0000000000..f23940d34b --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_onsubmit_value_change.html @@ -0,0 +1,70 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test input value change right after onsubmit event</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: input value change right after onsubmit event + +<script> + let chromeScript = runChecksAfterCommonInit(); + + function getSubmitMessage() { + info("getSubmitMessage"); + return new Promise((resolve, reject) => { + chromeScript.addMessageListener("formSubmissionProcessed", function processed(...args) { + info("got formSubmissionProcessed"); + chromeScript.removeMessageListener("formSubmissionProcessed", processed); + resolve(args[0]); + }); + }); + } +</script> +<p id="display"></p> + +<div id="content" style="display: none"> + + <form id="form1" action="formTest.js" onsubmit="return false;"> + <input type="text" name="uname" id="ufield"> + <input type="password" name="pword" id="pfield"> + <button type="submit" id="submitBtn">Submit</button> + </form> + +</div> + +<pre id="test"></pre> +<script> + /** Test for Login Manager: input value change right after onsubmit event **/ + add_task(async function checkFormValues() { + SpecialPowers.wrap(document.getElementById("ufield")).setUserInput("testuser"); + SpecialPowers.wrap(document.getElementById("pfield")).setUserInput("testpass"); + is(getFormElementByName(1, "uname").value, "testuser", "Checking for filled username"); + is(getFormElementByName(1, "pword").value, "testpass", "Checking for filled password"); + + document.getElementById("form1").addEventListener("submit", () => { + // deliberately assign to .value rather than setUserInput: + // the scenario under test here is that script is changing/populating + // fields after the user has clicked the submit button + document.getElementById("ufield").value = "newuser"; + document.getElementById("pfield").value = "newpass"; + }, true); + + document.getElementById("form1").addEventListener("submit", (e) => e.preventDefault()); + + let processedPromise = getSubmitMessage(); + + let button = document.getElementById("submitBtn"); + button.click(); + + let { data } = await processedPromise; + is(data.usernameField.value, "testuser", "Should have registered \"testuser\" for username"); + is(data.newPasswordField.value, "testpass", "Should have registered \"testpass\" for username"); + }); +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_password_field_autocomplete.html b/toolkit/components/passwordmgr/test/mochitest/test_password_field_autocomplete.html new file mode 100644 index 0000000000..2db691b1bf --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_password_field_autocomplete.html @@ -0,0 +1,198 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test basic login autocomplete</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: multiple login autocomplete + +<script> +var chromeScript = runChecksAfterCommonInit(); + +const INSECURE_WARNING_TEXT = "This connection is not secure. Logins entered here could be compromised. Learn More"; + +let origin = window.location.origin; +addLoginsInParent( + // login0 has no username, so should be filtered out from the autocomplete list. + [origin, "http://autocomplete:8888", null, "", "user0pass", "", "pword"], + [origin, "http://autocomplete:8888", null, "tempuser1", "temppass1", "uname", "pword"], + [origin, "http://autocomplete:8888", null, "testuser2", "testpass2", "uname", "pword"], + [origin, "http://autocomplete:8888", null, "testuser3", "testpass3", "uname", "pword"], + [origin, "http://autocomplete:8888", null, "zzzuser4", "zzzpass4", "uname", "pword"]); +</script> +<p id="display"></p> + +<!-- we presumably can't hide the content for this test. --> +<div id="content"> + + <!-- form1 tests multiple matching logins --> + <form id="form1" action="http://autocomplete:8888/formtest.js" onsubmit="return false;"> + <h1>Sign in</h1> + <input type="text" name="uname"> + <input type="password" name="pword"> + <button type="submit">Submit</button> + </form> + + <form id="form2" action="http://autocomplete:8888/formtest.js" onsubmit="return false;"> + <input type="text" name="uname"> + <input type="password" name="pword" readonly="true"> + <button type="submit">Submit</button> + </form> + + <form id="form3" action="http://autocomplete:8888/formtest.js" onsubmit="return false;"> + <input type="text" name="uname"> + <input type="password" name="pword" disabled="true"> + <button type="submit">Submit</button> + </form> + +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> +/** Test for Login Manager: multiple login autocomplete. **/ + +let uname = getFormElementByName(1, "uname"); +let pword = getFormElementByName(1, "pword"); + +// Restore the form to the default state. +async function reinitializeForm(index) { + // Using innerHTML is for creating the autocomplete popup again, so the + // preference value will be applied to the constructor of + // LoginAutoCompleteResult. + let form = document.getElementById("form" + index); + let temp = form.innerHTML; + form.innerHTML = ""; + // eslint-disable-next-line no-unsanitized/property + form.innerHTML = temp; + + await new Promise(resolve => { + let observer = SpecialPowers.wrapCallback(() => { + SpecialPowers.removeObserver(observer, "passwordmgr-processed-form"); + resolve(); + }); + SpecialPowers.addObserver(observer, "passwordmgr-processed-form"); + }); + + await SimpleTest.promiseFocus(window); + + uname = getFormElementByName(index, "uname"); + pword = getFormElementByName(index, "pword"); + uname.value = ""; + pword.value = ""; + pword.focus(); +} + +function generateDateString(date) { + let dateAndTimeFormatter = new Services.intl.DateTimeFormat(undefined, + { dateStyle: "medium" }); + return dateAndTimeFormatter.format(date); +} + +const DATE_NOW_STRING = generateDateString(new Date()); + +// Check for expected username/password in form. +function checkACFormPasswordField(expectedPassword) { + var formID = uname.parentNode.id; + is(pword.value, expectedPassword, "Checking " + formID + " password is: " + JSON.stringify(expectedPassword)); +} + +async function userOpenAutocompleteOnForm1(autoFillInsecureForms) { + await SpecialPowers.pushPrefEnv({"set": [ + ["signon.autofillForms.http", autoFillInsecureForms], + ]}); + await reinitializeForm(1); + const autocompleteItems = await popupBy(); + + const popupState = await getPopupState(); + is(popupState.selectedIndex, -1, "Check no entries are selected upon opening"); + + const expectedMenuItems = [INSECURE_WARNING_TEXT, + "No username (" + DATE_NOW_STRING + ")", + "tempuser1", + "testuser2", + "testuser3", + "zzzuser4"]; + checkAutoCompleteResults(autocompleteItems, expectedMenuItems, "mochi.test", "Check all menuitems are displayed correctly."); +} + +async function userPressedDown_passwordIs(value) { + synthesizeKey("KEY_ArrowDown"); + await Promise.resolve(); // let focus happen + checkACFormPasswordField(value); +} + +async function userPressedEnter_passwordIs(value) { + synthesizeKey("KEY_Enter"); + await Promise.resolve(); // let focus happen + checkACFormPasswordField(value); +} + +async function noPopupOnForm(formIndex, reason) { + await SpecialPowers.pushPrefEnv({"set": [ + ["signon.autofillForms.http", true], + ]}); + await reinitializeForm(formIndex); + + // Trigger autocomplete popup + synthesizeKey("KEY_ArrowDown"); // open + let popupState = await getPopupState(); + is(popupState.open, false, reason); +} + +add_setup(async () => { + listenForUnexpectedPopupShown(); +}); + +add_task(async function form1_initial_empty() { + await SimpleTest.promiseFocus(window); + + // Make sure initial form is empty. + checkACFormPasswordField(""); + let popupState = await getPopupState(); + is(popupState.open, false, "Check popup is initially closed"); +}); + +add_task(async function noAutocompleteForReadonlyField() { + await noPopupOnForm(2, "Check popup is closed for a readonly field."); +}); + +add_task(async function noAutocompleteForDisabledField() { + await noPopupOnForm(3, "Check popup is closed for a disabled field."); +}); + +add_task(async function insecureAutoFill_EnterOnWarning() { + await userOpenAutocompleteOnForm1(true); + await userPressedDown_passwordIs(""); + await userPressedEnter_passwordIs(""); +}); + +add_task(async function insecureAutoFill_EnterOnLogin() { + await userOpenAutocompleteOnForm1(true); + await userPressedDown_passwordIs(""); // select insecure warning + await userPressedDown_passwordIs(""); // select login + await userPressedEnter_passwordIs("user0pass"); +}); + +add_task(async function noInsecureAutoFill_EnterOnWarning() { + await userOpenAutocompleteOnForm1(false); + await userPressedDown_passwordIs(""); // select insecure warning + await userPressedEnter_passwordIs(""); +}); + +add_task(async function noInsecureAutoFill_EnterOnLogin() { + await userOpenAutocompleteOnForm1(false); + await userPressedDown_passwordIs(""); // select insecure warning + await userPressedDown_passwordIs(""); // select login + await userPressedEnter_passwordIs("user0pass"); +}); + +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_password_length.html b/toolkit/components/passwordmgr/test/mochitest/test_password_length.html new file mode 100644 index 0000000000..3edfc1a00a --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_password_length.html @@ -0,0 +1,150 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Test handling of different password length</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="pwmgr_common.js"></script> + <link rel="stylesheet" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<script type="application/javascript"> +const { LoginManagerChild } = SpecialPowers.ChromeUtils.import( + "resource://gre/modules/LoginManagerChild.jsm" +); + +let readyPromise = registerRunTests(); + +let loadPromise = new Promise(resolve => { + document.addEventListener("DOMContentLoaded", () => { + document.getElementById("loginFrame").addEventListener("load", (evt) => { + resolve(); + }); + }); +}); + +async function loadFormIntoIframe(origin, html) { + let loginFrame = document.getElementById("loginFrame"); + let loadedPromise = new Promise((resolve) => { + loginFrame.addEventListener("load", function() { + resolve(); + }, {once: true}); + }); + let processedPromise = promiseFormsProcessed(); + loginFrame.src = origin + "/tests/toolkit/components/passwordmgr/test/mochitest/blank.html"; + await loadedPromise; + + await SpecialPowers.spawn(getIframeBrowsingContext(window, 0), [html], function(contentHtml) { + // eslint-disable-next-line no-unsanitized/property + this.content.document.documentElement.innerHTML = contentHtml; + }); + + // Wait for the form to be processed before trying to submit. + await processedPromise; +} + +add_setup(async () => { + info("Waiting for setup and page and frame loads"); + await readyPromise; + await loadPromise; +}); + +const DEFAULT_ORIGIN = window.location.origin; +const TESTCASES = [ + { + testName: "test_control2PasswordFields", + pword1: "pass1", + pword2: "pass2", + expectedNewPassword: { value: "pass2" }, + expectedOldPassword: { value: "pass1" }, + }, + { + testName: "test_1characterPassword", + pword1: "x", + pword2: "pass2", + expectedNewPassword: { value: "pass2" }, + expectedOldPassword: null, + }, + { + testName: "test_2characterPassword", + pword1: "xy", + pword2: "pass2", + expectedNewPassword: { value: "pass2" }, + expectedOldPassword: { value: "xy" }, + }, + { + testName: "test_1characterNewPassword", + pword1: "pass1", + pword2: "x", + expectedNewPassword: { value: "pass1" }, + expectedOldPassword: null, + }, +]; + +/** + * @return {Promise} resolving when form submission was processed. + */ +function getSubmitMessage() { + return new Promise((resolve, reject) => { + PWMGR_COMMON_PARENT.addMessageListener("formSubmissionProcessed", function processed(...args) { + info("got formSubmissionProcessed"); + PWMGR_COMMON_PARENT.removeMessageListener("formSubmissionProcessed", processed); + resolve(args[0]); + }); + }); +} + +add_task(async function test_password_lengths() { + for (let tc of TESTCASES) { + info("Starting testcase: " + tc.testName + ", " + JSON.stringify([tc.pword1, tc.pword2])); + await loadFormIntoIframe(DEFAULT_ORIGIN, `<form id="form1" onsubmit="return false;"> + <input type="text" name="uname" value="myname"> + <input type="password" name="pword1" value=""> + <input type="password" name="pword2" value=""> + <button type="submit" id="submitBtn">Submit</button> + </form>`); + + await SpecialPowers.spawn(getIframeBrowsingContext(window, 0), [tc], function(testcase) { + let doc = this.content.document; + Assert.equal(doc.querySelector("[name='uname']").value, "myname", "Checking for filled username"); + doc.querySelector("[name='pword1']").setUserInput(testcase.pword1); + doc.querySelector("[name='pword2']").setUserInput(testcase.pword2); + }); + + // Check data sent via PasswordManager:onFormSubmit + let processedPromise = getSubmitMessage(); + await SpecialPowers.spawn(getIframeBrowsingContext(window, 0), [], function() { + this.content.document.getElementById("submitBtn").click(); + }); + + let { data } = await processedPromise; + info("Got submitted result: " + JSON.stringify(data)); + + if (tc.expectedNewPassword === null) { + is(data.newPasswordField, + tc.expectedNewPassword, "Check expectedNewPassword is null"); + } else { + is(data.newPasswordField.value, + tc.expectedNewPassword.value, + "Check that newPasswordField.value matches the expectedNewPassword.value"); + } + if (tc.expectedOldPassword === null) { + is(data.oldPasswordField, + tc.expectedOldPassword, "Check expectedOldPassword is null"); + } else { + is(data.oldPasswordField.value, + tc.expectedOldPassword.value, + "Check that oldPasswordField.value matches expectedOldPassword.value"); + } + } +}); +</script> + +<p id="display"></p> + +<div id="content"> + <iframe id="loginFrame" src="/tests/toolkit/components/passwordmgr/test/mochitest/blank.html"></iframe> +</div> +<pre id="test"></pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_passwords_in_type_password.html b/toolkit/components/passwordmgr/test/mochitest/test_passwords_in_type_password.html new file mode 100644 index 0000000000..fcaeb0e455 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_passwords_in_type_password.html @@ -0,0 +1,114 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test that passwords only get filled in type=password</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: Bug 242956 +<script> +gTestDependsOnDeprecatedLogin = true; +runChecksAfterCommonInit(() => startTest()); + +let DEFAULT_ORIGIN = window.location.origin; +</script> +<p id="display"></p> +<div id="content" style="display: none"> +</div> +<pre id="test"> +<script class="testbody" type="text/javascript"> + +/** Test for Login Manager: 242956 (Stored password is inserted into a + readable text input on a second page) **/ + +// Make sure that pwmgr only puts passwords into type=password <input>s. +// Might as well test the converse, too (username in password field). + +async function startTest() { + let win = window.open("about:blank"); + SimpleTest.registerCleanupFunction(() => win.close()); + + // only 4 out of 7 forms are to be autofilled + await loadFormIntoWindow(DEFAULT_ORIGIN, ` + <!-- pword is not a type=password input --> + <form id="form1" action="formtest.js"> + <input type="text" name="uname"> + <input type="text" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- uname is not a type=text input --> + <form id="form2" action="formtest.js"> + <input type="password" name="uname"> + <input type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- two "pword" inputs, (text + password) --> + <form id="form3" action="formtest.js"> + <input type="text" name="uname"> + <input type="text" name="pword"> + <input type="password" name="qword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- same thing, different order --> + <form id="form4" action="formtest.js"> + <input type="text" name="uname"> + <input type="password" name="pword"> + <input type="text" name="qword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- uname is not a type=text input (try a checkbox just for variety) --> + <form id="form5" action="formtest.js"> + <input type="checkbox" name="uname" value=""> + <input type="password" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- pword is not a type=password input (try a checkbox just for variety) --> + <form id="form6" action="formtest.js"> + <input type="text" name="uname"> + <input type="checkbox" name="pword" value=""> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form> + + <!-- pword is not a type=password input --> + <form id="form7" action="formtest.js"> + <input type="text" name="uname" value="testuser"> + <input type="text" name="pword"> + + <button type="submit">Submit</button> + <button type="reset"> Reset </button> + </form>`, win, 4); + + await checkLoginFormInFrameWithElementValues(win, 1, "", ""); + await checkLoginFormInFrameWithElementValues(win, 2, "testpass", ""); + await checkLoginFormInFrameWithElementValues(win, 3, "", "testuser", "testpass"); + await checkLoginFormInFrameWithElementValues(win, 4, "testuser", "testpass", ""); + await checkLoginFormInFrameWithElementValues(win, 5, "", "testpass"); + await checkLoginFormInFrameWithElementValues(win, 6, "", ""); + await checkLoginFormInFrameWithElementValues(win, 7, "testuser", ""); + + SimpleTest.finish(); +} +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_primary_password.html b/toolkit/components/passwordmgr/test/mochitest/test_primary_password.html new file mode 100644 index 0000000000..f8ffec57d0 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_primary_password.html @@ -0,0 +1,298 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test for primary password</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <script type="text/javascript" src="../../../prompts/test/prompt_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: primary password. + +<p id="display"></p> + +<div id="content" style="display: none"> +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> +"use strict"; + +// Force parent to not look for tab-modal prompts, as they're not used for auth prompts. +modalType = Ci.nsIPrompt.MODAL_TYPE_WINDOW; + +const exampleCom = "https://example.com/tests/toolkit/components/passwordmgr/test/mochitest/"; +const exampleOrg = "https://example.org/tests/toolkit/components/passwordmgr/test/mochitest/"; + +gTestDependsOnDeprecatedLogin = true; +const chromeScript = runChecksAfterCommonInit(); + +const win = window.open("about:blank"); +SimpleTest.registerCleanupFunction(() => win.close()); + +add_setup(async () => { + await addLoginsInParent( + ["https://example.com", "https://example.com", null, "user1", "pass1", "uname", "pword"], + ["https://example.org", "https://example.org", null, "user2", "pass2", "uname", "pword"] + ); + ok(await isLoggedIn(), "should be initially logged in (no PP)"); + enablePrimaryPassword(); + ok(!await isLoggedIn(), "should be logged out after setting PP"); +}); + +add_task(async function test_1() { + // Trigger a MP prompt via the API + const state = { + msg: "Please enter your Primary Password.", + title: "the title", + textValue: "", + passValue: "", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: true, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "passField", + defButton: "button0", + }; + const action = { + buttonClick: "ok", + passField: LoginTestUtils.primaryPassword.primaryPassword, + }; + const promptDone = handlePrompt(state, action); + + const logins = await LoginManager.getAllLogins(); + + await promptDone; + is(logins.length, 3, "expected number of logins"); + + ok(await isLoggedIn(), "should be logged in after MP prompt"); + logoutPrimaryPassword(); + ok(!await isLoggedIn(), "should be logged out"); +}); + +add_task(async function test_2() { + // Try again but click cancel. + const state = { + msg: "Please enter your Primary Password.", + title: "the title", + textValue: "", + passValue: "", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: true, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "passField", + defButton: "button0", + }; + const action = { + buttonClick: "cancel", + }; + const promptDone = handlePrompt(state, action); + + const logins = await LoginManager.getAllLogins().catch(() => {}); + await promptDone; + is(logins, undefined, "shouldn't have gotten logins"); + ok(!await isLoggedIn(), "should still be logged out"); +}); + +add_task(async function test_3() { + const state = { + msg: "Please enter your Primary Password.", + title: "the title", + textValue: "", + passValue: "", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: true, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "passField", + defButton: "button0", + }; + const action = { + buttonClick: "ok", + passField: LoginTestUtils.primaryPassword.primaryPassword, + }; + const promptDone = handlePrompt(state, action); + + const fillPromise = promiseFormsProcessed(); + + info("Load a single window to trigger a MP"); + await SimpleTest.promiseFocus(win, true); + win.location = exampleCom + "subtst_primary_pass.html"; + + await promptDone; + info("promptDone"); + await fillPromise; + info("filled"); + + // check contents of win fields + + await SpecialPowers.spawn(win, [], function() { + const u = this.content.document.getElementById("userfield"); + const p = this.content.document.getElementById("passfield"); + Assert.equal(u.value, "user1", "checking expected user to have been filled in"); + Assert.equal(p.value, "pass1", "checking expected pass to have been filled in"); + u.value = ""; + p.value = ""; + }); + + ok(await isLoggedIn(), "should be logged in"); + logoutPrimaryPassword(); + ok(!await isLoggedIn(), "should be logged out"); +}); + +add_task(async function test_4() { + const state = { + msg: "Please enter your Primary Password.", + title: "the title", + textValue: "", + passValue: "", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: true, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "passField", + defButton: "button0", + }; + let action = { + buttonClick: "none", + }; + const promptDone = handlePrompt(state, action); + + // first part of loading 2 MP-triggering windows + await SimpleTest.promiseFocus(win); + win.location = exampleOrg + "subtst_primary_pass.html"; + // The MP prompt is open but don't take any action yet. + await promptDone; + + // check contents of win fields + await SpecialPowers.spawn(win, [], function() { + const u = this.content.document.getElementById("userfield"); + const p = this.content.document.getElementById("passfield"); + Assert.equal(u.value, "", "checking expected empty user"); + Assert.equal(p.value, "", "checking expected empty pass"); + }); + + ok(!await isLoggedIn(), "should be logged out"); + + // XXX check that there's 1 MP window open + + // Load a second login form in an iframe + // This should detect that there's already a pending MP prompt, and not + // put up a second one. + + // Since the Primary Password prompt is open, we can't focus another tab + // to load the second form. Instead, we load the same form into an iframe. + const url = exampleOrg + "subtst_primary_pass.html"; + await SpecialPowers.spawn(win, [url], async function(urlF) { + const iframe = this.content.document.querySelector("iframe"); + const loadPromise = new Promise(resolve => { + iframe.addEventListener("load", function onload() { + resolve(); + }, { once: true }); + }); + // Use the same origin as the top level to ensure we would autofill + // if we could (we don't fill in cross-origin iframes). + iframe.src = urlF; + await loadPromise; + }); + + // We can't use promiseFormsProcessed* here, because _fillForm doesn't + // run if Primary Password is locked. + await new Promise(resolve => { + // Testing a negative, wait a little to give the login manager a chance to + // (incorrectly) fill in the form. Note, we cannot use setTimeout() + // here because the modal window suspends all window timers. Instead we + // must use a chrome script to use nsITimer directly. + const chromeURL = SimpleTest.getTestFileURL("chrome_timeout.js"); + const script = SpecialPowers.loadChromeScript(chromeURL); + script.addMessageListener("ready", _ => { + script.sendAsyncMessage("setTimeout", { delay: 500 }); + }); + script.addMessageListener("timeout", resolve); + }); + + // iframe should load without having triggered a MP prompt (because one + // is already waiting) + + // check contents of iframe fields + await SpecialPowers.spawn(win, [], function() { + const iframe = this.content.document.querySelector("iframe"); + const frameDoc = iframe.contentDocument; + const u = frameDoc.getElementById("userfield"); + const p = frameDoc.getElementById("passfield"); + Assert.equal(u.value, "", "checking expected empty user"); + Assert.equal(p.value, "", "checking expected empty pass"); + }); + + // XXX check that there's 1 MP window open + ok(!await isLoggedIn(), "should be logged out"); + + // Ok, now enter the MP. The MP prompt is already up. + const fillPromise = promiseFormsProcessed(2); + + // fill existing MP dialog with MP. + action = { + buttonClick: "ok", + passField: LoginTestUtils.primaryPassword.primaryPassword, + }; + await handlePrompt(state, action); + await fillPromise; + + // We shouldn't have to worry about win's load event racing with + // filling of the iframe's data. We notify observers synchronously, so + // the iframe's observer will process the iframe before win even finishes + // processing the form. + ok(await isLoggedIn(), "should be logged in"); + + // check contents of win fields + await SpecialPowers.spawn(win, [], function() { + const u = this.content.document.getElementById("userfield"); + const p = this.content.document.getElementById("passfield"); + Assert.equal(u.value, "user2", "checking expected user to have been filled in"); + Assert.equal(p.value, "pass2", "checking expected pass to have been filled in"); + + // clearing fields to not cause a submission when the next document is loaded + u.value = ""; + p.value = ""; + }); + + // check contents of iframe fields + await SpecialPowers.spawn(win, [], function() { + const iframe = this.content.document.querySelector("iframe"); + const frameDoc = iframe.contentDocument; + const u = frameDoc.getElementById("userfield"); + const p = frameDoc.getElementById("passfield"); + Assert.equal(u.value, "user2", "checking expected user to have been filled in"); + Assert.equal(p.value, "pass2", "checking expected pass to have been filled in"); + + // clearing fields to not cause a submission when the next document is loaded + u.value = ""; + p.value = ""; + }); +}); + +// XXX do a test5ABC with clicking cancel? + +SimpleTest.registerCleanupFunction(function finishTest() { + disablePrimaryPassword(); +}); + +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_prompt.html b/toolkit/components/passwordmgr/test/mochitest/test_prompt.html new file mode 100644 index 0000000000..115039c706 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_prompt.html @@ -0,0 +1,669 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test prompter.{prompt,asyncPromptPassword,asyncPromptUsernameAndPassword}</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <script type="text/javascript" src="../../../prompts/test/prompt_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<p id="display"></p> + +<div id="content" style="display: none"> +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> +var state, action; +var uname = { value: null }; +var pword = { value: null }; +var result = { value: null }; +var isOk; + +// Force parent to not look for tab-modal prompts, as they're not used for auth prompts. +modalType = Ci.nsIPrompt.MODAL_TYPE_WINDOW; + +let prompterParent = runInParent(() => { + const promptFac = Cc["@mozilla.org/passwordmanager/authpromptfactory;1"]. + getService(Ci.nsIPromptFactory); + + let chromeWin = Services.wm.getMostRecentWindow("navigator:browser"); + let prompter1 = promptFac.getPrompt(chromeWin, Ci.nsIAuthPrompt); + + addMessageListener("proxyPrompter", async function onMessage(msg) { + let rv = await prompter1[msg.methodName](...msg.args); + return { + rv, + // Send the args back to content so out/inout args can be checked. + args: msg.args, + }; + }); +}); + +let prompter1 = new PrompterProxy(prompterParent); + +const defaultTitle = "the title"; +const defaultMsg = "the message"; + +add_setup(async () => { + await addLoginsInParent( + ["http://example.com", null, "http://example.com", "", "examplepass", "", ""], + ["http://example2.com", null, "http://example2.com", "user1name", "user1pass", "", ""], + ["http://example2.com", null, "http://example2.com", "user2name", "user2pass", "", ""], + ["http://example2.com", null, "http://example2.com", "user3.name@host", "user3pass", "", ""], + ["http://example2.com", null, "http://example2.com", "100@beef", "user3pass", "", ""], + ["http://example2.com", null, "http://example2.com", "100%beef", "user3pass", "", ""] + ); +}); + +add_task(async function test_prompt_accept() { + state = { + msg: "the message", + title: "the title", + textValue: "abc", + passValue: "", + iconClass: "question-icon", + titleHidden: true, + textHidden: false, + passHidden: true, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + action = { + buttonClick: "ok", + textField: "xyz", + }; + promptDone = handlePrompt(state, action); + isOk = prompter1.prompt(defaultTitle, defaultMsg, "http://example.com", + Ci.nsIAuthPrompt.SAVE_PASSWORD_NEVER, "abc", result); + await promptDone; + + ok(isOk, "Checking dialog return value (accept)"); + is(result.value, "xyz", "Checking prompt() returned value"); +}); + +add_task(async function test_prompt_cancel() { + state = { + msg: "the message", + title: "the title", + textValue: "abc", + passValue: "", + iconClass: "question-icon", + titleHidden: true, + textHidden: false, + passHidden: true, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + action = { + buttonClick: "cancel", + }; + promptDone = handlePrompt(state, action); + isOk = prompter1.prompt(defaultTitle, defaultMsg, "http://example.com", + Ci.nsIAuthPrompt.SAVE_PASSWORD_NEVER, "abc", result); + await promptDone; + ok(!isOk, "Checking dialog return value (cancel)"); +}); + +add_task(async function test_promptPassword_defaultAccept() { + // Default password provided, existing logins are ignored. + state = { + msg: "the message", + title: "the title", + textValue: "", + passValue: "inputpw", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: true, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "passField", + defButton: "button0", + }; + action = { + buttonClick: "ok", + passField: "secret", + }; + pword.value = "inputpw"; + promptDone = handlePrompt(state, action); + isOk = await prompter1.asyncPromptPassword(defaultTitle, defaultMsg, "http://example.com", + Ci.nsIAuthPrompt.SAVE_PASSWORD_NEVER, pword); + await promptDone; + ok(isOk, "Checking dialog return value (accept)"); + is(pword.value, "secret", "Checking returned password"); +}); + +add_task(async function test_promptPassword_defaultCancel() { + // Default password provided, existing logins are ignored. + state = { + msg: "the message", + title: "the title", + textValue: "", + passValue: "inputpw", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: true, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "passField", + defButton: "button0", + }; + action = { + buttonClick: "cancel", + }; + pword.value = "inputpw"; + promptDone = handlePrompt(state, action); + isOk = await prompter1.asyncPromptPassword(defaultTitle, defaultMsg, "http://example.com", + Ci.nsIAuthPrompt.SAVE_PASSWORD_NEVER, pword); + await promptDone; + ok(!isOk, "Checking dialog return value (cancel)"); +}); + +add_task(async function test_promptPassword_emptyAccept() { + // No default password provided, realm does not match existing login. + state = { + msg: "the message", + title: "the title", + textValue: "", + passValue: "", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: true, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "passField", + defButton: "button0", + }; + action = { + buttonClick: "ok", + passField: "secret", + }; + pword.value = null; + promptDone = handlePrompt(state, action); + isOk = await prompter1.asyncPromptPassword(defaultTitle, defaultMsg, "http://nonexample.com", + Ci.nsIAuthPrompt.SAVE_PASSWORD_NEVER, pword); + await promptDone; + ok(isOk, "Checking dialog return value (accept)"); + is(pword.value, "secret", "Checking returned password"); +}); + +add_task(async function test_promptPassword_saved() { + // No default password provided, matching login is returned w/o prompting. + pword.value = null; + isOk = await prompter1.asyncPromptPassword(defaultTitle, defaultMsg, "http://example.com", + Ci.nsIAuthPrompt.SAVE_PASSWORD_NEVER, pword); + ok(isOk, "Checking dialog return value (accept)"); + is(pword.value, "examplepass", "Checking returned password"); +}); + +add_task(async function test_promptPassword_noMatchingPasswordForEmptyUN() { + // No default password provided, none of the logins from this host are + // password-only so the user is prompted. + state = { + msg: "the message", + title: "the title", + textValue: "", + passValue: "", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: true, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "passField", + defButton: "button0", + }; + action = { + buttonClick: "ok", + passField: "secret", + }; + pword.value = null; + promptDone = handlePrompt(state, action); + isOk = await prompter1.asyncPromptPassword(defaultTitle, defaultMsg, "http://example2.com", + Ci.nsIAuthPrompt.SAVE_PASSWORD_NEVER, pword); + await promptDone; + ok(isOk, "Checking dialog return value (accept)"); + is(pword.value, "secret", "Checking returned password"); +}); + +add_task(async function test_promptPassword_matchingPWForUN() { + // No default password provided, matching login is returned w/o prompting. + pword.value = null; + isOk = await prompter1.asyncPromptPassword(defaultTitle, defaultMsg, "http://user1name@example2.com", + Ci.nsIAuthPrompt.SAVE_PASSWORD_NEVER, pword); + ok(isOk, "Checking dialog return value (accept)"); + is(pword.value, "user1pass", "Checking returned password"); +}); + +add_task(async function test_promptPassword_matchingPWForUN2() { + // No default password provided, matching login is returned w/o prompting. + pword.value = null; + isOk = await prompter1.asyncPromptPassword(defaultTitle, defaultMsg, "http://user2name@example2.com", + Ci.nsIAuthPrompt.SAVE_PASSWORD_NEVER, pword); + ok(isOk, "Checking dialog return value (accept)"); + is(pword.value, "user2pass", "Checking returned password"); +}); + +add_task(async function test_promptPassword_matchingPWForUN3() { + // No default password provided, matching login is returned w/o prompting. + pword.value = null; + isOk = await prompter1.asyncPromptPassword(defaultTitle, defaultMsg, "http://user3%2Ename%40host@example2.com", + Ci.nsIAuthPrompt.SAVE_PASSWORD_NEVER, pword); + ok(isOk, "Checking dialog return value (accept)"); + is(pword.value, "user3pass", "Checking returned password"); +}); + +add_task(async function test_promptPassword_extraAt() { + // No default password provided, matching login is returned w/o prompting. + pword.value = null; + isOk = await prompter1.asyncPromptPassword(defaultTitle, defaultMsg, "http://100@beef@example2.com", + Ci.nsIAuthPrompt.SAVE_PASSWORD_NEVER, pword); + ok(isOk, "Checking dialog return value (accept)"); + is(pword.value, "user3pass", "Checking returned password"); +}); + +add_task(async function test_promptPassword_usernameEncoding() { + // No default password provided, matching login is returned w/o prompting. + pword.value = null; + isOk = await prompter1.asyncPromptPassword(defaultTitle, defaultMsg, "http://100%25beef@example2.com", + Ci.nsIAuthPrompt.SAVE_PASSWORD_NEVER, pword); + ok(isOk, "Checking dialog return value (accept)"); + is(pword.value, "user3pass", "Checking returned password"); + + // XXX test saving a password with Ci.nsIAuthPrompt.SAVE_PASSWORD_PERMANENTLY +}); + +add_task(async function test_promptPassword_realm() { + // We don't pre-fill or save for NS_GetAuthKey-generated realms, but we should still prompt + state = { + msg: "the message", + title: "the title", + textValue: "", + passValue: "", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: true, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "passField", + defButton: "button0", + }; + action = { + buttonClick: "ok", + passField: "fill2pass", + }; + pword.value = null; + promptDone = handlePrompt(state, action); + isOk = await prompter1.asyncPromptPassword(defaultTitle, defaultMsg, "example2.com:80 (somerealm)", + Ci.nsIAuthPrompt.SAVE_PASSWORD_NEVER, pword); + await promptDone; + ok(isOk, "Checking dialog return value (accept)"); + is(pword.value, "fill2pass", "Checking returned password"); +}); + +add_task(async function test_promptPassword_realm2() { + // We don't pre-fill or save for NS_GetAuthKey-generated realms, but we should still prompt + state = { + msg: "the message", + title: "the title", + textValue: "", + passValue: "", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: true, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "passField", + defButton: "button0", + }; + action = { + buttonClick: "ok", + passField: "fill2pass", + }; + pword.value = null; + promptDone = handlePrompt(state, action); + isOk = await prompter1.asyncPromptPassword(defaultTitle, defaultMsg, "example2.com:80 (somerealm)", + Ci.nsIAuthPrompt.SAVE_PASSWORD_PERMANENTLY, pword); + await promptDone; + ok(isOk, "Checking dialog return value (accept)"); + is(pword.value, "fill2pass", "Checking returned password"); +}); + +add_task(async function test_promptUsernameAndPassword_accept() { + state = { + msg: "the message", + title: "the title", + textValue: "inuser", + passValue: "inpass", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + action = { + buttonClick: "ok", + textField: "outuser", + passField: "outpass", + }; + uname.value = "inuser"; + pword.value = "inpass"; + promptDone = handlePrompt(state, action); + isOk = await prompter1.asyncPromptUsernameAndPassword(defaultTitle, defaultMsg, "http://nonexample.com", + Ci.nsIAuthPrompt.SAVE_PASSWORD_NEVER, uname, pword); + await promptDone; + ok(isOk, "Checking dialog return value (accept)"); + is(uname.value, "outuser", "Checking returned username"); + is(pword.value, "outpass", "Checking returned password"); +}); + +add_task(async function test_promptUsernameAndPassword_cancel() { + state = { + msg: "the message", + title: "the title", + textValue: "inuser", + passValue: "inpass", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + action = { + buttonClick: "cancel", + }; + uname.value = "inuser"; + pword.value = "inpass"; + promptDone = handlePrompt(state, action); + isOk = await prompter1.asyncPromptUsernameAndPassword(defaultTitle, defaultMsg, "http://nonexample.com", + Ci.nsIAuthPrompt.SAVE_PASSWORD_NEVER, uname, pword); + await promptDone; + ok(!isOk, "Checking dialog return value (cancel)"); +}); + +add_task(async function test_promptUsernameAndPassword_autofill() { + // test filling in existing password-only login + state = { + msg: "the message", + title: "the title", + textValue: "", + passValue: "examplepass", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + action = { + buttonClick: "ok", + }; + uname.value = null; + pword.value = null; + promptDone = handlePrompt(state, action); + isOk = await prompter1.asyncPromptUsernameAndPassword(defaultTitle, defaultMsg, "http://example.com", + Ci.nsIAuthPrompt.SAVE_PASSWORD_PERMANENTLY, uname, pword); + await promptDone; + ok(isOk, "Checking dialog return value (accept)"); + is(uname.value, "", "Checking returned username"); + is(pword.value, "examplepass", "Checking returned password"); +}); + +add_task(async function test_promptUsernameAndPassword_multipleExisting() { + // test filling in existing login (undetermined from multiple selection) + // user2name/user2pass would also be valid to fill here. + state = { + msg: "the message", + title: "the title", + textValue: "user1name", + passValue: "user1pass", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + action = { + buttonClick: "ok", + }; + uname.value = null; + pword.value = null; + promptDone = handlePrompt(state, action); + isOk = await prompter1.asyncPromptUsernameAndPassword(defaultTitle, defaultMsg, "http://example2.com", + Ci.nsIAuthPrompt.SAVE_PASSWORD_PERMANENTLY, uname, pword); + await promptDone; + ok(isOk, "Checking dialog return value (accept)"); + ok(uname.value == "user1name" || uname.value == "user2name", "Checking returned username"); + ok(pword.value == "user1pass" || uname.value == "user2pass", "Checking returned password"); +}); + +add_task(async function test_promptUsernameAndPassword_multipleExisting1() { + // test filling in existing login (user1 from multiple selection) + state = { + msg: "the message", + title: "the title", + textValue: "user1name", + passValue: "user1pass", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + action = { + buttonClick: "ok", + }; + uname.value = "user1name"; + pword.value = null; + promptDone = handlePrompt(state, action); + isOk = await prompter1.asyncPromptUsernameAndPassword(defaultTitle, defaultMsg, "http://example2.com", + Ci.nsIAuthPrompt.SAVE_PASSWORD_PERMANENTLY, uname, pword); + await promptDone; + ok(isOk, "Checking dialog return value (accept)"); + is(uname.value, "user1name", "Checking returned username"); + is(pword.value, "user1pass", "Checking returned password"); +}); + +add_task(async function test_promptUsernameAndPassword_multipleExisting2() { + // test filling in existing login (user2 from multiple selection) + state = { + msg: "the message", + title: "the title", + textValue: "user2name", + passValue: "user2pass", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + action = { + buttonClick: "ok", + }; + uname.value = "user2name"; + pword.value = null; + promptDone = handlePrompt(state, action); + isOk = await prompter1.asyncPromptUsernameAndPassword(defaultTitle, defaultMsg, "http://example2.com", + Ci.nsIAuthPrompt.SAVE_PASSWORD_PERMANENTLY, uname, pword); + await promptDone; + ok(isOk, "Checking dialog return value (accept)"); + is(uname.value, "user2name", "Checking returned username"); + is(pword.value, "user2pass", "Checking returned password"); +}); + +add_task(async function test_promptUsernameAndPassword_passwordChange() { + // test changing password + state = { + msg: "the message", + title: "the title", + textValue: "user2name", + passValue: "user2pass", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + action = { + buttonClick: "ok", + passField: "NEWuser2pass", + }; + uname.value = "user2name"; + pword.value = null; + promptDone = handlePrompt(state, action); + isOk = await prompter1.asyncPromptUsernameAndPassword(defaultTitle, defaultMsg, "http://example2.com", + Ci.nsIAuthPrompt.SAVE_PASSWORD_PERMANENTLY, uname, pword); + await promptDone; + ok(isOk, "Checking dialog return value (accept)"); + is(uname.value, "user2name", "Checking returned username"); + is(pword.value, "NEWuser2pass", "Checking returned password"); +}); + +add_task(async function test_promptUsernameAndPassword_changePasswordBack() { + // test changing password (back to original value) + state = { + msg: "the message", + title: "the title", + textValue: "user2name", + passValue: "NEWuser2pass", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + action = { + buttonClick: "ok", + passField: "user2pass", + }; + uname.value = "user2name"; + pword.value = null; + promptDone = handlePrompt(state, action); + isOk = await prompter1.asyncPromptUsernameAndPassword(defaultTitle, defaultMsg, "http://example2.com", + Ci.nsIAuthPrompt.SAVE_PASSWORD_PERMANENTLY, uname, pword); + await promptDone; + ok(isOk, "Checking dialog return value (accept)"); + is(uname.value, "user2name", "Checking returned username"); + is(pword.value, "user2pass", "Checking returned password"); +}); + +add_task(async function test_promptUsernameAndPassword_realm() { + // We don't pre-fill or save for NS_GetAuthKey-generated realms, but we should still prompt + state = { + msg: "the message", + title: "the title", + textValue: "", + passValue: "", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + action = { + buttonClick: "ok", + textField: "fill2user", + passField: "fill2pass", + }; + uname.value = null; + pword.value = null; + promptDone = handlePrompt(state, action); + isOk = await prompter1.asyncPromptUsernameAndPassword(defaultTitle, defaultMsg, "example2.com:80 (somerealm)", + Ci.nsIAuthPrompt.SAVE_PASSWORD_NEVER, uname, pword); + await promptDone; + ok(isOk, "Checking dialog return value (accept)"); + is(uname.value, "fill2user", "Checking returned username"); + is(pword.value, "fill2pass", "Checking returned password"); +}); + +add_task(async function test_promptUsernameAndPassword_realm2() { + // We don't pre-fill or save for NS_GetAuthKey-generated realms, but we should still prompt + state = { + msg: "the message", + title: "the title", + textValue: "", + passValue: "", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + action = { + buttonClick: "ok", + textField: "fill2user", + passField: "fill2pass", + }; + uname.value = null; + pword.value = null; + promptDone = handlePrompt(state, action); + isOk = await prompter1.asyncPromptUsernameAndPassword(defaultTitle, defaultMsg, "example2.com:80 (somerealm)", + Ci.nsIAuthPrompt.SAVE_PASSWORD_PERMANENTLY, uname, pword); + await promptDone; + ok(isOk, "Checking dialog return value (accept)"); + is(uname.value, "fill2user", "Checking returned username"); + is(pword.value, "fill2pass", "Checking returned password"); +}); + +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_prompt_async.html b/toolkit/components/passwordmgr/test/mochitest/test_prompt_async.html new file mode 100644 index 0000000000..d9934a3d28 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_prompt_async.html @@ -0,0 +1,621 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test for Async Auth Prompt</title> + <script type="text/javascript" src="/MochiKit/MochiKit.js"></script> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <script type="text/javascript" src="../../../prompts/test/prompt_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> + + <script class="testbody" type="text/javascript"> + const { NetUtil } = SpecialPowers.ChromeUtils.import( + "resource://gre/modules/NetUtil.jsm" + ); + const { TestUtils } = SpecialPowers.ChromeUtils.import( + "resource://testing-common/TestUtils.jsm" + ); + const EXAMPLE_COM = "http://example.com/tests/toolkit/components/passwordmgr/test/mochitest/"; + const EXAMPLE_ORG = "http://example.org/tests/toolkit/components/passwordmgr/test/mochitest/"; + let mozproxyOrigin; + + // Let prompt_common know what kind of modal type is enabled for auth prompts. + modalType = authPromptModalType; + + // These are magically defined on the window due to the iframe IDs + /* global iframe1, iframe2a, iframe2b */ + + /** + * Add a listener to add some logins to be autofilled in the HTTP/proxy auth. prompts later. + */ + let pwmgrParent = runInParent(() => { + Services.prefs.setIntPref("network.auth.subresource-http-auth-allow", 2); + Services.prefs.setIntPref("prompts.authentication_dialog_abuse_limit", -1); + + addMessageListener("initLogins", async function onMessage(msg) { + const loginsData = [ + [msg.mozproxyOrigin, "proxy_realm", "proxy_user", "proxy_pass"], + [msg.mozproxyOrigin, "proxy_realm2", "proxy_user2", "proxy_pass2"], + [msg.mozproxyOrigin, "proxy_realm3", "proxy_user3", "proxy_pass3"], + [msg.mozproxyOrigin, "proxy_realm4", "proxy_user4", "proxy_pass4"], + [msg.mozproxyOrigin, "proxy_realm5", "proxy_user5", "proxy_pass5"], + ["http://example.com", "mochirealm", "user1name", "user1pass"], + ["http://example.org", "mochirealm2", "user2name", "user2pass"], + ["http://example.com", "mochirealm3", "user3name", "user3pass"], + ["http://example.com", "mochirealm4", "user4name", "user4pass"], + ["http://example.com", "mochirealm5", "user5name", "user5pass"], + ["http://example.com", "mochirealm6", "user6name", "user6pass"] + ]; + const logins = loginsData.map(([host, realm, user, pass]) => { + const login = Cc["@mozilla.org/login-manager/loginInfo;1"].createInstance(Ci.nsILoginInfo); + login.init(host, null, realm, user, pass, "", ""); + return login + }) + await Services.logins.addLogins(logins); + }); + }); // end runInParent + + function promiseLoadedContentDoc(frame) { + return new Promise(resolve => { + frame.addEventListener("load", function onLoad(evt) { + resolve(SpecialPowers.wrap(frame).contentDocument); + }, { once: true }); + }); + } + + function promiseProxyErrorLoad(frame) { + return TestUtils.waitForCondition(async function checkForProxyConnectFailure() { + try { + return await SpecialPowers.spawn(frame, [], function() { + return this.content.document.documentURI.includes("proxyConnectFailure"); + }) + } catch (e) { + // The frame may not be ready for the 'spawn' task right after setting + // iframe.src, which will throw an exception when that happens. + // Since this test is testing error load, we can't wait until the iframe + // is 'loaded' either. So we simply catch the exception here and retry the task + // later since we are in the waitForCondition loop. + return false; + } + }, "Waiting for proxyConnectFailure documentURI"); + } + + /** + * Make a channel to get the ProxyInfo used by the test harness so that we + * can add logins for the correct proxy origin. + */ + add_task(async function setup_getProxyInfoForHarness() { + await new Promise(resolve => { + let resolveCallback = SpecialPowers.wrapCallbackObject({ + // eslint-disable-next-line mozilla/use-chromeutils-generateqi + QueryInterface(iid) { + const interfaces = [Ci.nsIProtocolProxyCallback, Ci.nsISupports]; + + if (!interfaces.some(v => iid.equals(v))) { + throw SpecialPowers.Cr.NS_ERROR_NO_INTERFACE; + } + return this; + }, + + onProxyAvailable(req, uri, pi, status) { + // Add logins using the proxy host and port used by the mochitest harness. + mozproxyOrigin = "moz-proxy://" + SpecialPowers.wrap(pi).host + ":" + + SpecialPowers.wrap(pi).port; + + pwmgrParent.sendQuery("initLogins", {mozproxyOrigin}).then(resolve) + }, + }); + + // Need to allow for arbitrary network servers defined in PAC instead of a hardcoded moz-proxy. + let channel = NetUtil.newChannel({ + uri: "http://example.com", + loadUsingSystemPrincipal: true, + }); + + let pps = SpecialPowers.Cc["@mozilla.org/network/protocol-proxy-service;1"] + .getService(); + + pps.asyncResolve(channel, 0, resolveCallback); + }); + }); + + add_task(async function test_proxyAuthThenTwoHTTPAuth() { + // Load through a single proxy with authentication required 3 different + // pages, first with one login, other two with their own different login. + // We expect to show just a single dialog for proxy authentication and + // then two dialogs to authenticate to login 1 and then login 2. + + let iframe1DocPromise = promiseLoadedContentDoc(iframe1); + let iframe2aDocPromise = promiseLoadedContentDoc(iframe2a); + let iframe2bDocPromise = promiseLoadedContentDoc(iframe2b); + + iframe1.src = EXAMPLE_COM + "authenticate.sjs?" + + "r=1&" + + "user=user1name&" + + "pass=user1pass&" + + "realm=mochirealm&" + + "proxy_user=proxy_user&" + + "proxy_pass=proxy_pass&" + + "proxy_realm=proxy_realm"; + iframe2a.src = EXAMPLE_ORG + "authenticate.sjs?" + + "r=2&" + + "user=user2name&" + + "pass=user2pass&" + + "realm=mochirealm2&" + + "proxy_user=proxy_user&" + + "proxy_pass=proxy_pass&" + + "proxy_realm=proxy_realm"; + iframe2b.src = EXAMPLE_ORG + "authenticate.sjs?" + + "r=3&" + + "user=user2name&" + + "pass=user2pass&" + + "realm=mochirealm2&" + + "proxy_user=proxy_user&" + + "proxy_pass=proxy_pass&" + + "proxy_realm=proxy_realm"; + + let state = { + msg: `The proxy ${mozproxyOrigin} is requesting a username and password. The site says: “proxy_realm”`, + title: "Authentication Required", + textValue: "proxy_user", + passValue: "proxy_pass", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + let action = { + buttonClick: "ok", + }; + await handlePrompt(state, action); + + // We don't know what order these prompts appear in so get both states and check them. + // We can't use Promise.all here since we can't start the 2nd timer in chromeScript.js until + // the first timer is done since the timer variable gets clobbered, plus we don't want + // different actions racing each other. + let promptStates = [ + await handlePromptWithoutChecks(action), + await handlePromptWithoutChecks(action), + ]; + + let expected1 = Object.assign({}, state, { + msg: "This site is asking you to sign in. Warning: Your login information will be shared with example.com, not the website you are currently visiting.", + textValue: "user1name", + passValue: "user1pass", + }); + + let expected2 = Object.assign({}, state, { + msg: "This site is asking you to sign in. Warning: Your login information will be shared with example.org, not the website you are currently visiting.", + textValue: "user2name", + passValue: "user2pass", + }); + + // The order isn't important. + let expectedPromptStates = [ + expected1, + expected2, + ]; + + is(promptStates.length, expectedPromptStates.length, + "Check we handled the right number of prompts"); + for (let promptState of promptStates) { + let expectedStateIndexForMessage = expectedPromptStates.findIndex(eps => { + return eps.msg == promptState.msg; + }); + isnot(expectedStateIndexForMessage, -1, "Check state message was found in expected array"); + let expectedPromptState = expectedPromptStates.splice(expectedStateIndexForMessage, 1)[0]; + checkPromptState(promptState, expectedPromptState); + } + + await iframe1DocPromise; + await iframe2aDocPromise; + await iframe2bDocPromise; + + await SpecialPowers.spawn(getIframeBrowsingContext(window, 0), [], function() { + let doc = this.content.document; + let authok1 = doc.getElementById("ok").textContent; + let proxyok1 = doc.getElementById("proxy").textContent; + Assert.equal(authok1, "PASS", "WWW Authorization OK, frame1"); + Assert.equal(proxyok1, "PASS", "Proxy Authorization OK, frame1"); + }); + + await SpecialPowers.spawn(getIframeBrowsingContext(window, 1), [], function() { + let doc = this.content.document; + let authok2a = doc.getElementById("ok").textContent; + let proxyok2a = doc.getElementById("proxy").textContent; + Assert.equal(authok2a, "PASS", "WWW Authorization OK, frame2a"); + Assert.equal(proxyok2a, "PASS", "Proxy Authorization OK, frame2a"); + }); + + await SpecialPowers.spawn(getIframeBrowsingContext(window, 2), [], function() { + let doc = this.content.document; + let authok2b = doc.getElementById("ok").textContent; + let proxyok2b = doc.getElementById("proxy").textContent; + Assert.equal(authok2b, "PASS", "WWW Authorization OK, frame2b"); + Assert.equal(proxyok2b, "PASS", "Proxy Authorization OK, frame2b"); + }); + }); + + add_task(async function test_threeSubframesWithSameProxyAndHTTPAuth() { + // Load an iframe with 3 subpages all requiring the same login through + // an authenticated proxy. We expect 2 dialogs, proxy authentication + // and web authentication. + + let iframe1DocPromise = promiseLoadedContentDoc(iframe1); + + iframe1.src = EXAMPLE_COM + "subtst_prompt_async.html"; + iframe2a.src = "about:blank"; + iframe2b.src = "about:blank"; + + let state = { + msg: `The proxy ${mozproxyOrigin} is requesting a username and password. The site says: “proxy_realm2”`, + title: "Authentication Required", + textValue: "proxy_user2", + passValue: "proxy_pass2", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + let action = { + buttonClick: "ok", + }; + await handlePrompt(state, action); + + Object.assign(state, { + msg: "This site is asking you to sign in. Warning: Your login information will be shared with example.com, not the website you are currently visiting.", + textValue: "user3name", + passValue: "user3pass", + }); + await handlePrompt(state, action); + + await iframe1DocPromise; + + function checkIframe(frameid) { + let doc = this.content.document; + let authok = doc.getElementById("ok").textContent; + let proxyok = doc.getElementById("proxy").textContent; + + Assert.equal(authok, "PASS", "WWW Authorization OK, " + frameid); + Assert.equal(proxyok, "PASS", "Proxy Authorization OK, " + frameid); + } + + let parentIFrameBC = SpecialPowers.wrap(window).windowGlobalChild + .browsingContext.children[0]; + + let childIFrame = SpecialPowers.unwrap(parentIFrameBC.children[0]); + await SpecialPowers.spawn(childIFrame, ["iframe1"], checkIframe); + childIFrame = SpecialPowers.unwrap(parentIFrameBC.children[1]); + await SpecialPowers.spawn(childIFrame, ["iframe2"], checkIframe); + childIFrame = SpecialPowers.unwrap(parentIFrameBC.children[2]); + await SpecialPowers.spawn(childIFrame, ["iframe3"], checkIframe); + }); + + add_task(async function test_oneFrameWithUnauthenticatedProxy() { + // Load in the iframe page through unauthenticated proxy + // and discard the proxy authentication. We expect to see + // unauthenticated page content and just a single dialog. + + iframe1.src = EXAMPLE_COM + "authenticate.sjs?" + + "user=user4name&" + + "pass=user4pass&" + + "realm=mochirealm4&" + + "proxy_user=proxy_user3&" + + "proxy_pass=proxy_pass3&" + + "proxy_realm=proxy_realm3"; + + let state = { + msg: `The proxy ${mozproxyOrigin} is requesting a username and password. The site says: “proxy_realm3”`, + title: "Authentication Required", + textValue: "proxy_user3", + passValue: "proxy_pass3", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + let action = { + buttonClick: "cancel", + }; + await handlePrompt(state, action); + + await promiseProxyErrorLoad(iframe1); + }); + + add_task(async function test_reloadReusingProxyAuthButCancellingHTTPAuth() { + // Reload the frame from previous step and pass the proxy authentication + // but cancel the WWW authentication. We should get the proxy=ok and WWW=fail + // content as a result. + let iframe1DocPromise = promiseLoadedContentDoc(iframe1); + + iframe1.src = EXAMPLE_COM + "authenticate.sjs?" + + "user=user4name&" + + "pass=user4pass&" + + "realm=mochirealm4&" + + "proxy_user=proxy_user3&" + + "proxy_pass=proxy_pass3&" + + "proxy_realm=proxy_realm3"; + + let state = { + msg: `The proxy ${mozproxyOrigin} is requesting a username and password. The site says: “proxy_realm3”`, + title: "Authentication Required", + textValue: "proxy_user3", + passValue: "proxy_pass3", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + let action = { + buttonClick: "ok", + }; + await handlePrompt(state, action); + + Object.assign(state, { + msg: "This site is asking you to sign in. Warning: Your login information will be shared with example.com, not the website you are currently visiting.", + textValue: "user4name", + passValue: "user4pass", + }); + action = { + buttonClick: "cancel", + }; + await handlePrompt(state, action); + + await iframe1DocPromise; + + await SpecialPowers.spawn(getIframeBrowsingContext(window, 0), [], function() { + let doc = this.content.document; + let authok1 = doc.getElementById("ok").textContent; + let proxyok1 = doc.getElementById("proxy").textContent; + + Assert.equal(authok1, "FAIL", "WWW Authorization FAILED, frame1"); + Assert.equal(proxyok1, "PASS", "Proxy Authorization OK, frame1"); + }); + }); + + add_task(async function test_hugePayloadCancelled() { + // Same as the previous two steps but let the server generate + // huge content load to check http channel is capable to handle + // case when auth dialog is canceled or accepted before unauthenticated + // content data is load from the server. (This would be better to + // implement using delay of server response). + iframe1.src = EXAMPLE_COM + "authenticate.sjs?" + + "user=user5name&" + + "pass=user5pass&" + + "realm=mochirealm5&" + + "proxy_user=proxy_user4&" + + "proxy_pass=proxy_pass4&" + + "proxy_realm=proxy_realm4&" + + "huge=1"; + + let state = { + msg: `The proxy ${mozproxyOrigin} is requesting a username and password. The site says: “proxy_realm4”`, + title: "Authentication Required", + textValue: "proxy_user4", + passValue: "proxy_pass4", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + let action = { + buttonClick: "cancel", + }; + await handlePrompt(state, action); + + await promiseProxyErrorLoad(iframe1); + }); + + add_task(async function test_hugeProxySuccessWWWFail() { + // Reload the frame from the previous step and let the proxy + // authentication pass but WWW fail. We expect two dialogs + // and an unauthenticated page content load. + + let iframe1DocPromise = promiseLoadedContentDoc(iframe1); + iframe1.src = EXAMPLE_COM + "authenticate.sjs?" + + "user=user5name&" + + "pass=user5pass&" + + "realm=mochirealm5&" + + "proxy_user=proxy_user4&" + + "proxy_pass=proxy_pass4&" + + "proxy_realm=proxy_realm4&" + + "huge=1"; + + let state = { + msg: `The proxy ${mozproxyOrigin} is requesting a username and password. The site says: “proxy_realm4”`, + title: "Authentication Required", + textValue: "proxy_user4", + passValue: "proxy_pass4", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + let action = { + buttonClick: "ok", + }; + await handlePrompt(state, action); + + Object.assign(state, { + msg: "This site is asking you to sign in. Warning: Your login information will be shared with example.com, not the website you are currently visiting.", + textValue: "user5name", + passValue: "user5pass", + }); + action = { + buttonClick: "cancel", + }; + await handlePrompt(state, action); + + await iframe1DocPromise; + + await SpecialPowers.spawn(getIframeBrowsingContext(window, 0), [], function() { + let doc = this.content.document; + let authok1 = doc.getElementById("ok").textContent; + let proxyok1 = doc.getElementById("proxy").textContent; + let footnote = doc.getElementById("footnote").textContent; + + Assert.equal(authok1, "FAIL", "WWW Authorization FAILED, frame1"); + Assert.equal(proxyok1, "PASS", "Proxy Authorization OK, frame1"); + Assert.equal(footnote, "This is a footnote after the huge content fill", + "Footnote present and loaded completely"); + }); + }); + + add_task(async function test_hugeProxySuccessWWWSuccess() { + // Reload again and let pass all authentication dialogs. + // Check we get the authenticated content not broken by + // the unauthenticated content. + + let iframe1DocPromise = promiseLoadedContentDoc(iframe1); + await SpecialPowers.spawn(iframe1, [], function() { + this.content.document.location.reload(); + }); + + let state = { + msg: "This site is asking you to sign in. Warning: Your login information will be shared with example.com, not the website you are currently visiting.", + title: "Authentication Required", + textValue: "user5name", + passValue: "user5pass", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + let action = { + buttonClick: "ok", + }; + await handlePrompt(state, action); + + await iframe1DocPromise; + + await SpecialPowers.spawn(getIframeBrowsingContext(window, 0), [], function() { + let doc = this.content.document; + let authok1 = doc.getElementById("ok").textContent; + let proxyok1 = doc.getElementById("proxy").textContent; + let footnote = doc.getElementById("footnote").textContent; + + Assert.equal(authok1, "PASS", "WWW Authorization OK, frame1"); + Assert.equal(proxyok1, "PASS", "Proxy Authorization OK, frame1"); + Assert.equal(footnote, "This is a footnote after the huge content fill", + "Footnote present and loaded completely"); + }); + }); + + add_task(async function test_cancelSome() { + // Check we process all challenges sent by server when + // user cancels prompts + let iframe1DocPromise = promiseLoadedContentDoc(iframe1); + iframe1.src = EXAMPLE_COM + "authenticate.sjs?" + + "user=user6name&" + + "pass=user6pass&" + + "realm=mochirealm6&" + + "proxy_user=proxy_user5&" + + "proxy_pass=proxy_pass5&" + + "proxy_realm=proxy_realm5&" + + "huge=1&" + + "multiple=3"; + + let state = { + msg: `The proxy ${mozproxyOrigin} is requesting a username and password. The site says: “proxy_realm5”`, + title: "Authentication Required", + textValue: "proxy_user5", + passValue: "proxy_pass5", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + let action = { + buttonClick: "cancel", + }; + await handlePrompt(state, action); + + action = { + buttonClick: "cancel", + }; + await handlePrompt(state, action); + + action = { + buttonClick: "ok", + }; + await handlePrompt(state, action); + + Object.assign(state, { + msg: "This site is asking you to sign in. Warning: Your login information will be shared with example.com, not the website you are currently visiting.", + textValue: "user6name", + passValue: "user6pass", + }); + + action = { + buttonClick: "cancel", + }; + await handlePrompt(state, action); + + action = { + buttonClick: "ok", + }; + await handlePrompt(state, action); + + await iframe1DocPromise; + await SpecialPowers.spawn(getIframeBrowsingContext(window, 0), [], function() { + let doc = this.content.document; + let authok1 = doc.getElementById("ok").textContent; + let proxyok1 = doc.getElementById("proxy").textContent; + let footnote = doc.getElementById("footnote").textContent; + + Assert.equal(authok1, "PASS", "WWW Authorization OK, frame1"); + Assert.equal(proxyok1, "PASS", "Proxy Authorization OK, frame1"); + Assert.equal(footnote, "This is a footnote after the huge content fill", + "Footnote present and loaded completely"); + }); + + }); + </script> +</head> +<body> + <iframe id="iframe1"></iframe> + <iframe id="iframe2a"></iframe> + <iframe id="iframe2b"></iframe> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_prompt_http.html b/toolkit/components/passwordmgr/test/mochitest/test_prompt_http.html new file mode 100644 index 0000000000..effe438d1c --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_prompt_http.html @@ -0,0 +1,319 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test HTTP auth prompts by loading authenticate.sjs</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <script type="text/javascript" src="../../../prompts/test/prompt_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<p id="display"></p> + +<div id="content" style="display: none"> + <iframe id="iframe"></iframe> +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> +var iframe = document.getElementById("iframe"); + +// Let prompt_common know what kind of modal type is enabled for auth prompts. +modalType = authPromptModalType; + +const AUTHENTICATE_PATH = new URL("authenticate.sjs", window.location.href).pathname; + +add_setup(async () => { + await addLoginsInParent( + ["http://mochi.test:8888", null, "mochitest", "mochiuser1", "mochipass1", "", ""], + ["http://mochi.test:8888", null, "mochitest2", "mochiuser2", "mochipass2", "", ""], + ["http://mochi.test:8888", null, "mochitest3", "mochiuser3", "mochipass3-old", "", ""], + // Logins to test scheme upgrades (allowed) and downgrades (disallowed) + ["http://example.com", null, "schemeUpgrade", "httpUser", "httpPass", "", ""], + ["https://example.com", null, "schemeDowngrade", "httpsUser", "httpsPass", "", ""], + // HTTP and HTTPS version of the same domain and realm but with different passwords. + ["http://example.org", null, "schemeUpgradeDedupe", "dedupeUser", "httpPass", "", ""], + ["https://example.org", null, "schemeUpgradeDedupe", "dedupeUser", "httpsPass", "", ""] + ); +}); + +add_task(async function test_iframe() { + let state = { + msg: "This site is asking you to sign in.", + title: "Authentication Required", + textValue: "mochiuser1", + passValue: "mochipass1", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + let action = { + buttonClick: "ok", + }; + promptDone = handlePrompt(state, action); + + // The following tests are driven by iframe loads + + var iframeLoaded = onloadPromiseFor("iframe"); + iframe.src = "authenticate.sjs?user=mochiuser1&pass=mochipass1"; + await promptDone; + await iframeLoaded; + await checkEchoedAuthInfo({user: "mochiuser1", pass: "mochipass1"}, + iframe); + + state = { + msg: "This site is asking you to sign in.", + title: "Authentication Required", + textValue: "mochiuser2", + passValue: "mochipass2", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + action = { + buttonClick: "ok", + }; + promptDone = handlePrompt(state, action); + // We've already authenticated to this host:port. For this next + // request, the existing auth should be sent, we'll get a 401 reply, + // and we should prompt for new auth. + iframeLoaded = onloadPromiseFor("iframe"); + iframe.src = "authenticate.sjs?user=mochiuser2&pass=mochipass2&realm=mochitest2"; + await promptDone; + await iframeLoaded; + await checkEchoedAuthInfo({user: "mochiuser2", pass: "mochipass2"}, + iframe); + + // Now make a load that requests the realm from test 1000. It was + // already provided there, so auth will *not* be prompted for -- the + // networking layer already knows it! + iframeLoaded = onloadPromiseFor("iframe"); + iframe.src = "authenticate.sjs?user=mochiuser1&pass=mochipass1"; + await iframeLoaded; + await checkEchoedAuthInfo({user: "mochiuser1", pass: "mochipass1"}, + iframe); + + // Same realm we've already authenticated to, but with a different + // expected password (to trigger an auth prompt, and change-password + // popup notification). + state = { + msg: "This site is asking you to sign in.", + title: "Authentication Required", + textValue: "mochiuser1", + passValue: "mochipass1", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + action = { + buttonClick: "ok", + passField: "mochipass1-new", + }; + promptDone = handlePrompt(state, action); + iframeLoaded = onloadPromiseFor("iframe"); + let promptShownPromise = promisePromptShown("passwordmgr-prompt-change"); + iframe.src = "authenticate.sjs?user=mochiuser1&pass=mochipass1-new"; + await promptDone; + await iframeLoaded; + await checkEchoedAuthInfo({user: "mochiuser1", pass: "mochipass1-new"}, + iframe); + await promptShownPromise; + + // Same as last test, but for a realm we haven't already authenticated + // to (but have an existing saved login for, so that we'll trigger + // a change-password popup notification. + state = { + msg: "This site is asking you to sign in.", + title: "Authentication Required", + textValue: "mochiuser3", + passValue: "mochipass3-old", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + action = { + buttonClick: "ok", + passField: "mochipass3-new", + }; + promptDone = handlePrompt(state, action); + iframeLoaded = onloadPromiseFor("iframe"); + promptShownPromise = promisePromptShown("passwordmgr-prompt-change"); + iframe.src = "authenticate.sjs?user=mochiuser3&pass=mochipass3-new&realm=mochitest3"; + await promptDone; + await iframeLoaded; + await checkEchoedAuthInfo({user: "mochiuser3", pass: "mochipass3-new"}, + iframe); + await promptShownPromise; + + // Housekeeping: Delete login4 to test the save prompt in the next test. + runInParent(() => { + var tmpLogin = Cc["@mozilla.org/login-manager/loginInfo;1"]. + createInstance(Ci.nsILoginInfo); + tmpLogin.init("http://mochi.test:8888", null, "mochitest3", + "mochiuser3", "mochipass3-old", "", ""); + Services.logins.removeLogin(tmpLogin); + + // Clear cached auth from this subtest, and avoid leaking due to bug 459620. + var authMgr = Cc["@mozilla.org/network/http-auth-manager;1"]. + getService(Ci.nsIHttpAuthManager); + authMgr.clearAll(); + }); + + state = { + msg: "This site is asking you to sign in.", + title: "Authentication Required", + textValue: "", + passValue: "", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + action = { + buttonClick: "ok", + textField: "mochiuser3", + passField: "mochipass3-old", + }; + // Trigger a new prompt, so we can test adding a new login. + promptDone = handlePrompt(state, action); + + iframeLoaded = onloadPromiseFor("iframe"); + promptShownPromise = promisePromptShown("passwordmgr-prompt-save"); + iframe.src = "authenticate.sjs?user=mochiuser3&pass=mochipass3-old&realm=mochitest3"; + await promptDone; + await iframeLoaded; + await checkEchoedAuthInfo({user: "mochiuser3", pass: "mochipass3-old"}, + iframe); + await promptShownPromise; +}); + +add_task(async function test_schemeUpgrade() { + let state = { + msg: "This site is asking you to sign in. Warning: Your login information " + + "will be shared with example.com, not the website you are currently visiting.", + title: "Authentication Required", + textValue: "httpUser", + passValue: "httpPass", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + let action = { + buttonClick: "ok", + }; + let promptDone = handlePrompt(state, action); + + // The following tests are driven by iframe loads + + let iframeLoaded = onloadPromiseFor("iframe"); + iframe.src = "https://example.com" + AUTHENTICATE_PATH + + "?user=httpUser&pass=httpPass&realm=schemeUpgrade"; + await promptDone; + await iframeLoaded; + await checkEchoedAuthInfo({user: "httpUser", pass: "httpPass"}, + iframe); +}); + +add_task(async function test_schemeDowngrade() { + const state = { + msg: "This site is asking you to sign in. Warning: Your login information " + + "will be shared with example.com, not the website you are currently visiting.", + title: "Authentication Required", + textValue: "", // empty because we shouldn't downgrade + passValue: "", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + const action = { + buttonClick: "cancel", + }; + const promptDone = handlePrompt(state, action); + + // The following tests are driven by iframe loads + + const iframeLoaded = onloadPromiseFor("iframe"); + iframe.src = "http://example.com" + AUTHENTICATE_PATH + + "?user=unused&pass=unused&realm=schemeDowngrade"; + await promptDone; + await iframeLoaded; +}); + +add_task(async function test_schemeUpgrade_dedupe() { + const state = { + msg: "This site is asking you to sign in. Warning: Your login information " + + "will be shared with example.org, not the website you are currently visiting.", + title: "Authentication Required", + textValue: "dedupeUser", + passValue: "httpsPass", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + const action = { + buttonClick: "ok", + }; + const promptDone = handlePrompt(state, action); + + // The following tests are driven by iframe loads + + const iframeLoaded = onloadPromiseFor("iframe"); + iframe.src = "https://example.org" + AUTHENTICATE_PATH + + "?user=dedupeUser&pass=httpsPass&realm=schemeUpgradeDedupe"; + await promptDone; + await iframeLoaded; + await checkEchoedAuthInfo({user: "dedupeUser", pass: "httpsPass"}, + iframe); +}); +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_prompt_noWindow.html b/toolkit/components/passwordmgr/test/mochitest/test_prompt_noWindow.html new file mode 100644 index 0000000000..5b7584e4fa --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_prompt_noWindow.html @@ -0,0 +1,72 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test HTTP auth prompts by loading authenticate.sjs with no window</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <script type="text/javascript" src="../../../prompts/test/prompt_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<p id="display"></p> + +<div id="content" style="display: none"> +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> + +// Let prompt_common know what kind of modal type is enabled for auth prompts. +modalType = authPromptModalType; + +add_setup(async () => { + await addLoginsInParent( + ["http://mochi.test:8888", null, "mochitest", "mochiuser1", "mochipass1", "", ""] + ); +}); + +add_task(async function test_sandbox_xhr() { + const state = { + msg: "This site is asking you to sign in.", + title: "Authentication Required", + textValue: "mochiuser1", + passValue: "mochipass1", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + const action = { + buttonClick: "ok", + }; + const promptDone = handlePrompt(state, action); + + const url = new URL("authenticate.sjs?user=mochiuser1&pass=mochipass1", window.location.href); + const sandboxConstructor = SpecialPowers.Cu.Sandbox; + const sandbox = new sandboxConstructor(this, {wantXrays: true}); + function sandboxedRequest(sandboxedUrl) { + const req = new XMLHttpRequest(); + req.open("GET", sandboxedUrl, true); + req.send(null); + } + + const loginModifiedPromise = promiseStorageChanged(["modifyLogin"]); + sandbox.sandboxedRequest = sandboxedRequest(url); + info("send the XHR request in the sandbox"); + SpecialPowers.Cu.evalInSandbox("sandboxedRequest;", sandbox); + + await promptDone; + info("prompt shown, waiting for metadata updates"); + // Ensure the timeLastUsed and timesUsed metadata are updated. + await loginModifiedPromise; +}); +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_prompt_promptAuth.html b/toolkit/components/passwordmgr/test/mochitest/test_prompt_promptAuth.html new file mode 100644 index 0000000000..08cbedab88 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_prompt_promptAuth.html @@ -0,0 +1,370 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test promptAuth prompts</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <script type="text/javascript" src="../../../prompts/test/prompt_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<p id="display"></p> + +<div id="content" style="display: none"> +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> +const level = Ci.nsIAuthPrompt2.LEVEL_NONE; +const authinfo = { + username: "", + password: "", + domain: "", + + flags: Ci.nsIAuthInformation.AUTH_HOST, + authenticationScheme: "basic", + realm: "", +}; + +// Let prompt_common know what kind of modal type is enabled for auth prompts. +modalType = authPromptModalType; + +const prompterParent = runInParent(() => { + const promptFac = Cc["@mozilla.org/passwordmanager/authpromptfactory;1"]. + getService(Ci.nsIPromptFactory); + + const chromeWin = Services.wm.getMostRecentWindow("navigator:browser"); + const prompter2 = promptFac.getPrompt(chromeWin, Ci.nsIAuthPrompt2); + prompter2.QueryInterface(Ci.nsILoginManagerAuthPrompter).browser = chromeWin.gBrowser.selectedBrowser; + + const channels = {}; + channels.channel1 = Services.io.newChannel("http://example.com", + null, + null, + null, // aLoadingNode + Services. + scriptSecurityManager.getSystemPrincipal(), + null, // aTriggeringPrincipal + Ci.nsILoadInfo.SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL, + Ci.nsIContentPolicy.TYPE_OTHER); + + channels.channel2 = Services.io.newChannel("http://example2.com", + null, + null, + null, // aLoadingNode + Services. + scriptSecurityManager.getSystemPrincipal(), + null, // aTriggeringPrincipal + Ci.nsILoadInfo.SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL, + Ci.nsIContentPolicy.TYPE_OTHER); + + addMessageListener("proxyPrompter", function onMessage(msg) { + const args = [...msg.args]; + const channelName = args.shift(); + // Replace the channel name string (arg. 0) with the channel by that name. + args.unshift(channels[channelName]); + + const rv = prompter2[msg.methodName](...args); + return { + rv, + // Send the args back to content so out/inout args can be checked. + args: msg.args, + }; + }); +}); + +const prompter2 = new PrompterProxy(prompterParent); + +add_setup(async () => { + await addLoginsInParent( + ["http://example.com", null, "http://example.com", "", "examplepass", "", ""], + ["http://example2.com", null, "http://example2.com", "user1name", "user1pass", "", ""], + ["http://example2.com", null, "http://example2.com", "user2name", "user2pass", "", ""], + ["http://example2.com", null, "http://example2.com", "user3.name@host", "user3pass", "", ""], + ["http://example2.com", null, "http://example2.com", "100@beef", "user3pass", "", ""], + ["http://example2.com", null, "http://example2.com", "100%beef", "user3pass", "", ""] + ); +}); + +add_task(async function test_accept() { + const state = { + msg: "This site is asking you to sign in.", + title: "Authentication Required", + textValue: "inuser", + passValue: "inpass", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + const action = { + buttonClick: "ok", + textField: "outuser", + passField: "outpass", + }; + authinfo.username = "inuser"; + authinfo.password = "inpass"; + authinfo.realm = "some realm"; + + promptDone = handlePrompt(state, action); + // Since prompter2 is actually a proxy to send a message to a chrome script and + // we can't send a channel in a message, we instead send the channel name that + // already exists in the chromeScript. + const isOk = prompter2.promptAuth("channel1", level, authinfo); + await promptDone; + + ok(isOk, "Checking dialog return value (accept)"); + is(authinfo.username, "outuser", "Checking returned username"); + is(authinfo.password, "outpass", "Checking returned password"); +}); + +add_task(async function test_cancel() { + const state = { + msg: "This site is asking you to sign in.", + title: "Authentication Required", + textValue: "outuser", + passValue: "outpass", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + const action = { + buttonClick: "cancel", + }; + promptDone = handlePrompt(state, action); + const isOk = prompter2.promptAuth("channel1", level, authinfo); + await promptDone; + + ok(!isOk, "Checking dialog return value (cancel)"); +}); + +add_task(async function test_pwonly() { + // test filling in password-only login + const state = { + msg: "This site is asking you to sign in.", + title: "Authentication Required", + textValue: "", + passValue: "examplepass", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + const action = { + buttonClick: "ok", + }; + authinfo.username = ""; + authinfo.password = ""; + authinfo.realm = "http://example.com"; + + promptDone = handlePrompt(state, action); + const isOk = prompter2.promptAuth("channel1", level, authinfo); + await promptDone; + + ok(isOk, "Checking dialog return value (accept)"); + is(authinfo.username, "", "Checking returned username"); + is(authinfo.password, "examplepass", "Checking returned password"); +}); + +add_task(async function test_multipleExisting() { + // test filling in existing login (undetermined from multiple selection) + // user2name/user2pass would also be valid to fill here. + const state = { + msg: "This site is asking you to sign in.", + title: "Authentication Required", + textValue: "user1name", + passValue: "user1pass", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + const action = { + buttonClick: "ok", + }; + authinfo.username = ""; + authinfo.password = ""; + authinfo.realm = "http://example2.com"; + + promptDone = handlePrompt(state, action); + const isOk = prompter2.promptAuth("channel2", level, authinfo); + await promptDone; + + ok(isOk, "Checking dialog return value (accept)"); + ok(authinfo.username == "user1name" || authinfo.username == "user2name", "Checking returned username"); + ok(authinfo.password == "user1pass" || authinfo.password == "user2pass", "Checking returned password"); +}); + +add_task(async function test_multipleExisting2() { + // test filling in existing login (undetermined --> user1) + // user2name/user2pass would also be valid to fill here. + const state = { + msg: "This site is asking you to sign in.", + title: "Authentication Required", + textValue: "user1name", + passValue: "user1pass", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + // enter one of the known logins, test 504+505 exercise the two possible states. + const action = { + buttonClick: "ok", + textField: "user1name", + passField: "user1pass", + }; + authinfo.username = ""; + authinfo.password = ""; + authinfo.realm = "http://example2.com"; + + promptDone = handlePrompt(state, action); + const isOk = prompter2.promptAuth("channel2", level, authinfo); + await promptDone; + + ok(isOk, "Checking dialog return value (accept)"); + is(authinfo.username, "user1name", "Checking returned username"); + is(authinfo.password, "user1pass", "Checking returned password"); +}); + +add_task(async function test_multipleExisting3() { + // test filling in existing login (undetermined --> user2) + // user2name/user2pass would also be valid to fill here. + const state = { + msg: "This site is asking you to sign in.", + title: "Authentication Required", + textValue: "user1name", + passValue: "user1pass", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + // enter one of the known logins, test 504+505 exercise the two possible states. + const action = { + buttonClick: "ok", + textField: "user2name", + passField: "user2pass", + }; + authinfo.username = ""; + authinfo.password = ""; + authinfo.realm = "http://example2.com"; + + promptDone = handlePrompt(state, action); + const isOk = prompter2.promptAuth("channel2", level, authinfo); + await promptDone; + + ok(isOk, "Checking dialog return value (accept)"); + is(authinfo.username, "user2name", "Checking returned username"); + is(authinfo.password, "user2pass", "Checking returned password"); +}); + +add_task(async function test_changingMultiple() { + // test changing a password (undetermined --> user2 w/ newpass) + // user2name/user2pass would also be valid to fill here. + const state = { + msg: "This site is asking you to sign in.", + title: "Authentication Required", + textValue: "user1name", + passValue: "user1pass", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + // force to user2, and change the password + const action = { + buttonClick: "ok", + textField: "user2name", + passField: "NEWuser2pass", + }; + authinfo.username = ""; + authinfo.password = ""; + authinfo.realm = "http://example2.com"; + + promptDone = handlePrompt(state, action); + const isOk = prompter2.promptAuth("channel2", level, authinfo); + await promptDone; + + ok(isOk, "Checking dialog return value (accept)"); + is(authinfo.username, "user2name", "Checking returned username"); + is(authinfo.password, "NEWuser2pass", "Checking returned password"); +}); + +add_task(async function test_changingMultiple2() { + // test changing a password (undetermined --> user2 w/ origpass) + // user2name/user2pass would also be valid to fill here. + const state = { + msg: "This site is asking you to sign in.", + title: "Authentication Required", + textValue: "user1name", + passValue: "user1pass", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + // force to user2, and change the password back + const action = { + buttonClick: "ok", + textField: "user2name", + passField: "user2pass", + }; + authinfo.username = ""; + authinfo.password = ""; + authinfo.realm = "http://example2.com"; + + promptDone = handlePrompt(state, action); + const isOk = prompter2.promptAuth("channel2", level, authinfo); + await promptDone; + + ok(isOk, "Checking dialog return value (accept)"); + is(authinfo.username, "user2name", "Checking returned username"); + is(authinfo.password, "user2pass", "Checking returned password"); +}); +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_prompt_promptAuth_proxy.html b/toolkit/components/passwordmgr/test/mochitest/test_prompt_promptAuth_proxy.html new file mode 100644 index 0000000000..a7cec2d0b9 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_prompt_promptAuth_proxy.html @@ -0,0 +1,269 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test promptAuth proxy prompts</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <script type="text/javascript" src="../../../prompts/test/prompt_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<p id="display"></p> + +<div id="content" style="display: none"> + <iframe id="iframe"></iframe> +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> +/* eslint-disable mozilla/use-chromeutils-generateqi */ + +const LEVEL = Ci.nsIAuthPrompt2.LEVEL_NONE; + +let proxyAuthinfo = { + username: "", + password: "", + domain: "", + + flags: Ci.nsIAuthInformation.AUTH_PROXY, + authenticationScheme: "basic", + realm: "", +}; + +// Let prompt_common know what kind of modal type is enabled for auth prompts. +modalType = authPromptModalType; + +let chromeScript = runInParent(() => { + const promptFac = Cc[ + "@mozilla.org/passwordmanager/authpromptfactory;1" + ].getService(Ci.nsIPromptFactory); + + let systemPrincipal = Services.scriptSecurityManager.getSystemPrincipal(); + + let chromeWin = Services.wm.getMostRecentWindow("navigator:browser"); + let prompter2 = promptFac.getPrompt(chromeWin, Ci.nsIAuthPrompt2); + prompter2.QueryInterface(Ci.nsILoginManagerAuthPrompter).browser = + chromeWin.gBrowser.selectedBrowser; + + let mozproxyURL; + let proxyChannel; + + addMessageListener("init", () => init()); + + addMessageListener("proxyPrompter", function onMessage(msg) { + let args = [...msg.args]; + + args[0] = proxyChannel; + let rv = prompter2[msg.methodName](...args); + return { + rv, + // Send the args back to content so out/inout args can be checked. + args: msg.args, + }; + }); + + addMessageListener("getTimeLastUsed", () => { + let logins = Services.logins.findLogins(mozproxyURL, null, "Proxy Realm"); + return logins[0].QueryInterface(Ci.nsILoginMetaInfo).timeLastUsed; + }); + + function init() { + // Need to allow for arbitrary network servers defined in PAC instead of a hardcoded moz-proxy. + let pps = Cc["@mozilla.org/network/protocol-proxy-service;1"].getService(); + + let channel = Services.io.newChannel( + "http://example.com", + null, + null, + null, // aLoadingNode + systemPrincipal, + null, // aTriggeringPrincipal + Ci.nsILoadInfo.SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL, + Ci.nsIContentPolicy.TYPE_OTHER + ); + pps.asyncResolve(channel, 0, resolveCallback); + } + + class ProxyChannelListener { + onStartRequest(request) { + sendAsyncMessage("initDone"); + } + onStopRequest(request, status) {} + } + + async function initLogins(pi) { + mozproxyURL = `moz-proxy://${pi.host}:${pi.port}`; + + let proxyLogin = Cc["@mozilla.org/login-manager/loginInfo;1"].createInstance( + Ci.nsILoginInfo + ); + + proxyLogin.init( + mozproxyURL, + null, + "Proxy Realm", + "proxuser", + "proxpass", + "", + "" + ); + + await Services.logins.addLoginAsync(proxyLogin); + } + + let resolveCallback = { + QueryInterface(iid) { + const interfaces = [Ci.nsIProtocolProxyCallback, Ci.nsISupports]; + + if ( + !interfaces.some(function (v) { + return iid.equals(v); + }) + ) { + throw Components.Exception("", Cr.NS_ERROR_NO_INTERFACE); + } + return this; + }, + + async onProxyAvailable(req, uri, pi, status) { + await initLogins(pi); + + // I'm cheating a bit here... We should probably do some magic foo to get + // something implementing nsIProxiedProtocolHandler and then call + // NewProxiedChannel(), so we have something that's definately a proxied + // channel. But Mochitests use a proxy for a number of hosts, so just + // requesting a normal channel will give us a channel that's proxied. + // The proxyChannel needs to move to at least on-modify-request to + // have valid ProxyInfo, but we use OnStartRequest during startup() + // for simplicity. + proxyChannel = Services.io.newChannel( + "http://mochi.test:8888", + null, + null, + null, // aLoadingNode + systemPrincipal, + null, // aTriggeringPrincipal + Ci.nsILoadInfo.SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL, + Ci.nsIContentPolicy.TYPE_OTHER + ); + proxyChannel.asyncOpen(new ProxyChannelListener()); + }, + }; +}); + +let prompter2 = new PrompterProxy(chromeScript); + +add_setup(async () => { + let initComplete = new Promise((resolve) => + chromeScript.addMessageListener("initDone", resolve) + ); + chromeScript.sendAsyncMessage("init"); + info("Waiting for startup to complete..."); + await initComplete; +}); + +add_task(async function test_noAutologin() { + // test proxy login (default = no autologin), make sure it prompts. + let state = { + msg: + "The proxy moz-proxy://127.0.0.1:8888 is requesting a username and password. The site says: “Proxy Realm”", + title: "Authentication Required", + textValue: "proxuser", + passValue: "proxpass", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + let action = { + buttonClick: "ok", + }; + proxyAuthinfo.username = ""; + proxyAuthinfo.password = ""; + proxyAuthinfo.realm = "Proxy Realm"; + proxyAuthinfo.flags = Ci.nsIAuthInformation.AUTH_PROXY; + + let time1 = await chromeScript.sendQuery("getTimeLastUsed"); + promptDone = handlePrompt(state, action); + let isOk = prompter2.promptAuth(null, LEVEL, proxyAuthinfo); + await promptDone; + let time2 = await chromeScript.sendQuery("getTimeLastUsed"); + + ok(isOk, "Checking dialog return value (accept)"); + isnot(time1, time2, "Checking that timeLastUsed was updated"); + is(proxyAuthinfo.username, "proxuser", "Checking returned username"); + is(proxyAuthinfo.password, "proxpass", "Checking returned password"); +}); + +add_task(async function test_autologin() { + // test proxy login (with autologin) + + // Enable the autologin pref. + await SpecialPowers.pushPrefEnv({ + set: [["signon.autologin.proxy", true]], + }); + + proxyAuthinfo.username = ""; + proxyAuthinfo.password = ""; + proxyAuthinfo.realm = "Proxy Realm"; + proxyAuthinfo.flags = Ci.nsIAuthInformation.AUTH_PROXY; + + let time1 = await chromeScript.sendQuery("getTimeLastUsed"); + let isOk = prompter2.promptAuth(null, LEVEL, proxyAuthinfo); + let time2 = await chromeScript.sendQuery("getTimeLastUsed"); + + ok(isOk, "Checking dialog return value (accept)"); + isnot(time1, time2, "Checking that timeLastUsed was updated"); + is(proxyAuthinfo.username, "proxuser", "Checking returned username"); + is(proxyAuthinfo.password, "proxpass", "Checking returned password"); +}); + +add_task(async function test_autologin_incorrect() { + // test proxy login (with autologin), ensure it prompts after a failed auth. + let state = { + msg: + "The proxy moz-proxy://127.0.0.1:8888 is requesting a username and password. The site says: “Proxy Realm”", + title: "Authentication Required", + textValue: "proxuser", + passValue: "proxpass", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + let action = { + buttonClick: "ok", + }; + + proxyAuthinfo.username = ""; + proxyAuthinfo.password = ""; + proxyAuthinfo.realm = "Proxy Realm"; + proxyAuthinfo.flags = + Ci.nsIAuthInformation.AUTH_PROXY | Ci.nsIAuthInformation.PREVIOUS_FAILED; + + let time1 = await chromeScript.sendQuery("getTimeLastUsed"); + promptDone = handlePrompt(state, action); + let isOk = prompter2.promptAuth(null, LEVEL, proxyAuthinfo); + await promptDone; + let time2 = await chromeScript.sendQuery("getTimeLastUsed"); + + ok(isOk, "Checking dialog return value (accept)"); + isnot(time1, time2, "Checking that timeLastUsed was updated"); + is(proxyAuthinfo.username, "proxuser", "Checking returned username"); + is(proxyAuthinfo.password, "proxpass", "Checking returned password"); +}); +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_recipe_login_fields.html b/toolkit/components/passwordmgr/test/mochitest/test_recipe_login_fields.html new file mode 100644 index 0000000000..818a4e15bf --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_recipe_login_fields.html @@ -0,0 +1,212 @@ +<!DOCTYPE html> +<html> +<head> + <meta charset="utf-8"> + <title>Test for recipes overriding login fields</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="pwmgr_common.js"></script> + <link rel="stylesheet" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<script> +gTestDependsOnDeprecatedLogin = true; +var chromeScript = runChecksAfterCommonInit(); + +let fillPromiseResolvers = []; + +function waitForFills(fillCount) { + let promises = []; + while (fillCount--) { + let promise = new Promise(resolve => fillPromiseResolvers.push(resolve)); + promises.push(promise); + } + + return Promise.all(promises); +} + +add_setup(async () => { + // This test should run without any existing loaded recipes interfering. + await resetRecipes(); + + if (document.readyState !== "complete") { + await new Promise((resolve) => { + document.onreadystatechange = () => { + if (document.readyState !== "complete") { + return; + } + document.onreadystatechange = null; + resolve(); + }; + }); + } + + document.getElementById("content") + .addEventListener("input", function handleInputEvent(evt) { + let resolve = fillPromiseResolvers.shift(); + if (!resolve) { + ok(false, "Too many fills"); + return; + } + + resolve(evt.target); + }); +}); + +add_task(async function loadUsernamePasswordSelectorRecipes() { + await loadRecipes({ + siteRecipes: [{ + hosts: ["mochi.test:8888"], + usernameSelector: "input[name='uname1']", + passwordSelector: "input[name='pword2']", + }], + }); +}); + +add_task(async function testOverriddingFields() { + // Insert the form dynamically so autofill is triggered after setup above. + document.getElementById("content").innerHTML = ` + <!-- form with recipe for the username and password --> + <form id="form1"> + <input type="text" name="uname1" data-expected="true"> + <input type="text" name="uname2" data-expected="false"> + <input type="password" name="pword1" data-expected="false"> + <input type="password" name="pword2" data-expected="true"> + </form>`; + + let elements = await waitForFills(2); + for (let element of elements) { + is(element.dataset.expected, "true", `${element.name} was filled`); + } +}); + +add_task(async function testDefaultHeuristics() { + // Insert the form dynamically so autofill is triggered after setup above. + document.getElementById("content").innerHTML = ` + <!-- Fallback to the default heuristics since the selectors don't match --> + <form id="form2"> + <input type="text" name="uname3" data-expected="false"> + <input type="text" name="uname4" data-expected="true"> + <input type="password" name="pword3" data-expected="true"> + <input type="password" name="pword4" data-expected="false"> + </form>`; + + let elements = await waitForFills(2); + for (let element of elements) { + is(element.dataset.expected, "true", `${element.name} was filled`); + } +}); + +add_task(async function loadNotUsernameSelectorRecipes() { + await resetRecipes(); + await loadRecipes({ + siteRecipes: [{ + hosts: ["mochi.test:8888"], + notUsernameSelector: "input[name='not_uname1']", + }], + }); +}); + +add_task(async function testNotUsernameField() { + document.getElementById("content").innerHTML = ` + <!-- The field matching notUsernameSelector should be skipped --> + <form id="form3"> + <input type="text" name="uname5" data-expected="true"> + <input type="text" name="not_uname1" data-expected="false"> + <input type="password" name="pword5" data-expected="true"> + </form>`; + + let elements = await waitForFills(2); + for (let element of elements) { + is(element.dataset.expected, "true", `${element.name} was filled`); + } +}); + +add_task(async function testNotUsernameFieldNoUsername() { + document.getElementById("content").innerHTML = ` + <!-- The field matching notUsernameSelector should be skipped. + No username field should be found and filled in this case --> + <form id="form4"> + <input type="text" name="not_uname1" data-expected="false"> + <input type="password" name="pword6" data-expected="true"> + </form>`; + + let elements = await waitForFills(1); + for (let element of elements) { + is(element.dataset.expected, "true", `${element.name} was filled`); + } +}); + +add_task(async function loadNotPasswordSelectorRecipes() { + await resetRecipes(); + await loadRecipes({ + siteRecipes: [{ + hosts: ["mochi.test:8888"], + notPasswordSelector: "input[name='not_pword'], input[name='not_pword2']", + }], + }); +}); + +add_task(async function testNotPasswordField() { + document.getElementById("content").innerHTML = ` + <!-- The field matching notPasswordSelector should be skipped --> + <form id="form5"> + <input type="text" name="uname7" data-expected="true"> + <input type="password" name="not_pword" data-expected="false"> + <input type="password" name="pword7" data-expected="true"> + </form>`; + + let elements = await waitForFills(2); + for (let element of elements) { + is(element.dataset.expected, "true", `${element.name} was filled`); + } +}); + +add_task(async function testNotPasswordFieldNoPassword() { + document.getElementById("content").innerHTML = ` + <!-- The field matching notPasswordSelector should be skipped. + No username or password field should be found and filled in this case. + A dummy form7 is added after so we know when the login manager is done + considering filling form6. --> + <form id="form6"> + <input type="text" name="uname8" data-expected="false"> + <input type="password" name="not_pword" data-expected="false"> + </form> + <form id="form7"> + <input type="password" name="pword9" data-expected="true"> + </form>`; + + let elements = await waitForFills(1); + for (let element of elements) { + is(element.dataset.expected, "true", `${element.name} was filled`); + } +}); + +add_task(async function testNotPasswordField_tooManyToOkay() { + document.getElementById("content").innerHTML = ` + <!-- The field matching notPasswordSelector should be skipped so we won't + have too many pw fields to handle (3). --> + <form id="form8"> + <input type="text" name="uname9" data-expected="true"> + <input type="password" name="not_pword2" data-expected="false"> + <input type="password" name="not_pword" data-expected="false"> + <input type="password" name="pword10" data-expected="true"> + <input type="password" name="pword11" data-expected="false"> + <input type="password" name="pword12" data-expected="false"> + </form>`; + + let elements = await waitForFills(2); + for (let element of elements) { + is(element.dataset.expected, "true", `${element.name} was filled`); + } +}); + +</script> + +<p id="display"></p> + +<div id="content"> + // Forms are inserted dynamically +</div> +<pre id="test"></pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_submit_without_field_modifications.html b/toolkit/components/passwordmgr/test/mochitest/test_submit_without_field_modifications.html new file mode 100644 index 0000000000..db06561b9d --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_submit_without_field_modifications.html @@ -0,0 +1,313 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Don't send onFormSubmit message on navigation if the user did not interact + with the login fields</title> + <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<p id="display"></p> + +<div id="content"> + <iframe id="loginFrame"> + </iframe> +</div> + +<pre id="test"></pre> +<script> +const { TestUtils } = SpecialPowers.ChromeUtils.import( + "resource://testing-common/TestUtils.jsm" +); +SimpleTest.requestFlakyTimeout("Giving a chance for the unexpected popup to show"); + +const EXAMPLE_COM = window.location.origin + "/tests/toolkit/components/passwordmgr/test/mochitest/"; +const PREFILLED_FORM_URL = EXAMPLE_COM + "subtst_prefilled_form.html" + +let iframe = document.getElementById("loginFrame"); + +function waitForLoad() { + return new Promise(resolve => { + function handleLoad() { + iframe.removeEventListener("load", handleLoad); + resolve(); + } + iframe.addEventListener("load", handleLoad); + }); +} + +async function setupWithOneLogin(pageUrl) { + let origin = window.location.origin; + addLoginsInParent([origin, origin, null, "user1", "pass1"]); + + let chromeScript = runInParent(function testSetup() { + for (let l of Services.logins.getAllLogins()) { + info("Got login: " + l.username + ", " + l.password); + } + }); + + await setup(pageUrl); + return chromeScript; +} + +function resetSavedLogins() { + let chromeScript = runInParent(function testTeardown() { + Services.logins.removeAllUserFacingLogins(); + }); + chromeScript.destroy(); +} + +async function setup(pageUrl) { + let loadPromise = waitForLoad(); + let processedFormPromise = promiseFormsProcessed(); + iframe.src = pageUrl; + + await processedFormPromise; + info("initial form processed"); + await loadPromise; + await SpecialPowers.spawn(getIframeBrowsingContext(window), [], function() { + let doc = this.content.document; + let link = doc.createElement("a"); + link.setAttribute("href", "http://mochi.test:8888"); + doc.body.appendChild(link); + }); +} + +async function navigateWithoutUserInteraction() { + let loadPromise = waitForLoad(); + await SpecialPowers.spawn(getIframeBrowsingContext(window), [], function() { + let doc = this.content.document; + let hadInteracted = doc.userHasInteracted; + let target = doc.querySelector("a[href]"); + if (target) { + target.click(); + } else { + target = doc.querySelector("form"); + target.submit(); + } + is(doc.userHasInteracted, hadInteracted, "document.userHasInteracted shouldn't have changed"); + }); + await loadPromise; +} + +async function userInput(selector, value) { + await SpecialPowers.spawn(getIframeBrowsingContext(window), [selector, value], async function(sel, val) { + // use "real" synthesized events rather than setUserInput to ensure + // document.userHasInteracted is flipped true + let EventUtils = ContentTaskUtils.getEventUtils(content); + let target = this.content.document.querySelector(sel); + target.focus(); + target.select(); + await EventUtils.synthesizeKey("KEY_Backspace", {}, this.content); + await EventUtils.sendString(val, this.content); + info( + `userInput: new target.value: ${target.value}` + ); + target.blur(); + return Promise.resolve(); + }); +} + +function checkDocumentUserHasInteracted() { + return SpecialPowers.spawn(getIframeBrowsingContext(window), [], function() { + return this.content.document.userHasInteracted; + }); +} + +add_task(async function test_init() { + // For this test, we'll be testing with & without user document interaction. + // So we'll reset the pref which dictates the behavior of + // LoginFormState._formHasModifiedFields in automation + // and ensure all interactions are properly emulated + ok(SpecialPowers.getBoolPref("signon.testOnlyUserHasInteractedByPrefValue"), "signon.testOnlyUserHasInteractedByPrefValue should default to true"); + info("test_init, flipping the signon.testOnlyUserHasInteractedByPrefValue pref"); + await SpecialPowers.pushPrefEnv({"set": [ + ["signon.testOnlyUserHasInteractedByPrefValue", false], + ]}); + SimpleTest.registerCleanupFunction(async function cleanup_pref() { + await SpecialPowers.popPrefEnv(); + }); + + await SimpleTest.promiseWaitForCondition(() => LoginHelper.testOnlyUserHasInteractedWithDocument === null); + is(LoginHelper.testOnlyUserHasInteractedWithDocument, null, + "LoginHelper.testOnlyUserHasInteractedWithDocument should be null for this set of tests"); +}); + +add_task(async function test_no_message_on_navigation() { + // If login field values were set by the website, we don't message to save the + // login values if the user did not interact with the fields before submiting. + await setup(PREFILLED_FORM_URL); + + let submitMessageSent = false; + getSubmitMessage().then(value => { + submitMessageSent = true; + }); + await navigateWithoutUserInteraction(); + + // allow time to pass before concluding no onFormSubmit message was sent + await new Promise(res => setTimeout(res, 1000)); + ok(!submitMessageSent, "onFormSubmit message is not sent on navigation since the login fields were not modified"); +}); + +add_task(async function test_prefd_off_message_on_navigation() { + // Confirm the pref controls capture behavior with non-user-set field values. + await SpecialPowers.pushPrefEnv({"set": [ + ["signon.userInputRequiredToCapture.enabled", false], + ]}); + await setup(PREFILLED_FORM_URL); + + let promiseSubmitMessage = getSubmitMessage(); + await navigateWithoutUserInteraction(); + await promiseSubmitMessage; + info("onFormSubmit message was sent as expected after navigation"); + + SpecialPowers.popPrefEnv(); +}); + +add_task(async function test_message_with_user_interaction_on_navigation() { + await setup(PREFILLED_FORM_URL); + await userInput("#form-basic-username", "foo"); + + let promiseSubmitMessage = getSubmitMessage(); + await navigateWithoutUserInteraction(); + await promiseSubmitMessage; + info("onFormSubmit message was sent as expected after user interaction"); +}); + +add_task(async function test_empty_form_with_input_handler() { + await setup(EXAMPLE_COM + "formless_basic.html"); + await userInput("#form-basic-username", "user"); + await userInput("#form-basic-password", "pass"); + + let promiseSubmitMessage = getSubmitMessage(); + await navigateWithoutUserInteraction(); + await promiseSubmitMessage; + info("onFormSubmit message was sent as expected after user interaction"); +}); + +add_task(async function test_no_message_on_autofill_without_user_interaction() { + let chromeScript = await setupWithOneLogin(EXAMPLE_COM + "form_basic.html"); + // Check for autofilled values. + await checkLoginFormInFrame(getIframeBrowsingContext(window, 0), + "form-basic-username", "user1", + "form-basic-password", "pass1"); + + info("LoginHelper.testOnlyUserHasInteractedWithDocument:" + + LoginHelper.testOnlyUserHasInteractedWithDocument + ); + ok(!(await checkDocumentUserHasInteracted()), "document.userHasInteracted should be initially false"); + let submitMessageSent = false; + getSubmitMessage().then(value => { + submitMessageSent = true; + }); + info("Navigating the page") + await navigateWithoutUserInteraction(); + + // allow time to pass before concluding no onFormSubmit message was sent + await new Promise(res => setTimeout(res, 1000)); + + chromeScript.destroy(); + resetSavedLogins(); + + ok(!submitMessageSent, "onFormSubmit message is not sent on navigation since the document had no user interaction"); +}); + +add_task(async function test_message_on_autofill_with_document_interaction() { + // We expect that as long as the form values !== their defaultValues, + // any document interaction allows the submit message to be sent + + let chromeScript = await setupWithOneLogin(EXAMPLE_COM + "form_basic.html"); + // Check for autofilled values. + await checkLoginFormInFrame(getIframeBrowsingContext(window, 0), + "form-basic-username", "user1", + "form-basic-password", "pass1"); + + let userInteracted = await checkDocumentUserHasInteracted(); + ok(!userInteracted, "document.userHasInteracted should be initially false"); + + await SpecialPowers.spawn(getIframeBrowsingContext(window), ["#form-basic-username"], async function(sel) { + // Click somewhere in the document to ensure document.userHasInteracted is flipped to true + let EventUtils = ContentTaskUtils.getEventUtils(content); + let target = this.content.document.querySelector(sel); + + await EventUtils.synthesizeMouseAtCenter(target, {}, this.content); + }); + + userInteracted = await checkDocumentUserHasInteracted(); + ok(userInteracted, "After synthesizeMouseAtCenter, document.userHasInteracted should be true"); + + let promiseSubmitMessage = getSubmitMessage(); + await navigateWithoutUserInteraction(); + + let { data } = await promiseSubmitMessage; + ok(data.autoFilledLoginGuid, "Message was sent with autoFilledLoginGuid"); + info("Message was sent as expected after document user interaction"); + + chromeScript.destroy(); + resetSavedLogins(); +}); + +add_task(async function test_message_on_autofill_with_user_interaction() { + // Editing a field value causes the submit message to be sent as + // there is both document interaction and field modification + let chromeScript = await setupWithOneLogin(EXAMPLE_COM + "form_basic.html"); + // Check for autofilled values. + await checkLoginFormInFrame(getIframeBrowsingContext(window, 0), + "form-basic-username", "user1", + "form-basic-password", "pass1"); + + userInput("#form-basic-username", "newuser"); + let promiseSubmitMessage = getSubmitMessage(); + await navigateWithoutUserInteraction(); + + let { data } = await promiseSubmitMessage; + ok(data.autoFilledLoginGuid, "Message was sent with autoFilledLoginGuid"); + is(data.usernameField.value, "newuser", "Message was sent with correct usernameField.value"); + info("Message was sent as expected after user form interaction"); + + chromeScript.destroy(); + resetSavedLogins(); +}); + +add_task(async function test_no_message_on_user_input_from_other_form() { + // ensure input into unrelated fields on the page don't change login form modified-ness + await setup(PREFILLED_FORM_URL); + + // Add a form which will not be submitted and an input associated with that form + await SpecialPowers.spawn(getIframeBrowsingContext(window), [], function() { + let doc = this.content.document; + let loginForm = doc.querySelector("form"); + let fragment = doc.createDocumentFragment(); + let otherForm = doc.createElement("form"); + otherForm.id ="otherForm"; + fragment.appendChild(otherForm); + + let alienField = doc.createElement("input"); + alienField.id = "alienField"; + alienField.type = "text"; // not a password field + alienField.setAttribute("form", "otherForm"); + // new field is child of the login, but a member of different non-login form via its .form property + loginForm.appendChild(alienField); + doc.body.appendChild(fragment); + }); + await userInput("#alienField", "something"); + + let submitMessageSent = false; + getSubmitMessage().then(data => { + info("submit mesage data: " + JSON.stringify(data)); + submitMessageSent = true; + }); + + info("submitting the form"); + await navigateWithoutUserInteraction(); + + // allow time to pass before concluding no onFormSubmit message was sent + await new Promise(res => setTimeout(res, 1000)); + ok(!submitMessageSent, "onFormSubmit message is not sent on navigation since no login fields were modified"); +}); + +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_username_focus.html b/toolkit/components/passwordmgr/test/mochitest/test_username_focus.html new file mode 100644 index 0000000000..510cb2e1f1 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_username_focus.html @@ -0,0 +1,166 @@ + +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test interaction between autocomplete and focus on username fields</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script src="/tests/SimpleTest/EventUtils.js"></script> + <script type="text/javascript" src="../../../satchel/test/satchel_common.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +<p id="display"></p> +<div id="content"></div> +<pre id="test"> +<script class="testbody" type="text/javascript"> +const action1 = "http://username-focus-1"; +const action2 = "http://username-focus-2"; + +add_setup(async () => { + await addLoginsInParent( + [location.origin, action1, null, "testuser1A", "testpass1A", "", ""], + [location.origin, action2, null, "testuser2A", "testpass2A", "", ""], + [location.origin, action2, null, "testuser2B", "testpass2B", "", ""] + ); +}); + +add_task(async function autofilled() { + const form = createLoginForm({ action: action1 }); + + info("Username and password already filled so don't show autocomplete"); + await noPopupBy(() => form.uname.focus()); + + form.submit.focus(); + form.uname.value = "testuser"; + info("Focus when we don't have an exact match"); + await popupBy(() => form.uname.focus()); +}); + +add_task(async function autofilled_prefilled_un() { + const form = createLoginForm({ + action: action1, + username: { + value: "testuser1A" + } + }); + + info("Username and password already filled so don't show autocomplete"); + await noPopupBy(() => form.uname.focus()); + + form.submit.focus(); + form.uname.value = "testuser"; + info("Focus when we don't have an exact match"); + await popupBy(() => form.uname.focus()); +}); + +add_task(async function autofilled_focused_dynamic() { + const form = createLoginForm({ + action: action1, + password: { + type: "not-yet-password" + } + }); + + info("Username and password will be filled while username focused"); + await noPopupBy(() => form.uname.focus()); + + info("triggering autofill"); + await noPopupBy(() => form.pword.type = "password"); + + const popupState = await getPopupState(); + is(popupState.open, false, "Check popup is closed"); + + form.submit.focus(); + form.pword.value = "test"; + info("Focus when we don't have an exact match"); + await popupBy(() => form.uname.focus()); +}); + +// Begin testing forms that have multiple saved logins + +add_task(async function multiple() { + const form = createLoginForm({ action: action2 }); + + info("Fields not filled due to multiple so autocomplete upon focus"); + await popupBy(() => form.uname.focus()); +}); + +add_task(async function multiple_dynamic() { + const form = createLoginForm({ + action: action2, + password: { + type: "not-yet-password" + } + }); + + info("Fields not filled but username is focused upon marking so open"); + await noPopupBy(() => form.uname.focus()); + + info("triggering _fillForm code"); + await popupBy(() => form.pword.type = "password"); +}); + +add_task(async function multiple_prefilled_un1() { + const form = createLoginForm({ + action: action2, + username: { + value: "testuser2A" + } + }); + + info("Username and password already filled so don't show autocomplete"); + await noPopupBy(() => form.uname.focus()); + + form.submit.focus(); + form.uname.value = "testuser"; + info("Focus when we don't have an exact match"); + await popupBy(() => form.uname.focus()); +}); + +add_task(async function multiple_prefilled_un2() { + const form = createLoginForm({ + action: action2, + username: { + value: "testuser2B" + } + }); + + info("Username and password already filled so don't show autocomplete"); + await noPopupBy(() => form.uname.focus()); + + form.submit.focus(); + form.uname.value = "testuser"; + info("Focus when we don't have an exact match"); + await popupBy(() => form.uname.focus()); +}); + +add_task(async function multiple_prefilled_focused_dynamic() { + const form = createLoginForm({ + action: action2, + username: { + value: "testuser2B" + }, + password: { + type: "not-yet-password" + } + }); + + info("Username and password will be filled while username focused"); + await noPopupBy(() => form.uname.focus()); + info("triggering autofill"); + await noPopupBy(() => form.pword.type = "password"); + + let popupState = await getPopupState(); + is(popupState.open, false, "Check popup is closed"); + + form.submit.focus(); + form.pword.value = "test"; + info("Focus when we don't have an exact match"); + await popupBy(() => form.uname.focus()); +}); +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_xhr.html b/toolkit/components/passwordmgr/test/mochitest/test_xhr.html new file mode 100644 index 0000000000..ac573d2b02 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_xhr.html @@ -0,0 +1,164 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title>Test for XHR prompts</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <script type="text/javascript" src="../../../prompts/test/prompt_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> +Login Manager test: XHR prompt +<p id="display"></p> + +<div id="content" style="display: none"> + <iframe id="iframe"></iframe> +</div> + +<pre id="test"> +<script class="testbody" type="text/javascript"> + +/** Test for Login Manager: XHR prompts. **/ +function makeRequest(uri) { + return new Promise((resolve, reject) => { + let request = new XMLHttpRequest(); + request.open("GET", uri, true); + request.addEventListener("loadend", function onLoadEnd() { + let result = xhrLoad(request.responseXML); + resolve(result); + }); + request.send(null); + }); +} + +function xhrLoad(xmlDoc) { + // The server echos back the user/pass it received. + var username = xmlDoc.getElementById("user").textContent; + var password = xmlDoc.getElementById("pass").textContent; + var authok = xmlDoc.getElementById("ok").textContent; + return {username, password, authok}; +} + +// Let prompt_common know what kind of modal type is enabled for auth prompts. +modalType = authPromptModalType; + +let prompterParent = runInParent(() => { + const promptFac = Cc["@mozilla.org/passwordmanager/authpromptfactory;1"]. + getService(Ci.nsIPromptFactory); + + let chromeWin = Services.wm.getMostRecentWindow("navigator:browser"); + let prompt = promptFac.getPrompt(chromeWin, Ci.nsIAuthPrompt); + + addMessageListener("proxyPrompter", function onMessage(msg) { + let rv = prompt[msg.methodName](...msg.args); + return { + rv, + // Send the args back to content so out/inout args can be checked. + args: msg.args, + }; + }); +}); + +let prompter1 = new PrompterProxy(prompterParent); + +add_setup(async () => { + await addLoginsInParent( + ["http://mochi.test:8888", null, "xhr", "xhruser1", "xhrpass1"], + ["http://mochi.test:8888", null, "xhr2", "xhruser2", "xhrpass2"] + ); +}); + +add_task(async function test1() { + let state = { + msg: "This site is asking you to sign in.", + title: "Authentication Required", + textValue: "xhruser1", + passValue: "xhrpass1", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + let action = { + buttonClick: "ok", + }; + let promptDone = handlePrompt(state, action); + let requestPromise = makeRequest("authenticate.sjs?user=xhruser1&pass=xhrpass1&realm=xhr"); + await promptDone; + let result = await requestPromise; + + is(result.authok, "PASS", "Checking for successful authentication"); + is(result.username, "xhruser1", "Checking for username"); + is(result.password, "xhrpass1", "Checking for password"); +}); + +add_task(async function test2() { + // Test correct parenting, by opening another tab in the foreground, + // and making sure the prompt re-focuses the original tab when shown: + let newWin = window.open(); + newWin.focus(); + + let state = { + msg: "This site is asking you to sign in.", + title: "Authentication Required", + textValue: "xhruser2", + passValue: "xhrpass2", + iconClass: "authentication-icon question-icon", + titleHidden: true, + textHidden: false, + passHidden: false, + checkHidden: true, + checkMsg: "", + checked: false, + focused: "textField", + defButton: "button0", + }; + + // For window prompts check that the dialog is modal, chrome and dependent; + // We can't just check window.opener because that'll be + // a content window, which therefore isn't exposed (it'll lie and + // be null). + if (authPromptModalType === SpecialPowers.Services.prompt.MODAL_TYPE_WINDOW) { + state.chrome = true; + state.dialog = true; + state.chromeDependent = true; + state.isWindowModal = true; + } + + let action = { + buttonClick: "ok", + }; + let promptDone = handlePrompt(state, action); + let requestPromise = makeRequest("authenticate.sjs?user=xhruser2&pass=xhrpass2&realm=xhr2"); + await promptDone; + let result = await requestPromise; + + runInParent(() => { + // Check that the right tab is focused: + let browserWin = Services.wm.getMostRecentWindow("navigator:browser"); + let spec = browserWin.gBrowser.selectedBrowser.currentURI.spec; + assert.ok(spec.startsWith(window.location.origin), + `Tab with remote URI (rather than about:blank) + should be focused (${spec})`); + }); + + is(result.authok, "PASS", "Checking for successful authentication"); + is(result.username, "xhruser2", "Checking for username"); + is(result.password, "xhrpass2", "Checking for password"); + + // Wait for the assert from the parent script to run and send back its reply, + // so it's processed before the test ends. + await SpecialPowers.executeAfterFlushingMessageQueue(); + + newWin.close(); +}); +</script> +</pre> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/mochitest/test_xhr_2.html b/toolkit/components/passwordmgr/test/mochitest/test_xhr_2.html new file mode 100644 index 0000000000..16d5e786e0 --- /dev/null +++ b/toolkit/components/passwordmgr/test/mochitest/test_xhr_2.html @@ -0,0 +1,56 @@ +<!DOCTYPE HTML> +<html> +<!-- +https://bugzilla.mozilla.org/show_bug.cgi?id=654348 +--> +<head> + <meta charset="utf-8"> + <title>Test XHR auth with user and pass arguments</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="text/javascript" src="pwmgr_common.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body onload="startTest()"> +<script class="testbody" type="text/javascript"> + +/** + * This test checks we correctly ignore authentication entry + * for a subpath and use creds from the URL when provided when XHR + * is used with filled user name and password. + * + * 1. connect authenticate.sjs that excepts user1:pass1 password + * 2. connect authenticate.sjs that this time expects differentuser2:pass2 password + * we must use the creds that are provided to the xhr witch are different and expected + */ + +function doxhr(URL, user, pass, code, next) { + var xhr = new XMLHttpRequest(); + if (user && pass) { + xhr.open("POST", URL, true, user, pass); + } else { + xhr.open("POST", URL, true); + } + xhr.onload = function() { + is(xhr.status, code, "expected response code " + code); + next(); + }; + xhr.onerror = function() { + ok(false, "request passed"); + finishTest(); + }; + xhr.send(); +} + +function startTest() { + doxhr("authenticate.sjs?user=dummy&pass=pass1&realm=realm1&formauth=1", "dummy", "dummy", 403, function() { + doxhr("authenticate.sjs?user=dummy&pass=pass1&realm=realm1&formauth=1", "dummy", "pass1", 200, finishTest); + }); +} + +function finishTest() { + SimpleTest.finish(); +} + +</script> +</body> +</html> diff --git a/toolkit/components/passwordmgr/test/unit/data/corruptDB.sqlite b/toolkit/components/passwordmgr/test/unit/data/corruptDB.sqlite Binary files differnew file mode 100644 index 0000000000..b234246cac --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/data/corruptDB.sqlite diff --git a/toolkit/components/passwordmgr/test/unit/data/key4.db b/toolkit/components/passwordmgr/test/unit/data/key4.db Binary files differnew file mode 100644 index 0000000000..b75a14aa8e --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/data/key4.db diff --git a/toolkit/components/passwordmgr/test/unit/data/signons-v1.sqlite b/toolkit/components/passwordmgr/test/unit/data/signons-v1.sqlite Binary files differnew file mode 100644 index 0000000000..fe030b61fd --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/data/signons-v1.sqlite diff --git a/toolkit/components/passwordmgr/test/unit/data/signons-v1v2.sqlite b/toolkit/components/passwordmgr/test/unit/data/signons-v1v2.sqlite Binary files differnew file mode 100644 index 0000000000..729512a12b --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/data/signons-v1v2.sqlite diff --git a/toolkit/components/passwordmgr/test/unit/data/signons-v2.sqlite b/toolkit/components/passwordmgr/test/unit/data/signons-v2.sqlite Binary files differnew file mode 100644 index 0000000000..a6c72b31e8 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/data/signons-v2.sqlite diff --git a/toolkit/components/passwordmgr/test/unit/data/signons-v2v3.sqlite b/toolkit/components/passwordmgr/test/unit/data/signons-v2v3.sqlite Binary files differnew file mode 100644 index 0000000000..359df5d311 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/data/signons-v2v3.sqlite diff --git a/toolkit/components/passwordmgr/test/unit/data/signons-v3.sqlite b/toolkit/components/passwordmgr/test/unit/data/signons-v3.sqlite Binary files differnew file mode 100644 index 0000000000..918f4142fe --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/data/signons-v3.sqlite diff --git a/toolkit/components/passwordmgr/test/unit/data/signons-v3v4.sqlite b/toolkit/components/passwordmgr/test/unit/data/signons-v3v4.sqlite Binary files differnew file mode 100644 index 0000000000..e06c33aae3 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/data/signons-v3v4.sqlite diff --git a/toolkit/components/passwordmgr/test/unit/data/signons-v4.sqlite b/toolkit/components/passwordmgr/test/unit/data/signons-v4.sqlite Binary files differnew file mode 100644 index 0000000000..227c09c816 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/data/signons-v4.sqlite diff --git a/toolkit/components/passwordmgr/test/unit/data/signons-v4v5.sqlite b/toolkit/components/passwordmgr/test/unit/data/signons-v4v5.sqlite Binary files differnew file mode 100644 index 0000000000..4534cf2553 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/data/signons-v4v5.sqlite diff --git a/toolkit/components/passwordmgr/test/unit/data/signons-v5v6.sqlite b/toolkit/components/passwordmgr/test/unit/data/signons-v5v6.sqlite Binary files differnew file mode 100644 index 0000000000..eb4ee6d01e --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/data/signons-v5v6.sqlite diff --git a/toolkit/components/passwordmgr/test/unit/data/signons-v999-2.sqlite b/toolkit/components/passwordmgr/test/unit/data/signons-v999-2.sqlite Binary files differnew file mode 100644 index 0000000000..e09c4f7100 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/data/signons-v999-2.sqlite diff --git a/toolkit/components/passwordmgr/test/unit/data/signons-v999.sqlite b/toolkit/components/passwordmgr/test/unit/data/signons-v999.sqlite Binary files differnew file mode 100644 index 0000000000..0328a1a02a --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/data/signons-v999.sqlite diff --git a/toolkit/components/passwordmgr/test/unit/head.js b/toolkit/components/passwordmgr/test/unit/head.js new file mode 100644 index 0000000000..8c2dc53f66 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/head.js @@ -0,0 +1,134 @@ +/** + * Provides infrastructure for automated login components tests. + */ + +"use strict"; + +// Globals + +const { AppConstants } = ChromeUtils.importESModule( + "resource://gre/modules/AppConstants.sys.mjs" +); +const { XPCOMUtils } = ChromeUtils.importESModule( + "resource://gre/modules/XPCOMUtils.sys.mjs" +); +const { LoginRecipesContent, LoginRecipesParent } = ChromeUtils.importESModule( + "resource://gre/modules/LoginRecipes.sys.mjs" +); +const { LoginHelper } = ChromeUtils.importESModule( + "resource://gre/modules/LoginHelper.sys.mjs" +); +const { FileTestUtils } = ChromeUtils.importESModule( + "resource://testing-common/FileTestUtils.sys.mjs" +); +const { LoginTestUtils } = ChromeUtils.importESModule( + "resource://testing-common/LoginTestUtils.sys.mjs" +); +const { MockDocument } = ChromeUtils.importESModule( + "resource://testing-common/MockDocument.sys.mjs" +); + +const lazy = {}; + +ChromeUtils.defineESModuleGetters(this, { + DownloadPaths: "resource://gre/modules/DownloadPaths.sys.mjs", + FileUtils: "resource://gre/modules/FileUtils.sys.mjs", +}); + +const LoginInfo = Components.Constructor( + "@mozilla.org/login-manager/loginInfo;1", + "nsILoginInfo", + "init" +); + +const TestData = LoginTestUtils.testData; +const newPropertyBag = LoginHelper.newPropertyBag; + +const NEW_PASSWORD_HEURISTIC_ENABLED_PREF = + "signon.generation.confidenceThreshold"; +const RELATED_REALMS_ENABLED_PREF = "signon.relatedRealms.enabled"; +const IMPROVED_PASSWORD_RULES_PREF = "signon.improvedPasswordRules.enabled"; +/** + * All the tests are implemented with add_task, this starts them automatically. + */ +function run_test() { + do_get_profile(); + run_next_test(); +} + +// Global helpers + +/** + * Returns a reference to a temporary file that is guaranteed not to exist and + * is cleaned up later. See FileTestUtils.getTempFile for details. + */ +function getTempFile(leafName) { + return FileTestUtils.getTempFile(leafName); +} + +const RecipeHelpers = { + initNewParent() { + return new LoginRecipesParent({ defaults: null }).initializationPromise; + }, +}; + +// Initialization functions common to all tests + +add_setup(async function test_common_initialize() { + // Before initializing the service for the first time, we should copy the key + // file required to decrypt the logins contained in the SQLite databases used + // by migration tests. This file is not required for the other tests. + const keyDBName = "key4.db"; + await IOUtils.copy( + do_get_file(`data/${keyDBName}`).path, + PathUtils.join(PathUtils.profileDir, keyDBName) + ); + + // Ensure that the service and the storage module are initialized. + await Services.logins.initializationPromise; + Services.prefs.setBoolPref(RELATED_REALMS_ENABLED_PREF, true); + if (LoginHelper.relatedRealmsEnabled) { + // Ensure that there is a mocked Remote Settings database for the + // "websites-with-shared-credential-backends" collection + await LoginTestUtils.remoteSettings.setupWebsitesWithSharedCredentials(); + } +}); + +add_setup(async function test_common_prefs() { + Services.prefs.setStringPref(NEW_PASSWORD_HEURISTIC_ENABLED_PREF, "0.75"); +}); + +/** + * Compare two FormLike to see if they represent the same information. Elements + * are compared using their @id attribute. + */ +function formLikeEqual(a, b) { + Assert.strictEqual( + Object.keys(a).length, + Object.keys(b).length, + "Check the formLikes have the same number of properties" + ); + + for (let propName of Object.keys(a)) { + if (propName == "elements") { + Assert.strictEqual( + a.elements.length, + b.elements.length, + "Check element count" + ); + for (let i = 0; i < a.elements.length; i++) { + Assert.strictEqual( + a.elements[i].id, + b.elements[i].id, + "Check element " + i + " id" + ); + } + continue; + } + Assert.strictEqual( + a[propName], + b[propName], + "Compare formLike " + propName + " property" + ); + } +} diff --git a/toolkit/components/passwordmgr/test/unit/test_CSVParser.js b/toolkit/components/passwordmgr/test/unit/test_CSVParser.js new file mode 100644 index 0000000000..d680d8daf2 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_CSVParser.js @@ -0,0 +1,254 @@ +/* Any copyright is dedicated to the Public Domain. +http://creativecommons.org/publicdomain/zero/1.0/ */ + +"use strict"; + +const { CSV } = ChromeUtils.importESModule( + "resource://gre/modules/CSV.sys.mjs" +); + +const TEST_CASES = [ + { + description: + "string with fields with no special characters gets parsed correctly", + csvString: ` +url,username,password +https://example.com/,testusername,testpassword +`, + expectedHeaderLine: ["url", "username", "password"], + expectedParsedLines: [ + { + url: "https://example.com/", + username: "testusername", + password: "testpassword", + }, + ], + delimiter: ",", + throwsError: false, + }, + { + description: + "string with fields enclosed in quotes with no special characters gets parsed correctly", + csvString: ` +"url","username","password" +"https://example.com/","testusername","testpassword" +`, + expectedHeaderLine: ["url", "username", "password"], + expectedParsedLines: [ + { + url: "https://example.com/", + username: "testusername", + password: "testpassword", + }, + ], + delimiter: ",", + throwsError: false, + }, + { + description: "empty fields gets parsed correctly", + csvString: ` +"url","username","password" +"https://example.com/","","" +`, + expectedHeaderLine: ["url", "username", "password"], + expectedParsedLines: [ + { + url: "https://example.com/", + username: "", + password: "", + }, + ], + delimiter: ",", + throwsError: false, + }, + { + description: "string with commas in fields gets parsed correctly", + csvString: ` +url,username,password +https://example.com/,"test,usern,ame","tes,,tpassword" +`, + expectedHeaderLine: ["url", "username", "password"], + expectedParsedLines: [ + { + url: "https://example.com/", + username: "test,usern,ame", + password: "tes,,tpassword", + }, + ], + delimiter: ",", + throwsError: false, + }, + { + description: "string with line break in fields gets parsed correctly", + csvString: ` +url,username,password +https://example.com/,"test\nusername","\ntestpass\n\nword" +`, + expectedHeaderLine: ["url", "username", "password"], + expectedParsedLines: [ + { + url: "https://example.com/", + username: "test\nusername", + password: "\ntestpass\n\nword", + }, + ], + delimiter: ",", + throwsError: false, + }, + { + description: "string with quotation mark in fields gets parsed correctly", + csvString: ` +url,username,password +https://example.com/,"testusern""ame","test""""pass""word" +`, + expectedHeaderLine: ["url", "username", "password"], + expectedParsedLines: [ + { + url: "https://example.com/", + username: 'testusern"ame', + password: 'test""pass"word', + }, + ], + delimiter: ",", + throwsError: false, + }, + { + description: "tsv string with tab as delimiter gets parsed correctly", + csvString: ` +url\tusername\tpassword +https://example.com/\ttestusername\ttestpassword +`, + expectedHeaderLine: ["url", "username", "password"], + expectedParsedLines: [ + { + url: "https://example.com/", + username: "testusername", + password: "testpassword", + }, + ], + delimiter: "\t", + throwsError: false, + }, + { + description: "string with CR LF as line breaks gets parsed correctly", + csvString: + "url,username,password\r\nhttps://example.com/,testusername,testpassword\r\n", + expectedHeaderLine: ["url", "username", "password"], + expectedParsedLines: [ + { + url: "https://example.com/", + username: "testusername", + password: "testpassword", + }, + ], + delimiter: ",", + throwsError: false, + }, + { + description: + "string without line break at the end of the file gets parsed correctly", + csvString: ` +url,username,password +https://example.com/,testusername,testpassword`, + expectedHeaderLine: ["url", "username", "password"], + expectedParsedLines: [ + { + url: "https://example.com/", + username: "testusername", + password: "testpassword", + }, + ], + delimiter: ",", + throwsError: false, + }, + { + description: + "multiple line breaks at the beginning, in the middle or at the end of a string are trimmed and not parsed as empty rows", + csvString: ` +\r\r +url,username,password +\n\n +https://example.com/,testusername,testpassword +\n\r +`, + expectedHeaderLine: ["url", "username", "password"], + expectedParsedLines: [ + { + url: "https://example.com/", + username: "testusername", + password: "testpassword", + }, + ], + delimiter: ",", + throwsError: false, + }, + { + description: + "throws error when after a field, that is enclosed in quotes, follow any invalid characters (doesn't follow csv standard - RFC 4180)", + csvString: ` + url,username,password + https://example.com/,"testusername"outside,testpassword + `, + delimiter: ",", + throwsError: true, + }, + { + description: + "throws error when the closing quotation mark for a field is missing (doesn't follow csv standard - RFC 4180)", + csvString: ` +url,"username,password +https://example.com/,testusername,testpassword +`, + delimiter: ",", + throwsError: true, + }, + { + description: + "parsing empty csv file results in empty header line and empty parsedLines", + csvString: "", + expectedHeaderLine: [], + expectedParsedLines: [], + delimiter: ",", + throwsError: false, + }, + { + description: + "parsing csv file with only header line results in empty parsedLines", + csvString: "url,username,password\n", + expectedHeaderLine: ["url", "username", "password"], + expectedParsedLines: [], + delimiter: ",", + throwsError: false, + }, +]; + +async function parseCSVStringAndValidateResult(test) { + info(`Test case: ${test.description}`); + if (test.throwsError) { + Assert.throws( + () => CSV.parse(test.csvString, test.delimiter), + /Stopped parsing because of wrong csv format/ + ); + } else { + let [resultHeaderLine, resultParsedLines] = CSV.parse( + test.csvString, + test.delimiter + ); + Assert.deepEqual( + resultHeaderLine, + test.expectedHeaderLine, + "Header line check" + ); + Assert.deepEqual( + resultParsedLines, + test.expectedParsedLines, + "Parsed lines check" + ); + } +} + +add_task(function test_csv_parsing_results() { + TEST_CASES.forEach(testCase => { + parseCSVStringAndValidateResult(testCase); + }); +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_LoginManagerParent_doAutocompleteSearch.js b/toolkit/components/passwordmgr/test/unit/test_LoginManagerParent_doAutocompleteSearch.js new file mode 100644 index 0000000000..2e182a7064 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_LoginManagerParent_doAutocompleteSearch.js @@ -0,0 +1,148 @@ +/** + * Test LoginManagerParent.doAutocompleteSearch() + */ + +"use strict"; + +const { sinon } = ChromeUtils.importESModule( + "resource://testing-common/Sinon.sys.mjs" +); +const { LoginManagerParent } = ChromeUtils.importESModule( + "resource://gre/modules/LoginManagerParent.sys.mjs" +); + +// new-password to the happy path +const NEW_PASSWORD_TEMPLATE_ARG = { + actionOrigin: "https://mozilla.org", + searchString: "", + previousResult: null, + requestId: "foo", + hasBeenTypePassword: true, + isSecure: true, + isProbablyANewPasswordField: true, +}; + +add_setup(async () => { + Services.prefs.setBoolPref("signon.generation.available", true); + Services.prefs.setBoolPref("signon.generation.enabled", true); + + await LoginTestUtils.remoteSettings.setupImprovedPasswordRules(); + + sinon + .stub(LoginManagerParent._browsingContextGlobal, "get") + .withArgs(123) + .callsFake(() => { + return { + currentWindowGlobal: { + documentPrincipal: + Services.scriptSecurityManager.createContentPrincipalFromOrigin( + "https://www.example.com^userContextId=1" + ), + documentURI: Services.io.newURI("https://www.example.com"), + }, + }; + }); +}); + +add_task(async function test_generated_noLogins() { + let LMP = new LoginManagerParent(); + LMP.useBrowsingContext(123); + + Assert.ok(LMP.doAutocompleteSearch, "doAutocompleteSearch exists"); + + let result1 = await LMP.doAutocompleteSearch( + "https://example.com", + NEW_PASSWORD_TEMPLATE_ARG + ); + equal(result1.logins.length, 0, "no logins"); + Assert.ok(result1.generatedPassword, "has a generated password"); + equal(result1.generatedPassword.length, 15, "generated password length"); + Assert.ok( + result1.willAutoSaveGeneratedPassword, + "will auto-save when storage is empty" + ); + + info("repeat the search and ensure the same password was used"); + let result2 = await LMP.doAutocompleteSearch( + "https://example.com", + NEW_PASSWORD_TEMPLATE_ARG + ); + equal(result2.logins.length, 0, "no logins"); + equal( + result2.generatedPassword, + result1.generatedPassword, + "same generated password" + ); + Assert.ok( + result1.willAutoSaveGeneratedPassword, + "will auto-save when storage is still empty" + ); + + info("Check cases where a password shouldn't be generated"); + + let result3 = await LMP.doAutocompleteSearch("https://example.com", { + ...NEW_PASSWORD_TEMPLATE_ARG, + ...{ + hasBeenTypePassword: false, + isProbablyANewPasswordField: false, + }, + }); + equal( + result3.generatedPassword, + null, + "no generated password when not a pw. field" + ); + + let result4 = await LMP.doAutocompleteSearch("https://example.com", { + ...NEW_PASSWORD_TEMPLATE_ARG, + ...{ + // This is false when there is no autocomplete="new-password" attribute && + // LoginAutoComplete.isProbablyANewPasswordField returns false + isProbablyANewPasswordField: false, + }, + }); + equal( + result4.generatedPassword, + null, + "no generated password when isProbablyANewPasswordField is false" + ); + + LMP.useBrowsingContext(999); + let result5 = await LMP.doAutocompleteSearch("https://example.com", { + ...NEW_PASSWORD_TEMPLATE_ARG, + }); + equal( + result5.generatedPassword, + null, + "no generated password with a missing browsingContextId" + ); +}); + +add_task(async function test_generated_emptyUsernameSavedLogin() { + info("Test with a login that will prevent auto-saving"); + await LoginTestUtils.addLogin({ + username: "", + password: "my-saved-password", + origin: "https://example.com", + formActionOrigin: NEW_PASSWORD_TEMPLATE_ARG.actionOrigin, + }); + + let LMP = new LoginManagerParent(); + LMP.useBrowsingContext(123); + + Assert.ok(LMP.doAutocompleteSearch, "doAutocompleteSearch exists"); + + let result1 = await LMP.doAutocompleteSearch( + "https://example.com", + NEW_PASSWORD_TEMPLATE_ARG + ); + equal(result1.logins.length, 1, "1 login"); + Assert.ok(result1.generatedPassword, "has a generated password"); + equal(result1.generatedPassword.length, 15, "generated password length"); + Assert.ok( + !result1.willAutoSaveGeneratedPassword, + "won't auto-save when an empty-username match is found" + ); + + LoginTestUtils.clearData(); +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_LoginManagerParent_getGeneratedPassword.js b/toolkit/components/passwordmgr/test/unit/test_LoginManagerParent_getGeneratedPassword.js new file mode 100644 index 0000000000..72503723b8 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_LoginManagerParent_getGeneratedPassword.js @@ -0,0 +1,176 @@ +/** + * Test LoginManagerParent.getGeneratedPassword() + */ + +"use strict"; + +const { sinon } = ChromeUtils.importESModule( + "resource://testing-common/Sinon.sys.mjs" +); +const { LoginManagerParent } = ChromeUtils.importESModule( + "resource://gre/modules/LoginManagerParent.sys.mjs" +); + +function simulateNavigationInTheFrame(newOrigin) { + LoginManagerParent._browsingContextGlobal.get.restore(); + sinon + .stub(LoginManagerParent._browsingContextGlobal, "get") + .withArgs(99) + .callsFake(() => { + return { + currentWindowGlobal: { + documentPrincipal: + Services.scriptSecurityManager.createContentPrincipalFromOrigin( + `https://${newOrigin}^userContextId=2` + ), + documentURI: Services.io.newURI("https://www.example.com"), + }, + }; + }); +} + +add_task(async function test_getGeneratedPassword() { + // Force the feature to be enabled. + Services.prefs.setBoolPref("signon.generation.available", true); + Services.prefs.setBoolPref("signon.generation.enabled", true); + + // Setup the improved rules collection since the improved password rules + // pref is on by default. Otherwise any interaciton with LMP.getGeneratedPassword() + // will take a long time to complete + if (LoginHelper.improvedPasswordRulesEnabled) { + await LoginTestUtils.remoteSettings.setupImprovedPasswordRules(); + } + + let LMP = new LoginManagerParent(); + LMP.useBrowsingContext(99); + + Assert.ok(LMP.getGeneratedPassword, "LMP.getGeneratedPassword exists"); + equal( + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().size, + 0, + "Empty cache to start" + ); + + equal(await LMP.getGeneratedPassword(), null, "Null with no BrowsingContext"); + + Assert.ok( + LoginManagerParent._browsingContextGlobal, + "Check _browsingContextGlobal exists" + ); + Assert.ok( + !LoginManagerParent._browsingContextGlobal.get(99), + "BrowsingContext 99 shouldn't exist yet" + ); + info("Stubbing BrowsingContext.get(99)"); + sinon + .stub(LoginManagerParent._browsingContextGlobal, "get") + .withArgs(99) + .callsFake(() => { + return { + currentWindowGlobal: { + documentPrincipal: + Services.scriptSecurityManager.createContentPrincipalFromOrigin( + "https://www.example.com^userContextId=6" + ), + documentURI: Services.io.newURI("https://www.example.com"), + }, + }; + }); + Assert.ok( + LoginManagerParent._browsingContextGlobal.get(99), + "Checking BrowsingContext.get(99) stub" + ); + let password1 = await LMP.getGeneratedPassword(); + notEqual(password1, null, "Check password was returned"); + equal( + password1.length, + LoginTestUtils.generation.LENGTH, + "Check password length" + ); + equal( + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().size, + 1, + "1 added to cache" + ); + equal( + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().get( + "https://www.example.com^userContextId=6" + ).value, + password1, + "Cache key and value" + ); + let password2 = await LMP.getGeneratedPassword(); + equal( + password1, + password2, + "Same password should be returned for the same origin" + ); + + // Updating autosaved login to have username will reset generated password + const autoSavedLogin = await LoginTestUtils.addLogin({ + origin: "https://www.example.com^userContextId=6", + username: "", + password: password1, + }); + const updatedLogin = autoSavedLogin.clone(); + updatedLogin.username = "anyone"; + await LoginTestUtils.modifyLogin(autoSavedLogin, updatedLogin); + password2 = await LMP.getGeneratedPassword(); + notEqual( + password1, + password2, + "New password should be returned for the same origin after login saved" + ); + + simulateNavigationInTheFrame("www.mozilla.org"); + let password3 = await LMP.getGeneratedPassword(); + notEqual( + password2, + password3, + "Different password for a different origin for the same BC" + ); + equal( + password3.length, + LoginTestUtils.generation.LENGTH, + "Check password3 length" + ); + + simulateNavigationInTheFrame("bank.biz"); + let password4 = await LMP.getGeneratedPassword({ inputMaxLength: 5 }); + notEqual( + password4, + password2, + "Different password for a different origin for the same BC" + ); + notEqual( + password4, + password3, + "Different password for a different origin for the same BC" + ); + equal(password4.length, 5, "password4 length is limited by input.maxLength"); + + info("Now checks cases where null should be returned"); + + Services.prefs.setBoolPref("signon.rememberSignons", false); + equal( + await LMP.getGeneratedPassword(), + null, + "Prevented when pwmgr disabled" + ); + Services.prefs.setBoolPref("signon.rememberSignons", true); + + Services.prefs.setBoolPref("signon.generation.available", false); + equal(await LMP.getGeneratedPassword(), null, "Prevented when unavailable"); + Services.prefs.setBoolPref("signon.generation.available", true); + + Services.prefs.setBoolPref("signon.generation.enabled", false); + equal(await LMP.getGeneratedPassword(), null, "Prevented when disabled"); + Services.prefs.setBoolPref("signon.generation.enabled", true); + + LMP.useBrowsingContext(123); + equal( + await LMP.getGeneratedPassword(), + null, + "Prevented when browsingContext is missing" + ); +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_LoginManagerParent_onPasswordEditedOrGenerated.js b/toolkit/components/passwordmgr/test/unit/test_LoginManagerParent_onPasswordEditedOrGenerated.js new file mode 100644 index 0000000000..2573dcd4af --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_LoginManagerParent_onPasswordEditedOrGenerated.js @@ -0,0 +1,1141 @@ +/** + * Test LoginManagerParent._onPasswordEditedOrGenerated() + */ + +"use strict"; + +const { sinon } = ChromeUtils.importESModule( + "resource://testing-common/Sinon.sys.mjs" +); +const { LoginManagerParent } = ChromeUtils.importESModule( + "resource://gre/modules/LoginManagerParent.sys.mjs" +); +const { LoginManagerPrompter } = ChromeUtils.importESModule( + "resource://gre/modules/LoginManagerPrompter.sys.mjs" +); + +const { TestUtils } = ChromeUtils.importESModule( + "resource://testing-common/TestUtils.sys.mjs" +); +const loginTemplate = Object.freeze({ + origin: "https://www.example.com", + formActionOrigin: "https://www.mozilla.org", +}); + +let LMP = new LoginManagerParent(); + +function stubPrompter() { + let fakePromptToSavePassword = sinon.stub(); + let fakePromptToChangePassword = sinon.stub(); + sinon.stub(LMP, "_getPrompter").callsFake(() => { + return { + promptToSavePassword: fakePromptToSavePassword, + promptToChangePassword: fakePromptToChangePassword, + }; + }); + LMP._getPrompter().promptToSavePassword(); + LMP._getPrompter().promptToChangePassword(); + Assert.ok(LMP._getPrompter.calledTwice, "Checking _getPrompter stub"); + Assert.ok( + fakePromptToSavePassword.calledOnce, + "Checking fakePromptToSavePassword stub" + ); + Assert.ok( + fakePromptToChangePassword.calledOnce, + "Checking fakePromptToChangePassword stub" + ); + function resetPrompterHistory() { + LMP._getPrompter.resetHistory(); + fakePromptToSavePassword.resetHistory(); + fakePromptToChangePassword.resetHistory(); + } + function restorePrompter() { + LMP._getPrompter.restore(); + } + resetPrompterHistory(); + return { + fakePromptToSavePassword, + fakePromptToChangePassword, + resetPrompterHistory, + restorePrompter, + }; +} + +async function stubGeneratedPasswordForBrowsingContextId(id) { + Assert.ok( + LoginManagerParent._browsingContextGlobal, + "Check _browsingContextGlobal exists" + ); + Assert.ok( + !LoginManagerParent._browsingContextGlobal.get(id), + `BrowsingContext ${id} shouldn't exist yet` + ); + info(`Stubbing BrowsingContext.get(${id})`); + let stub = sinon + .stub(LoginManagerParent._browsingContextGlobal, "get") + .withArgs(id) + .callsFake(() => { + return { + currentWindowGlobal: { + documentPrincipal: + Services.scriptSecurityManager.createContentPrincipalFromOrigin( + "https://www.example.com^userContextId=6" + ), + documentURI: Services.io.newURI("https://www.example.com"), + }, + get embedderElement() { + info("returning embedderElement"); + let browser = MockDocument.createTestDocument( + "chrome://browser/content/browser.xhtml", + `<box xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"> + <browser></browser> + </box>`, + "application/xml", + true + ).querySelector("browser"); + MockDocument.mockBrowsingContextProperty(browser, this); + return browser; + }, + get top() { + return this; + }, + }; + }); + Assert.ok( + LoginManagerParent._browsingContextGlobal.get(id), + `Checking BrowsingContext.get(${id}) stub` + ); + + const generatedPassword = await LMP.getGeneratedPassword(); + notEqual(generatedPassword, null, "Check password was returned"); + equal( + generatedPassword.length, + LoginTestUtils.generation.LENGTH, + "Check password length" + ); + equal( + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().size, + 1, + "1 added to cache" + ); + equal( + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().get( + "https://www.example.com^userContextId=6" + ).value, + generatedPassword, + "Cache key and value" + ); + LoginManagerParent._browsingContextGlobal.get.resetHistory(); + + return { + stub, + generatedPassword, + }; +} + +function checkEditTelemetryRecorded(expectedCount, msg) { + info("Check that expected telemetry event was recorded"); + const snapshot = Services.telemetry.snapshotEvents( + Ci.nsITelemetry.DATASET_PRERELEASE_CHANNELS, + false + ); + let resultsCount = 0; + if ("parent" in snapshot) { + const telemetryProps = Object.freeze({ + category: "pwmgr", + method: "filled_field_edited", + object: "generatedpassword", + }); + const results = snapshot.parent.filter( + ([time, category, method, object]) => { + return ( + category === telemetryProps.category && + method === telemetryProps.method && + object === telemetryProps.object + ); + } + ); + resultsCount = results.length; + } + equal( + resultsCount, + expectedCount, + "Check count of pwmgr.filled_field_edited for generatedpassword: " + msg + ); +} + +async function startTestConditions(contextId) { + LMP.useBrowsingContext(contextId); + + Assert.ok( + LMP._onPasswordEditedOrGenerated, + "LMP._onPasswordEditedOrGenerated exists" + ); + equal(await LMP.getGeneratedPassword(), null, "Null with no BrowsingContext"); + equal( + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().size, + 0, + "Empty cache to start" + ); + equal( + Services.logins.getAllLogins().length, + 0, + "Should have no saved logins at the start of the test" + ); +} + +/* + * Compare login details excluding usernameField and passwordField + */ +function assertLoginProperties(actualLogin, expected) { + equal(actualLogin.origin, expected.origin, "Compare origin"); + equal( + actualLogin.formActionOrigin, + expected.formActionOrigin, + "Compare formActionOrigin" + ); + equal(actualLogin.httpRealm, expected.httpRealm, "Compare httpRealm"); + equal(actualLogin.username, expected.username, "Compare username"); + equal(actualLogin.password, expected.password, "Compare password"); +} + +add_setup(async () => { + // Get a profile for storage. + do_get_profile(); + + // Force the feature to be enabled. + Services.prefs.setBoolPref("signon.generation.available", true); + Services.prefs.setBoolPref("signon.generation.enabled", true); + await LoginTestUtils.remoteSettings.setupImprovedPasswordRules(); +}); + +add_task(async function test_onPasswordEditedOrGenerated_generatedPassword() { + await startTestConditions(99); + let { generatedPassword } = await stubGeneratedPasswordForBrowsingContextId( + 99 + ); + let { fakePromptToChangePassword, restorePrompter } = stubPrompter(); + let rootBrowser = LMP.getRootBrowser(); + + let storageChangedPromised = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "addLogin" + ); + + equal( + Services.logins.getAllLogins().length, + 0, + "Should have no saved logins at the start of the test" + ); + + await LMP._onPasswordEditedOrGenerated( + rootBrowser, + "https://www.example.com", + { + browsingContextId: 99, + formActionOrigin: "https://www.mozilla.org", + newPasswordField: { value: generatedPassword }, + usernameField: { value: "someusername" }, + triggeredByFillingGenerated: true, + } + ); + + let [login] = await storageChangedPromised; + let expected = new LoginInfo( + "https://www.example.com", + "https://www.mozilla.org", + null, + "", // verify we don't include the username when auto-saving a login + generatedPassword + ); + + Assert.ok(login.equals(expected), "Check added login"); + Assert.ok(LMP._getPrompter.calledOnce, "Checking _getPrompter was called"); + Assert.ok( + fakePromptToChangePassword.calledOnce, + "Checking promptToChangePassword was called" + ); + Assert.ok( + fakePromptToChangePassword.getCall(0).args[3], + "promptToChangePassword had a truthy 'dismissed' argument" + ); + Assert.ok( + fakePromptToChangePassword.getCall(0).args[4], + "promptToChangePassword had a truthy 'notifySaved' argument" + ); + + info("Edit the password"); + const newPassword = generatedPassword + "🔥"; + storageChangedPromised = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "modifyLogin" + ); + await LMP._onPasswordEditedOrGenerated( + rootBrowser, + "https://www.example.com", + { + browsingContextId: 99, + formActionOrigin: "https://www.mozilla.org", + newPasswordField: { value: newPassword }, + usernameField: { value: "someusername" }, + triggeredByFillingGenerated: true, + } + ); + let generatedPW = + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().get( + "https://www.example.com^userContextId=6" + ); + Assert.ok(generatedPW.edited, "Cached edited boolean should be true"); + equal(generatedPW.value, newPassword, "Cached password should be updated"); + // login metadata should be updated + let [dataArray] = await storageChangedPromised; + login = dataArray.queryElementAt(1, Ci.nsILoginInfo); + expected.password = newPassword; + Assert.ok(login.equals(expected), "Check updated login"); + equal( + Services.logins.getAllLogins().length, + 1, + "Should have 1 saved login still" + ); + + info( + "Simulate a second edit to check that the telemetry event for the first edit is not recorded twice" + ); + const newerPassword = newPassword + "🦊"; + storageChangedPromised = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "modifyLogin" + ); + await LMP._onPasswordEditedOrGenerated( + rootBrowser, + "https://www.example.com", + { + browsingContextId: 99, + formActionOrigin: "https://www.mozilla.org", + newPasswordField: { value: newerPassword }, + usernameField: { value: "someusername" }, + triggeredByFillingGenerated: true, + } + ); + generatedPW = LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().get( + "https://www.example.com^userContextId=6" + ); + Assert.ok(generatedPW.edited, "Cached edited state should remain true"); + equal(generatedPW.value, newerPassword, "Cached password should be updated"); + [dataArray] = await storageChangedPromised; + login = dataArray.queryElementAt(1, Ci.nsILoginInfo); + expected.password = newerPassword; + Assert.ok(login.equals(expected), "Check updated login"); + equal( + Services.logins.getAllLogins().length, + 1, + "Should have 1 saved login still" + ); + + checkEditTelemetryRecorded(1, "with auto-save"); + + LoginManagerParent._browsingContextGlobal.get.restore(); + restorePrompter(); + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().clear(); + Services.logins.removeAllUserFacingLogins(); + Services.telemetry.clearEvents(); +}); + +add_task( + async function test_onPasswordEditedOrGenerated_editToEmpty_generatedPassword() { + await startTestConditions(99); + let { generatedPassword } = await stubGeneratedPasswordForBrowsingContextId( + 99 + ); + let { fakePromptToChangePassword, restorePrompter } = stubPrompter(); + let rootBrowser = LMP.getRootBrowser(); + + let storageChangedPromised = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "addLogin" + ); + + equal( + Services.logins.getAllLogins().length, + 0, + "Should have no saved logins at the start of the test" + ); + + await LMP._onPasswordEditedOrGenerated( + rootBrowser, + "https://www.example.com", + { + browsingContextId: 99, + formActionOrigin: "https://www.mozilla.org", + newPasswordField: { value: generatedPassword }, + usernameField: { value: "someusername" }, + triggeredByFillingGenerated: true, + } + ); + + let [login] = await storageChangedPromised; + let expected = new LoginInfo( + "https://www.example.com", + "https://www.mozilla.org", + null, + "", // verify we don't include the username when auto-saving a login + generatedPassword + ); + + Assert.ok(login.equals(expected), "Check added login"); + Assert.ok(LMP._getPrompter.calledOnce, "Checking _getPrompter was called"); + Assert.ok( + fakePromptToChangePassword.calledOnce, + "Checking promptToChangePassword was called" + ); + Assert.ok( + fakePromptToChangePassword.getCall(0).args[3], + "promptToChangePassword had a truthy 'dismissed' argument" + ); + Assert.ok( + fakePromptToChangePassword.getCall(0).args[4], + "promptToChangePassword had a truthy 'notifySaved' argument" + ); + + info("Edit the password to be empty"); + const newPassword = ""; + await LMP._onPasswordEditedOrGenerated( + rootBrowser, + "https://www.example.com", + { + browsingContextId: 99, + formActionOrigin: "https://www.mozilla.org", + newPasswordField: { value: newPassword }, + usernameField: { value: "someusername" }, + triggeredByFillingGenerated: true, + } + ); + let generatedPW = + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().get( + "https://www.example.com^userContextId=6" + ); + Assert.ok(!generatedPW.edited, "Cached edited boolean should be false"); + equal( + generatedPW.value, + generatedPassword, + "Cached password shouldn't be updated" + ); + + checkEditTelemetryRecorded(0, "Blanking doesn't count as an edit"); + + LoginManagerParent._browsingContextGlobal.get.restore(); + restorePrompter(); + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().clear(); + Services.logins.removeAllUserFacingLogins(); + Services.telemetry.clearEvents(); + } +); + +add_task(async function test_addUsernameBeforeAutoSaveEdit() { + await startTestConditions(99); + let { generatedPassword } = await stubGeneratedPasswordForBrowsingContextId( + 99 + ); + let { fakePromptToChangePassword, restorePrompter, resetPrompterHistory } = + stubPrompter(); + let rootBrowser = LMP.getRootBrowser(); + let fakePopupNotifications = { + getNotification: sinon.stub().returns({ dismissed: true }), + }; + sinon.stub(LoginHelper, "getBrowserForPrompt").callsFake(() => { + return { + ownerGlobal: { + PopupNotifications: fakePopupNotifications, + }, + }; + }); + + let storageChangedPromised = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "addLogin" + ); + + equal( + Services.logins.getAllLogins().length, + 0, + "Should have no saved logins at the start of the test" + ); + + await LMP._onPasswordEditedOrGenerated( + rootBrowser, + "https://www.example.com", + { + browsingContextId: 99, + formActionOrigin: "https://www.mozilla.org", + newPasswordField: { value: generatedPassword }, + usernameField: { value: "someusername" }, + triggeredByFillingGenerated: true, + } + ); + + let [login] = await storageChangedPromised; + let expected = new LoginInfo( + "https://www.example.com", + "https://www.mozilla.org", + null, + "", // verify we don't include the username when auto-saving a login + generatedPassword + ); + + Assert.ok(login.equals(expected), "Check added login"); + Assert.ok(LMP._getPrompter.calledOnce, "Checking _getPrompter was called"); + Assert.ok( + fakePromptToChangePassword.calledOnce, + "Checking promptToChangePassword was called" + ); + Assert.ok( + fakePromptToChangePassword.getCall(0).args[3], + "promptToChangePassword had a truthy 'dismissed' argument" + ); + Assert.ok( + fakePromptToChangePassword.getCall(0).args[4], + "promptToChangePassword had a truthy 'notifySaved' argument" + ); + + info("Checking the getNotification stub"); + Assert.ok( + !fakePopupNotifications.getNotification.called, + "getNotification didn't get called yet" + ); + resetPrompterHistory(); + + info("Add a username to the auto-saved login in storage"); + let loginWithUsername = login.clone(); + loginWithUsername.username = "added_username"; + LoginManagerPrompter._updateLogin(login, loginWithUsername); + + info("Edit the password"); + const newPassword = generatedPassword + "🔥"; + storageChangedPromised = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "modifyLogin" + ); + // will update the doorhanger with changed password + await LMP._onPasswordEditedOrGenerated( + rootBrowser, + "https://www.example.com", + { + browsingContextId: 99, + formActionOrigin: "https://www.mozilla.org", + newPasswordField: { value: newPassword }, + usernameField: { value: "someusername" }, + triggeredByFillingGenerated: true, + } + ); + let generatedPW = + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().get( + "https://www.example.com^userContextId=6" + ); + Assert.ok(generatedPW.edited, "Cached edited boolean should be true"); + equal(generatedPW.value, newPassword, "Cached password should be updated"); + let [dataArray] = await storageChangedPromised; + login = dataArray.queryElementAt(1, Ci.nsILoginInfo); + loginWithUsername.password = newPassword; + // the password should be updated in storage, but not the username (until the user confirms the doorhanger) + assertLoginProperties(login, loginWithUsername); + Assert.ok(login.matches(loginWithUsername, false), "Check updated login"); + equal( + Services.logins.getAllLogins().length, + 1, + "Should have 1 saved login still" + ); + + Assert.ok( + fakePopupNotifications.getNotification.calledOnce, + "getNotification was called" + ); + Assert.ok(LMP._getPrompter.calledOnce, "Checking _getPrompter was called"); + Assert.ok( + fakePromptToChangePassword.calledOnce, + "Checking promptToChangePassword was called" + ); + Assert.ok( + fakePromptToChangePassword.getCall(0).args[3], + "promptToChangePassword had a truthy 'dismissed' argument" + ); + // The generated password changed, so we expect notifySaved to be true + Assert.ok( + fakePromptToChangePassword.getCall(0).args[4], + "promptToChangePassword should have a falsey 'notifySaved' argument" + ); + resetPrompterHistory(); + + info( + "Simulate a second edit to check that the telemetry event for the first edit is not recorded twice" + ); + const newerPassword = newPassword + "🦊"; + storageChangedPromised = TestUtils.topicObserved( + "passwordmgr-storage-changed", + (_, data) => data == "modifyLogin" + ); + info("Calling _onPasswordEditedOrGenerated again"); + await LMP._onPasswordEditedOrGenerated( + rootBrowser, + "https://www.example.com", + { + browsingContextId: 99, + formActionOrigin: "https://www.mozilla.org", + newPasswordField: { value: newerPassword }, + usernameField: { value: "someusername" }, + triggeredByFillingGenerated: true, + } + ); + generatedPW = LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().get( + "https://www.example.com^userContextId=6" + ); + Assert.ok(generatedPW.edited, "Cached edited state should remain true"); + equal(generatedPW.value, newerPassword, "Cached password should be updated"); + [dataArray] = await storageChangedPromised; + login = dataArray.queryElementAt(1, Ci.nsILoginInfo); + loginWithUsername.password = newerPassword; + assertLoginProperties(login, loginWithUsername); + Assert.ok(login.matches(loginWithUsername, false), "Check updated login"); + equal( + Services.logins.getAllLogins().length, + 1, + "Should have 1 saved login still" + ); + + checkEditTelemetryRecorded(1, "with auto-save"); + + Assert.ok( + fakePromptToChangePassword.calledOnce, + "Checking promptToChangePassword was called" + ); + equal( + fakePromptToChangePassword.getCall(0).args[2].password, + newerPassword, + "promptToChangePassword had the updated password" + ); + Assert.ok( + fakePromptToChangePassword.getCall(0).args[3], + "promptToChangePassword had a truthy 'dismissed' argument" + ); + + LoginManagerParent._browsingContextGlobal.get.restore(); + LoginHelper.getBrowserForPrompt.restore(); + restorePrompter(); + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().clear(); + Services.logins.removeAllUserFacingLogins(); + Services.telemetry.clearEvents(); +}); + +add_task(async function test_editUsernameOfFilledSavedLogin() { + await startTestConditions(99); + await stubGeneratedPasswordForBrowsingContextId(99); + let { + fakePromptToChangePassword, + fakePromptToSavePassword, + restorePrompter, + resetPrompterHistory, + } = stubPrompter(); + let rootBrowser = LMP.getRootBrowser(); + let fakePopupNotifications = { + getNotification: sinon.stub().returns({ dismissed: true }), + }; + sinon.stub(LoginHelper, "getBrowserForPrompt").callsFake(() => { + return { + ownerGlobal: { + PopupNotifications: fakePopupNotifications, + }, + }; + }); + + let login0Props = Object.assign({}, loginTemplate, { + username: "someusername", + password: "qweqweq", + }); + info("Adding initial login: " + JSON.stringify(login0Props)); + let savedLogin = await LoginTestUtils.addLogin(login0Props); + + info( + "Saved initial login: " + JSON.stringify(Services.logins.getAllLogins()[0]) + ); + + equal( + Services.logins.getAllLogins().length, + 1, + "Should have 1 saved login at the start of the test" + ); + + // first prompt to save a new login + let newUsername = "differentuser"; + let newPassword = login0Props.password + "🔥"; + await LMP._onPasswordEditedOrGenerated( + rootBrowser, + "https://www.example.com", + { + browsingContextId: 99, + formActionOrigin: "https://www.mozilla.org", + autoFilledLoginGuid: savedLogin.guid, + newPasswordField: { value: newPassword }, + usernameField: { value: newUsername }, + triggeredByFillingGenerated: false, + } + ); + + let expected = new LoginInfo( + login0Props.origin, + login0Props.formActionOrigin, + null, + newUsername, + newPassword + ); + + Assert.ok(LMP._getPrompter.calledOnce, "Checking _getPrompter was called"); + info("Checking the getNotification stub"); + Assert.ok( + !fakePopupNotifications.getNotification.called, + "getNotification was not called" + ); + Assert.ok( + fakePromptToSavePassword.calledOnce, + "Checking promptToSavePassword was called" + ); + Assert.ok( + fakePromptToSavePassword.getCall(0).args[2], + "promptToSavePassword had a truthy 'dismissed' argument" + ); + Assert.ok( + !fakePromptToSavePassword.getCall(0).args[3], + "promptToSavePassword had a falsey 'notifySaved' argument" + ); + assertLoginProperties(fakePromptToSavePassword.getCall(0).args[1], expected); + resetPrompterHistory(); + + // then prompt with matching username/password + await LMP._onPasswordEditedOrGenerated( + rootBrowser, + "https://www.example.com", + { + browsingContextId: 99, + formActionOrigin: "https://www.mozilla.org", + autoFilledLoginGuid: savedLogin.guid, + newPasswordField: { value: login0Props.password }, + usernameField: { value: login0Props.username }, + triggeredByFillingGenerated: false, + } + ); + + expected = new LoginInfo( + login0Props.origin, + login0Props.formActionOrigin, + null, + login0Props.username, + login0Props.password + ); + + Assert.ok(LMP._getPrompter.calledOnce, "Checking _getPrompter was called"); + info("Checking the getNotification stub"); + Assert.ok( + fakePopupNotifications.getNotification.called, + "getNotification was called" + ); + Assert.ok( + fakePromptToChangePassword.calledOnce, + "Checking promptToChangePassword was called" + ); + Assert.ok( + fakePromptToChangePassword.getCall(0).args[3], + "promptToChangePassword had a truthy 'dismissed' argument" + ); + Assert.ok( + !fakePromptToChangePassword.getCall(0).args[4], + "promptToChangePassword had a falsey 'notifySaved' argument" + ); + assertLoginProperties( + fakePromptToChangePassword.getCall(0).args[2], + expected + ); + resetPrompterHistory(); + + LoginManagerParent._browsingContextGlobal.get.restore(); + LoginHelper.getBrowserForPrompt.restore(); + restorePrompter(); + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().clear(); + Services.logins.removeAllUserFacingLogins(); + Services.telemetry.clearEvents(); +}); + +add_task( + async function test_onPasswordEditedOrGenerated_generatedPassword_withDisabledLogin() { + await startTestConditions(99); + let { generatedPassword } = await stubGeneratedPasswordForBrowsingContextId( + 99 + ); + let { restorePrompter } = stubPrompter(); + let rootBrowser = LMP.getRootBrowser(); + + info("Disable login saving for the site"); + Services.logins.setLoginSavingEnabled("https://www.example.com", false); + await LMP._onPasswordEditedOrGenerated( + rootBrowser, + "https://www.example.com", + { + browsingContextId: 99, + formActionOrigin: "https://www.mozilla.org", + newPasswordField: { value: generatedPassword }, + triggeredByFillingGenerated: true, + } + ); + equal( + Services.logins.getAllLogins().length, + 0, + "Should have no saved logins since saving is disabled" + ); + Assert.ok( + LMP._getPrompter.notCalled, + "Checking _getPrompter wasn't called" + ); + + // Clean up + LoginManagerParent._browsingContextGlobal.get.restore(); + restorePrompter(); + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().clear(); + Services.logins.setLoginSavingEnabled("https://www.example.com", true); + Services.logins.removeAllUserFacingLogins(); + } +); + +add_task( + async function test_onPasswordEditedOrGenerated_generatedPassword_withSavedEmptyUsername() { + await startTestConditions(99); + let login0Props = Object.assign({}, loginTemplate, { + username: "", + password: "qweqweq", + }); + info("Adding initial login: " + JSON.stringify(login0Props)); + let expected = await LoginTestUtils.addLogin(login0Props); + + info( + "Saved initial login: " + + JSON.stringify(Services.logins.getAllLogins()[0]) + ); + + let { generatedPassword: password1 } = + await stubGeneratedPasswordForBrowsingContextId(99); + let { restorePrompter, fakePromptToChangePassword } = stubPrompter(); + let rootBrowser = LMP.getRootBrowser(); + + await LMP._onPasswordEditedOrGenerated( + rootBrowser, + "https://www.example.com", + { + browsingContextId: 99, + formActionOrigin: "https://www.mozilla.org", + newPasswordField: { value: password1 }, + triggeredByFillingGenerated: true, + } + ); + equal( + Services.logins.getAllLogins().length, + 1, + "Should just have the previously-saved login with empty username" + ); + assertLoginProperties(Services.logins.getAllLogins()[0], login0Props); + + Assert.ok(LMP._getPrompter.calledOnce, "Checking _getPrompter was called"); + Assert.ok( + fakePromptToChangePassword.calledOnce, + "Checking promptToChangePassword was called" + ); + Assert.ok( + fakePromptToChangePassword.getCall(0).args[3], + "promptToChangePassword had a truthy 'dismissed' argument" + ); + Assert.ok( + !fakePromptToChangePassword.getCall(0).args[4], + "promptToChangePassword had a falsey 'notifySaved' argument" + ); + + info("Edit the password"); + const newPassword = password1 + "🔥"; + await LMP._onPasswordEditedOrGenerated( + rootBrowser, + "https://www.example.com", + { + browsingContextId: 99, + formActionOrigin: "https://www.mozilla.org", + newPasswordField: { value: newPassword }, + usernameField: { value: "someusername" }, + triggeredByFillingGenerated: true, + } + ); + let generatedPW = + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().get( + "https://www.example.com^userContextId=6" + ); + Assert.ok(generatedPW.edited, "Cached edited boolean should be true"); + equal(generatedPW.storageGUID, null, "Should have no storageGUID"); + equal(generatedPW.value, newPassword, "Cached password should be updated"); + assertLoginProperties(Services.logins.getAllLogins()[0], login0Props); + Assert.ok( + Services.logins.getAllLogins()[0].equals(expected), + "Ensure no changes" + ); + equal( + Services.logins.getAllLogins().length, + 1, + "Should have 1 saved login still" + ); + + checkEditTelemetryRecorded(1, "Updating cache, not storage (no auto-save)"); + + LoginManagerParent._browsingContextGlobal.get.restore(); + restorePrompter(); + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().clear(); + Services.logins.removeAllUserFacingLogins(); + Services.telemetry.clearEvents(); + } +); + +add_task( + async function test_onPasswordEditedOrGenerated_generatedPassword_withSavedEmptyUsernameAndUsernameValue() { + // Save as the above task but with a non-empty username field value. + await startTestConditions(99); + let login0Props = Object.assign({}, loginTemplate, { + username: "", + password: "qweqweq", + }); + info("Adding initial login: " + JSON.stringify(login0Props)); + let expected = await LoginTestUtils.addLogin(login0Props); + + info( + "Saved initial login: " + + JSON.stringify(Services.logins.getAllLogins()[0]) + ); + + let { generatedPassword: password1 } = + await stubGeneratedPasswordForBrowsingContextId(99); + let { + restorePrompter, + fakePromptToChangePassword, + fakePromptToSavePassword, + } = stubPrompter(); + let rootBrowser = LMP.getRootBrowser(); + + await LMP._onPasswordEditedOrGenerated( + rootBrowser, + "https://www.example.com", + { + browsingContextId: 99, + formActionOrigin: "https://www.mozilla.org", + newPasswordField: { value: password1 }, + usernameField: { value: "non-empty-username" }, + triggeredByFillingGenerated: true, + } + ); + equal( + Services.logins.getAllLogins().length, + 1, + "Should just have the previously-saved login with empty username" + ); + assertLoginProperties(Services.logins.getAllLogins()[0], login0Props); + + Assert.ok(LMP._getPrompter.calledOnce, "Checking _getPrompter was called"); + Assert.ok( + fakePromptToChangePassword.notCalled, + "Checking promptToChangePassword wasn't called" + ); + Assert.ok( + fakePromptToSavePassword.calledOnce, + "Checking promptToSavePassword was called" + ); + Assert.ok( + fakePromptToSavePassword.getCall(0).args[2], + "promptToSavePassword had a truthy 'dismissed' argument" + ); + Assert.ok( + !fakePromptToSavePassword.getCall(0).args[3], + "promptToSavePassword had a falsey 'notifySaved' argument" + ); + + info("Edit the password"); + const newPassword = password1 + "🔥"; + await LMP._onPasswordEditedOrGenerated( + rootBrowser, + "https://www.example.com", + { + browsingContextId: 99, + formActionOrigin: "https://www.mozilla.org", + newPasswordField: { value: newPassword }, + usernameField: { value: "non-empty-username" }, + triggeredByFillingGenerated: true, + } + ); + Assert.ok( + fakePromptToChangePassword.notCalled, + "Checking promptToChangePassword wasn't called" + ); + Assert.ok( + fakePromptToSavePassword.calledTwice, + "Checking promptToSavePassword was called again" + ); + Assert.ok( + fakePromptToSavePassword.getCall(1).args[2], + "promptToSavePassword had a truthy 'dismissed' argument" + ); + Assert.ok( + !fakePromptToSavePassword.getCall(1).args[3], + "promptToSavePassword had a falsey 'notifySaved' argument" + ); + + let generatedPW = + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().get( + "https://www.example.com^userContextId=6" + ); + Assert.ok(generatedPW.edited, "Cached edited boolean should be true"); + equal(generatedPW.storageGUID, null, "Should have no storageGUID"); + equal(generatedPW.value, newPassword, "Cached password should be updated"); + assertLoginProperties(Services.logins.getAllLogins()[0], login0Props); + Assert.ok( + Services.logins.getAllLogins()[0].equals(expected), + "Ensure no changes" + ); + equal( + Services.logins.getAllLogins().length, + 1, + "Should have 1 saved login still" + ); + + checkEditTelemetryRecorded( + 1, + "Updating cache, not storage (no auto-save) with username in field" + ); + + LoginManagerParent._browsingContextGlobal.get.restore(); + restorePrompter(); + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().clear(); + Services.logins.removeAllUserFacingLogins(); + Services.telemetry.clearEvents(); + } +); + +add_task( + async function test_onPasswordEditedOrGenerated_generatedPassword_withEmptyUsernameDifferentFormActionOrigin() { + await startTestConditions(99); + let login0Props = Object.assign({}, loginTemplate, { + username: "", + password: "qweqweq", + }); + await LoginTestUtils.addLogin(login0Props); + + let { generatedPassword: password1 } = + await stubGeneratedPasswordForBrowsingContextId(99); + let { restorePrompter, fakePromptToChangePassword } = stubPrompter(); + let rootBrowser = LMP.getRootBrowser(); + + await LMP._onPasswordEditedOrGenerated( + rootBrowser, + "https://www.example.com", + { + browsingContextId: 99, + formActionOrigin: "https://www.elsewhere.com", + newPasswordField: { value: password1 }, + triggeredByFillingGenerated: true, + } + ); + + let savedLogins = Services.logins.getAllLogins(); + equal( + savedLogins.length, + 2, + "Should have saved the generated-password login" + ); + + assertLoginProperties(savedLogins[0], login0Props); + assertLoginProperties( + savedLogins[1], + Object.assign({}, loginTemplate, { + formActionOrigin: "https://www.elsewhere.com", + username: "", + password: password1, + }) + ); + + Assert.ok(LMP._getPrompter.calledOnce, "Checking _getPrompter was called"); + Assert.ok( + fakePromptToChangePassword.calledOnce, + "Checking promptToChangePassword was called" + ); + Assert.ok( + fakePromptToChangePassword.getCall(0).args[2], + "promptToChangePassword had a truthy 'dismissed' argument" + ); + Assert.ok( + fakePromptToChangePassword.getCall(0).args[3], + "promptToChangePassword had a truthy 'notifySaved' argument" + ); + + LoginManagerParent._browsingContextGlobal.get.restore(); + restorePrompter(); + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().clear(); + Services.logins.removeAllUserFacingLogins(); + } +); + +add_task( + async function test_onPasswordEditedOrGenerated_generatedPassword_withSavedUsername() { + await startTestConditions(99); + let login0Props = Object.assign({}, loginTemplate, { + username: "previoususer", + password: "qweqweq", + }); + await LoginTestUtils.addLogin(login0Props); + + let { generatedPassword: password1 } = + await stubGeneratedPasswordForBrowsingContextId(99); + let { restorePrompter, fakePromptToChangePassword } = stubPrompter(); + let rootBrowser = LMP.getRootBrowser(); + + await LMP._onPasswordEditedOrGenerated( + rootBrowser, + "https://www.example.com", + { + browsingContextId: 99, + formActionOrigin: "https://www.mozilla.org", + newPasswordField: { value: password1 }, + triggeredByFillingGenerated: true, + } + ); + + let savedLogins = Services.logins.getAllLogins(); + equal( + savedLogins.length, + 2, + "Should have saved the generated-password login" + ); + assertLoginProperties(Services.logins.getAllLogins()[0], login0Props); + assertLoginProperties( + savedLogins[1], + Object.assign({}, loginTemplate, { + username: "", + password: password1, + }) + ); + + Assert.ok(LMP._getPrompter.calledOnce, "Checking _getPrompter was called"); + Assert.ok( + fakePromptToChangePassword.calledOnce, + "Checking promptToChangePassword was called" + ); + Assert.ok( + fakePromptToChangePassword.getCall(0).args[2], + "promptToChangePassword had a truthy 'dismissed' argument" + ); + Assert.ok( + fakePromptToChangePassword.getCall(0).args[3], + "promptToChangePassword had a truthy 'notifySaved' argument" + ); + + LoginManagerParent._browsingContextGlobal.get.restore(); + restorePrompter(); + LoginManagerParent.getGeneratedPasswordsByPrincipalOrigin().clear(); + Services.logins.removeAllUserFacingLogins(); + } +); diff --git a/toolkit/components/passwordmgr/test/unit/test_LoginManagerParent_searchAndDedupeLogins.js b/toolkit/components/passwordmgr/test/unit/test_LoginManagerParent_searchAndDedupeLogins.js new file mode 100644 index 0000000000..33ee5bd04c --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_LoginManagerParent_searchAndDedupeLogins.js @@ -0,0 +1,207 @@ +/** + * Test LoginManagerParent._searchAndDedupeLogins() + */ + +"use strict"; + +const { LoginManagerParent: LMP } = ChromeUtils.importESModule( + "resource://gre/modules/LoginManagerParent.sys.mjs" +); + +const DOMAIN1_HTTP_ORIGIN = "http://www3.example.com"; +const DOMAIN1_HTTPS_ORIGIN = "https://www3.example.com"; + +const DOMAIN1_HTTP_TO_HTTP_U1_P1 = TestData.formLogin({}); +const DOMAIN1_HTTP_TO_HTTP_U2_P1 = TestData.formLogin({ + username: "user2", +}); +const DOMAIN1_HTTP_TO_HTTP_U3_P1 = TestData.formLogin({ + username: "user3", +}); +const DOMAIN1_HTTPS_TO_HTTPS_U1_P1 = TestData.formLogin({ + origin: DOMAIN1_HTTPS_ORIGIN, + formActionOrigin: "https://login.example.com", +}); +const DOMAIN1_HTTPS_TO_HTTPS_U2_P1 = TestData.formLogin({ + origin: DOMAIN1_HTTPS_ORIGIN, + formActionOrigin: "https://login.example.com", + username: "user2", +}); +const DOMAIN1_HTTPS_TO_HTTPS_U1_P2 = TestData.formLogin({ + origin: DOMAIN1_HTTPS_ORIGIN, + formActionOrigin: "https://login.example.com", + password: "password two", +}); +const DOMAIN1_HTTPS_TO_HTTPS_U1_P2_DIFFERENT_PORT = TestData.formLogin({ + origin: "https://www3.example.com:8080", + password: "password two", +}); +const DOMAIN1_HTTP_TO_HTTP_U1_P2 = TestData.formLogin({ + password: "password two", +}); +const DOMAIN1_HTTP_TO_HTTP_U1_P1_DIFFERENT_PORT = TestData.formLogin({ + origin: "http://www3.example.com:8080", +}); +const DOMAIN2_HTTP_TO_HTTP_U1_P1 = TestData.formLogin({ + origin: "http://different.example.com", +}); +const DOMAIN2_HTTPS_TO_HTTPS_U1_P1 = TestData.formLogin({ + origin: "https://different.example.com", + formActionOrigin: "https://login.example.com", +}); + +add_task(function setup() { + // Not enabled by default in all.js: + Services.prefs.setBoolPref("signon.schemeUpgrades", true); +}); + +add_task(async function test_searchAndDedupeLogins_acceptDifferentSubdomains() { + let testcases = [ + { + description: "HTTPS form, same hostPort, same username, different scheme", + formActionOrigin: DOMAIN1_HTTPS_ORIGIN, + logins: [DOMAIN1_HTTPS_TO_HTTPS_U1_P1, DOMAIN1_HTTP_TO_HTTP_U1_P1], + expected: [DOMAIN1_HTTPS_TO_HTTPS_U1_P1], + }, + { + description: "HTTP form, same hostPort, same username, different scheme", + formActionOrigin: DOMAIN1_HTTP_ORIGIN, + logins: [DOMAIN1_HTTPS_TO_HTTPS_U1_P1, DOMAIN1_HTTP_TO_HTTP_U1_P1], + expected: [DOMAIN1_HTTP_TO_HTTP_U1_P1], + }, + { + description: "HTTPS form, different passwords, different scheme", + formActionOrigin: DOMAIN1_HTTPS_ORIGIN, + logins: [DOMAIN1_HTTPS_TO_HTTPS_U1_P1, DOMAIN1_HTTP_TO_HTTP_U1_P2], + expected: [DOMAIN1_HTTPS_TO_HTTPS_U1_P1], + }, + { + description: "HTTP form, different passwords, different scheme", + formActionOrigin: DOMAIN1_HTTP_ORIGIN, + logins: [DOMAIN1_HTTPS_TO_HTTPS_U1_P1, DOMAIN1_HTTP_TO_HTTP_U1_P2], + expected: [DOMAIN1_HTTP_TO_HTTP_U1_P2], + }, + { + description: "HTTPS form, same origin, different port, both schemes", + formActionOrigin: DOMAIN1_HTTPS_ORIGIN, + logins: [ + DOMAIN1_HTTPS_TO_HTTPS_U1_P1, + DOMAIN1_HTTP_TO_HTTP_U1_P1_DIFFERENT_PORT, + DOMAIN1_HTTPS_TO_HTTPS_U1_P2_DIFFERENT_PORT, + ], + expected: [ + DOMAIN1_HTTPS_TO_HTTPS_U1_P1, + DOMAIN1_HTTPS_TO_HTTPS_U1_P2_DIFFERENT_PORT, + ], + }, + { + description: "HTTP form, same origin, different port, both schemes", + formActionOrigin: DOMAIN1_HTTP_ORIGIN, + logins: [ + DOMAIN1_HTTPS_TO_HTTPS_U1_P1, + DOMAIN1_HTTP_TO_HTTP_U1_P1_DIFFERENT_PORT, + DOMAIN1_HTTPS_TO_HTTPS_U1_P2_DIFFERENT_PORT, + ], + expected: [DOMAIN1_HTTP_TO_HTTP_U1_P1_DIFFERENT_PORT], + }, + { + description: "HTTPS form, different origin, different scheme", + formActionOrigin: DOMAIN1_HTTPS_ORIGIN, + logins: [DOMAIN1_HTTPS_TO_HTTPS_U1_P1, DOMAIN2_HTTP_TO_HTTP_U1_P1], + expected: [DOMAIN1_HTTPS_TO_HTTPS_U1_P1], + }, + { + description: + "HTTPS form, different origin, different scheme, same password, same hostPort preferred", + formActionOrigin: DOMAIN1_HTTPS_ORIGIN, + logins: [DOMAIN1_HTTP_TO_HTTP_U1_P1, DOMAIN2_HTTPS_TO_HTTPS_U1_P1], + expected: [DOMAIN1_HTTP_TO_HTTP_U1_P1], + }, + { + description: "HTTP form, different origin, different scheme", + formActionOrigin: DOMAIN1_HTTP_ORIGIN, + logins: [DOMAIN1_HTTPS_TO_HTTPS_U1_P1, DOMAIN2_HTTP_TO_HTTP_U1_P1], + expected: [DOMAIN2_HTTP_TO_HTTP_U1_P1], + }, + { + description: "HTTPS form, different username, different scheme", + formActionOrigin: DOMAIN1_HTTPS_ORIGIN, + logins: [DOMAIN1_HTTPS_TO_HTTPS_U1_P1, DOMAIN1_HTTP_TO_HTTP_U2_P1], + expected: [DOMAIN1_HTTPS_TO_HTTPS_U1_P1, DOMAIN1_HTTP_TO_HTTP_U2_P1], + }, + { + description: "HTTP form, different username, different scheme", + formActionOrigin: DOMAIN1_HTTP_ORIGIN, + logins: [DOMAIN1_HTTPS_TO_HTTPS_U1_P1, DOMAIN1_HTTP_TO_HTTP_U2_P1], + expected: [DOMAIN1_HTTP_TO_HTTP_U2_P1], + }, + { + description: "HTTPS form, different usernames, different schemes", + formActionOrigin: DOMAIN1_HTTPS_ORIGIN, + logins: [ + DOMAIN1_HTTPS_TO_HTTPS_U1_P2, + DOMAIN1_HTTPS_TO_HTTPS_U2_P1, + DOMAIN1_HTTP_TO_HTTP_U1_P1, + DOMAIN1_HTTP_TO_HTTP_U3_P1, + ], + expected: [ + DOMAIN1_HTTPS_TO_HTTPS_U1_P2, + DOMAIN1_HTTPS_TO_HTTPS_U2_P1, + DOMAIN1_HTTP_TO_HTTP_U3_P1, + ], + }, + ]; + + for (let tc of testcases) { + info(tc.description); + + let guids = await Services.logins.addLogins(tc.logins); + Assert.strictEqual( + guids.length, + tc.logins.length, + "Check length of added logins" + ); + + let actual = await LMP.searchAndDedupeLogins(tc.formActionOrigin, { + formActionOrigin: tc.formActionOrigin, + looseActionOriginMatch: true, + acceptDifferentSubdomains: true, + }); + info(`actual:\n ${JSON.stringify(actual, null, 2)}`); + info(`expected:\n ${JSON.stringify(tc.expected, null, 2)}`); + Assert.strictEqual( + actual.length, + tc.expected.length, + `Check result length` + ); + for (let [i, login] of tc.expected.entries()) { + Assert.ok(actual[i].equals(login), `Check index ${i}`); + } + + Services.logins.removeAllUserFacingLogins(); + } +}); + +add_task(async function test_reject_duplicates() { + const testcases = [ + { + description: "HTTPS form, both https, same username, different password", + formActionOrigin: DOMAIN1_HTTPS_ORIGIN, + logins: [DOMAIN1_HTTPS_TO_HTTPS_U1_P1, DOMAIN1_HTTPS_TO_HTTPS_U1_P2], + }, + { + description: "HTTP form, both https, same username, different password", + formActionOrigin: DOMAIN1_HTTP_ORIGIN, + logins: [DOMAIN1_HTTPS_TO_HTTPS_U1_P1, DOMAIN1_HTTPS_TO_HTTPS_U1_P2], + }, + ]; + + for (const tc of testcases) { + info(tc.description); + + const result = await Services.logins.addLogins(tc.logins); + Assert.equal(result.length, 1, "only single login added"); + + Services.logins.removeAllUserFacingLogins(); + } +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_LoginManagerPrompter_getUsernameSuggestions.js b/toolkit/components/passwordmgr/test/unit/test_LoginManagerPrompter_getUsernameSuggestions.js new file mode 100644 index 0000000000..d3a94ba08b --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_LoginManagerPrompter_getUsernameSuggestions.js @@ -0,0 +1,188 @@ +const { LoginManagerPrompter } = ChromeUtils.importESModule( + "resource://gre/modules/LoginManagerPrompter.sys.mjs" +); + +const TEST_CASES = [ + { + description: "page values should appear before saved values", + savedLogins: [{ username: "savedUsername", password: "savedPassword" }], + possibleUsernames: ["pageUsername"], + expectedSuggestions: [ + { text: "pageUsername", style: "possible-username" }, + { text: "savedUsername", style: "login" }, + ], + isLoggedIn: true, + }, + { + description: "duplicate page values should be deduped", + savedLogins: [], + possibleUsernames: ["pageUsername", "pageUsername", "pageUsername2"], + expectedSuggestions: [ + { text: "pageUsername", style: "possible-username" }, + { text: "pageUsername2", style: "possible-username" }, + ], + isLoggedIn: true, + }, + { + description: "page values should dedupe and win over saved values", + savedLogins: [{ username: "username", password: "savedPassword" }], + possibleUsernames: ["username"], + expectedSuggestions: [{ text: "username", style: "possible-username" }], + isLoggedIn: true, + }, + { + description: "empty usernames should be filtered out", + savedLogins: [{ username: "", password: "savedPassword" }], + possibleUsernames: [""], + expectedSuggestions: [], + isLoggedIn: true, + }, + { + description: "auth logins should be displayed alongside normal ones", + savedLogins: [ + { username: "normalUsername", password: "normalPassword" }, + { isAuth: true, username: "authUsername", password: "authPassword" }, + ], + possibleUsernames: [""], + expectedSuggestions: [ + { text: "normalUsername", style: "login" }, + { text: "authUsername", style: "login" }, + ], + isLoggedIn: true, + }, + { + description: "saved logins from subdomains should be displayed", + savedLogins: [ + { + username: "savedUsername", + password: "savedPassword", + origin: "https://subdomain.example.com", + }, + ], + possibleUsernames: [], + expectedSuggestions: [{ text: "savedUsername", style: "login" }], + isLoggedIn: true, + }, + { + description: "usernames from different subdomains should be deduped", + savedLogins: [ + { + username: "savedUsername", + password: "savedPassword", + origin: "https://subdomain.example.com", + }, + { + username: "savedUsername", + password: "savedPassword", + origin: "https://example.com", + }, + ], + possibleUsernames: [], + expectedSuggestions: [{ text: "savedUsername", style: "login" }], + isLoggedIn: true, + }, + { + description: "No results with saved login when Primary Password is locked", + savedLogins: [ + { + username: "savedUsername", + password: "savedPassword", + origin: "https://example.com", + }, + ], + possibleUsernames: [], + expectedSuggestions: [], + isLoggedIn: false, + }, +]; + +const LOGIN = TestData.formLogin({ + origin: "https://example.com", + formActionOrigin: "https://example.com", + username: "LOGIN is used only for its origin", + password: "LOGIN is used only for its origin", +}); + +function _setPrefs() { + Services.prefs.setBoolPref("signon.capture.inputChanges.enabled", true); + registerCleanupFunction(() => { + Services.prefs.clearUserPref("signon.capture.inputChanges.enabled"); + }); +} + +async function _saveLogins(loginDatas) { + const logins = loginDatas.map(loginData => { + let login; + if (loginData.isAuth) { + login = TestData.authLogin({ + origin: loginData.origin ?? "https://example.com", + httpRealm: "example-realm", + username: loginData.username, + password: loginData.password, + }); + } else { + login = TestData.formLogin({ + origin: loginData.origin ?? "https://example.com", + formActionOrigin: "https://example.com", + username: loginData.username, + password: loginData.password, + }); + } + return login; + }); + await Services.logins.addLogins(logins); +} + +function _compare(expectedArr, actualArr) { + Assert.ok(!!expectedArr, "Expect expectedArr to be truthy"); + Assert.ok(!!actualArr, "Expect actualArr to be truthy"); + Assert.ok( + expectedArr.length == actualArr.length, + "Expect expectedArr and actualArr to be the same length" + ); + for (let i = 0; i < expectedArr.length; i++) { + const expected = expectedArr[i]; + const actual = actualArr[i]; + + Assert.ok( + expected.text == actual.text, + `Expect element #${i} text to match. Expected: '${expected.text}', Actual '${actual.text}'` + ); + Assert.ok( + expected.style == actual.style, + `Expect element #${i} text to match. Expected: '${expected.style}', Actual '${actual.style}'` + ); + } +} + +async function _test(testCase) { + info(`Starting test case: ${testCase.description}`); + info(`Storing saved logins: ${JSON.stringify(testCase.savedLogins)}`); + await _saveLogins(testCase.savedLogins); + + if (!testCase.isLoggedIn) { + // Primary Password should be enabled and locked + LoginTestUtils.primaryPassword.enable(); + } + + info("Computing results"); + const result = await LoginManagerPrompter._getUsernameSuggestions( + LOGIN, + testCase.possibleUsernames + ); + + _compare(testCase.expectedSuggestions, result); + + info("Cleaning up state"); + if (!testCase.isLoggedIn) { + LoginTestUtils.primaryPassword.disable(); + } + LoginTestUtils.clearData(); +} + +add_task(async function test_LoginManagerPrompter_getUsernameSuggestions() { + _setPrefs(); + for (const tc of TEST_CASES) { + await _test(tc); + } +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_OSCrypto_win.js b/toolkit/components/passwordmgr/test/unit/test_OSCrypto_win.js new file mode 100644 index 0000000000..9545f5ea02 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_OSCrypto_win.js @@ -0,0 +1,138 @@ +/** + * Tests the OSCrypto object. + */ + +"use strict"; + +// Globals + +ChromeUtils.defineESModuleGetters(this, { + OSCrypto: "resource://gre/modules/OSCrypto_win.sys.mjs", +}); + +let crypto = new OSCrypto(); + +// Tests + +add_task(function test_getIELoginHash() { + Assert.equal( + crypto.getIELoginHash("https://bugzilla.mozilla.org/page.cgi"), + "4A66FE96607885790F8E67B56EEE52AB539BAFB47D" + ); + + Assert.equal( + crypto.getIELoginHash("https://github.com/login"), + "0112F7DCE67B8579EA01367678AA44AB9868B5A143" + ); + + Assert.equal( + crypto.getIELoginHash("https://login.live.com/login.srf"), + "FBF92E5D804C82717A57856533B779676D92903688" + ); + + Assert.equal( + crypto.getIELoginHash("https://preview.c9.io/riadh/w1/pass.1.html"), + "6935CF27628830605927F86AB53831016FC8973D1A" + ); + + Assert.equal( + crypto.getIELoginHash("https://reviewboard.mozilla.org/account/login/"), + "09141FD287E2E59A8B1D3BB5671537FD3D6B61337A" + ); + + Assert.equal( + crypto.getIELoginHash("https://www.facebook.com/"), + "EF44D3E034009CB0FD1B1D81A1FF3F3335213BD796" + ); +}); + +add_task(function test_decryptData_encryptData() { + function encryptDecrypt(value, key) { + Assert.ok(true, `Testing value='${value}' with key='${key}'`); + let encrypted = crypto.encryptData(value, key); + Assert.ok(!!encrypted, "Encrypted value returned"); + let decrypted = crypto.decryptData(encrypted, key); + Assert.equal(decrypted, value, "Decrypted value matches initial value"); + return decrypted; + } + + let values = [ + "", + "secret", + "https://www.mozilla.org", + "https://reviewboard.mozilla.org", + "https://bugzilla.mozilla.org/page.cgi", + "新年快樂新年快樂", + ]; + let keys = [ + null, + "a", + "keys", + "abcdedf", + "pass", + "https://bugzilla.mozilla.org/page.cgi", + "https://login.live.com/login.srf", + ]; + for (let value of values) { + for (let key of keys) { + Assert.equal( + encryptDecrypt(value, key), + value, + `'${value}' encrypted then decrypted with entropy of '${key}' should match original value.` + ); + } + } + + let url = "https://twitter.com/"; + let value = [ + 1, 0, 0, 0, 208, 140, 157, 223, 1, 21, 209, 17, 140, 122, 0, 192, 79, 194, + 151, 235, 1, 0, 0, 0, 254, 58, 230, 75, 132, 228, 181, 79, 184, 160, 37, + 106, 201, 29, 42, 152, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 16, 102, 0, 0, 0, 1, 0, + 0, 32, 0, 0, 0, 90, 136, 17, 124, 122, 57, 178, 24, 34, 86, 209, 198, 184, + 107, 58, 58, 32, 98, 61, 239, 129, 101, 56, 239, 114, 159, 139, 165, 183, + 40, 183, 85, 0, 0, 0, 0, 14, 128, 0, 0, 0, 2, 0, 0, 32, 0, 0, 0, 147, 170, + 34, 21, 53, 227, 191, 6, 201, 84, 106, 31, 57, 227, 46, 127, 219, 199, 80, + 142, 37, 104, 112, 223, 26, 165, 223, 55, 176, 89, 55, 37, 112, 0, 0, 0, 98, + 70, 221, 109, 5, 152, 46, 11, 190, 213, 226, 58, 244, 20, 180, 217, 63, 155, + 227, 132, 7, 151, 235, 6, 37, 232, 176, 182, 141, 191, 251, 50, 20, 123, 53, + 11, 247, 233, 112, 121, 130, 27, 168, 68, 92, 144, 192, 7, 12, 239, 53, 217, + 253, 155, 54, 109, 236, 216, 225, 245, 79, 234, 165, 225, 104, 36, 77, 13, + 195, 237, 143, 165, 100, 107, 230, 70, 54, 19, 179, 35, 8, 101, 93, 202, + 121, 210, 222, 28, 93, 122, 36, 84, 185, 249, 238, 3, 102, 149, 248, 94, + 137, 16, 192, 22, 251, 220, 22, 223, 16, 58, 104, 187, 64, 0, 0, 0, 70, 72, + 15, 119, 144, 66, 117, 203, 190, 82, 131, 46, 111, 130, 238, 191, 170, 63, + 186, 117, 46, 88, 171, 3, 94, 146, 75, 86, 243, 159, 63, 195, 149, 25, 105, + 141, 42, 217, 108, 18, 63, 62, 98, 182, 241, 195, 12, 216, 152, 230, 176, + 253, 202, 129, 41, 185, 135, 111, 226, 92, 27, 78, 27, 198, + ]; + + let arr1 = crypto.arrayToString(value); + let arr2 = crypto.stringToArray( + crypto.decryptData(crypto.encryptData(arr1, url), url) + ); + for (let i = 0; i < arr1.length; i++) { + Assert.equal(arr2[i], value[i], "Checking index " + i); + } +}); + +add_task(function test_decryptDataOutput() { + const testString = "2<FPZd"; + const encrypted = crypto.encryptData(testString); + + const decryptedString = crypto.decryptData(encrypted, null, "string"); + Assert.equal( + decryptedString, + testString, + "Decrypted string matches initial value" + ); + + const decryptedBytes = crypto.decryptData(encrypted, null, "bytes"); + testString.split("").forEach((c, i) => { + const code = c.charCodeAt(0); + Assert.equal( + decryptedBytes[i], + code, + `Decrypted bytes matches ${c} charCode (${code})` + ); + }); +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_PasswordGenerator.js b/toolkit/components/passwordmgr/test/unit/test_PasswordGenerator.js new file mode 100644 index 0000000000..a5537a4289 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_PasswordGenerator.js @@ -0,0 +1,122 @@ +"use strict"; + +const { PasswordGenerator } = ChromeUtils.importESModule( + "resource://gre/modules/PasswordGenerator.sys.mjs" +); + +add_task(async function test_shuffleString() { + let original = "1234567890"; + let shuffled = PasswordGenerator._shuffleString(original); + notEqual(original, shuffled, "String should have been shuffled"); +}); + +add_task(async function test_randomUInt8Index() { + throws( + () => PasswordGenerator._randomUInt8Index(256), + /uint8/, + "Should throw for larger than uint8" + ); + Assert.ok( + Number.isSafeInteger(PasswordGenerator._randomUInt8Index(255)), + "Check integer returned" + ); +}); + +add_task(async function test_generatePassword_classes() { + let password = PasswordGenerator.generatePassword( + /* REQUIRED_CHARACTER_CLASSES */ + + { length: 4 } + ); + info(password); + equal(password.length, 4, "Check length is correct"); + Assert.ok( + password.match(/[a-km-np-z]/), + "Minimal password should include at least one lowercase character" + ); + Assert.ok( + password.match(/[A-HJ-NP-Z]/), + "Minimal password should include at least one uppercase character" + ); + Assert.ok( + password.match(/[2-9]/), + "Minimal password should include at least one digit" + ); + Assert.ok( + password.match(/[-~!@#$%^&*_+=)}:;"'>,.?\]]/), + "Minimal password should include at least one special character" + ); + Assert.ok( + password.match(/^[a-km-np-zA-HJ-NP-Z2-9-~!@#$%^&*_+=)}:;"'>,.?\]]+$/), + "All characters should be in the expected set" + ); +}); + +add_task(async function test_generatePassword_length() { + let password = PasswordGenerator.generatePassword({ length: 5 }); + info(password); + equal(password.length, 5, "Check length is correct"); + + password = PasswordGenerator.generatePassword({ length: 3 }); + equal(password.length, 4, "Minimum generated length is 4"); + + password = PasswordGenerator.generatePassword({ length: Math.pow(2, 8) }); + equal( + password.length, + Math.pow(2, 8) - 1, + "Maximum generated length is Math.pow(2, 8) - 1 " + ); + + Assert.ok( + password.match(/^[a-km-np-zA-HJ-NP-Z2-9-~!@#$%^&*_+=)}:;"'>,.?\]]+$/), + "All characters should be in the expected set" + ); +}); + +add_task(async function test_generatePassword_defaultLength() { + let password = PasswordGenerator.generatePassword({}); + info(password); + equal(password.length, 15, "Check default length is correct"); + Assert.ok( + password.match(/^[a-km-np-zA-HJ-NP-Z2-9-~!@#$%^&*_+=)}:;"'>,.?\]]{15}$/), + "All characters should be in the expected set" + ); +}); + +add_task( + async function test_generatePassword_immutableDefaultRequiredClasses() { + // We need to escape our special characters since some of them + // have special meaning in regex. + let specialCharacters = PasswordGenerator._getSpecialCharacters(); + let escapedSpecialCharacters = specialCharacters.replace( + /[.*\-+?^${}()|[\]\\]/g, + "\\$&" + ); + specialCharacters = new RegExp(`[${escapedSpecialCharacters}]`); + let rules = new Map(); + rules.set("required", ["special"]); + let password = PasswordGenerator.generatePassword({ rules }); + equal(password.length, 15, "Check default length is correct"); + Assert.ok( + password.match(specialCharacters), + "Password should include special character." + ); + let allCharacters = new RegExp( + `[a-km-np-zA-HJ-NP-Z2-9 ${escapedSpecialCharacters}]{15}` + ); + Assert.ok( + password.match(allCharacters), + "All characters should be in the expected set" + ); + password = PasswordGenerator.generatePassword({}); + equal(password.length, 15, "Check default length is correct"); + Assert.ok( + password.match(specialCharacters), + "Password should include special character." + ); + Assert.ok( + password.match(/^[a-km-np-zA-HJ-NP-Z2-9-~!@#$%^&*_+=)}:;"'>,.?\]]{15}$/), + "All characters, minus special characters, should be in the expected set" + ); + } +); diff --git a/toolkit/components/passwordmgr/test/unit/test_PasswordRulesManager_generatePassword.js b/toolkit/components/passwordmgr/test/unit/test_PasswordRulesManager_generatePassword.js new file mode 100644 index 0000000000..88520769cf --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_PasswordRulesManager_generatePassword.js @@ -0,0 +1,523 @@ +/** + * Test PasswordRulesManager.generatePassword() + */ + +"use strict"; +const { PasswordGenerator } = ChromeUtils.importESModule( + "resource://gre/modules/PasswordGenerator.sys.mjs" +); +const { PasswordRulesManagerParent } = ChromeUtils.importESModule( + "resource://gre/modules/PasswordRulesManager.sys.mjs" +); +const { PasswordRulesParser } = ChromeUtils.importESModule( + "resource://gre/modules/PasswordRulesParser.sys.mjs" +); +const { RemoteSettings } = ChromeUtils.importESModule( + "resource://services-settings/remote-settings.sys.mjs" +); +const { TelemetryTestUtils } = ChromeUtils.importESModule( + "resource://testing-common/TelemetryTestUtils.sys.mjs" +); + +Services.prefs.setBoolPref( + "toolkit.telemetry.testing.overrideProductsCheck", + true +); + +const IMPROVED_RULES_COLLECTION = "password-rules"; + +function getRulesForRecord(records, baseOrigin) { + let rules; + for (let record of records) { + if (record.Domain === baseOrigin) { + rules = record["password-rules"]; + break; + } + } + return rules; +} + +add_task(async function test_verify_password_rules() { + const testCases = [ + { maxlength: 12 }, + { minlength: 4, maxlength: 32 }, + { required: ["lower"] }, + { required: ["upper"] }, + { required: ["digit"] }, + { required: ["special"] }, + { required: ["*", "$", "@", "_", "B", "Q"] }, + { required: ["lower", "upper", "special"] }, + { "max-consecutive": 2 }, + { + minlength: 8, + required: [ + "digit", + [ + "-", + " ", + "!", + '"', + "#", + "$", + "&", + "'", + "(", + ")", + "*", + "+", + ",", + ".", + ":", + ";", + "<", + "=", + ">", + "?", + "@", + "[", + "^", + "_", + "`", + "{", + "|", + "}", + "~", + "]", + ], + ], + }, + { minlength: 8, maxlength: 16, required: ["lower", "upper", "digit"] }, + { + minlength: 8, + maxlength: 20, + required: ["lower", "upper", "digit"], + "max-consecutive": 2, + }, + ]; + + for (let test of testCases) { + let mapOfRules = new Map(); + let rules = ``; + for (let testRules in test) { + mapOfRules.set(testRules, test[testRules]); + if (test[testRules] === "required" && test[testRules].includes("*$")) { + rules += `${testRules}: ${test[testRules].join("")}`; + } else { + rules += `${testRules}: ${test[testRules]};`; + } + } + let generatedPassword = PasswordGenerator.generatePassword({ + rules: mapOfRules, + }); + verifyPassword(rules, generatedPassword); + } +}); + +/** + * Note: We do not test the "allowed" property in these tests. + * This is because a password can still be valid even if there is not a character from + * the "allowed" list. + * If a character, or character class, is required, then it should be marked as such. + * */ + +add_task(async function test_generatePassword_many_rules() { + // Force password generation to be enabled. + Services.prefs.setBoolPref("signon.generation.available", true); + Services.prefs.setBoolPref("signon.generation.enabled", true); + Services.prefs.setBoolPref("signon.improvedPasswordRules.enabled", true); + // TEST_ORIGIN emulates the browsingContext.currentWindowGlobal.documentURI variable in LoginManagerParent + // and so it should always be a correctly formed URI when working with + // the PasswordRulesParser and PasswordRulesManager modules + const TEST_ORIGIN = Services.io.newURI("https://example.com"); + + // TEST_BASE_ORIGIN is how each domain is stored in RemoteSettings, and so + // we need this in order to parse out the particular password rules we're verifying + const TEST_BASE_ORIGIN = "example.com"; + await LoginTestUtils.remoteSettings.setupImprovedPasswordRules(); + const records = await RemoteSettings(IMPROVED_RULES_COLLECTION).get(); + + let rules = getRulesForRecord(records, TEST_BASE_ORIGIN); + + rules = PasswordRulesParser.parsePasswordRules(rules); + Assert.ok(rules.length, "Rules should exist after parsing"); + + let PRMP = new PasswordRulesManagerParent(); + Assert.ok(PRMP.generatePassword, "PRMP.generatePassword exists"); + + let generatedPassword = await PRMP.generatePassword(TEST_ORIGIN); + Assert.ok(generatedPassword, "A password was generated"); + + verifyPassword(rules, generatedPassword); + + await LoginTestUtils.remoteSettings.cleanImprovedPasswordRules(); +}); + +add_task(async function test_generatePassword_all_characters_allowed() { + // Force password generation to be enabled. + Services.prefs.setBoolPref("signon.generation.available", true); + Services.prefs.setBoolPref("signon.generation.enabled", true); + Services.prefs.setBoolPref("signon.improvedPasswordRules.enabled", true); + // TEST_ORIGIN emulates the browsingContext.currentWindowGlobal.documentURI variable in LoginManagerParent + // and so it should always be a correctly formed URI when working with + // the PasswordRulesParser and PasswordRulesManager modules + const TEST_ORIGIN = Services.io.newURI("https://example.com"); + + // TEST_BASE_ORIGIN is how each domain is stored in RemoteSettings, and so + // we need this in order to parse out the particular password rules we're verifying + const TEST_BASE_ORIGIN = "example.com"; + const TEST_RULES = "minlength: 6; maxlength: 12;"; + await LoginTestUtils.remoteSettings.setupImprovedPasswordRules( + TEST_BASE_ORIGIN, + TEST_RULES + ); + const records = await RemoteSettings(IMPROVED_RULES_COLLECTION).get(); + + let rules = getRulesForRecord(records, TEST_BASE_ORIGIN); + + rules = PasswordRulesParser.parsePasswordRules(rules); + Assert.ok(rules.length, "Rules should exist after parsing"); + + let PRMP = new PasswordRulesManagerParent(); + Assert.ok(PRMP.generatePassword, "PRMP.generatePassword exists"); + + let generatedPassword = await PRMP.generatePassword(TEST_ORIGIN); + Assert.ok(generatedPassword, "A password was generated"); + + verifyPassword(rules, generatedPassword); + + await LoginTestUtils.remoteSettings.cleanImprovedPasswordRules(); +}); + +add_task(async function test_generatePassword_required_special_character() { + // Force password generation to be enabled. + Services.prefs.setBoolPref("signon.generation.available", true); + Services.prefs.setBoolPref("signon.generation.enabled", true); + Services.prefs.setBoolPref("signon.improvedPasswordRules.enabled", true); + // TEST_ORIGIN emulates the browsingContext.currentWindowGlobal.documentURI variable in LoginManagerParent + // and so it should always be a correctly formed URI when working with + // the PasswordRulesParser and PasswordRulesManager modules + const TEST_ORIGIN = Services.io.newURI("https://example.com"); + + // TEST_BASE_ORIGIN is how each domain is stored in RemoteSettings, and so + // we need this in order to parse out the particular password rules we're verifying + const TEST_BASE_ORIGIN = "example.com"; + const TEST_RULES = "required: special"; + await LoginTestUtils.remoteSettings.setupImprovedPasswordRules( + TEST_BASE_ORIGIN, + TEST_RULES + ); + const records = await RemoteSettings(IMPROVED_RULES_COLLECTION).get(); + + let rules = getRulesForRecord(records, TEST_BASE_ORIGIN); + + rules = PasswordRulesParser.parsePasswordRules(rules); + Assert.ok(rules.length, "Rules should exist after parsing"); + + let PRMP = new PasswordRulesManagerParent(); + Assert.ok(PRMP.generatePassword, "PRMP.generatePassword exists"); + + let generatedPassword = await PRMP.generatePassword(TEST_ORIGIN); + Assert.ok(generatedPassword, "A password was generated"); + + verifyPassword(TEST_RULES, generatedPassword); +}); + +add_task( + async function test_generatePassword_with_arbitrary_required_characters() { + // Force password generation to be enabled. + Services.prefs.setBoolPref("signon.generation.available", true); + Services.prefs.setBoolPref("signon.generation.enabled", true); + Services.prefs.setBoolPref("signon.improvedPasswordRules.enabled", true); + // TEST_ORIGIN emulates the browsingContext.currentWindowGlobal.documentURI variable in LoginManagerParent + // and so it should always be a correctly formed URI when working with + // the PasswordRulesParser and PasswordRulesManager modules + const TEST_ORIGIN = Services.io.newURI("https://example.com"); + + // TEST_BASE_ORIGIN is how each domain is stored in RemoteSettings, and so + // we need this in order to parse out the particular password rules we're verifying + const TEST_BASE_ORIGIN = "example.com"; + const REQUIRED_ARBITRARY_CHARACTERS = "!#$@*()_+="; + // We use an extremely long password to ensure there are no invalid characters generated in the password. + // This ensures we exhaust all of "allRequiredCharacters" in PasswordGenerator.jsm. + // Otherwise, there's a small chance a "," may have been added to "allRequiredCharacters" + // which will generate an invalid password in this case. + const TEST_RULES = `required: [${REQUIRED_ARBITRARY_CHARACTERS}], upper, lower; maxlength: 255; minlength: 255;`; + await LoginTestUtils.remoteSettings.setupImprovedPasswordRules( + TEST_BASE_ORIGIN, + TEST_RULES + ); + const records = await RemoteSettings(IMPROVED_RULES_COLLECTION).get(); + + let rules = getRulesForRecord(records, TEST_BASE_ORIGIN); + + rules = PasswordRulesParser.parsePasswordRules(rules); + Assert.ok(rules.length, "Rules should exist after parsing"); + + let PRMP = new PasswordRulesManagerParent(); + Assert.ok(PRMP.generatePassword, "PRMP.generatePassword exists"); + + let generatedPassword = await PRMP.generatePassword(TEST_ORIGIN); + generatedPassword = await PRMP.generatePassword(TEST_ORIGIN); + Assert.ok(generatedPassword, "A password was generated"); + + verifyPassword(TEST_RULES, generatedPassword); + + let specialCharacters = PasswordGenerator._getSpecialCharacters(); + let digits = PasswordGenerator._getDigits(); + // Additional verification for this password case since + // we want to ensure no extra special characters and no digits are generated. + let disallowedSpecialCharacters = ""; + for (let char of specialCharacters) { + if (!REQUIRED_ARBITRARY_CHARACTERS.includes(char)) { + disallowedSpecialCharacters += char; + } + } + for (let char of disallowedSpecialCharacters) { + Assert.ok( + !generatedPassword.includes(char), + "Password must not contain any disallowed special characters: " + char + ); + } + for (let char of digits) { + Assert.ok( + !generatedPassword.includes(char), + "Password must not contain any digits: " + char + ); + } + } +); + +// Checks the "www4.prepaid.bankofamerica.com" case to ensure the rules are found +add_task(async function test_generatePassword_subdomain_rule() { + const testCases = [ + { + uri: "https://www4.test.example.com", + rulesDomain: "example.com", + shouldApplyPWRule: true, + }, + { + uri: "https://test.example.com", + rulesDomain: "example.com", + shouldApplyPWRule: true, + }, + { + uri: "https://example.com", + rulesDomain: "example.com", + shouldApplyPWRule: true, + }, + { + uri: "https://www4.test.example.com", + rulesDomain: "test.example.com", + shouldApplyPWRule: true, + }, + { + uri: "https://test.example.com", + rulesDomain: "test.example.com", + shouldApplyPWRule: true, + }, + { + uri: "https://example.com", + rulesDomain: "test.example.com", + shouldApplyPWRule: false, + }, + { + uri: "https://evil.com", + rulesDomain: "example.com", + shouldApplyPWRule: false, + }, + { + uri: "https://evil.example.com", + rulesDomain: "test.example.com", + shouldApplyPWRule: false, + }, + { + uri: "https://test.example.com.cn", + rulesDomain: "test.example.com", + shouldApplyPWRule: false, + }, + { + uri: "https://eviltest.example.com", + rulesDomain: "test.example.com", + shouldApplyPWRule: false, + }, + ]; + const TEST_RULES = "required: special; maxlength: 12;"; + + for (let test of testCases) { + await LoginTestUtils.remoteSettings.setupImprovedPasswordRules( + test.rulesDomain, + TEST_RULES + ); + const TEST_ORIGIN = Services.io.newURI(test.uri); + const TEST_BASE_ORIGIN = test.rulesDomain; + const records = await RemoteSettings(IMPROVED_RULES_COLLECTION).get(); + + let rules = getRulesForRecord(records, TEST_BASE_ORIGIN); + + rules = PasswordRulesParser.parsePasswordRules(rules); + Assert.ok(rules.length, "Rules should exist after parsing"); + + let PRMP = new PasswordRulesManagerParent(); + + let generatedPassword = await PRMP.generatePassword(TEST_ORIGIN); + Assert.ok( + generatedPassword, + "A password was generated for URI: " + test.uri + ); + + // If a rule should be applied, we verify the password has all the required classes in the generated password. + if (test.shouldApplyPWRule) { + verifyPassword(rules, generatedPassword); + } + } +}); + +add_task(async function test_improved_password_rules_telemetry() { + // Force password generation to be enabled. + Services.prefs.setBoolPref("signon.generation.available", true); + Services.prefs.setBoolPref("signon.generation.enabled", true); + Services.prefs.setBoolPref("signon.improvedPasswordRules.enabled", true); + + const IMPROVED_PASSWORD_GENERATION_HISTOGRAM = + "PWMGR_NUM_IMPROVED_GENERATED_PASSWORDS"; + + // Clear out the previous pings from this test + let snapshot = TelemetryTestUtils.getAndClearHistogram( + IMPROVED_PASSWORD_GENERATION_HISTOGRAM + ); + + // TEST_ORIGIN emulates the browsingContext.currentWindowGlobal.documentURI variable in LoginManagerParent + // and so it should always be a correctly formed URI when working with + // the PasswordRulesParser and PasswordRulesManager modules + let TEST_ORIGIN = Services.io.newURI("https://example.com"); + await LoginTestUtils.remoteSettings.setupImprovedPasswordRules(); + + let PRMP = new PasswordRulesManagerParent(); + + // Generate a password with custom rules, + // so we should send a ping to the custom rules bucket (position 1). + let generatedPassword = await PRMP.generatePassword(TEST_ORIGIN); + Assert.ok(generatedPassword, "A password was generated"); + + TelemetryTestUtils.assertHistogram(snapshot, 1, 1); + + TEST_ORIGIN = Services.io.newURI("https://otherexample.com"); + // Generate a password with default rules, + // so we should send a ping to the default rules bucket (position 0). + snapshot = TelemetryTestUtils.getAndClearHistogram( + IMPROVED_PASSWORD_GENERATION_HISTOGRAM + ); + generatedPassword = await PRMP.generatePassword(TEST_ORIGIN); + Assert.ok(generatedPassword, "A password was generated"); + + TelemetryTestUtils.assertHistogram(snapshot, 0, 1); +}); + +function checkCharacters(password, _characters) { + let containsCharacters = false; + let testString = _characters.join(""); + for (let character of password) { + containsCharacters = testString.includes(character); + if (containsCharacters) { + return containsCharacters; + } + } + return containsCharacters; +} + +function checkConsecutiveCharacters(generatePassword, value) { + let findMaximumRepeating = str => { + let max = 0; + for (let start = 0, end = 1; end < str.length; ) { + if (str[end] === str[start]) { + if (max < end - start + 1) { + max = end - start + 1; + if (max > value) { + return max; + } + } + end++; + } else { + start = end++; + } + } + return max; + }; + let consecutiveCharacters = findMaximumRepeating(generatePassword); + if (consecutiveCharacters <= value) { + return true; + } + return false; +} + +function verifyPassword(rules, generatedPassword) { + const UPPER_CASE_ALPHA = PasswordGenerator._getUpperCaseCharacters(); + const LOWER_CASE_ALPHA = PasswordGenerator._getLowerCaseCharacters(); + const DIGITS = PasswordGenerator._getDigits(); + const SPECIAL_CHARACTERS = PasswordGenerator._getSpecialCharacters(); + for (let rule of rules) { + let { _name, value } = rule; + if (_name === "required") { + for (let required of value) { + if (required._name === "upper") { + let _checkUppercase = new RegExp(`[${UPPER_CASE_ALPHA}]`); + Assert.ok( + generatedPassword.match(_checkUppercase), + "Password must include upper case letter" + ); + } else if (required._name === "lower") { + let _checkLowercase = new RegExp(`[${LOWER_CASE_ALPHA}]`); + Assert.ok( + generatedPassword.match(_checkLowercase), + "Password must include lower case letter" + ); + } else if (required._name === "digit") { + let _checkDigits = new RegExp(`[${DIGITS}]`); + Assert.ok( + generatedPassword.match(_checkDigits), + "Password must include digits" + ); + generatedPassword.match(_checkDigits); + } else if (required._name === "special") { + // We need to escape our special characters since some of them + // have special meaning in regex. + let escapedSpecialCharacters = SPECIAL_CHARACTERS.replace( + /[.*\-+?^${}()|[\]\\]/g, + "\\$&" + ); + let _checkSpecial = new RegExp(`[${escapedSpecialCharacters}]`); + Assert.ok( + generatedPassword.match(_checkSpecial), + "Password must include special character" + ); + } else { + // Nested destructing of the value object in the characters case + let [{ _characters }] = value; + + // We can't use regex to do a quick check here since the + // required characters could be characters that need to be escaped + // in order for the regex to work properly ([]"^...etc) + Assert.ok( + checkCharacters(generatedPassword, _characters), + `Password must contain one of the following characters: ${_characters}` + ); + } + } + } else if (_name === "minlength") { + Assert.ok( + generatedPassword.length >= value, + `Password should have a minimum length of ${value}` + ); + } else if (_name === "maxlength") { + Assert.ok( + generatedPassword.length <= value, + `Password should have a maximum length of ${value}` + ); + } else if (_name === "max-consecutive") { + Assert.ok( + checkConsecutiveCharacters(generatedPassword, value), + `Password must not contain more than ${value} consecutive characters` + ); + } + } +} diff --git a/toolkit/components/passwordmgr/test/unit/test_context_menu.js b/toolkit/components/passwordmgr/test/unit/test_context_menu.js new file mode 100644 index 0000000000..56d4620338 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_context_menu.js @@ -0,0 +1,345 @@ +/** + * Test the password manager context menu. + */ + +"use strict"; + +const { LoginManagerContextMenu } = ChromeUtils.importESModule( + "resource://gre/modules/LoginManagerContextMenu.sys.mjs" +); + +const dateAndTimeFormatter = new Services.intl.DateTimeFormat(undefined, { + dateStyle: "medium", +}); + +const ORIGIN_HTTP_EXAMPLE_ORG = "http://example.org"; +const ORIGIN_HTTPS_EXAMPLE_ORG = "https://example.org"; +const ORIGIN_HTTPS_EXAMPLE_ORG_8080 = "https://example.org:8080"; + +const FORM_LOGIN_HTTPS_EXAMPLE_ORG_U1_P1 = formLogin({ + formActionOrigin: ORIGIN_HTTPS_EXAMPLE_ORG, + guid: "FORM_LOGIN_HTTPS_EXAMPLE_ORG_U1_P1", + origin: ORIGIN_HTTPS_EXAMPLE_ORG, +}); + +// HTTP version of the above +const FORM_LOGIN_HTTP_EXAMPLE_ORG_U1_P1 = formLogin({ + formActionOrigin: ORIGIN_HTTP_EXAMPLE_ORG, + guid: "FORM_LOGIN_HTTP_EXAMPLE_ORG_U1_P1", + origin: ORIGIN_HTTP_EXAMPLE_ORG, +}); + +// Same as above but with a different password +const FORM_LOGIN_HTTP_EXAMPLE_ORG_U1_P2 = formLogin({ + formActionOrigin: ORIGIN_HTTP_EXAMPLE_ORG, + guid: "FORM_LOGIN_HTTP_EXAMPLE_ORG_U1_P2", + origin: ORIGIN_HTTP_EXAMPLE_ORG, + password: "pass2", +}); + +// Non-default port + +const FORM_LOGIN_HTTPS_EXAMPLE_ORG_8080_U1_P2 = formLogin({ + formActionOrigin: ORIGIN_HTTPS_EXAMPLE_ORG_8080, + guid: "FORM_LOGIN_HTTPS_EXAMPLE_ORG_8080_U1_P2", + origin: ORIGIN_HTTPS_EXAMPLE_ORG_8080, + password: "pass2", +}); + +// HTTP Auth. + +const HTTP_LOGIN_HTTPS_EXAMPLE_ORG_U1_P1 = authLogin({ + guid: "FORM_LOGIN_HTTPS_EXAMPLE_ORG_U1_P1", + origin: ORIGIN_HTTPS_EXAMPLE_ORG, +}); + +XPCOMUtils.defineLazyGetter(this, "_stringBundle", function () { + return Services.strings.createBundle( + "chrome://passwordmgr/locale/passwordmgr.properties" + ); +}); + +/** + * Prepare data for the following tests. + */ +add_task(async function test_initialize() { + Services.prefs.setBoolPref("signon.schemeUpgrades", true); +}); + +add_task(async function test_sameOriginBothHTTPAndHTTPSDeduped() { + await runTestcase({ + formOrigin: FORM_LOGIN_HTTPS_EXAMPLE_ORG_U1_P1.origin, + savedLogins: [FORM_LOGIN_HTTPS_EXAMPLE_ORG_U1_P1], + expectedItems: [ + { + login: FORM_LOGIN_HTTPS_EXAMPLE_ORG_U1_P1, + }, + ], + }); +}); + +add_task(async function test_sameOriginOnlyHTTPS_noUsername() { + let loginWithoutUsername = FORM_LOGIN_HTTPS_EXAMPLE_ORG_U1_P1.clone(); + loginWithoutUsername.QueryInterface(Ci.nsILoginMetaInfo).guid = "no-username"; + loginWithoutUsername.username = ""; + await runTestcase({ + formOrigin: loginWithoutUsername.origin, + savedLogins: [loginWithoutUsername], + expectedItems: [ + { + login: loginWithoutUsername, + time: true, + }, + ], + }); +}); + +add_task(async function test_sameOriginOnlyHTTP() { + await runTestcase({ + formOrigin: FORM_LOGIN_HTTP_EXAMPLE_ORG_U1_P1.origin, + savedLogins: [FORM_LOGIN_HTTP_EXAMPLE_ORG_U1_P1], + expectedItems: [ + { + login: FORM_LOGIN_HTTP_EXAMPLE_ORG_U1_P1, + }, + ], + }); +}); + +// Scheme upgrade/downgrade tasks + +add_task(async function test_sameOriginDedupeSchemeUpgrade() { + await runTestcase({ + formOrigin: FORM_LOGIN_HTTPS_EXAMPLE_ORG_U1_P1.origin, + savedLogins: [ + FORM_LOGIN_HTTPS_EXAMPLE_ORG_U1_P1, + FORM_LOGIN_HTTP_EXAMPLE_ORG_U1_P1, + ], + expectedItems: [ + { + login: FORM_LOGIN_HTTPS_EXAMPLE_ORG_U1_P1, + }, + ], + }); +}); + +add_task(async function test_sameOriginSchemeDowngrade() { + // Should have no https: when formOrigin is https: + await runTestcase({ + formOrigin: FORM_LOGIN_HTTP_EXAMPLE_ORG_U1_P1.origin, + savedLogins: [ + FORM_LOGIN_HTTPS_EXAMPLE_ORG_U1_P1, + FORM_LOGIN_HTTP_EXAMPLE_ORG_U1_P1, + ], + expectedItems: [ + { + login: FORM_LOGIN_HTTP_EXAMPLE_ORG_U1_P1, + }, + ], + }); +}); + +add_task(async function test_sameOriginNotShadowedSchemeUpgrade() { + await runTestcase({ + formOrigin: FORM_LOGIN_HTTPS_EXAMPLE_ORG_U1_P1.origin, + savedLogins: [ + FORM_LOGIN_HTTPS_EXAMPLE_ORG_U1_P1, + FORM_LOGIN_HTTP_EXAMPLE_ORG_U1_P2, // Different password + ], + expectedItems: [ + { + login: FORM_LOGIN_HTTPS_EXAMPLE_ORG_U1_P1, + time: true, + }, + { + login: FORM_LOGIN_HTTP_EXAMPLE_ORG_U1_P2, + time: true, + }, + ], + }); +}); + +add_task(async function test_sameOriginShadowedSchemeDowngrade() { + // Should have no https: when formOrigin is https: + await runTestcase({ + formOrigin: FORM_LOGIN_HTTP_EXAMPLE_ORG_U1_P1.origin, + savedLogins: [ + FORM_LOGIN_HTTPS_EXAMPLE_ORG_U1_P1, + FORM_LOGIN_HTTP_EXAMPLE_ORG_U1_P2, // Different password + ], + expectedItems: [ + { + login: FORM_LOGIN_HTTP_EXAMPLE_ORG_U1_P2, + }, + ], + }); +}); + +// Non-default port tasks + +add_task(async function test_sameDomainDifferentPort_onDefault() { + await runTestcase({ + formOrigin: FORM_LOGIN_HTTPS_EXAMPLE_ORG_U1_P1.origin, + savedLogins: [ + FORM_LOGIN_HTTPS_EXAMPLE_ORG_U1_P1, + FORM_LOGIN_HTTPS_EXAMPLE_ORG_8080_U1_P2, + ], + expectedItems: [ + { + login: FORM_LOGIN_HTTPS_EXAMPLE_ORG_U1_P1, + }, + ], + }); +}); + +add_task(async function test_sameDomainDifferentPort_onNonDefault() { + await runTestcase({ + // Swap the formOrigin compared to above + formOrigin: FORM_LOGIN_HTTPS_EXAMPLE_ORG_8080_U1_P2.origin, + savedLogins: [ + FORM_LOGIN_HTTPS_EXAMPLE_ORG_U1_P1, + FORM_LOGIN_HTTPS_EXAMPLE_ORG_8080_U1_P2, + ], + expectedItems: [ + { + login: FORM_LOGIN_HTTPS_EXAMPLE_ORG_8080_U1_P2, + }, + ], + }); +}); + +// HTTP auth. suggestions + +add_task(async function test_sameOriginOnlyHTTPAuth() { + await runTestcase({ + formOrigin: FORM_LOGIN_HTTPS_EXAMPLE_ORG_U1_P1.origin, + savedLogins: [HTTP_LOGIN_HTTPS_EXAMPLE_ORG_U1_P1], + expectedItems: [ + { + login: HTTP_LOGIN_HTTPS_EXAMPLE_ORG_U1_P1, + }, + ], + }); +}); + +// Helpers + +function formLogin(modifications = {}) { + let mods = Object.assign( + {}, + { + timePasswordChanged: 1573821296000, + }, + modifications + ); + return TestData.formLogin(mods); +} + +function authLogin(modifications = {}) { + let mods = Object.assign( + {}, + { + timePasswordChanged: 1573821296000, + }, + modifications + ); + return TestData.authLogin(mods); +} + +/** + * Tests if the LoginManagerContextMenu returns the correct login items. + */ +async function runTestcase({ formOrigin, savedLogins, expectedItems }) { + const DOCUMENT_CONTENT = "<form><input id='pw' type=password></form>"; + + await Services.logins.addLogins(savedLogins); + + // Create the logins menuitems fragment. + let { fragment, document } = createLoginsFragment( + formOrigin, + DOCUMENT_CONTENT + ); + + if (!expectedItems.length) { + Assert.ok(fragment === null, "Null returned. No logins were found."); + return; + } + let actualItems = [...fragment.children]; + + // Check if the items are those expected to be listed. + checkLoginItems(actualItems, expectedItems); + + document.body.appendChild(fragment); + + // Try to clear the fragment. + LoginManagerContextMenu.clearLoginsFromMenu(document); + Assert.equal( + document.querySelectorAll("menuitem").length, + 0, + "All items correctly cleared." + ); + + Services.logins.removeAllUserFacingLogins(); +} + +/** + * Create a fragment with a menuitem for each login. + */ +function createLoginsFragment(url, content) { + const CHROME_URL = "chrome://mock-chrome/content/"; + + // Create a mock document. + let document = MockDocument.createTestDocument( + CHROME_URL, + content, + undefined, + true + ); + + // We also need a simple mock Browser object for this test. + let browser = { + ownerDocument: document, + }; + + let formOrigin = LoginHelper.getLoginOrigin(url); + return { + document, + fragment: LoginManagerContextMenu.addLoginsToMenu( + null, + browser, + formOrigin + ), + }; +} + +function checkLoginItems(actualItems, expectedDetails) { + for (let [i, expectedDetail] of expectedDetails.entries()) { + let actualElement = actualItems[i]; + + Assert.equal(actualElement.localName, "menuitem", "Check localName"); + + let expectedLabel = expectedDetail.login.username; + if (!expectedLabel) { + expectedLabel += _stringBundle.GetStringFromName("noUsername"); + } + if (expectedDetail.time) { + expectedLabel += + " (" + + dateAndTimeFormatter.format( + new Date(expectedDetail.login.timePasswordChanged) + ) + + ")"; + } + Assert.equal( + actualElement.getAttribute("label"), + expectedLabel, + `Check label ${i}` + ); + } + + Assert.equal( + actualItems.length, + expectedDetails.length, + "Should have the correct number of menu items" + ); +} diff --git a/toolkit/components/passwordmgr/test/unit/test_dedupeLogins.js b/toolkit/components/passwordmgr/test/unit/test_dedupeLogins.js new file mode 100644 index 0000000000..f0305e3c69 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_dedupeLogins.js @@ -0,0 +1,411 @@ +/** + * Test LoginHelper.dedupeLogins + */ + +"use strict"; + +const DOMAIN1_HTTP_TO_HTTP_U1_P1 = TestData.formLogin({ + timePasswordChanged: 3000, + timeLastUsed: 2000, +}); +const DOMAIN1_HTTP_TO_HTTP_U1_P2 = TestData.formLogin({ + password: "password two", +}); +const DOMAIN2_HTTP_TO_HTTP_U2_P2 = TestData.formLogin({ + origin: "http://www4.example.com", + formActionOrigin: "http://www4.example.com", + password: "password two", + username: "username two", +}); + +const DOMAIN1_HTTPS_TO_HTTP_U1_P1 = TestData.formLogin({ + formActionOrigin: "http://www.example.com", + origin: "https://www3.example.com", + timePasswordChanged: 4000, + timeLastUsed: 1000, +}); +const DOMAIN1_HTTPS_TO_HTTPS_U1_P1 = TestData.formLogin({ + formActionOrigin: "https://www.example.com", + origin: "https://www3.example.com", + timePasswordChanged: 4000, + timeLastUsed: 1000, +}); + +const DOMAIN1_HTTPS_TO_EMPTY_U1_P1 = TestData.formLogin({ + formActionOrigin: "", + origin: "https://www3.example.com", +}); +const DOMAIN1_HTTPS_TO_EMPTYU_P1 = TestData.formLogin({ + origin: "https://www3.example.com", + username: "", +}); +const DOMAIN1_HTTP_AUTH = TestData.authLogin({ + origin: "http://www3.example.com", +}); +const DOMAIN1_HTTPS_AUTH = TestData.authLogin({ + origin: "https://www3.example.com", +}); +const DOMAIN1_HTTPS_LOGIN = TestData.formLogin({ + origin: "https://www3.example.com", + formActionOrigin: "https://www3.example.com", +}); +const DOMAIN1_HTTP_LOGIN = TestData.formLogin({ + origin: "http://www3.example.com", + formActionOrigin: "http://www3.example.com", +}); +const DOMAIN1_HTTPS_NONSTANDARD_PORT1 = TestData.formLogin({ + origin: "https://www3.example.com:8001", + formActionOrigin: "https://www3.example.com:8001", +}); +const DOMAIN1_HTTPS_NONSTANDARD_PORT2 = TestData.formLogin({ + origin: "https://www3.example.com:8008", + formActionOrigin: "https://www3.example.com:8008", +}); +const DOMAIN2_HTTPS_LOGIN = TestData.formLogin({ + origin: "https://www4.example.com", + formActionOrigin: "https://www4.example.com", +}); +const DOMAIN2_HTTPS_LOGIN_NEWER = TestData.formLogin({ + origin: "https://www4.example.com", + formActionOrigin: "https://www4.example.com", + timePasswordChanged: 4000, + timeLastUsed: 4000, +}); +const DOMAIN2_HTTPS_TO_HTTPS_U2_P2 = TestData.formLogin({ + origin: "https://www4.example.com", + formActionOrigin: "https://www4.example.com", + password: "password two", + username: "username two", +}); + +add_task(function test_dedupeLogins() { + // [description, expectedOutput, dedupe arg. 0, dedupe arg 1, ...] + let testcases = [ + [ + "exact dupes", + [DOMAIN1_HTTP_TO_HTTP_U1_P1], + [DOMAIN1_HTTP_TO_HTTP_U1_P1, DOMAIN1_HTTP_TO_HTTP_U1_P1], + undefined, + [], // force no resolveBy logic to test behavior of preferring the first.. + ], + [ + "default uniqueKeys is un + pw", + [DOMAIN1_HTTP_TO_HTTP_U1_P1, DOMAIN1_HTTP_TO_HTTP_U1_P2], + [DOMAIN1_HTTP_TO_HTTP_U1_P1, DOMAIN1_HTTP_TO_HTTP_U1_P2], + undefined, + [], + ], + [ + "same usernames, different passwords, dedupe username only", + [DOMAIN1_HTTP_TO_HTTP_U1_P1], + [DOMAIN1_HTTP_TO_HTTP_U1_P1, DOMAIN1_HTTP_TO_HTTP_U1_P2], + ["username"], + [], + ], + [ + "same un+pw, different scheme", + [DOMAIN1_HTTP_TO_HTTP_U1_P1], + [DOMAIN1_HTTP_TO_HTTP_U1_P1, DOMAIN1_HTTPS_TO_HTTP_U1_P1], + undefined, + [], + ], + [ + "same un+pw, different scheme, reverse order", + [DOMAIN1_HTTPS_TO_HTTP_U1_P1], + [DOMAIN1_HTTPS_TO_HTTP_U1_P1, DOMAIN1_HTTP_TO_HTTP_U1_P1], + undefined, + [], + ], + [ + "same un+pw, different scheme, include origin", + [DOMAIN1_HTTP_TO_HTTP_U1_P1, DOMAIN1_HTTPS_TO_HTTP_U1_P1], + [DOMAIN1_HTTP_TO_HTTP_U1_P1, DOMAIN1_HTTPS_TO_HTTP_U1_P1], + ["origin", "username", "password"], + [], + ], + [ + "empty username is not deduped with non-empty", + [DOMAIN1_HTTP_TO_HTTP_U1_P1, DOMAIN1_HTTPS_TO_EMPTYU_P1], + [DOMAIN1_HTTP_TO_HTTP_U1_P1, DOMAIN1_HTTPS_TO_EMPTYU_P1], + undefined, + [], + ], + [ + "empty username is deduped with same passwords", + [DOMAIN1_HTTPS_TO_EMPTYU_P1], + [DOMAIN1_HTTPS_TO_EMPTYU_P1, DOMAIN1_HTTP_TO_HTTP_U1_P1], + ["password"], + [], + ], + [ + "mix of form and HTTP auth", + [DOMAIN1_HTTP_TO_HTTP_U1_P1], + [DOMAIN1_HTTP_TO_HTTP_U1_P1, DOMAIN1_HTTP_AUTH], + undefined, + [], + ], + ]; + + for (let tc of testcases) { + let description = tc.shift(); + let expected = tc.shift(); + let actual = LoginHelper.dedupeLogins(...tc); + Assert.strictEqual(actual.length, expected.length, `Check: ${description}`); + for (let [i, login] of expected.entries()) { + Assert.strictEqual(actual[i], login, `Check index ${i}`); + } + } +}); + +add_task(async function test_dedupeLogins_resolveBy() { + Assert.ok( + DOMAIN1_HTTP_TO_HTTP_U1_P1.timeLastUsed > + DOMAIN1_HTTPS_TO_HTTP_U1_P1.timeLastUsed, + "Sanity check timeLastUsed difference" + ); + Assert.ok( + DOMAIN1_HTTP_TO_HTTP_U1_P1.timePasswordChanged < + DOMAIN1_HTTPS_TO_HTTP_U1_P1.timePasswordChanged, + "Sanity check timePasswordChanged difference" + ); + Assert.ok( + DOMAIN1_HTTPS_LOGIN.timePasswordChanged < + DOMAIN2_HTTPS_LOGIN_NEWER.timePasswordChanged, + "Sanity check timePasswordChanged difference" + ); + + let testcases = [ + [ + "default resolveBy is timeLastUsed", + [DOMAIN1_HTTP_TO_HTTP_U1_P1], + [DOMAIN1_HTTPS_TO_HTTP_U1_P1, DOMAIN1_HTTP_TO_HTTP_U1_P1], + ], + [ + "default resolveBy is timeLastUsed, reversed input", + [DOMAIN1_HTTP_TO_HTTP_U1_P1], + [DOMAIN1_HTTP_TO_HTTP_U1_P1, DOMAIN1_HTTPS_TO_HTTP_U1_P1], + ], + [ + "resolveBy timeLastUsed + timePasswordChanged", + [DOMAIN1_HTTP_TO_HTTP_U1_P1], + [DOMAIN1_HTTPS_TO_HTTP_U1_P1, DOMAIN1_HTTP_TO_HTTP_U1_P1], + undefined, + ["timeLastUsed", "timePasswordChanged"], + ], + [ + "resolveBy timeLastUsed + timePasswordChanged, reversed input", + [DOMAIN1_HTTP_TO_HTTP_U1_P1], + [DOMAIN1_HTTP_TO_HTTP_U1_P1, DOMAIN1_HTTPS_TO_HTTP_U1_P1], + undefined, + ["timeLastUsed", "timePasswordChanged"], + ], + [ + "resolveBy timePasswordChanged", + [DOMAIN1_HTTPS_TO_HTTP_U1_P1], + [DOMAIN1_HTTPS_TO_HTTP_U1_P1, DOMAIN1_HTTP_TO_HTTP_U1_P1], + undefined, + ["timePasswordChanged"], + ], + [ + "resolveBy timePasswordChanged, reversed", + [DOMAIN1_HTTPS_TO_HTTP_U1_P1], + [DOMAIN1_HTTP_TO_HTTP_U1_P1, DOMAIN1_HTTPS_TO_HTTP_U1_P1], + undefined, + ["timePasswordChanged"], + ], + [ + "resolveBy timePasswordChanged + timeLastUsed", + [DOMAIN1_HTTPS_TO_HTTP_U1_P1], + [DOMAIN1_HTTPS_TO_HTTP_U1_P1, DOMAIN1_HTTP_TO_HTTP_U1_P1], + undefined, + ["timePasswordChanged", "timeLastUsed"], + ], + [ + "resolveBy timePasswordChanged + timeLastUsed, reversed", + [DOMAIN1_HTTPS_TO_HTTP_U1_P1], + [DOMAIN1_HTTP_TO_HTTP_U1_P1, DOMAIN1_HTTPS_TO_HTTP_U1_P1], + undefined, + ["timePasswordChanged", "timeLastUsed"], + ], + [ + "resolveBy scheme + timePasswordChanged, prefer HTTP", + [DOMAIN1_HTTP_TO_HTTP_U1_P1], + [DOMAIN1_HTTPS_TO_HTTP_U1_P1, DOMAIN1_HTTP_TO_HTTP_U1_P1], + undefined, + ["scheme", "timePasswordChanged"], + DOMAIN1_HTTP_TO_HTTP_U1_P1.origin, + ], + [ + "resolveBy scheme + timePasswordChanged, prefer HTTP, reversed input", + [DOMAIN1_HTTP_TO_HTTP_U1_P1], + [DOMAIN1_HTTP_TO_HTTP_U1_P1, DOMAIN1_HTTPS_TO_HTTP_U1_P1], + undefined, + ["scheme", "timePasswordChanged"], + DOMAIN1_HTTP_TO_HTTP_U1_P1.origin, + ], + [ + "resolveBy scheme + timePasswordChanged, prefer HTTPS", + [DOMAIN1_HTTPS_TO_HTTP_U1_P1], + [DOMAIN1_HTTPS_TO_HTTP_U1_P1, DOMAIN1_HTTP_TO_HTTP_U1_P1], + undefined, + ["scheme", "timePasswordChanged"], + DOMAIN1_HTTPS_TO_HTTP_U1_P1.origin, + ], + [ + "resolveBy scheme + timePasswordChanged, prefer HTTPS, reversed input", + [DOMAIN1_HTTPS_TO_HTTP_U1_P1], + [DOMAIN1_HTTP_TO_HTTP_U1_P1, DOMAIN1_HTTPS_TO_HTTP_U1_P1], + undefined, + ["scheme", "timePasswordChanged"], + DOMAIN1_HTTPS_TO_HTTP_U1_P1.origin, + ], + [ + "resolveBy scheme HTTP auth", + [DOMAIN1_HTTPS_AUTH], + [DOMAIN1_HTTP_AUTH, DOMAIN1_HTTPS_AUTH], + undefined, + ["scheme"], + DOMAIN1_HTTPS_AUTH.origin, + ], + [ + "resolveBy scheme HTTP auth, reversed input", + [DOMAIN1_HTTPS_AUTH], + [DOMAIN1_HTTPS_AUTH, DOMAIN1_HTTP_AUTH], + undefined, + ["scheme"], + DOMAIN1_HTTPS_AUTH.origin, + ], + [ + "resolveBy scheme, empty form submit URL", + [DOMAIN1_HTTPS_TO_HTTP_U1_P1], + [DOMAIN1_HTTPS_TO_HTTP_U1_P1, DOMAIN1_HTTPS_TO_EMPTY_U1_P1], + undefined, + ["scheme"], + DOMAIN1_HTTPS_TO_HTTP_U1_P1.origin, + ], + [ + "resolveBy subdomain, different subdomains, same login, subdomain1 preferred", + [DOMAIN1_HTTPS_LOGIN], + [DOMAIN1_HTTPS_LOGIN, DOMAIN2_HTTPS_LOGIN], + undefined, + ["subdomain"], + DOMAIN1_HTTPS_LOGIN.origin, + ], + [ + "resolveBy subdomain, different subdomains, same login, subdomain2 preferred", + [DOMAIN2_HTTPS_LOGIN], + [DOMAIN1_HTTPS_LOGIN, DOMAIN2_HTTPS_LOGIN], + undefined, + ["subdomain"], + DOMAIN2_HTTPS_LOGIN.origin, + ], + [ + "resolveBy subdomain+timePasswordChanged, different subdomains, same login, subdomain1 preferred", + [DOMAIN1_HTTPS_LOGIN], + [DOMAIN1_HTTPS_LOGIN, DOMAIN2_HTTPS_LOGIN_NEWER], + undefined, + ["subdomain", "timePasswordChanged"], + DOMAIN1_HTTPS_LOGIN.origin, + ], + [ + "resolveBy subdomain, same subdomain, different schemes", + [DOMAIN1_HTTPS_LOGIN], + [DOMAIN1_HTTPS_LOGIN, DOMAIN1_HTTP_LOGIN], + undefined, + ["subdomain"], + DOMAIN1_HTTPS_LOGIN.origin, + ], + [ + "resolveBy subdomain, same subdomain, different ports", + [DOMAIN1_HTTPS_LOGIN], + [ + DOMAIN1_HTTPS_LOGIN, + DOMAIN1_HTTPS_NONSTANDARD_PORT1, + DOMAIN1_HTTPS_NONSTANDARD_PORT2, + ], + undefined, + ["subdomain"], + DOMAIN1_HTTPS_LOGIN.origin, + ], + [ + "resolveBy subdomain, same subdomain, different schemes, different ports", + [DOMAIN1_HTTPS_LOGIN], + [ + DOMAIN1_HTTPS_LOGIN, + DOMAIN1_HTTPS_NONSTANDARD_PORT1, + DOMAIN1_HTTPS_NONSTANDARD_PORT2, + ], + undefined, + ["subdomain"], + DOMAIN1_HTTPS_AUTH.origin, + ], + [ + "resolveBy matching searchAndDedupeLogins, prefer domain matches then https: scheme over http:", + // expected: + [DOMAIN1_HTTPS_TO_HTTPS_U1_P1, DOMAIN2_HTTPS_TO_HTTPS_U2_P2], + // logins: + [ + DOMAIN1_HTTP_TO_HTTP_U1_P1, + DOMAIN1_HTTPS_TO_HTTPS_U1_P1, + DOMAIN2_HTTP_TO_HTTP_U2_P2, + DOMAIN2_HTTPS_TO_HTTPS_U2_P2, + ], + // uniqueKeys: + undefined, + // resolveBy: + ["subdomain", "actionOrigin", "scheme", "timePasswordChanged"], + // preferredOrigin: + DOMAIN1_HTTPS_TO_HTTPS_U1_P1.origin, + ], + ]; + + for (let tc of testcases) { + let description = tc.shift(); + let expected = tc.shift(); + let actual = LoginHelper.dedupeLogins(...tc); + info(`'${description}' actual:\n ${JSON.stringify(actual, null, 2)}`); + Assert.strictEqual(actual.length, expected.length, `Check: ${description}`); + for (let [i, login] of expected.entries()) { + Assert.strictEqual(actual[i], login, `Check index ${i}`); + } + } +}); + +add_task(async function test_dedupeLogins_preferredOriginMissing() { + let testcases = [ + [ + "resolveBy scheme + timePasswordChanged, missing preferredOrigin", + /preferredOrigin/, + [DOMAIN1_HTTPS_TO_HTTP_U1_P1, DOMAIN1_HTTP_TO_HTTP_U1_P1], + undefined, + ["scheme", "timePasswordChanged"], + ], + [ + "resolveBy timePasswordChanged + scheme, missing preferredOrigin", + /preferredOrigin/, + [DOMAIN1_HTTPS_TO_HTTP_U1_P1, DOMAIN1_HTTP_TO_HTTP_U1_P1], + undefined, + ["timePasswordChanged", "scheme"], + ], + [ + "resolveBy scheme + timePasswordChanged, empty preferredOrigin", + /preferredOrigin/, + [DOMAIN1_HTTPS_TO_HTTP_U1_P1, DOMAIN1_HTTP_TO_HTTP_U1_P1], + undefined, + ["scheme", "timePasswordChanged"], + "", + ], + ]; + + for (let tc of testcases) { + let description = tc.shift(); + let expectedException = tc.shift(); + Assert.throws( + () => { + LoginHelper.dedupeLogins(...tc); + }, + expectedException, + `Check: ${description}` + ); + } +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_disabled_hosts.js b/toolkit/components/passwordmgr/test/unit/test_disabled_hosts.js new file mode 100644 index 0000000000..1d6e161149 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_disabled_hosts.js @@ -0,0 +1,223 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +/** + * Tests getLoginSavingEnabled, setLoginSavingEnabled, and getAllDisabledHosts. + */ + +"use strict"; + +// Tests + +/** + * Tests setLoginSavingEnabled and getAllDisabledHosts. + */ +add_task(function test_setLoginSavingEnabled_getAllDisabledHosts() { + // Add some disabled hosts, and verify that different schemes for the same + // domain are considered different hosts. + let origin1 = "http://disabled1.example.com"; + let origin2 = "http://disabled2.example.com"; + let origin3 = "https://disabled2.example.com"; + Services.logins.setLoginSavingEnabled(origin1, false); + Services.logins.setLoginSavingEnabled(origin2, false); + Services.logins.setLoginSavingEnabled(origin3, false); + + LoginTestUtils.assertDisabledHostsEqual( + Services.logins.getAllDisabledHosts(), + [origin1, origin2, origin3] + ); + + // Adding the same host twice should not result in an error. + Services.logins.setLoginSavingEnabled(origin2, false); + LoginTestUtils.assertDisabledHostsEqual( + Services.logins.getAllDisabledHosts(), + [origin1, origin2, origin3] + ); + + // Removing a disabled host should work. + Services.logins.setLoginSavingEnabled(origin2, true); + LoginTestUtils.assertDisabledHostsEqual( + Services.logins.getAllDisabledHosts(), + [origin1, origin3] + ); + + // Removing the last disabled host should work. + Services.logins.setLoginSavingEnabled(origin1, true); + Services.logins.setLoginSavingEnabled(origin3, true); + LoginTestUtils.assertDisabledHostsEqual( + Services.logins.getAllDisabledHosts(), + [] + ); +}); + +/** + * Tests setLoginSavingEnabled and getLoginSavingEnabled. + */ +add_task(function test_setLoginSavingEnabled_getLoginSavingEnabled() { + let origin1 = "http://disabled.example.com"; + let origin2 = "https://disabled.example.com"; + + // Hosts should not be disabled by default. + Assert.ok(Services.logins.getLoginSavingEnabled(origin1)); + Assert.ok(Services.logins.getLoginSavingEnabled(origin2)); + + // Test setting initial values. + Services.logins.setLoginSavingEnabled(origin1, false); + Services.logins.setLoginSavingEnabled(origin2, true); + Assert.ok(!Services.logins.getLoginSavingEnabled(origin1)); + Assert.ok(Services.logins.getLoginSavingEnabled(origin2)); + + // Test changing values. + Services.logins.setLoginSavingEnabled(origin1, true); + Services.logins.setLoginSavingEnabled(origin2, false); + Assert.ok(Services.logins.getLoginSavingEnabled(origin1)); + Assert.ok(!Services.logins.getLoginSavingEnabled(origin2)); + + // Clean up. + Services.logins.setLoginSavingEnabled(origin2, true); +}); + +/** + * Tests setLoginSavingEnabled with invalid NUL characters in the origin. + */ +add_task(function test_setLoginSavingEnabled_invalid_characters() { + let origin = "http://null\0X.example.com"; + Assert.throws( + () => Services.logins.setLoginSavingEnabled(origin, false), + /Invalid origin/ + ); + + // Verify that no data was stored by the previous call. + LoginTestUtils.assertDisabledHostsEqual( + Services.logins.getAllDisabledHosts(), + [] + ); +}); + +/** + * Tests different values of the "signon.rememberSignons" property. + */ +add_task(function test_rememberSignons() { + let origin1 = "http://example.com"; + let origin2 = "http://localhost"; + + // The default value for the preference should be true. + Assert.ok(Services.prefs.getBoolPref("signon.rememberSignons")); + + // Hosts should not be disabled by default. + Services.logins.setLoginSavingEnabled(origin1, false); + Assert.ok(!Services.logins.getLoginSavingEnabled(origin1)); + Assert.ok(Services.logins.getLoginSavingEnabled(origin2)); + + // Disable storage of saved passwords globally. + Services.prefs.setBoolPref("signon.rememberSignons", false); + registerCleanupFunction(() => + Services.prefs.clearUserPref("signon.rememberSignons") + ); + + // All hosts should now appear disabled. + Assert.ok(!Services.logins.getLoginSavingEnabled(origin1)); + Assert.ok(!Services.logins.getLoginSavingEnabled(origin2)); + + // The list of disabled hosts should be unaltered. + LoginTestUtils.assertDisabledHostsEqual( + Services.logins.getAllDisabledHosts(), + [origin1] + ); + + // Changing values with the preference set should work. + Services.logins.setLoginSavingEnabled(origin1, true); + Services.logins.setLoginSavingEnabled(origin2, false); + + // All hosts should still appear disabled. + Assert.ok(!Services.logins.getLoginSavingEnabled(origin1)); + Assert.ok(!Services.logins.getLoginSavingEnabled(origin2)); + + // The list of disabled hosts should have been changed. + LoginTestUtils.assertDisabledHostsEqual( + Services.logins.getAllDisabledHosts(), + [origin2] + ); + + // Enable storage of saved passwords again. + Services.prefs.setBoolPref("signon.rememberSignons", true); + + // Hosts should now appear enabled as requested. + Assert.ok(Services.logins.getLoginSavingEnabled(origin1)); + Assert.ok(!Services.logins.getLoginSavingEnabled(origin2)); + + // Clean up. + Services.logins.setLoginSavingEnabled(origin2, true); + LoginTestUtils.assertDisabledHostsEqual( + Services.logins.getAllDisabledHosts(), + [] + ); +}); + +/** + * Tests storing disabled hosts with non-ASCII characters where IDN is supported. + */ +add_task( + async function test_storage_setLoginSavingEnabled_nonascii_IDN_is_supported() { + let origin = "http://大.net"; + let encoding = "http://xn--pss.net"; + + // Test adding disabled host with nonascii URL (http://大.net). + Services.logins.setLoginSavingEnabled(origin, false); + await LoginTestUtils.reloadData(); + Assert.equal(Services.logins.getLoginSavingEnabled(origin), false); + Assert.equal(Services.logins.getLoginSavingEnabled(encoding), false); + LoginTestUtils.assertDisabledHostsEqual( + Services.logins.getAllDisabledHosts(), + [origin] + ); + + LoginTestUtils.clearData(); + + // Test adding disabled host with IDN ("http://xn--pss.net"). + Services.logins.setLoginSavingEnabled(encoding, false); + await LoginTestUtils.reloadData(); + Assert.equal(Services.logins.getLoginSavingEnabled(origin), false); + Assert.equal(Services.logins.getLoginSavingEnabled(encoding), false); + LoginTestUtils.assertDisabledHostsEqual( + Services.logins.getAllDisabledHosts(), + [origin] + ); + + LoginTestUtils.clearData(); + } +); + +/** + * Tests storing disabled hosts with non-ASCII characters where IDN is not supported. + */ +add_task( + async function test_storage_setLoginSavingEnabled_nonascii_IDN_not_supported() { + let origin = "http://√.com"; + let encoding = "http://xn--19g.com"; + + // Test adding disabled host with nonascii URL (http://√.com). + Services.logins.setLoginSavingEnabled(origin, false); + await LoginTestUtils.reloadData(); + Assert.equal(Services.logins.getLoginSavingEnabled(origin), false); + Assert.equal(Services.logins.getLoginSavingEnabled(encoding), false); + LoginTestUtils.assertDisabledHostsEqual( + Services.logins.getAllDisabledHosts(), + [encoding] + ); + + LoginTestUtils.clearData(); + + // Test adding disabled host with IDN ("http://xn--19g.com"). + Services.logins.setLoginSavingEnabled(encoding, false); + await LoginTestUtils.reloadData(); + Assert.equal(Services.logins.getLoginSavingEnabled(origin), false); + Assert.equal(Services.logins.getLoginSavingEnabled(encoding), false); + LoginTestUtils.assertDisabledHostsEqual( + Services.logins.getAllDisabledHosts(), + [encoding] + ); + + LoginTestUtils.clearData(); + } +); diff --git a/toolkit/components/passwordmgr/test/unit/test_displayOrigin.js b/toolkit/components/passwordmgr/test/unit/test_displayOrigin.js new file mode 100644 index 0000000000..a42f066b3e --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_displayOrigin.js @@ -0,0 +1,43 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +/** + * Test nsILoginInfo.displayOrigin + */ + +"use strict"; + +add_task(function test_displayOrigin() { + // Trying to access `displayOrigin` for each login shouldn't throw. + for (let loginInfo of TestData.loginList()) { + let { displayOrigin } = loginInfo; + info(loginInfo.origin); + info(displayOrigin); + Assert.equal(typeof displayOrigin, "string", "Check type"); + Assert.greater(displayOrigin.length, 0, "Check length"); + if (loginInfo.origin.startsWith("file://")) { + // Fails to create the URL + Assert.ok(displayOrigin.startsWith(loginInfo.origin), "Contains origin"); + } else { + Assert.ok( + displayOrigin.startsWith(loginInfo.origin.replace(/.+:\/\//, "")), + "Contains domain" + ); + } + let matches; + if ((matches = loginInfo.origin.match(/:([0-9]+)$/))) { + Assert.ok(displayOrigin.includes(matches[1]), "Check port is included"); + } + Assert.ok(!displayOrigin.includes("null"), "Doesn't contain `null`"); + Assert.ok( + !displayOrigin.includes("undefined"), + "Doesn't contain `undefined`" + ); + if (loginInfo.httpRealm !== null) { + Assert.ok( + displayOrigin.includes(loginInfo.httpRealm), + "Contains httpRealm" + ); + } + } +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_doLoginsMatch.js b/toolkit/components/passwordmgr/test/unit/test_doLoginsMatch.js new file mode 100644 index 0000000000..fb38f08cf7 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_doLoginsMatch.js @@ -0,0 +1,57 @@ +/** + * Test LoginHelper.doLoginsMatch + */ + +add_task(function test_formActionOrigin_ignoreSchemes() { + let httpActionLogin = TestData.formLogin(); + let httpsActionLogin = TestData.formLogin({ + formActionOrigin: "https://www.example.com", + }); + let jsActionLogin = TestData.formLogin({ + formActionOrigin: "javascript:", + }); + let emptyActionLogin = TestData.formLogin({ + formActionOrigin: "", + }); + + Assert.notEqual( + httpActionLogin.formActionOrigin, + httpsActionLogin.formActionOrigin, + "Ensure actions differ" + ); + + const TEST_CASES = [ + [httpActionLogin, httpActionLogin, true], + [httpsActionLogin, httpsActionLogin, true], + [jsActionLogin, jsActionLogin, true], + [emptyActionLogin, emptyActionLogin, true], + // only differing by scheme: + [httpsActionLogin, httpActionLogin, true], + [httpActionLogin, httpsActionLogin, true], + + // empty matches everything + [httpsActionLogin, emptyActionLogin, true], + [emptyActionLogin, httpsActionLogin, true], + [jsActionLogin, emptyActionLogin, true], + [emptyActionLogin, jsActionLogin, true], + + // Begin false cases: + [httpsActionLogin, jsActionLogin, false], + [jsActionLogin, httpsActionLogin, false], + [httpActionLogin, jsActionLogin, false], + [jsActionLogin, httpActionLogin, false], + ]; + + for (let [login1, login2, expected] of TEST_CASES) { + Assert.strictEqual( + LoginHelper.doLoginsMatch(login1, login2, { + ignorePassword: false, + ignoreSchemes: true, + }), + expected, + `LoginHelper.doLoginsMatch: +\t${JSON.stringify(login1)} +\t${JSON.stringify(login2)}` + ); + } +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_findRelatedRealms.js b/toolkit/components/passwordmgr/test/unit/test_findRelatedRealms.js new file mode 100644 index 0000000000..b79a0ab4c4 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_findRelatedRealms.js @@ -0,0 +1,156 @@ +/* Any copyright is dedicated to the Public Domain. +http://creativecommons.org/publicdomain/zero/1.0/ */ + +"use strict"; + +const { LoginRelatedRealmsParent } = ChromeUtils.importESModule( + "resource://gre/modules/LoginRelatedRealms.sys.mjs" +); +const { RemoteSettings } = ChromeUtils.importESModule( + "resource://services-settings/remote-settings.sys.mjs" +); + +const REMOTE_SETTINGS_COLLECTION = "websites-with-shared-credential-backends"; + +add_task(async function test_related_domain_matching() { + const client = RemoteSettings(REMOTE_SETTINGS_COLLECTION); + const records = await client.get(); + console.log(records); + + // Assumes that the test collection is a 2D array with one subarray + let relatedRealms = records[0].relatedRealms; + relatedRealms = relatedRealms.flat(); + Assert.ok(relatedRealms); + + let LRR = new LoginRelatedRealmsParent(); + + // We should not return unrelated realms + let result = await LRR.findRelatedRealms("https://not-example.com"); + equal(result.length, 0, "Check that there were no related realms found"); + + // We should not return unrelated realms given an unrelated subdomain + result = await LRR.findRelatedRealms("https://sub.not-example.com"); + equal(result.length, 0, "Check that there were no related realms found"); + // We should return the related realms collection + result = await LRR.findRelatedRealms("https://sub.example.com"); + equal( + result.length, + relatedRealms.length, + "Ensure that three related realms were found" + ); + + // We should return the related realms collection minus the base domain that we searched with + result = await LRR.findRelatedRealms("https://example.co.uk"); + equal( + result.length, + relatedRealms.length - 1, + "Ensure that two related realms were found" + ); +}); + +add_task(async function test_newly_synced_collection() { + // Initialize LoginRelatedRealmsParent so the sync handler is enabled + let LRR = new LoginRelatedRealmsParent(); + await LRR.getSharedCredentialsCollection(); + + const client = RemoteSettings(REMOTE_SETTINGS_COLLECTION); + let records = await client.get(); + const record1 = { + id: records[0].id, + relatedRealms: records[0].relatedRealms, + }; + + // Assumes that the test collection is a 2D array with one subarray + let originalRelatedRealms = records[0].relatedRealms; + originalRelatedRealms = originalRelatedRealms.flat(); + Assert.ok(originalRelatedRealms); + + const updatedRelatedRealms = ["completely-different.com", "example.com"]; + const record2 = { + id: "some-other-ID", + relatedRealms: [updatedRelatedRealms], + }; + const payload = { + current: [record2], + created: [record2], + updated: [], + deleted: [record1], + }; + await RemoteSettings(REMOTE_SETTINGS_COLLECTION).emit("sync", { + data: payload, + }); + + let [{ id, relatedRealms }] = await LRR.getSharedCredentialsCollection(); + equal(id, record2.id, "internal collection ID should be updated"); + equal( + relatedRealms, + record2.relatedRealms, + "internal collection related realms should be updated" + ); + + // We should return only one result, and that result should be example.com + // NOT other-example.com or example.co.uk + let result = await LRR.findRelatedRealms("https://completely-different.com"); + equal( + result.length, + updatedRelatedRealms.length - 1, + "Check that there is only one related realm found" + ); + equal( + result[0], + "example.com", + "Ensure that the updated collection should only match example.com" + ); +}); + +add_task(async function test_no_related_domains() { + await LoginTestUtils.remoteSettings.cleanWebsitesWithSharedCredentials(); + + const client = RemoteSettings(REMOTE_SETTINGS_COLLECTION); + let records = await client.get(); + + equal(records.length, 0, "Check that there are no related realms"); + + let LRR = new LoginRelatedRealmsParent(); + + Assert.ok(LRR.findRelatedRealms, "Ensure findRelatedRealms exists"); + + let result = await LRR.findRelatedRealms("https://example.com"); + equal(result.length, 0, "Assert that there were no related realms found"); +}); + +add_task(async function test_unrelated_subdomains() { + await LoginTestUtils.remoteSettings.cleanWebsitesWithSharedCredentials(); + let testCollection = [ + ["slpl.bibliocommons.com", "slpl.overdrive.com"], + ["springfield.overdrive.com", "coolcat.org"], + ]; + await LoginTestUtils.remoteSettings.setupWebsitesWithSharedCredentials( + testCollection + ); + + let LRR = new LoginRelatedRealmsParent(); + let result = await LRR.findRelatedRealms("https://evil.overdrive.com"); + equal(result.length, 0, "Assert that there were no related realms found"); + + result = await LRR.findRelatedRealms("https://abc.slpl.bibliocommons.com"); + equal(result.length, 2, "Assert that two related realms were found"); + equal(result[0], testCollection[0][0]); + equal(result[1], testCollection[0][1]); + + result = await LRR.findRelatedRealms("https://slpl.overdrive.com"); + console.log("what is result: " + result); + equal(result.length, 1, "Assert that one related realm was found"); + for (let item of result) { + notEqual( + item, + "coolcat.org", + "coolcat.org is not related to slpl.overdrive.com" + ); + notEqual( + item, + "springfield.overdrive.com", + "springfield.overdrive.com is not related to slpl.overdrive.com" + ); + } +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_getFormFields.js b/toolkit/components/passwordmgr/test/unit/test_getFormFields.js new file mode 100644 index 0000000000..a04b497181 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_getFormFields.js @@ -0,0 +1,572 @@ +/** + * Test for LoginFormState._getFormFields. + */ + +"use strict"; + +const { LoginFormFactory } = ChromeUtils.importESModule( + "resource://gre/modules/LoginFormFactory.sys.mjs" +); + +const { LoginManagerChild } = ChromeUtils.importESModule( + "resource://gre/modules/LoginManagerChild.sys.mjs" +); + +const TESTENVIRONMENTS = { + filledPW1WithGeneratedPassword: { + generatedPWFieldSelectors: ["#pw1"], + }, +}; + +const TESTCASES = [ + { + description: "1 password field outside of a <form>", + document: `<input id="pw1" type=password>`, + returnedFieldIDs: { + usernameField: null, + newPasswordField: "pw1", + oldPasswordField: null, + }, + skipEmptyFields: undefined, + extraTestEnvironments: [TESTENVIRONMENTS.filledPW1WithGeneratedPassword], + extraTestPreferences: [], + }, + { + description: "1 text field outside of a <form> without a password field", + document: `<input id="un1">`, + returnedFieldIDs: { + usernameField: null, + newPasswordField: null, + oldPasswordField: null, + }, + skipEmptyFields: undefined, + // there is no password field to fill, so no sense testing with gen. passwords + extraTestEnvironments: [], + extraTestPreferences: [], + }, + { + description: "1 username & password field outside of a <form>", + document: `<input id="un1"> + <input id="pw1" type=password>`, + returnedFieldIDs: { + usernameField: "un1", + newPasswordField: "pw1", + oldPasswordField: null, + }, + skipEmptyFields: undefined, + extraTestEnvironments: [TESTENVIRONMENTS.filledPW1WithGeneratedPassword], + extraTestPreferences: [], + }, + { + beforeGetFunction(doc, formLike) { + // Access the formLike.elements lazy getter to have it cached. + Assert.equal( + formLike.elements.length, + 2, + "Check initial elements length" + ); + doc.getElementById("un1").remove(); + }, + description: "1 username & password field outside of a <form>, un1 removed", + document: `<input id="un1"> + <input id="pw1" type=password>`, + returnedFieldIDs: { + usernameField: null, + newPasswordField: "pw1", + oldPasswordField: null, + }, + skipEmptyFields: undefined, + extraTestEnvironments: [TESTENVIRONMENTS.filledPW1WithGeneratedPassword], + extraTestPreferences: [], + }, + { + description: "1 username & password field in a <form>", + document: `<form> + <input id="un1"> + <input id="pw1" type=password> + </form>`, + returnedFieldIDs: { + usernameField: "un1", + newPasswordField: "pw1", + oldPasswordField: null, + }, + skipEmptyFields: undefined, + extraTestEnvironments: [TESTENVIRONMENTS.filledPW1WithGeneratedPassword], + extraTestPreferences: [], + }, + { + description: "5 empty password fields outside of a <form>", + document: `<input id="pw1" type=password> + <input id="pw2" type=password> + <input id="pw3" type=password> + <input id="pw4" type=password> + <input id="pw5" type=password>`, + returnedFieldIDs: { + usernameField: null, + newPasswordField: "pw1", + oldPasswordField: null, + }, + skipEmptyFields: undefined, + extraTestEnvironments: [TESTENVIRONMENTS.filledPW1WithGeneratedPassword], + extraTestPreferences: [], + }, + { + description: "6 empty password fields outside of a <form>", + document: `<input id="pw1" type=password> + <input id="pw2" type=password> + <input id="pw3" type=password> + <input id="pw4" type=password> + <input id="pw5" type=password> + <input id="pw6" type=password>`, + returnedFieldIDs: { + usernameField: null, + newPasswordField: null, + oldPasswordField: null, + }, + skipEmptyFields: undefined, + extraTestEnvironments: [TESTENVIRONMENTS.filledPW1WithGeneratedPassword], + extraTestPreferences: [], + }, + { + description: + "4 password fields outside of a <form> (1 empty, 3 full) with skipEmpty", + document: `<input id="pw1" type=password> + <input id="pw2" type=password value="pass2"> + <input id="pw3" type=password value="pass3"> + <input id="pw4" type=password value="pass4">`, + returnedFieldIDs: { + usernameField: null, + newPasswordField: null, + oldPasswordField: null, + }, + skipEmptyFields: true, + // This test assumes that pw1 has not been filled, so don't test prefilling it + extraTestEnvironments: [], + extraTestPreferences: [], + }, + { + description: "Form with 1 password field", + document: `<form><input id="pw1" type=password></form>`, + returnedFieldIDs: { + usernameField: null, + newPasswordField: "pw1", + oldPasswordField: null, + }, + skipEmptyFields: undefined, + extraTestEnvironments: [TESTENVIRONMENTS.filledPW1WithGeneratedPassword], + extraTestPreferences: [], + }, + { + description: "Form with 2 password fields", + document: `<form><input id="pw1" type=password><input id='pw2' type=password></form>`, + returnedFieldIDs: { + usernameField: null, + newPasswordField: "pw1", + oldPasswordField: null, + }, + skipEmptyFields: undefined, + extraTestEnvironments: [TESTENVIRONMENTS.filledPW1WithGeneratedPassword], + extraTestPreferences: [], + }, + { + description: "1 password field in a form, 1 outside (not processed)", + document: `<form><input id="pw1" type=password></form><input id="pw2" type=password>`, + returnedFieldIDs: { + usernameField: null, + newPasswordField: "pw1", + oldPasswordField: null, + }, + skipEmptyFields: undefined, + extraTestEnvironments: [TESTENVIRONMENTS.filledPW1WithGeneratedPassword], + extraTestPreferences: [], + }, + { + description: + "1 password field in a form, 1 text field outside (not processed)", + document: `<form><input id="pw1" type=password></form><input>`, + returnedFieldIDs: { + usernameField: null, + newPasswordField: "pw1", + oldPasswordField: null, + }, + skipEmptyFields: undefined, + extraTestEnvironments: [TESTENVIRONMENTS.filledPW1WithGeneratedPassword], + extraTestPreferences: [], + }, + { + description: + "1 text field in a form, 1 password field outside (not processed)", + document: `<form><input></form><input id="pw1" type=password>`, + returnedFieldIDs: { + usernameField: null, + newPasswordField: null, + oldPasswordField: null, + }, + skipEmptyFields: undefined, + extraTestEnvironments: [TESTENVIRONMENTS.filledPW1WithGeneratedPassword], + extraTestPreferences: [], + }, + { + description: + "2 password fields outside of a <form> with 1 linked via @form", + document: `<input id="pw1" type=password><input id="pw2" type=password form='form1'> + <form id="form1"></form>`, + returnedFieldIDs: { + usernameField: null, + newPasswordField: "pw1", + oldPasswordField: null, + }, + skipEmptyFields: undefined, + extraTestEnvironments: [TESTENVIRONMENTS.filledPW1WithGeneratedPassword], + extraTestPreferences: [], + }, + { + description: + "2 password fields outside of a <form> with 1 linked via @form + skipEmpty", + document: `<input id="pw1" type=password><input id="pw2" type=password form="form1"> + <form id="form1"></form>`, + returnedFieldIDs: { + usernameField: null, + newPasswordField: null, + oldPasswordField: null, + }, + skipEmptyFields: true, + extraTestEnvironments: [TESTENVIRONMENTS.filledPW1WithGeneratedPassword], + extraTestPreferences: [], + }, + { + description: + "2 password fields outside of a <form> with 1 linked via @form + skipEmpty with 1 empty", + document: `<input id="pw1" type=password value="pass1"><input id="pw2" type=password form="form1"> + <form id="form1"></form>`, + returnedFieldIDs: { + usernameField: null, + newPasswordField: "pw1", + oldPasswordField: null, + }, + skipEmptyFields: true, + extraTestEnvironments: [TESTENVIRONMENTS.filledPW1WithGeneratedPassword], + extraTestPreferences: [], + }, + { + description: + "3 password fields, 2nd and 3rd are filled with generated passwords", + document: `<input id="pw1" type=password> + <input id="pw2" type=password value="pass2"> + <input id="pw3" type=password value="pass3">`, + returnedFieldIDs: { + usernameField: null, + newPasswordField: "pw2", + confirmPasswordField: "pw3", + oldPasswordField: "pw1", + }, + skipEmptyFields: undefined, + generatedPWFieldSelectors: ["#pw2", "#pw3"], + // this test doesn't make sense to run with different filled generated password values + extraTestEnvironments: [], + extraTestPreferences: [], + }, + // begin of getusername heuristic tests + { + description: "multiple non-username like input fields in a <form>", + document: `<form> + <input id="un1"> + <input id="un2"> + <input id="un3"> + <input id="pw1" type=password> + </form>`, + returnedFieldIDs: { + usernameField: "un3", + newPasswordField: "pw1", + oldPasswordField: null, + }, + skipEmptyFields: undefined, + extraTestEnvironments: [TESTENVIRONMENTS.filledPW1WithGeneratedPassword], + extraTestPreferences: [], + }, + { + description: + "1 username input and multiple non-username like input in a <form>", + document: `<form> + <input id="un1"> + <input id="un2" autocomplete="username"> + <input id="un3"> + <input id="pw1" type=password> + </form>`, + returnedFieldIDs: { + usernameField: "un2", + newPasswordField: "pw1", + oldPasswordField: null, + }, + skipEmptyFields: undefined, + extraTestEnvironments: [TESTENVIRONMENTS.filledPW1WithGeneratedPassword], + extraTestPreferences: [], + }, + { + description: + "1 email input and multiple non-username like input in a <form>", + document: `<form> + <input id="un1"> + <input id="un2" autocomplete="email"> + <input id="un3"> + <input id="pw1" type=password> + </form>`, + returnedFieldIDs: { + usernameField: "un2", + newPasswordField: "pw1", + oldPasswordField: null, + }, + skipEmptyFields: undefined, + extraTestEnvironments: [TESTENVIRONMENTS.filledPW1WithGeneratedPassword], + extraTestPreferences: [], + }, + { + description: + "1 username & 1 email field, the email field is more close to the password", + document: `<form> + <input id="un1" autocomplete="username"> + <input id="un2" autocomplete="email"> + <input id="pw1" type=password> + </form>`, + returnedFieldIDs: { + usernameField: "un1", + newPasswordField: "pw1", + oldPasswordField: null, + }, + skipEmptyFields: undefined, + extraTestEnvironments: [TESTENVIRONMENTS.filledPW1WithGeneratedPassword], + extraTestPreferences: [], + }, + { + description: + "1 username and 1 email field, the username field is more close to the password", + document: `<form> + <input id="un1" autocomplete="email"> + <input id="un2" autocomplete="username"> + <input id="pw1" type=password> + </form>`, + returnedFieldIDs: { + usernameField: "un2", + newPasswordField: "pw1", + oldPasswordField: null, + }, + skipEmptyFields: undefined, + extraTestEnvironments: [TESTENVIRONMENTS.filledPW1WithGeneratedPassword], + extraTestPreferences: [], + }, + { + description: "2 username fields in a <form>", + document: `<form> + <input id="un1" autocomplete="username"> + <input id="un2" autocomplete="username"> + <input id="un3"> + <input id="pw1" type=password> + </form>`, + returnedFieldIDs: { + usernameField: "un2", + newPasswordField: "pw1", + oldPasswordField: null, + }, + skipEmptyFields: undefined, + extraTestEnvironments: [TESTENVIRONMENTS.filledPW1WithGeneratedPassword], + extraTestPreferences: [], + }, + { + description: "2 email fields in a <form>", + document: `<form> + <input id="un1" autocomplete="email"> + <input id="un2" autocomplete="email"> + <input id="un3"> + <input id="pw1" type=password> + </form>`, + returnedFieldIDs: { + usernameField: "un1", + newPasswordField: "pw1", + oldPasswordField: null, + }, + skipEmptyFields: undefined, + extraTestEnvironments: [TESTENVIRONMENTS.filledPW1WithGeneratedPassword], + extraTestPreferences: [], + }, + { + description: "the password field precedes the username field", + document: `<form> + <input id="un1"> + <input id="pw1" type=password> + <input id="un2" autocomplete="username"> + </form>`, + returnedFieldIDs: { + usernameField: "un1", + newPasswordField: "pw1", + oldPasswordField: null, + }, + skipEmptyFields: undefined, + extraTestEnvironments: [TESTENVIRONMENTS.filledPW1WithGeneratedPassword], + extraTestPreferences: [], + }, + // end of getusername heuristic tests + { + description: "1 username field in a <form>", + document: `<form> + <input id="un1" autocomplete="username"> + </form>`, + returnedFieldIDs: { + usernameField: "un1", + newPasswordField: null, + oldPasswordField: null, + }, + skipEmptyFields: undefined, + extraTestEnvironments: [], + extraTestPreferences: [], + }, + { + description: "1 input field in a <form>", + document: `<form> + <input id="un1""> + </form>`, + returnedFieldIDs: { + usernameField: null, + newPasswordField: null, + oldPasswordField: null, + }, + skipEmptyFields: undefined, + extraTestEnvironments: [], + extraTestPreferences: [], + }, + { + description: "1 username field in a <form> with usernameOnlyForm pref off", + document: `<form> + <input id="un1" autocomplete="username"> + </form>`, + returnedFieldIDs: { + usernameField: null, + newPasswordField: null, + oldPasswordField: null, + }, + skipEmptyFields: undefined, + extraTestEnvironments: [], + extraTestPreferences: [["signon.usernameOnlyForm.enabled", false]], + }, +]; + +const TEST_ENVIRONMENT_CASES = TESTCASES.flatMap(tc => { + let arr = [tc]; + // also run this test case with this different state + for (let env of tc.extraTestEnvironments) { + arr.push({ + ...tc, + ...env, + }); + } + return arr; +}); + +function _setPrefs() { + Services.prefs.setBoolPref("signon.usernameOnlyForm.enabled", true); + registerCleanupFunction(() => { + Services.prefs.clearUserPref("signon.usernameOnlyForm.enabled"); + }); +} + +_setPrefs(); + +for (let tc of TEST_ENVIRONMENT_CASES) { + info("Sanity checking the testcase: " + tc.description); + + (function () { + let testcase = tc; + add_task(async function () { + info("Starting testcase: " + testcase.description); + + for (let pref of testcase.extraTestPreferences) { + Services.prefs.setBoolPref(pref[0], pref[1]); + } + + info("Document string: " + testcase.document); + let document = MockDocument.createTestDocument( + "http://localhost:8080/test/", + testcase.document + ); + + let input = document.querySelector("input"); + MockDocument.mockOwnerDocumentProperty( + input, + document, + "http://localhost:8080/test/" + ); + + let formLike = LoginFormFactory.createFromField(input); + + if (testcase.beforeGetFunction) { + await testcase.beforeGetFunction(document, formLike); + } + + let lmc = new LoginManagerChild(); + let loginFormState = lmc.stateForDocument(formLike.ownerDocument); + loginFormState.generatedPasswordFields = _generateDocStateFromTestCase( + testcase, + document + ); + + let actual = loginFormState._getFormFields( + formLike, + testcase.skipEmptyFields, + new Set() + ); + + [ + "usernameField", + "newPasswordField", + "oldPasswordField", + "confirmPasswordField", + ].forEach(fieldName => { + Assert.ok( + fieldName in actual, + "_getFormFields return value includes " + fieldName + ); + }); + for (let key of Object.keys(testcase.returnedFieldIDs)) { + let expectedID = testcase.returnedFieldIDs[key]; + if (expectedID === null) { + Assert.strictEqual( + actual[key], + expectedID, + "Check returned field " + key + " is null" + ); + } else { + Assert.strictEqual( + actual[key].id, + expectedID, + "Check returned field " + key + " ID" + ); + } + } + + for (let pref of tc.extraTestPreferences) { + Services.prefs.clearUserPref(pref[0]); + } + }); + })(); +} + +function _generateDocStateFromTestCase(stateProperties, document) { + // prepopulate the document form state LMC holds with + // any generated password fields defined in this testcase + let generatedPasswordFields = new Set(); + info( + "stateProperties has generatedPWFieldSelectors: " + + stateProperties.generatedPWFieldSelectors?.join(", ") + ); + + if (stateProperties.generatedPWFieldSelectors?.length) { + stateProperties.generatedPWFieldSelectors.forEach(sel => { + let field = document.querySelector(sel); + if (field) { + generatedPasswordFields.add(field); + } else { + info(`No password field: ${sel} found in this document`); + } + }); + } + return generatedPasswordFields; +} diff --git a/toolkit/components/passwordmgr/test/unit/test_getPasswordFields.js b/toolkit/components/passwordmgr/test/unit/test_getPasswordFields.js new file mode 100644 index 0000000000..eee38c30d8 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_getPasswordFields.js @@ -0,0 +1,308 @@ +/** + * Test for LoginFormState._getPasswordFields using LoginFormFactory. + */ + +/* globals todo_check_eq */ +"use strict"; + +const { LoginFormFactory } = ChromeUtils.importESModule( + "resource://gre/modules/LoginFormFactory.sys.mjs" +); +const { LoginFormState } = ChromeUtils.importESModule( + "resource://gre/modules/LoginManagerChild.sys.mjs" +); +const TESTCASES = [ + { + description: "Empty document", + document: ``, + returnedFieldIDsByFormLike: [], + minPasswordLength: undefined, + }, + { + description: "Non-password input with no <form> present", + document: `<input>`, + // Only the IDs of password fields should be in this array + returnedFieldIDsByFormLike: [[]], + minPasswordLength: undefined, + }, + { + description: "1 password field outside of a <form>", + document: `<input id="pw1" type=password>`, + returnedFieldIDsByFormLike: [["pw1"]], + minPasswordLength: undefined, + }, + { + description: "5 empty password fields outside of a <form>", + document: `<input id="pw1" type=password> + <input id="pw2" type=password> + <input id="pw3" type=password> + <input id="pw4" type=password> + <input id="pw5" type=password>`, + returnedFieldIDsByFormLike: [["pw1", "pw2", "pw3", "pw4", "pw5"]], + minPasswordLength: undefined, + }, + { + description: "6 empty password fields outside of a <form>", + document: `<input id="pw1" type=password> + <input id="pw2" type=password> + <input id="pw3" type=password> + <input id="pw4" type=password> + <input id="pw5" type=password> + <input id="pw6" type=password>`, + returnedFieldIDsByFormLike: [[]], + minPasswordLength: undefined, + }, + { + description: + "4 password fields outside of a <form> (1 empty, 3 full) with minPasswordLength=2", + document: `<input id="pw1" type=password> + <input id="pw2" type=password value="pass2"> + <input id="pw3" type=password value="pass3"> + <input id="pw4" type=password value="pass4">`, + returnedFieldIDsByFormLike: [["pw2", "pw3", "pw4"]], + minPasswordLength: 2, + }, + { + description: "Form with 1 password field", + document: `<form><input id="pw1" type=password></form>`, + returnedFieldIDsByFormLike: [["pw1"]], + minPasswordLength: undefined, + }, + { + description: "Form with 2 password fields", + document: `<form><input id="pw1" type=password><input id='pw2' type=password></form>`, + returnedFieldIDsByFormLike: [["pw1", "pw2"]], + minPasswordLength: undefined, + }, + { + description: "1 password field in a form, 1 outside", + document: `<form><input id="pw1" type=password></form><input id="pw2" type=password>`, + returnedFieldIDsByFormLike: [["pw1"], ["pw2"]], + minPasswordLength: undefined, + }, + { + description: + "2 password fields outside of a <form> with 1 linked via @form", + document: `<input id="pw1" type=password><input id="pw2" type=password form='form1'> + <form id="form1"></form>`, + returnedFieldIDsByFormLike: [["pw1"], ["pw2"]], + minPasswordLength: undefined, + }, + { + description: + "2 password fields outside of a <form> with 1 linked via @form + minPasswordLength", + document: `<input id="pw1" type=password><input id="pw2" type=password form="form1"> + <form id="form1"></form>`, + returnedFieldIDsByFormLike: [[], []], + minPasswordLength: 2, + }, + { + description: "minPasswordLength should also skip white-space only fields", + /* eslint-disable no-tabs */ + document: `<input id="pw-space" type=password value=" "> + <input id="pw-tab" type=password value=" "> + <input id="pw-newline" type=password form="form1" value=" + "> + <form id="form1"></form>`, + /* eslint-enable no-tabs */ + returnedFieldIDsByFormLike: [[], []], + minPasswordLength: 2, + }, + { + description: "minPasswordLength should skip too-short field values", + document: `<form> + <input id="pw-empty" type=password> + <input id="pw-tooshort" type=password value="p"> + <input id="pw" type=password value="pz"> + </form>`, + returnedFieldIDsByFormLike: [["pw"]], + minPasswordLength: 2, + }, + { + description: "minPasswordLength should allow matching-length field values", + document: `<form> + <input id="pw-empty" type=password> + <input id="pw-matchlen" type=password value="pz"> + <input id="pw" type=password value="pazz"> + </form>`, + returnedFieldIDsByFormLike: [["pw-matchlen", "pw"]], + minPasswordLength: 2, + }, + { + description: + "2 password fields outside of a <form> with 1 linked via @form + minPasswordLength with 1 empty", + document: `<input id="pw1" type=password value=" pass1 "><input id="pw2" type=password form="form1"> + <form id="form1"></form>`, + returnedFieldIDsByFormLike: [["pw1"], []], + minPasswordLength: 2, + fieldOverrideRecipe: { + // Ensure a recipe without `notPasswordSelector` doesn't cause a problem. + hosts: ["localhost:8080"], + }, + }, + { + description: + "3 password fields outside of a <form> with 1 linked via @form + minPasswordLength", + document: `<input id="pw1" type=password value="pass1"><input id="pw2" type=password form="form1" value="pass2"><input id="pw3" type=password value="pass3"> + <form id="form1"><input id="pw4" type=password></form>`, + returnedFieldIDsByFormLike: [["pw3"], ["pw2"]], + minPasswordLength: 2, + fieldOverrideRecipe: { + hosts: ["localhost:8080"], + notPasswordSelector: "#pw1", + }, + }, + { + beforeGetFunction(doc) { + doc.getElementById("pw1").remove(); + }, + description: + "1 password field outside of a <form> which gets removed/disconnected", + document: `<input id="pw1" type=password>`, + returnedFieldIDsByFormLike: [[]], + minPasswordLength: undefined, + }, +]; + +for (let tc of TESTCASES) { + info("Sanity checking the testcase: " + tc.description); + + (function () { + let testcase = tc; + add_task(async function () { + info("Starting testcase: " + testcase.description); + let document = MockDocument.createTestDocument( + "http://localhost:8080/test/", + testcase.document + ); + + let mapRootElementToFormLike = new Map(); + for (let input of document.querySelectorAll("input")) { + let formLike = LoginFormFactory.createFromField(input); + let existingFormLike = mapRootElementToFormLike.get( + formLike.rootElement + ); + if (!existingFormLike) { + mapRootElementToFormLike.set(formLike.rootElement, formLike); + continue; + } + + // If the formLike is already present, ensure that the properties are the same. + info( + "Checking if the new FormLike for the same root has the same properties" + ); + formLikeEqual(formLike, existingFormLike); + } + + if (testcase.beforeGetFunction) { + await testcase.beforeGetFunction(document); + } + + Assert.strictEqual( + mapRootElementToFormLike.size, + testcase.returnedFieldIDsByFormLike.length, + "Check the correct number of different formLikes were returned" + ); + + let formLikeIndex = -1; + for (let formLikeFromInput of mapRootElementToFormLike.values()) { + formLikeIndex++; + let pwFields = LoginFormState._getPasswordFields(formLikeFromInput, { + fieldOverrideRecipe: testcase.fieldOverrideRecipe, + minPasswordLength: testcase.minPasswordLength, + }); + + if ( + ChromeUtils.getClassName(formLikeFromInput.rootElement) === + "HTMLFormElement" + ) { + let formLikeFromForm = LoginFormFactory.createFromForm( + formLikeFromInput.rootElement + ); + info( + "Checking that the FormLike created for the <form> matches" + + " the one from a password field" + ); + formLikeEqual(formLikeFromInput, formLikeFromForm); + } + + if (testcase.returnedFieldIDsByFormLike[formLikeIndex].length === 0) { + Assert.strictEqual( + pwFields, + null, + "If no password fields were found null should be returned" + ); + } else { + Assert.strictEqual( + pwFields.length, + testcase.returnedFieldIDsByFormLike[formLikeIndex].length, + "Check the # of password fields for formLike #" + formLikeIndex + ); + } + + for ( + let i = 0; + i < testcase.returnedFieldIDsByFormLike[formLikeIndex].length; + i++ + ) { + let expectedID = + testcase.returnedFieldIDsByFormLike[formLikeIndex][i]; + Assert.strictEqual( + pwFields[i].element.id, + expectedID, + "Check password field " + i + " ID" + ); + } + } + }); + })(); +} + +const EMOJI_TESTCASES = [ + { + description: + "Single characters composed of 2 code units should ideally fail minPasswordLength of 2", + document: `<form> + <input id="pw" type=password value="💩"> + </form>`, + returnedFieldIDsByFormLike: [["pw"]], + minPasswordLength: 2, + }, + { + description: + "Single characters composed of multiple code units should ideally fail minPasswordLength of 2", + document: `<form> + <input id="pw" type=password value="👪"> + </form>`, + minPasswordLength: 2, + }, +]; + +// Note: Bug 780449 tracks our handling of emoji and multi-code-point characters in password fields +// and the .length we should expect when a password value includes them +for (let tc of EMOJI_TESTCASES) { + info("Sanity checking the testcase: " + tc.description); + + (function () { + let testcase = tc; + add_task(async function () { + info("Starting testcase: " + testcase.description); + let document = MockDocument.createTestDocument( + "http://localhost:8080/test/", + testcase.document + ); + let input = document.querySelector("input[type='password']"); + Assert.ok(input, "Found the password field"); + let formLike = LoginFormFactory.createFromField(input); + let pwFields = LoginFormState._getPasswordFields(formLike, { + minPasswordLength: testcase.minPasswordLength, + }); + info("Got password fields: " + pwFields.length); + todo_check_eq( + pwFields.length, + 0, + "Check a single-character (emoji) password is excluded from the password fields collection" + ); + }); + })(); +} diff --git a/toolkit/components/passwordmgr/test/unit/test_getPasswordOrigin.js b/toolkit/components/passwordmgr/test/unit/test_getPasswordOrigin.js new file mode 100644 index 0000000000..9df18d05cc --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_getPasswordOrigin.js @@ -0,0 +1,35 @@ +/** + * Test for LoginHelper.getLoginOrigin + */ + +"use strict"; + +const TESTCASES = [ + ["javascript:void(0);", null], + ["javascript:void(0);", "javascript:", true], + ["chrome://MyAccount", "chrome://myaccount"], + ["data:text/html,example", null], + [ + "http://username:password@example.com:80/foo?bar=baz#fragment", + "http://example.com", + true, + ], + ["http://127.0.0.1:80/foo", "http://127.0.0.1"], + ["http://[::1]:80/foo", "http://[::1]"], + ["http://example.com:8080/foo", "http://example.com:8080"], + ["http://127.0.0.1:8080/foo", "http://127.0.0.1:8080", true], + ["http://[::1]:8080/foo", "http://[::1]:8080"], + ["https://example.com:443/foo", "https://example.com"], + ["https://[::1]:443/foo", "https://[::1]"], + ["https://[::1]:8443/foo", "https://[::1]:8443"], + ["ftp://username:password@[::1]:2121/foo", "ftp://[::1]:2121"], + [ + "moz-proxy://username:password@123.456.789.123:12345/foo", + "moz-proxy://123.456.789.123:12345", + ], +]; + +for (let [input, expected, allowJS] of TESTCASES) { + let actual = LoginHelper.getLoginOrigin(input, allowJS); + Assert.strictEqual(actual, expected, "Checking: " + input); +} diff --git a/toolkit/components/passwordmgr/test/unit/test_getUserNameAndPasswordFields.js b/toolkit/components/passwordmgr/test/unit/test_getUserNameAndPasswordFields.js new file mode 100644 index 0000000000..86aae5d14c --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_getUserNameAndPasswordFields.js @@ -0,0 +1,177 @@ +/** + * Test for LoginFormState.getUserNameAndPasswordFields + */ + +"use strict"; + +const { LoginManagerChild } = ChromeUtils.importESModule( + "resource://gre/modules/LoginManagerChild.sys.mjs" +); +const TESTCASES = [ + { + description: "1 password field outside of a <form>", + document: `<input id="pw1" type=password>`, + returnedFieldIDs: [null, "pw1", null], + }, + { + description: "1 text field in a <form> without a password field", + document: `<form> + <input id="un1"> + </form>`, + returnedFieldIDs: [null, null, null], + }, + { + description: "1 text field outside of a <form> without a password field", + document: `<input id="un1">`, + returnedFieldIDs: [null, null, null], + }, + { + description: "1 username & password field outside of a <form>", + document: `<input id="un1"> + <input id="pw1" type=password>`, + returnedFieldIDs: ["un1", "pw1", null], + }, + { + description: "1 username & password field in a <form>", + document: `<form> + <input id="un1"> + <input id="pw1" type=password> + </form>`, + returnedFieldIDs: ["un1", "pw1", null], + }, + { + description: "5 empty password fields outside of a <form>", + document: `<input id="pw1" type=password> + <input id="pw2" type=password> + <input id="pw3" type=password> + <input id="pw4" type=password> + <input id="pw5" type=password>`, + returnedFieldIDs: [null, "pw1", null], + }, + { + description: "6 empty password fields outside of a <form>", + document: `<input id="pw1" type=password> + <input id="pw2" type=password> + <input id="pw3" type=password> + <input id="pw4" type=password> + <input id="pw5" type=password> + <input id="pw6" type=password>`, + returnedFieldIDs: [null, null, null], + }, + { + description: "Form with 1 password field", + document: `<form><input id="pw1" type=password></form>`, + returnedFieldIDs: [null, "pw1", null], + }, + { + description: "Form with 2 password fields", + document: `<form><input id="pw1" type=password><input id='pw2' type=password></form>`, + returnedFieldIDs: [null, "pw1", null], + }, + { + description: "1 password field in a form, 1 outside (not processed)", + document: `<form><input id="pw1" type=password></form><input id="pw2" type=password>`, + returnedFieldIDs: [null, "pw1", null], + }, + { + description: + "1 password field in a form, 1 text field outside (not processed)", + document: `<form><input id="pw1" type=password></form><input>`, + returnedFieldIDs: [null, "pw1", null], + }, + { + description: + "1 text field in a form, 1 password field outside (not processed)", + document: `<form><input></form><input id="pw1" type=password>`, + returnedFieldIDs: [null, null, null], + }, + { + description: + "2 password fields outside of a <form> with 1 linked via @form", + document: `<input id="pw1" type=password><input id="pw2" type=password form='form1'> + <form id="form1"></form>`, + returnedFieldIDs: [null, "pw1", null], + }, + { + description: "1 username field in a <form>", + document: `<form> + <input id="un1" autocomplete=username> + </form>`, + returnedFieldIDs: ["un1", null, null], + }, + { + description: "1 username field outside of a <form>", + document: `<input id="un1" autocomplete=username>`, + returnedFieldIDs: [null, null, null], + }, +]; + +function _setPrefs() { + Services.prefs.setBoolPref("signon.usernameOnlyForm.enabled", true); + registerCleanupFunction(() => { + Services.prefs.clearUserPref("signon.usernameOnlyForm.enabled"); + }); +} + +_setPrefs(); + +for (let tc of TESTCASES) { + info("Sanity checking the testcase: " + tc.description); + + (function () { + let testcase = tc; + add_task(async function () { + info("Starting testcase: " + testcase.description); + let document = MockDocument.createTestDocument( + "http://localhost:8080/test/", + testcase.document + ); + + let input = document.querySelector("input"); + MockDocument.mockOwnerDocumentProperty( + input, + document, + "http://localhost:8080/test/" + ); + MockDocument.mockNodePrincipalProperty( + input, + "http://localhost:8080/test/" + ); + + // Additional mock to cache recipes + let win = {}; + Object.defineProperty(document, "defaultView", { + value: win, + }); + let formOrigin = LoginHelper.getLoginOrigin(document.documentURI); + LoginRecipesContent.cacheRecipes(formOrigin, win, new Set()); + + const loginManagerChild = new LoginManagerChild(); + const docState = loginManagerChild.stateForDocument(document); + let actual = docState.getUserNameAndPasswordFields(input); + + Assert.strictEqual( + testcase.returnedFieldIDs.length, + 3, + "getUserNameAndPasswordFields returns 3 elements" + ); + + for (let i = 0; i < testcase.returnedFieldIDs.length; i++) { + let expectedID = testcase.returnedFieldIDs[i]; + if (expectedID === null) { + Assert.strictEqual( + actual[i], + expectedID, + "Check returned field " + i + " is null" + ); + } else { + Assert.strictEqual( + actual[i].id, + expectedID, + "Check returned field " + i + " ID" + ); + } + } + }); + })(); +} diff --git a/toolkit/components/passwordmgr/test/unit/test_getUsernameFieldFromUsernameOnlyForm.js b/toolkit/components/passwordmgr/test/unit/test_getUsernameFieldFromUsernameOnlyForm.js new file mode 100644 index 0000000000..1af2bb889c --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_getUsernameFieldFromUsernameOnlyForm.js @@ -0,0 +1,179 @@ +/** + * Test for LoginFormState.getUsernameFieldFromUsernameOnlyForm + */ + +"use strict"; + +const { LoginManagerChild } = ChromeUtils.importESModule( + "resource://gre/modules/LoginManagerChild.sys.mjs" +); + +// expectation[0] tests cases when a form doesn't have a sign-in keyword. +// expectation[1] tests cases when a form has a sign-in keyword. +const TESTCASES = [ + { + description: "1 text input field", + document: `<form> + <input id="un1" type="text"> + </form>`, + expectations: [false, true], + }, + { + description: "1 text input field & 1 hidden input fields", + document: `<form> + <input id="un1" type="text"> + <input id="un2" type="hidden"> + </form>`, + expectations: [false, true], + }, + { + description: "1 username field", + document: `<form> + <input id="un1" autocomplete="username"> + </form>`, + expectations: [true, true], + }, + { + description: "1 username field & 1 hidden input fields", + document: `<form> + <input id="un1" autocomplete="username"> + <input id="un2" type="hidden"> + </form>`, + expectations: [true, true], + }, + { + description: "1 username field, 1 hidden input field, & 1 password field", + document: `<form> + <input id="un1" autocomplete="username"> + <input id="un2" type="hidden"> + <input id="pw1" type=password> + </form>`, + expectations: [false, false], + }, + { + description: "1 password field", + document: `<form> + <input id="pw1" type=password> + </form>`, + expectations: [false, false], + }, + { + description: "1 username & password field", + document: `<form> + <input id="un1" autocomplete="username"> + <input id="pw1" type=password> + </form>`, + expectations: [false, false], + }, + { + description: "1 username & text field", + document: `<form> + <input id="un1" autocomplete="username"> + <input id="un2" type="text"> + </form>`, + expectations: [false, false], + }, + { + description: "2 text input fields", + document: `<form> + <input id="un1" type="text"> + <input id="un2" type="text"> + </form>`, + expectations: [false, false], + }, + { + description: "2 username fields", + document: `<form> + <input id="un1" autocomplete="username"> + <input id="un2" autocomplete="username"> + </form>`, + expectations: [false, false], + }, + { + description: "1 username field with search keyword", + document: `<form> + <input id="un1" autocomplete="username" placeholder="search by username"> + </form>`, + expectations: [false, false], + }, + { + description: "1 text input field with code keyword", + document: `<form> + <input id="un1" type="text" placeholder="enter your 6-digit code"> + </form>`, + expectations: [false, false], + }, + { + description: "Form with only a hidden field", + document: `<form> + <input id="un1" type="hidden" autocomplete="username"> + </form>`, + expectations: [false, false], + }, + { + description: "Form with only a button", + document: `<form> + <input id="un1" type="button" autocomplete="username"> + </form>`, + expectations: [false, false], + }, + { + description: "A username only form matches not username selector", + document: `<form> + <input id="un1" type="text" name="secret_username"> + </form>`, + fieldOverrideRecipe: { + hosts: ["localhost:8080"], + notUsernameSelector: 'input[name="secret_username"]', + }, + expectations: [false, false], + }, +]; + +function _setPrefs() { + Services.prefs.setBoolPref("signon.usernameOnlyForm.enabled", true); + registerCleanupFunction(() => { + Services.prefs.clearUserPref("signon.usernameOnlyForm.enabled"); + }); +} + +_setPrefs(); + +for (let tc of TESTCASES) { + info("Sanity checking the testcase: " + tc.description); + + // A form is considered a username-only form + for (let formHasSigninKeyword of [false, true]) { + (function () { + const testcase = tc; + add_task(async function () { + if (formHasSigninKeyword) { + testcase.decription += " (form has a login keyword)"; + } + info("Starting testcase: " + testcase.description); + info("Document string: " + testcase.document); + const document = MockDocument.createTestDocument( + "http://localhost:8080/test/", + testcase.document + ); + + let form = document.querySelector("form"); + if (formHasSigninKeyword) { + form.setAttribute("name", "login"); + } + + const lmc = new LoginManagerChild(); + const docState = lmc.stateForDocument(form.ownerDocument); + const element = docState.getUsernameFieldFromUsernameOnlyForm( + form, + testcase.fieldOverrideRecipe + ); + Assert.strictEqual( + testcase.expectations[formHasSigninKeyword ? 1 : 0], + element != null, + `Return incorrect result when the layout is ${testcase.description}` + ); + }); + })(); + } +} diff --git a/toolkit/components/passwordmgr/test/unit/test_isInferredLoginForm.js b/toolkit/components/passwordmgr/test/unit/test_isInferredLoginForm.js new file mode 100644 index 0000000000..01bc3ff816 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_isInferredLoginForm.js @@ -0,0 +1,98 @@ +/** + * Test for LoginHelper.isInferredLoginForm. + */ + +"use strict"; + +const attributeTestData = [ + { + testValues: ["", "form", "search", "signup", "sign-up", "sign/up"], + expectation: false, + }, + { + testValues: [ + "Login", + "Log in", + "Log on", + "Log-on", + "Sign in", + "Sigin", + "Sign/in", + "Sign-in", + "Sign on", + "Sign-on", + "loginForm", + "form-sign-in", + ], + expectation: true, + }, +]; + +const classNameTestData = [ + { + testValues: [ + "", + "inputTxt form-control", + "user-input form-name", + "text name mail", + "form signup", + ], + expectation: false, + }, + { + testValues: ["login form"], + expectation: true, + }, +]; + +const TESTCASES = [ + { + description: "Test id attribute", + update: (doc, v) => { + doc.querySelector("form").setAttribute("id", v); + }, + subtests: attributeTestData, + }, + { + description: "Test name attribute", + update: (doc, v) => { + doc.querySelector("form").setAttribute("name", v); + }, + subtests: attributeTestData, + }, + { + description: "Test class attribute", + update: (doc, v) => { + doc.querySelector("form").setAttribute("class", v); + }, + subtests: [...attributeTestData, ...classNameTestData], + }, +]; + +for (let testcase of TESTCASES) { + info("Sanity checking the testcase: " + testcase.description); + + (function () { + add_task(async function () { + info("Starting testcase: " + testcase.description); + + for (let subtest of testcase.subtests) { + const document = MockDocument.createTestDocument( + "http://localhost:8080/test/", + `<form id="id" name="name"></form>` + ); + + for (let value of subtest.testValues) { + testcase.update(document, value); + const ele = document.querySelector("form"); + const ret = LoginHelper.isInferredLoginForm(ele); + Assert.strictEqual( + ret, + subtest.expectation, + `${testcase.description}, isInferredLoginForm doesn't return correct result while setting the value to ${value}` + ); + } + } + }); + })(); +} diff --git a/toolkit/components/passwordmgr/test/unit/test_isInferredUsernameField.js b/toolkit/components/passwordmgr/test/unit/test_isInferredUsernameField.js new file mode 100644 index 0000000000..e7d0785e8d --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_isInferredUsernameField.js @@ -0,0 +1,222 @@ +/** + * Test for LoginHelper.isInferredUsernameField and LoginHelper.isInferredEmailField. + */ + +"use strict"; + +const attributeTestData = [ + { + testValues: [ + "", + "name", + "e-mail", + "user", + "user name", + "userid", + "lastname", + ], + expectation: "none", + }, + { + testValues: ["email", "EmaiL", "loginemail", "邮箱"], + expectation: "email", + }, + { + testValues: ["username", "usErNaMe", "my username"], + expectation: "username", + }, + { + testValues: ["usernameAndemail", "EMAILUSERNAME"], + expectation: "username,email", + }, +]; + +const classNameTestData = [ + { + testValues: [ + "inputTxt form-control", + "user-input form-name", + "text name mail", + ], + expectation: "none", + }, + { + testValues: ["input email", "signin-email form", "input form valid-Email"], + expectation: "email", + }, + { + testValues: [ + "input username", + "signup-username form", + "input form my_username", + ], + expectation: "username", + }, + { + testValues: ["input text form username email"], + expectation: "username,email", + }, +]; + +const labelTestData = [ + { + testValues: [ + "First Name", + "Last Name", + "Company Name", + "Password", + "User Name", + ], + expectation: "none", + }, + { + testValues: ["Email:", "Email Address*"], + expectation: "email", + }, + { + testValues: ["Username:", "choose a username"], + expectation: "username", + }, + { + testValues: ["Username/Email", "username or email"], + expectation: "username,email", + }, +]; + +const TESTCASES = [ + { + description: "Test input type", + update: (doc, v) => { + doc.querySelector("input").setAttribute("type", v); + }, + subtests: [ + { + testValues: ["text", "url", "number", "username"], + expectation: "none", + }, + { + testValues: ["email"], + expectation: "email", + }, + ], + }, + { + description: "Test autocomplete field", + update: (doc, v) => { + doc.querySelector("input").setAttribute("autocomplete", v); + }, + subtests: [ + { + testValues: [ + "off", + "on", + "name", + "new-password", + "current-password", + "tel", + "tel-national", + "url", + ], + expectation: "none", + }, + { + testValues: ["email"], + expectation: "email", + }, + { + testValues: ["username"], + expectation: "username", + }, + ], + }, + { + description: "Test id attribute", + update: (doc, v) => { + doc.querySelector("input").setAttribute("id", v); + }, + subtests: attributeTestData, + }, + { + description: "Test name attribute", + update: (doc, v) => { + doc.querySelector("input").setAttribute("name", v); + }, + subtests: attributeTestData, + }, + { + description: "Test class attribute", + update: (doc, v) => { + doc.querySelector("input").setAttribute("class", v); + }, + subtests: [...attributeTestData, ...classNameTestData], + }, + { + description: "Test placeholder attribute", + update: (doc, v) => { + doc.querySelector("input").setAttribute("placeholder", v); + }, + subtests: attributeTestData, + }, + { + description: "Test the first label", + update: (doc, v) => { + doc.getElementById("l1").textContent = v; + }, + subtests: labelTestData, + }, + { + description: "Test the second label", + update: (doc, v) => { + doc.getElementById("l2").textContent = v; + }, + subtests: labelTestData, + + // The username detection heuristic only examine the first label associated + // with the input, so no matter what the data is for this label, it doesn't + // affect the result. + // We can update this testcase once we decide to support multiple labels. + supported: false, + }, +]; + +for (let testcase of TESTCASES) { + info("Sanity checking the testcase: " + testcase.description); + + (function () { + add_task(async function () { + info("Starting testcase: " + testcase.description); + + for (let subtest of testcase.subtests) { + let document = MockDocument.createTestDocument( + "http://localhost:8080/test/", + `<label id="l1" for="id"></label> + <label id="l2" for="id"></label> + <input id="id" type="text" name="name">` + ); + + for (let value of subtest.testValues) { + testcase.update(document, value); + let ele = document.querySelector("input"); + + let ret = LoginHelper.isInferredUsernameField(ele); + Assert.strictEqual( + ret, + testcase.supported !== false + ? subtest.expectation.includes("username") + : false, + `${testcase.description}, isInferredUsernameField doesn't return correct result while setting the value to ${value}` + ); + + ret = LoginHelper.isInferredEmailField(ele); + Assert.strictEqual( + ret, + testcase.supported !== false + ? subtest.expectation.includes("email") + : false, + `${testcase.description}, isInferredEmailField doesn't return correct result while setting the value to ${value}` + ); + } + } + }); + })(); +} diff --git a/toolkit/components/passwordmgr/test/unit/test_isOriginMatching.js b/toolkit/components/passwordmgr/test/unit/test_isOriginMatching.js new file mode 100644 index 0000000000..02547609ec --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_isOriginMatching.js @@ -0,0 +1,177 @@ +/** + * Test LoginHelper.isOriginMatching + */ + +"use strict"; + +add_task(function test_isOriginMatching() { + let testcases = [ + // Index 0 holds the expected return value followed by arguments to isOriginMatching. + [true, "http://example.com", "http://example.com"], + [true, "http://example.com:8080", "http://example.com:8080"], + [true, "https://example.com", "https://example.com"], + [true, "https://example.com:8443", "https://example.com:8443"], + + // The formActionOrigin can be "javascript:" + [true, "javascript:", "javascript:"], + [false, "javascript:", "http://example.com"], + [false, "http://example.com", "javascript:"], + + // HTTP Auth. logins have a null formActionOrigin + [true, null, null], + [false, null, "http://example.com"], + [false, "http://example.com", null], + + [false, "http://example.com", "http://mozilla.org"], + [false, "http://example.com", "http://example.com:8080"], + [false, "https://example.com", "http://example.com"], + [false, "https://example.com", "https://mozilla.org"], + [false, "http://example.com", "http://sub.example.com"], + [false, "https://example.com", "https://sub.example.com"], + [false, "http://example.com", "https://example.com:8443"], + [false, "http://example.com:8080", "http://example.com:8081"], + [false, "http://example.com", ""], + [false, "", "http://example.com"], + [ + true, + "http://example.com", + "https://example.com", + { schemeUpgrades: true }, + ], + [ + true, + "https://example.com", + "https://example.com", + { schemeUpgrades: true }, + ], + [ + true, + "http://example.com:8080", + "http://example.com:8080", + { schemeUpgrades: true }, + ], + [ + true, + "https://example.com:8443", + "https://example.com:8443", + { schemeUpgrades: true }, + ], + [ + false, + "https://example.com", + "http://example.com", + { schemeUpgrades: true }, + ], // downgrade + [ + false, + "http://example.com:8080", + "https://example.com", + { schemeUpgrades: true }, + ], // port mismatch + [ + false, + "http://example.com", + "https://example.com:8443", + { schemeUpgrades: true }, + ], // port mismatch + [ + false, + "http://sub.example.com", + "http://example.com", + { schemeUpgrades: true }, + ], + [ + true, + "http://sub.example.com", + "http://example.com", + { acceptDifferentSubdomains: true }, + ], + [ + true, + "http://sub.sub.example.com", + "http://example.com", + { acceptDifferentSubdomains: true }, + ], + [ + true, + "http://example.com", + "http://sub.example.com", + { acceptDifferentSubdomains: true }, + ], + [ + true, + "http://example.com", + "http://sub.sub.example.com", + { acceptDifferentSubdomains: true }, + ], + [ + false, + "https://sub.example.com", + "http://example.com", + { acceptDifferentSubdomains: true, schemeUpgrades: true }, + ], + [ + true, + "http://sub.example.com", + "https://example.com", + { acceptDifferentSubdomains: true, schemeUpgrades: true }, + ], + [ + true, + "http://sub.example.com", + "http://example.com:8081", + { acceptDifferentSubdomains: true }, + ], + [ + false, + "http://sub.example.com", + "http://sub.example.mozilla.com", + { acceptDifferentSubdomains: true }, + ], + // signon.includeOtherSubdomainsInLookup allows acceptDifferentSubdomains to be false + [ + false, + "http://sub.example.com", + "http://example.com", + { acceptDifferentSubdomains: false }, + ], + [ + false, + "http://sub.sub.example.com", + "http://example.com", + { acceptDifferentSubdomains: false }, + ], + [ + false, + "http://sub.example.com", + "http://example.com:8081", + { acceptDifferentSubdomains: false }, + ], + [ + false, + "http://sub.example.com", + "http://sub.example.mozilla.com", + { acceptDifferentSubdomains: false }, + ], + + // HTTP Auth. logins have a null formActionOrigin + [ + false, + null, + "http://example.com", + { + acceptDifferentSubdomains: false, + acceptWildcardMatch: true, + schemeUpgrades: true, + }, + ], + ]; + for (let tc of testcases) { + let expected = tc.shift(); + Assert.strictEqual( + LoginHelper.isOriginMatching(...tc), + expected, + "Check " + JSON.stringify(tc) + ); + } +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_isProbablyANewPasswordField.js b/toolkit/components/passwordmgr/test/unit/test_isProbablyANewPasswordField.js new file mode 100644 index 0000000000..167c160da2 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_isProbablyANewPasswordField.js @@ -0,0 +1,192 @@ +/** + * Test for LoginAutoComplete.isProbablyANewPasswordField. + */ + +"use strict"; + +const LoginAutoComplete = Cc[ + "@mozilla.org/login-manager/autocompletesearch;1" +].getService(Ci.nsILoginAutoCompleteSearch).wrappedJSObject; +// TODO: create a fake window for the test document to pass fathom.isVisible check. +// We should consider moving these tests to mochitest because many fathom +// signals rely on visibility, position, etc., of the test element (See Bug 1712699), +// which is not supported in xpcshell-test. +function makeDocumentVisibleToFathom(doc) { + let win = { + getComputedStyle() { + return { + overflow: "visible", + visibility: "visible", + }; + }, + }; + Object.defineProperty(doc, "defaultView", { + value: win, + }); + return doc; +} + +function labelledByDocument() { + let doc = MockDocument.createTestDocument( + "http://localhost:8080/test/", + `<div> + <label id="paper-input-label-2">Password</label> + <input aria-labelledby="paper-input-label-2" type="password"> + </div>` + ); + let div = doc.querySelector("div"); + // Put the div contents inside shadow DOM. + div.attachShadow({ mode: "open" }).append(...div.children); + return doc; +} +const LABELLEDBY_SHADOW_TESTCASE = labelledByDocument(); + +const TESTCASES = [ + // Note there is no test case for `<input type="password" autocomplete="new-password">` + // since isProbablyANewPasswordField explicitly does not run in that case. + { + description: "Basic login form", + document: ` + <h1>Sign in</h1> + <form> + <label>Username: <input type="text" name="username"></label> + <label>Password: <input type="password" name="password"></label> + <input type="submit" value="Sign in"> + </form> + `, + expectedResult: [false], + }, + { + description: "Basic registration form", + document: ` + <h1>Create account</h1> + <form> + <label>Username: <input type="text" name="username"></label> + <label>Password: <input type="password" name="new-password"></label> + <input type="submit" value="Register"> + </form> + `, + expectedResult: [true], + }, + { + // TODO: Add <placeholder="confirm"> to "confirm-passowrd" password field so fathom can recognize it + // as a new password field. Currently, the fathom rules don't really work well in xpcshell-test + // because signals rely on visibility, position doesn't work. If we move this test to mochitest, we should + // be able to remove the interim solution (See Bug 1712699). + description: "Basic password change form", + document: ` + <h1>Change password</h1> + <form> + <label>Current Password: <input type="password" name="current-password"></label> + <label>New Password: <input type="password" name="new-password"></label> + <label>Confirm Password: <input type="password" name="confirm-password" placeholder="confirm"></label> + <input type="submit" value="Save"> + </form> + `, + expectedResult: [false, true, true], + }, + { + description: "Basic login 'form' without a form element", + document: ` + <h1>Sign in</h1> + <label>Username: <input type="text" name="username"></label> + <label>Password: <input type="password" name="password"></label> + <input type="submit" value="Sign in"> + `, + expectedResult: [false], + }, + { + description: "Basic registration 'form' without a form element", + document: ` + <h1>Create account</h1> + <label>Username: <input type="text" name="username"></label> + <label>Password: <input type="password" name="new-password"></label> + <input type="submit" value="Register"> + `, + expectedResult: [true], + }, + { + description: "Basic password change 'form' without a form element", + document: ` + <h1>Change password</h1> + <label>Current Password: <input type="password" name="current-password"></label> + <label>New Password: <input type="password" name="new-password"></label> + <label>Confirm Password: <input type="password" name="confirm-password"></label> + <input type="submit" value="Save"> + `, + expectedResult: [false, true, true], + }, + { + description: "Password field with aria-labelledby inside shadow DOM", + document: LABELLEDBY_SHADOW_TESTCASE, + inputs: LABELLEDBY_SHADOW_TESTCASE.querySelector( + "div" + ).shadowRoot.querySelectorAll("input[type='password']"), + expectedResult: [false], + }, +]; + +add_task(async function test_returns_false_when_pref_disabled() { + const threshold = Services.prefs.getStringPref( + NEW_PASSWORD_HEURISTIC_ENABLED_PREF + ); + + info("Temporarily disabling new-password heuristic pref"); + Services.prefs.setStringPref(NEW_PASSWORD_HEURISTIC_ENABLED_PREF, "-1"); + + // Use registration form test case, where we know it should return true if enabled + const testcase = TESTCASES[1]; + info("Starting testcase: " + testcase.description); + const document = Document.isInstance(testcase.document) + ? testcase.document + : MockDocument.createTestDocument( + "http://localhost:8080/test/", + testcase.document + ); + for (let [i, input] of testcase.inputs || + document.querySelectorAll(`input[type="password"]`).entries()) { + const result = LoginAutoComplete.isProbablyANewPasswordField(input); + Assert.strictEqual( + result, + false, + `When the pref is set to disable, the result is always false, e.g. for the testcase, ${testcase.description} ${i}` + ); + } + + info("Re-enabling new-password heuristic pref"); + Services.prefs.setStringPref(NEW_PASSWORD_HEURISTIC_ENABLED_PREF, threshold); +}); + +for (let testcase of TESTCASES) { + info("Sanity checking the testcase: " + testcase.description); + + (function () { + add_task(async function () { + info("Starting testcase: " + testcase.description); + let document = Document.isInstance(testcase.document) + ? testcase.document + : MockDocument.createTestDocument( + "http://localhost:8080/test/", + testcase.document + ); + + document = makeDocumentVisibleToFathom(document); + + const results = []; + for (let input of testcase.inputs || + document.querySelectorAll(`input[type="password"]`)) { + const result = LoginAutoComplete.isProbablyANewPasswordField(input); + results.push(result); + } + + for (let i = 0; i < testcase.expectedResult.length; i++) { + let expectedResult = testcase.expectedResult[i]; + Assert.strictEqual( + results[i], + expectedResult, + `In the test case, ${testcase.description}, check if password field #${i} is a new password field.` + ); + } + }); + })(); +} diff --git a/toolkit/components/passwordmgr/test/unit/test_isUsernameFieldType.js b/toolkit/components/passwordmgr/test/unit/test_isUsernameFieldType.js new file mode 100644 index 0000000000..57238964a7 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_isUsernameFieldType.js @@ -0,0 +1,160 @@ +/** + * Test for LoginHelper.isUsernameFieldType + */ + +"use strict"; + +const autocompleteTypes = { + "": true, + on: true, + off: true, + name: false, + "unrecognized-type": true, + "given-name": false, + "additional-name": false, + "family-name": false, + nickname: false, + username: true, + "new-password": false, + "current-password": false, + "organization-title": false, + organization: false, + "street-address": false, + "address-line1": false, + "address-line2": false, + "address-line3": false, + "address-level4": false, + "address-level3": false, + "address-level2": false, + "address-level1": false, + country: false, + "country-name": false, + "postal-code": false, + "cc-name": false, + "cc-given-name": false, + "cc-additional-name": false, + "cc-family-name": false, + "cc-number": false, + "cc-exp": false, + "cc-exp-month": false, + "cc-exp-year": false, + "cc-csc": false, + "cc-type": false, + "transaction-currency": false, + "transaction-amount": false, + language: false, + bday: false, + "bday-day": false, + "bday-month": false, + "bday-year": false, + sex: false, + url: false, + photo: false, + tel: true, + "tel-country-code": false, + "tel-national": true, + "tel-area-code": false, + "tel-local": false, + "tel-local-prefix": false, + "tel-local-suffix": false, + "tel-extension": false, + email: true, + impp: false, +}; + +const TESTCASES = [ + { + description: "type=text", + document: `<input type="text">`, + expected: true, + }, + { + description: "type=email, no autocomplete attribute", + document: `<input type="email">`, + expected: true, + }, + { + description: "type=url, no autocomplete attribute", + document: `<input type="url">`, + expected: true, + }, + { + description: "type=tel, no autocomplete attribute", + document: `<input type="tel">`, + expected: true, + }, + { + description: "type=number, no autocomplete attribute", + document: `<input type="number">`, + expected: true, + }, + { + description: "type=search, no autocomplete attribute", + document: `<input type="search">`, + expected: true, + }, + { + description: "type=range, no autocomplete attribute", + document: `<input type="range">`, + expected: false, + }, + { + description: "type=date, no autocomplete attribute", + document: `<input type="date">`, + expected: false, + }, + { + description: "type=month, no autocomplete attribute", + document: `<input type="month">`, + expected: false, + }, + { + description: "type=week, no autocomplete attribute", + document: `<input type="week">`, + expected: false, + }, + { + description: "type=time, no autocomplete attribute", + document: `<input type="time">`, + expected: false, + }, + { + description: "type=datetime, no autocomplete attribute", + document: `<input type="datetime">`, + expected: false, + }, + { + description: "type=datetime-local, no autocomplete attribute", + document: `<input type="datetime-local">`, + expected: false, + }, + { + description: "type=color, no autocomplete attribute", + document: `<input type="color">`, + expected: false, + }, +]; + +for (let [name, expected] of Object.entries(autocompleteTypes)) { + TESTCASES.push({ + description: `type=text autocomplete=${name}`, + document: `<input type="text" autocomplete="${name}">`, + expected, + }); +} + +TESTCASES.forEach(testcase => { + add_task(async function () { + info("Starting testcase: " + testcase.description); + let document = MockDocument.createTestDocument( + "http://localhost:8080/test/", + testcase.document + ); + let input = document.querySelector("input"); + Assert.equal( + LoginHelper.isUsernameFieldType(input), + testcase.expected, + testcase.description + ); + }); +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_legacy_empty_formActionOrigin.js b/toolkit/components/passwordmgr/test/unit/test_legacy_empty_formActionOrigin.js new file mode 100644 index 0000000000..ec6846ab9f --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_legacy_empty_formActionOrigin.js @@ -0,0 +1,126 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +/** + * Tests the legacy case of a login store containing entries that have an empty + * string in the formActionOrigin field. + * + * In normal conditions, for the purpose of login autocomplete, HTML forms are + * identified using both the prePath of the URI on which they are located, and + * the prePath of the URI where the data will be submitted. This is represented + * by the origin and formActionOrigin properties of the stored nsILoginInfo. + * + * When a new login for use in forms is saved (after the user replies to the + * password prompt), it is always stored with both the origin and the + * formActionOrigin (that will be equal to the origin when the form has no + * "action" attribute). + * + * When the same form is displayed again, the password is autocompleted. If + * there is another form on the same site that submits to a different site, it + * is considered a different form, so the password is not autocompleted, but a + * new password can be stored for the other form. + * + * However, the login database might contain data for an nsILoginInfo that has a + * valid origin, but an empty formActionOrigin. This means that the login + * applies to all forms on the site, regardless of where they submit data to. + * + * A site can have at most one such login, and in case it is present, then it is + * not possible to store separate logins for forms on the same site that submit + * data to different sites. + * + * The only way to have such condition is to be using logins that were initially + * saved by a very old version of the browser, or because of data manually added + * by an extension in an old version. + */ + +"use strict"; + +// Tests + +/** + * Adds a login with an empty formActionOrigin, then it verifies that no other + * form logins can be added for the same host. + */ +add_task(async function test_addLogin_wildcard() { + let loginInfo = TestData.formLogin({ + origin: "http://any.example.com", + formActionOrigin: "", + }); + await Services.logins.addLoginAsync(loginInfo); + + // Normal form logins cannot be added anymore. + loginInfo = TestData.formLogin({ origin: "http://any.example.com" }); + await Assert.rejects( + Services.logins.addLoginAsync(loginInfo), + /already exists/ + ); + + // Authentication logins can still be added. + loginInfo = TestData.authLogin({ origin: "http://any.example.com" }); + await Services.logins.addLoginAsync(loginInfo); + + // Form logins can be added for other hosts. + loginInfo = TestData.formLogin({ origin: "http://other.example.com" }); + await Services.logins.addLoginAsync(loginInfo); +}); + +/** + * Verifies that findLogins, searchLogins, and countLogins include all logins + * that have an empty formActionOrigin in the store, even when a formActionOrigin is + * specified. + */ +add_task(function test_search_all_wildcard() { + // Search a given formActionOrigin on any host. + let matchData = newPropertyBag({ + formActionOrigin: "http://www.example.com", + }); + Assert.equal(Services.logins.searchLogins(matchData).length, 2); + + Assert.equal( + Services.logins.findLogins("", "http://www.example.com", null).length, + 2 + ); + + Assert.equal( + Services.logins.countLogins("", "http://www.example.com", null), + 2 + ); + + // Restrict the search to one host. + matchData.setProperty("origin", "http://any.example.com"); + Assert.equal(Services.logins.searchLogins(matchData).length, 1); + + Assert.equal( + Services.logins.findLogins( + "http://any.example.com", + "http://www.example.com", + null + ).length, + 1 + ); + + Assert.equal( + Services.logins.countLogins( + "http://any.example.com", + "http://www.example.com", + null + ), + 1 + ); +}); + +/** + * Verifies that specifying an empty string for formActionOrigin in searchLogins + * includes only logins that have an empty formActionOrigin in the store. + */ +add_task(function test_searchLogins_wildcard() { + let logins = Services.logins.searchLogins( + newPropertyBag({ formActionOrigin: "" }) + ); + + let loginInfo = TestData.formLogin({ + origin: "http://any.example.com", + formActionOrigin: "", + }); + LoginTestUtils.assertLoginListsEqual(logins, [loginInfo]); +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_legacy_validation.js b/toolkit/components/passwordmgr/test/unit/test_legacy_validation.js new file mode 100644 index 0000000000..7fb6c9807d --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_legacy_validation.js @@ -0,0 +1,94 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +/** + * Tests the legacy validation made when storing nsILoginInfo or disabled hosts. + * + * These rules exist because of limitations of the "signons.txt" storage file, + * that is not used anymore. They are still enforced by the Login Manager + * service, despite these values can now be safely stored in the back-end. + */ + +"use strict"; + +// Tests + +/** + * Tests legacy validation with addLogin. + */ +add_task(async function test_addLogin_invalid_characters_legacy() { + // Test newlines and carriage returns in properties that contain URLs. + for (let testValue of [ + "http://newline\n.example.com", + "http://carriagereturn.example.com\r", + ]) { + let loginInfo = TestData.formLogin({ origin: testValue }); + await Assert.rejects( + Services.logins.addLoginAsync(loginInfo), + /login values can't contain newlines/ + ); + + loginInfo = TestData.formLogin({ formActionOrigin: testValue }); + await Assert.rejects( + Services.logins.addLoginAsync(loginInfo), + /login values can't contain newlines/ + ); + + loginInfo = TestData.authLogin({ httpRealm: testValue }); + await Assert.rejects( + Services.logins.addLoginAsync(loginInfo), + /login values can't contain newlines/ + ); + } + + // Test newlines and carriage returns in form field names. + for (let testValue of ["newline_field\n", "carriagereturn\r_field"]) { + let loginInfo = TestData.formLogin({ usernameField: testValue }); + await Assert.rejects( + Services.logins.addLoginAsync(loginInfo), + /login values can't contain newlines/ + ); + + loginInfo = TestData.formLogin({ passwordField: testValue }); + await Assert.rejects( + Services.logins.addLoginAsync(loginInfo), + /login values can't contain newlines/ + ); + } + + // Test a single dot as the value of usernameField and formActionOrigin. + let loginInfo = TestData.formLogin({ usernameField: "." }); + await Assert.rejects( + Services.logins.addLoginAsync(loginInfo), + /login values can't be periods/ + ); + + loginInfo = TestData.formLogin({ formActionOrigin: "." }); + await Assert.rejects( + Services.logins.addLoginAsync(loginInfo), + /login values can't be periods/ + ); + + // Test the sequence " (" inside the value of the "origin" property. + loginInfo = TestData.formLogin({ origin: "http://parens (.example.com" }); + await Assert.rejects( + Services.logins.addLoginAsync(loginInfo), + /bad parens in origin/ + ); +}); + +/** + * Tests legacy validation with setLoginSavingEnabled. + */ +add_task(function test_setLoginSavingEnabled_invalid_characters_legacy() { + for (let origin of [ + "http://newline\n.example.com", + "http://carriagereturn.example.com\r", + ".", + ]) { + Assert.throws( + () => Services.logins.setLoginSavingEnabled(origin, false), + /Invalid origin/ + ); + } +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_login_autocomplete_result.js b/toolkit/components/passwordmgr/test/unit/test_login_autocomplete_result.js new file mode 100644 index 0000000000..8511e4f34a --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_login_autocomplete_result.js @@ -0,0 +1,735 @@ +const { LoginAutoCompleteResult } = ChromeUtils.importESModule( + "resource://gre/modules/LoginAutoComplete.sys.mjs" +); +let nsLoginInfo = Components.Constructor( + "@mozilla.org/login-manager/loginInfo;1", + Ci.nsILoginInfo, + "init" +); + +const PREF_SCHEME_UPGRADES = "signon.schemeUpgrades"; + +let matchingLogins = []; +matchingLogins.push( + new nsLoginInfo( + "https://mochi.test:8888", + "https://autocomplete:8888", + null, + "", + "emptypass1", + "uname", + "pword" + ) +); + +matchingLogins.push( + new nsLoginInfo( + "https://mochi.test:8888", + "https://autocomplete:8888", + null, + "tempuser1", + "temppass1", + "uname", + "pword" + ) +); + +matchingLogins.push( + new nsLoginInfo( + "https://mochi.test:8888", + "https://autocomplete:8888", + null, + "testuser2", + "testpass2", + "uname", + "pword" + ) +); +// subdomain: +matchingLogins.push( + new nsLoginInfo( + "https://sub.mochi.test:8888", + "https://autocomplete:8888", + null, + "testuser3", + "testpass3", + "uname", + "pword" + ) +); + +// to test signon.schemeUpgrades +matchingLogins.push( + new nsLoginInfo( + "http://mochi.test:8888", + "http://autocomplete:8888", + null, + "zzzuser4", + "zzzpass4", + "uname", + "pword" + ) +); + +// HTTP auth +matchingLogins.push( + new nsLoginInfo( + "https://mochi.test:8888", + null, + "My HTTP auth realm", + "httpuser", + "httppass" + ) +); + +add_setup(async () => { + // Get a profile so we have storage access and insert the logins to get unique GUIDs. + do_get_profile(); + matchingLogins = await Services.logins.addLogins(matchingLogins); +}); + +add_task(async function test_all_patterns() { + let meta = matchingLogins[0].QueryInterface(Ci.nsILoginMetaInfo); + let dateAndTimeFormatter = new Services.intl.DateTimeFormat(undefined, { + dateStyle: "medium", + }); + let time = dateAndTimeFormatter.format(new Date(meta.timePasswordChanged)); + const LABEL_NO_USERNAME = "No username (" + time + ")"; + const EXACT_ORIGIN_MATCH_COMMENT = "From this website"; + + let expectedResults = [ + { + isSecure: true, + hasBeenTypePassword: false, + matchingLogins, + items: [ + { + value: "", + label: LABEL_NO_USERNAME, + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "tempuser1", + label: "tempuser1", + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "testuser2", + label: "testuser2", + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "zzzuser4", + label: "zzzuser4", + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "httpuser", + label: "httpuser", + style: "loginWithOrigin", + comment: { comment: "mochi.test:8888 (My HTTP auth realm)" }, + }, + { + value: "testuser3", + label: "testuser3", + style: "loginWithOrigin", + comment: { comment: "sub.mochi.test:8888" }, + }, + { + value: "", + label: "View Saved Logins", + style: "loginsFooter", + comment: { + formHostname: "mochi.test", + telemetryEventData: { searchStartTimeMS: 0 }, + }, + }, + ], + }, + { + isSecure: false, + hasBeenTypePassword: false, + matchingLogins: [], + items: [ + { + value: "", + label: + "This connection is not secure. Logins entered here could be compromised. Learn More", + style: "insecureWarning", + comment: "", + }, + { + value: "", + label: "View Saved Logins", + style: "loginsFooter", + comment: { + formHostname: "mochi.test", + telemetryEventData: { searchStartTimeMS: 1 }, + }, + }, + ], + }, + { + isSecure: false, + hasBeenTypePassword: false, + matchingLogins, + items: [ + { + value: "", + label: + "This connection is not secure. Logins entered here could be compromised. Learn More", + style: "insecureWarning", + comment: "", + }, + { + value: "", + label: LABEL_NO_USERNAME, + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "tempuser1", + label: "tempuser1", + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "testuser2", + label: "testuser2", + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "zzzuser4", + label: "zzzuser4", + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "httpuser", + label: "httpuser", + style: "loginWithOrigin", + comment: { comment: "mochi.test:8888 (My HTTP auth realm)" }, + }, + { + value: "testuser3", + label: "testuser3", + style: "loginWithOrigin", + comment: { comment: "sub.mochi.test:8888" }, + }, + { + value: "", + label: "View Saved Logins", + style: "loginsFooter", + comment: { formHostname: "mochi.test" }, + }, + ], + }, + { + isSecure: true, + hasBeenTypePassword: true, + matchingLogins, + items: [ + { + value: "emptypass1", + label: LABEL_NO_USERNAME, + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "temppass1", + label: "tempuser1", + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "testpass2", + label: "testuser2", + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "zzzpass4", + label: "zzzuser4", + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "httppass", + label: "httpuser", + style: "loginWithOrigin", + comment: { comment: "mochi.test:8888 (My HTTP auth realm)" }, + }, + { + value: "testpass3", + label: "testuser3", + style: "loginWithOrigin", + comment: { comment: "sub.mochi.test:8888" }, + }, + { + value: "", + label: "View Saved Logins", + style: "loginsFooter", + comment: { formHostname: "mochi.test" }, + }, + ], + }, + { + isSecure: false, + hasBeenTypePassword: true, + matchingLogins, + items: [ + { + value: "", + label: + "This connection is not secure. Logins entered here could be compromised. Learn More", + style: "insecureWarning", + comment: "", + }, + { + value: "emptypass1", + label: LABEL_NO_USERNAME, + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "temppass1", + label: "tempuser1", + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "testpass2", + label: "testuser2", + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "zzzpass4", + label: "zzzuser4", + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "httppass", + label: "httpuser", + style: "loginWithOrigin", + comment: { comment: "mochi.test:8888 (My HTTP auth realm)" }, + }, + { + value: "testpass3", + label: "testuser3", + style: "loginWithOrigin", + comment: { comment: "sub.mochi.test:8888" }, + }, + { + value: "", + label: "View Saved Logins", + style: "loginsFooter", + comment: { formHostname: "mochi.test" }, + }, + ], + }, + { + isSecure: true, + hasBeenTypePassword: false, + matchingLogins, + items: [ + { + value: "", + label: LABEL_NO_USERNAME, + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "tempuser1", + label: "tempuser1", + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "testuser2", + label: "testuser2", + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "zzzuser4", + label: "zzzuser4", + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "httpuser", + label: "httpuser", + style: "loginWithOrigin", + comment: { comment: "mochi.test:8888 (My HTTP auth realm)" }, + }, + { + value: "testuser3", + label: "testuser3", + style: "loginWithOrigin", + comment: { comment: "sub.mochi.test:8888" }, + }, + { + value: "", + label: "View Saved Logins", + style: "loginsFooter", + comment: { formHostname: "mochi.test" }, + }, + ], + }, + { + isSecure: false, + hasBeenTypePassword: false, + matchingLogins: [], + searchString: "foo", + items: [ + { + value: "", + label: + "This connection is not secure. Logins entered here could be compromised. Learn More", + style: "insecureWarning", + comment: "", + }, + { + value: "", + label: "View Saved Logins", + style: "loginsFooter", + comment: { formHostname: "mochi.test" }, + }, + ], + }, + { + isSecure: true, + hasBeenTypePassword: true, + matchingLogins: [], + items: [ + { + value: "", + label: "View Saved Logins", + style: "loginsFooter", + comment: { formHostname: "mochi.test" }, + }, + ], + }, + { + isSecure: true, + hasBeenTypePassword: true, + matchingLogins: [], + searchString: "foo", + items: [], + }, + { + generatedPassword: "9ljgfd4shyktb45", + isSecure: true, + hasBeenTypePassword: true, + matchingLogins: [], + items: [ + { + value: "9ljgfd4shyktb45", + label: "Use a Securely Generated Password", + style: "generatedPassword", + comment: { + generatedPassword: "9ljgfd4shyktb45", + willAutoSaveGeneratedPassword: false, + }, + }, + { + value: "", + label: "View Saved Logins", + style: "loginsFooter", + comment: { formHostname: "mochi.test" }, + }, + ], + }, + { + description: + "willAutoSaveGeneratedPassword should propagate to the comment", + generatedPassword: "9ljgfd4shyktb45", + willAutoSaveGeneratedPassword: true, + isSecure: true, + hasBeenTypePassword: true, + matchingLogins: [], + items: [ + { + value: "9ljgfd4shyktb45", + label: "Use a Securely Generated Password", + style: "generatedPassword", + comment: { + generatedPassword: "9ljgfd4shyktb45", + willAutoSaveGeneratedPassword: true, + }, + }, + { + value: "", + label: "View Saved Logins", + style: "loginsFooter", + comment: { formHostname: "mochi.test" }, + }, + ], + }, + { + description: + "If a generated password is passed then show it even if there is a search string. This handles when forcing the generation option from the context menu of a non-empty field", + generatedPassword: "9ljgfd4shyktb45", + isSecure: true, + hasBeenTypePassword: true, + matchingLogins: [], + searchString: "9ljgfd4shyktb45", + items: [ + { + value: "9ljgfd4shyktb45", + label: "Use a Securely Generated Password", + style: "generatedPassword", + comment: { + generatedPassword: "9ljgfd4shyktb45", + willAutoSaveGeneratedPassword: false, + }, + }, + { + value: "", + label: "View Saved Logins", + style: "loginsFooter", + comment: { formHostname: "mochi.test" }, + }, + ], + }, + { + description: "secure username field on sub.mochi.test", + formOrigin: "https://sub.mochi.test:8888", + isSecure: true, + hasBeenTypePassword: false, + matchingLogins, + items: [ + { + value: "testuser3", + label: "testuser3", + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "", + label: LABEL_NO_USERNAME, + style: "loginWithOrigin", + comment: { comment: "mochi.test:8888" }, + }, + { + value: "tempuser1", + label: "tempuser1", + style: "loginWithOrigin", + comment: { comment: "mochi.test:8888" }, + }, + { + value: "testuser2", + label: "testuser2", + style: "loginWithOrigin", + comment: { comment: "mochi.test:8888" }, + }, + { + value: "zzzuser4", + label: "zzzuser4", + style: "loginWithOrigin", + comment: { comment: "mochi.test:8888" }, + }, + { + value: "httpuser", + label: "httpuser", + style: "loginWithOrigin", + comment: { comment: "mochi.test:8888 (My HTTP auth realm)" }, + }, + { + value: "", + label: "View Saved Logins", + style: "loginsFooter", + comment: { formHostname: "mochi.test" }, + }, + ], + }, + { + description: "secure password field on sub.mochi.test", + formOrigin: "https://sub.mochi.test:8888", + isSecure: true, + hasBeenTypePassword: true, + matchingLogins, + items: [ + { + value: "testpass3", + label: "testuser3", + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "emptypass1", + label: LABEL_NO_USERNAME, + style: "loginWithOrigin", + comment: { comment: "mochi.test:8888" }, + }, + { + value: "temppass1", + label: "tempuser1", + style: "loginWithOrigin", + comment: { comment: "mochi.test:8888" }, + }, + { + value: "testpass2", + label: "testuser2", + style: "loginWithOrigin", + comment: { comment: "mochi.test:8888" }, + }, + { + value: "zzzpass4", + label: "zzzuser4", + style: "loginWithOrigin", + comment: { comment: "mochi.test:8888" }, + }, + { + value: "httppass", + label: "httpuser", + style: "loginWithOrigin", + comment: { comment: "mochi.test:8888 (My HTTP auth realm)" }, + }, + { + value: "", + label: "View Saved Logins", + style: "loginsFooter", + comment: { formHostname: "mochi.test" }, + }, + ], + }, + { + description: "schemeUpgrades: false", + formOrigin: "https://mochi.test:8888", + schemeUpgrades: false, + isSecure: true, + hasBeenTypePassword: false, + matchingLogins, + items: [ + { + value: "", + label: LABEL_NO_USERNAME, + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "tempuser1", + label: "tempuser1", + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "testuser2", + label: "testuser2", + style: "loginWithOrigin", + comment: { comment: EXACT_ORIGIN_MATCH_COMMENT }, + }, + { + value: "zzzuser4", + label: "zzzuser4", + style: "loginWithOrigin", + comment: { comment: "mochi.test:8888" }, + }, + { + value: "httpuser", + label: "httpuser", + style: "loginWithOrigin", + comment: { comment: "mochi.test:8888 (My HTTP auth realm)" }, + }, + { + value: "testuser3", + label: "testuser3", + style: "loginWithOrigin", + comment: { comment: "sub.mochi.test:8888" }, + }, + { + value: "", + label: "View Saved Logins", + style: "loginsFooter", + comment: { formHostname: "mochi.test" }, + }, + ], + }, + ]; + + LoginHelper.createLogger("LoginAutoCompleteResult"); + Services.prefs.setBoolPref("signon.showAutoCompleteFooter", true); + + expectedResults.forEach((pattern, testIndex) => { + info(`expectedResults[${testIndex}]`); + info(JSON.stringify(pattern, null, 2)); + Services.prefs.setBoolPref( + PREF_SCHEME_UPGRADES, + "schemeUpgrades" in pattern ? pattern.schemeUpgrades : true + ); + let actual = new LoginAutoCompleteResult( + pattern.searchString || "", + pattern.matchingLogins, + [], + pattern.formOrigin || "https://mochi.test:8888", + { + hostname: "mochi.test", + generatedPassword: pattern.generatedPassword, + willAutoSaveGeneratedPassword: !!pattern.willAutoSaveGeneratedPassword, + isSecure: pattern.isSecure, + hasBeenTypePassword: pattern.hasBeenTypePassword, + telemetryEventData: { searchStartTimeMS: testIndex }, + } + ); + equal( + actual.matchCount, + pattern.items.length, + `${testIndex}: Check matching row count` + ); + pattern.items.forEach((item, index) => { + equal( + actual.getValueAt(index), + item.value, + `${testIndex}: Value ${index}` + ); + equal( + actual.getLabelAt(index), + item.label, + `${testIndex}: Label ${index}` + ); + equal( + actual.getStyleAt(index), + item.style, + `${testIndex}: Style ${index}` + ); + let actualComment = actual.getCommentAt(index); + if (typeof item.comment == "object") { + let parsedComment = JSON.parse(actualComment); + for (let [key, val] of Object.entries(item.comment)) { + Assert.deepEqual( + parsedComment[key], + val, + `${testIndex}: Comment.${key} ${index}` + ); + } + } else { + equal(actualComment, item.comment, `${testIndex}: Comment ${index}`); + } + }); + + if (pattern.items.length) { + Assert.throws( + () => actual.getValueAt(pattern.items.length), + /Index out of range\./ + ); + + Assert.throws( + () => actual.getLabelAt(pattern.items.length), + /Index out of range\./ + ); + + Assert.throws( + () => actual.removeValueAt(pattern.items.length), + /Index out of range\./ + ); + } + }); +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_loginsBackup.js b/toolkit/components/passwordmgr/test/unit/test_loginsBackup.js new file mode 100644 index 0000000000..775f6f5486 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_loginsBackup.js @@ -0,0 +1,218 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +/** + * Tests if logins-backup.json is used correctly in the event that logins.json is missing or corrupt. + */ + +"use strict"; + +ChromeUtils.defineESModuleGetters(this, { + LoginStore: "resource://gre/modules/LoginStore.sys.mjs", +}); +const { TestUtils } = ChromeUtils.importESModule( + "resource://testing-common/TestUtils.sys.mjs" +); +const { TelemetryTestUtils } = ChromeUtils.importESModule( + "resource://testing-common/TelemetryTestUtils.sys.mjs" +); + +const rawLogin1 = { + id: 1, + hostname: "http://www.example.com", + httpRealm: null, + formSubmitURL: "http://www.example.com", + usernameField: "field_" + String.fromCharCode(533, 537, 7570, 345), + passwordField: "field_" + String.fromCharCode(421, 259, 349, 537), + encryptedUsername: "(test)", + encryptedPassword: "(test)", + guid: "(test)", + encType: Ci.nsILoginManagerCrypto.ENCTYPE_SDR, + timeCreated: Date.now(), + timeLastUsed: Date.now(), + timePasswordChanged: Date.now(), + timesUsed: 1, +}; + +const rawLogin2 = { + id: 2, + hostname: "http://www.example2.com", + httpRealm: null, + formSubmitURL: "http://www.example2.com", + usernameField: "field_2" + String.fromCharCode(533, 537, 7570, 345), + passwordField: "field_2" + String.fromCharCode(421, 259, 349, 537), + encryptedUsername: "(test2)", + encryptedPassword: "(test2)", + guid: "(test2)", + encType: Ci.nsILoginManagerCrypto.ENCTYPE_SDR, + timeCreated: Date.now(), + timeLastUsed: Date.now(), + timePasswordChanged: Date.now(), + timesUsed: 1, +}; + +// Enable the collection (during test) for all products so even products +// that don't collect the data will be able to run the test without failure. +Services.prefs.setBoolPref( + "toolkit.telemetry.testing.overrideProductsCheck", + true +); + +/** + * Tests that logins-backup.json can be used by JSONFile.load() when logins.json is missing or cannot be read. + */ +add_task(async function test_logins_store_missing_or_corrupt_with_backup() { + const loginsStorePath = PathUtils.join(PathUtils.profileDir, "logins.json"); + const loginsStoreBackup = PathUtils.join( + PathUtils.profileDir, + "logins-backup.json" + ); + + // Get store.data ready. + let store = new LoginStore(loginsStorePath, loginsStoreBackup); + await store.load(); + + // Files should not exist at start up. + Assert.ok(!(await IOUtils.exists(store.path)), "No store file at start up"); + Assert.ok( + !(await IOUtils.exists(store._options.backupTo)), + "No backup file at start up" + ); + + // Add logins to create logins.json and logins-backup.json. + store.data.logins.push(rawLogin1); + await store._save(); + Assert.ok(await IOUtils.exists(store.path)); + + store.data.logins.push(rawLogin2); + await store._save(); + Assert.ok(await IOUtils.exists(store._options.backupTo)); + + // Remove logins.json and see if logins-backup.json will be used. + await IOUtils.remove(store.path); + store.data.logins = []; + store.dataReady = false; + Assert.ok(!(await IOUtils.exists(store.path))); + Assert.ok(await IOUtils.exists(store._options.backupTo)); + + // Clear any telemetry events recorded in the jsonfile category previously. + Services.telemetry.clearEvents(); + + await store.load(); + + Assert.ok( + await IOUtils.exists(store.path), + "logins.json is restored as expected after it went missing" + ); + + Assert.ok(await IOUtils.exists(store._options.backupTo)); + Assert.equal( + store.data.logins.length, + 1, + "Logins backup was used successfully when logins.json was missing" + ); + + TelemetryTestUtils.assertEvents( + [ + ["jsonfile", "load", "logins"], + ["jsonfile", "load", "logins", "used_backup"], + ], + {}, + { clear: true } + ); + info( + "Telemetry was recorded accurately when logins-backup.json is used when logins.json was missing" + ); + + // Corrupt the logins.json file. + let string = '{"logins":[{"hostname":"http://www.example.com","id":1,'; + await IOUtils.writeUTF8(store.path, string, { + tmpPath: `${store.path}.tmp`, + }); + + // Clear events recorded in the jsonfile category previously. + Services.telemetry.clearEvents(); + + // Try to load the corrupt file. + store.data.logins = []; + store.dataReady = false; + await store.load(); + + Assert.ok( + await IOUtils.exists(`${store.path}.corrupt`), + "logins.json.corrupt created" + ); + Assert.ok( + await IOUtils.exists(store.path), + "logins.json is restored after it was corrupted" + ); + + // Data should be loaded from logins-backup.json. + Assert.ok(await IOUtils.exists(store._options.backupTo)); + Assert.equal( + store.data.logins.length, + 1, + "Logins backup was used successfully when logins.json was corrupt" + ); + + TelemetryTestUtils.assertEvents( + [ + ["jsonfile", "load", "logins", ""], + ["jsonfile", "load", "logins", "invalid_json"], + ["jsonfile", "load", "logins", "used_backup"], + ], + {}, + { clear: true } + ); + info( + "Telemetry was recorded accurately when logins-backup.json is used when logins.json was corrupt" + ); + + // Clean up before we start the second part of the test. + await IOUtils.remove(`${store.path}.corrupt`); + + // Test that the backup file can be used by JSONFile.ensureDataReady() correctly when logins.json is missing. + // Remove logins.json + await IOUtils.remove(store.path); + store.data.logins = []; + store.dataReady = false; + Assert.ok(!(await IOUtils.exists(store.path))); + Assert.ok(await IOUtils.exists(store._options.backupTo)); + + store.ensureDataReady(); + + // Important to check here if logins.json is restored as expected + // after it went missing. + await IOUtils.exists(store.path); + + Assert.ok(await IOUtils.exists(store._options.backupTo)); + await TestUtils.waitForCondition(() => { + return store.data.logins.length == 1; + }); + + // Test that the backup file is used by JSONFile.ensureDataReady() when logins.json is corrupt. + // Corrupt the logins.json file. + await IOUtils.writeUTF8(store.path, string, { + tmpPath: `${store.path}.tmp`, + }); + + // Try to load the corrupt file. + store.data.logins = []; + store.dataReady = false; + store.ensureDataReady(); + + Assert.ok( + await IOUtils.exists(`${store.path}.corrupt`), + "logins.json.corrupt created" + ); + Assert.ok( + await IOUtils.exists(store.path), + "logins.json is restored after it was corrupted" + ); + + // Data should be loaded from logins-backup.json. + Assert.ok(await IOUtils.exists(store._options.backupTo)); + await TestUtils.waitForCondition(() => { + return store.data.logins.length == 1; + }); +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_logins_change.js b/toolkit/components/passwordmgr/test/unit/test_logins_change.js new file mode 100644 index 0000000000..ee3fee04d0 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_logins_change.js @@ -0,0 +1,628 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +/** + * Tests methods that add, remove, and modify logins. + */ + +"use strict"; + +// Globals + +const MAX_DATE_MS = 8640000000000000; + +/** + * Verifies that the specified login is considered invalid by addLogin and by + * modifyLogin with both nsILoginInfo and nsIPropertyBag arguments. + * + * This test requires that the login store is empty. + * + * @param aLoginInfo + * nsILoginInfo corresponding to an invalid login. + * @param aExpectedError + * This argument is passed to the "Assert.throws" test to determine which + * error is expected from the modification functions. + */ +async function checkLoginInvalid(aLoginInfo, aExpectedError) { + // Try to add the new login, and verify that no data is stored. + await Assert.rejects( + Services.logins.addLoginAsync(aLoginInfo), + aExpectedError + ); + LoginTestUtils.checkLogins([]); + + // Add a login for the modification tests. + let testLogin = TestData.formLogin({ origin: "http://modify.example.com" }); + await Services.logins.addLoginAsync(testLogin); + + // Try to modify the existing login using nsILoginInfo and nsIPropertyBag. + Assert.throws( + () => Services.logins.modifyLogin(testLogin, aLoginInfo), + aExpectedError + ); + Assert.throws( + () => + Services.logins.modifyLogin( + testLogin, + newPropertyBag({ + origin: aLoginInfo.origin, + formActionOrigin: aLoginInfo.formActionOrigin, + httpRealm: aLoginInfo.httpRealm, + username: aLoginInfo.username, + password: aLoginInfo.password, + usernameField: aLoginInfo.usernameField, + passwordField: aLoginInfo.passwordField, + }) + ), + aExpectedError + ); + + // Verify that no data was stored by the previous calls. + LoginTestUtils.checkLogins([testLogin]); + Services.logins.removeLogin(testLogin); +} + +/** + * Verifies that two objects are not the same instance + * but have equal attributes. + * + * @param {Object} objectA + * An object to compare. + * + * @param {Object} objectB + * Another object to compare. + * + * @param {string[]} attributes + * Attributes to compare. + * + * @return true if all passed attributes are equal for both objects, false otherwise. + */ +function compareAttributes(objectA, objectB, attributes) { + // If it's the same object, we want to return false. + if (objectA == objectB) { + return false; + } + return attributes.every(attr => objectA[attr] == objectB[attr]); +} + +// Tests + +/** + * Tests that adding logins to the database works. + */ +add_task(async function test_addLogin_removeLogin() { + // Each login from the test data should be valid and added to the list. + await Services.logins.addLogins(TestData.loginList()); + LoginTestUtils.checkLogins(TestData.loginList()); + + // Trying to add each login again should result in an error. + for (let loginInfo of TestData.loginList()) { + await Assert.rejects( + Services.logins.addLoginAsync(loginInfo), + /This login already exists./ + ); + } + + // Removing each login should succeed. + for (let loginInfo of TestData.loginList()) { + Services.logins.removeLogin(loginInfo); + } + + LoginTestUtils.checkLogins([]); +}); + +add_task(async function add_login_works_with_empty_array() { + const result = await Services.logins.addLogins([]); + Assert.equal(result.length, 0, "no logins added"); +}); + +add_task(async function duplicated_logins_are_not_added() { + const login = TestData.formLogin({ + username: "user", + }); + await Services.logins.addLogins([login]); + const result = await Services.logins.addLogins([login]); + Assert.equal(result, 0, "no logins added"); + Services.logins.removeAllUserFacingLogins(); +}); + +add_task(async function logins_containing_nul_in_username_are_not_added() { + const result = await Services.logins.addLogins([ + TestData.formLogin({ username: "user\0name" }), + ]); + Assert.equal(result, 0, "no logins added"); +}); + +add_task(async function logins_containing_nul_in_password_are_not_added() { + const result = await Services.logins.addLogins([ + TestData.formLogin({ password: "pass\0word" }), + ]); + Assert.equal(result, 0, "no logins added"); +}); + +add_task( + async function return_value_includes_plaintext_username_and_password() { + const login = TestData.formLogin({}); + const [result] = await Services.logins.addLogins([login]); + Assert.equal(result.username, login.username, "plaintext username is set"); + Assert.equal(result.password, login.password, "plaintext password is set"); + Services.logins.removeAllUserFacingLogins(); + } +); + +add_task(async function event_data_includes_plaintext_username_and_password() { + const login = TestData.formLogin({}); + const TestObserver = { + QueryInterface: ChromeUtils.generateQI([ + "nsIObserver", + "nsISupportsWeakReference", + ]), + observe(subject, topic, data) { + Assert.ok(subject instanceof Ci.nsILoginInfo); + Assert.ok(subject instanceof Ci.nsILoginMetaInfo); + Assert.equal( + subject.username, + login.username, + "plaintext username is set" + ); + Assert.equal( + subject.password, + login.password, + "plaintext password is set" + ); + }, + }; + Services.obs.addObserver(TestObserver, "passwordmgr-storage-changed"); + await Services.logins.addLogins([login]); + Services.obs.removeObserver(TestObserver, "passwordmgr-storage-changed"); + Services.logins.removeAllUserFacingLogins(); +}); + +/** + * Tests invalid combinations of httpRealm and formActionOrigin. + * + * For an nsILoginInfo to be valid for storage, one of the two properties should + * be strictly equal to null, and the other must not be null or an empty string. + * + * The legacy case of an empty string in formActionOrigin and a null value in + * httpRealm is also supported for storage at the moment. + */ +add_task(async function test_invalid_httpRealm_formActionOrigin() { + // httpRealm === null, formActionOrigin === null + await checkLoginInvalid( + TestData.formLogin({ formActionOrigin: null }), + /without a httpRealm or formActionOrigin/ + ); + + // httpRealm === "", formActionOrigin === null + await checkLoginInvalid( + TestData.authLogin({ httpRealm: "" }), + /without a httpRealm or formActionOrigin/ + ); + + // httpRealm === null, formActionOrigin === "" + // TODO: This is not enforced for now. + // await checkLoginInvalid(TestData.formLogin({ formActionOrigin: "" }), + // /without a httpRealm or formActionOrigin/); + + // httpRealm === "", formActionOrigin === "" + let login = TestData.formLogin({ formActionOrigin: "" }); + login.httpRealm = ""; + await checkLoginInvalid(login, /both a httpRealm and formActionOrigin/); + + // !!httpRealm, !!formActionOrigin + login = TestData.formLogin(); + login.httpRealm = "The HTTP Realm"; + await checkLoginInvalid(login, /both a httpRealm and formActionOrigin/); + + // httpRealm === "", !!formActionOrigin + login = TestData.formLogin(); + login.httpRealm = ""; + await checkLoginInvalid(login, /both a httpRealm and formActionOrigin/); + + // !!httpRealm, formActionOrigin === "" + login = TestData.authLogin(); + login.formActionOrigin = ""; + await checkLoginInvalid(login, /both a httpRealm and formActionOrigin/); +}); + +/** + * Tests null or empty values in required login properties. + */ +add_task(async function test_missing_properties() { + await checkLoginInvalid( + TestData.formLogin({ origin: null }), + /null or empty origin/ + ); + + await checkLoginInvalid( + TestData.formLogin({ origin: "" }), + /null or empty origin/ + ); + + await checkLoginInvalid( + TestData.formLogin({ username: null }), + /null username/ + ); + + await checkLoginInvalid( + TestData.formLogin({ password: null }), + /null or empty password/ + ); + + await checkLoginInvalid( + TestData.formLogin({ password: "" }), + /null or empty password/ + ); +}); + +/** + * Tests invalid NUL characters in nsILoginInfo properties. + */ +add_task(async function test_invalid_characters() { + let loginList = [ + TestData.authLogin({ origin: "http://null\0X.example.com" }), + TestData.authLogin({ httpRealm: "realm\0" }), + TestData.formLogin({ formActionOrigin: "http://null\0X.example.com" }), + TestData.formLogin({ usernameField: "field\0_null" }), + TestData.formLogin({ usernameField: ".\0" }), // Special single dot case + TestData.formLogin({ passwordField: "field\0_null" }), + TestData.formLogin({ username: "user\0name" }), + TestData.formLogin({ password: "pass\0word" }), + ]; + for (let loginInfo of loginList) { + await checkLoginInvalid(loginInfo, /login values can't contain nulls/); + } +}); + +/** + * Tests removing a login that does not exists. + */ +add_task(function test_removeLogin_nonexisting() { + Assert.throws( + () => Services.logins.removeLogin(TestData.formLogin()), + /No matching logins/ + ); +}); + +/** + * Tests removing all logins at once. + */ +add_task(async function test_removeAllUserFacingLogins() { + await Services.logins.addLogins(TestData.loginList()); + + Services.logins.removeAllUserFacingLogins(); + LoginTestUtils.checkLogins([]); + + // The function should also work when there are no logins to delete. + Services.logins.removeAllUserFacingLogins(); +}); + +/** + * Tests the modifyLogin function with an nsILoginInfo argument. + */ +add_task(async function test_modifyLogin_nsILoginInfo() { + let loginInfo = TestData.formLogin(); + let updatedLoginInfo = TestData.formLogin({ + username: "new username", + password: "new password", + usernameField: "new_form_field_username", + passwordField: "new_form_field_password", + }); + let differentLoginInfo = TestData.authLogin(); + + // Trying to modify a login that does not exist should throw. + Assert.throws( + () => Services.logins.modifyLogin(loginInfo, updatedLoginInfo), + /No matching logins/ + ); + + // Add the first form login, then modify it to match the second. + await Services.logins.addLoginAsync(loginInfo); + Services.logins.modifyLogin(loginInfo, updatedLoginInfo); + + // The data should now match the second login. + LoginTestUtils.checkLogins([updatedLoginInfo]); + Assert.throws( + () => Services.logins.modifyLogin(loginInfo, updatedLoginInfo), + /No matching logins/ + ); + + // The login can be changed to have a different type and origin. + Services.logins.modifyLogin(updatedLoginInfo, differentLoginInfo); + LoginTestUtils.checkLogins([differentLoginInfo]); + + // It is now possible to add a login with the old type and origin. + await Services.logins.addLoginAsync(loginInfo); + LoginTestUtils.checkLogins([loginInfo, differentLoginInfo]); + + // Modifying a login to match an existing one should not be possible. + Assert.throws( + () => Services.logins.modifyLogin(loginInfo, differentLoginInfo), + /already exists/ + ); + LoginTestUtils.checkLogins([loginInfo, differentLoginInfo]); + + LoginTestUtils.clearData(); +}); + +/** + * Tests the modifyLogin function with an nsIPropertyBag argument. + */ +add_task(async function test_modifyLogin_nsIProperyBag() { + let loginInfo = TestData.formLogin(); + let updatedLoginInfo = TestData.formLogin({ + username: "new username", + password: "new password", + usernameField: "", + passwordField: "new_form_field_password", + }); + let differentLoginInfo = TestData.authLogin(); + let differentLoginProperties = newPropertyBag({ + origin: differentLoginInfo.origin, + formActionOrigin: differentLoginInfo.formActionOrigin, + httpRealm: differentLoginInfo.httpRealm, + username: differentLoginInfo.username, + password: differentLoginInfo.password, + usernameField: differentLoginInfo.usernameField, + passwordField: differentLoginInfo.passwordField, + }); + + // Trying to modify a login that does not exist should throw. + Assert.throws( + () => Services.logins.modifyLogin(loginInfo, newPropertyBag()), + /No matching logins/ + ); + + // Add the first form login, then modify it to match the second, changing + // only some of its properties and checking the behavior with an empty string. + await Services.logins.addLoginAsync(loginInfo); + Services.logins.modifyLogin( + loginInfo, + newPropertyBag({ + username: "new username", + password: "new password", + usernameField: "", + passwordField: "new_form_field_password", + }) + ); + + // The data should now match the second login. + LoginTestUtils.checkLogins([updatedLoginInfo]); + Assert.throws( + () => Services.logins.modifyLogin(loginInfo, newPropertyBag()), + /No matching logins/ + ); + + // It is also possible to provide no properties to be modified. + Services.logins.modifyLogin(updatedLoginInfo, newPropertyBag()); + + // Specifying a null property for a required value should throw. + Assert.throws( + () => + Services.logins.modifyLogin( + loginInfo, + newPropertyBag({ + usernameField: null, + }) + ), + /No matching logins/ + ); + + // The login can be changed to have a different type and origin. + Services.logins.modifyLogin(updatedLoginInfo, differentLoginProperties); + LoginTestUtils.checkLogins([differentLoginInfo]); + + // It is now possible to add a login with the old type and origin. + await Services.logins.addLoginAsync(loginInfo); + LoginTestUtils.checkLogins([loginInfo, differentLoginInfo]); + + // Modifying a login to match an existing one should not be possible. + Assert.throws( + () => Services.logins.modifyLogin(loginInfo, differentLoginProperties), + /already exists/ + ); + LoginTestUtils.checkLogins([loginInfo, differentLoginInfo]); + + LoginTestUtils.clearData(); +}); + +/** + * Tests the login deduplication function. + */ +add_task(function test_deduplicate_logins() { + // Different key attributes combinations and the amount of unique + // results expected for the TestData login list. + let keyCombinations = [ + { + keyset: ["username", "password"], + results: 17, + }, + { + keyset: ["origin", "username"], + results: 21, + }, + { + keyset: ["origin", "username", "password"], + results: 22, + }, + { + keyset: ["origin", "username", "password", "formActionOrigin"], + results: 27, + }, + ]; + + let logins = TestData.loginList(); + + for (let testCase of keyCombinations) { + // Deduplicate the logins using the current testcase keyset. + let deduped = LoginHelper.dedupeLogins(logins, testCase.keyset); + Assert.equal( + deduped.length, + testCase.results, + "Correct amount of results." + ); + + // Checks that every login after deduping is unique. + Assert.ok( + deduped.every(loginA => + deduped.every( + loginB => !compareAttributes(loginA, loginB, testCase.keyset) + ) + ), + "Every login is unique." + ); + } +}); + +/** + * Ensure that the login deduplication function keeps the most recent login. + */ +add_task(function test_deduplicate_keeps_most_recent() { + // Logins to deduplicate. + let logins = [ + TestData.formLogin({ timeLastUsed: Date.UTC(2004, 11, 4, 0, 0, 0) }), + TestData.formLogin({ + formActionOrigin: "http://example.com", + timeLastUsed: Date.UTC(2015, 11, 4, 0, 0, 0), + }), + ]; + + // Deduplicate the logins. + let deduped = LoginHelper.dedupeLogins(logins); + Assert.equal(deduped.length, 1, "Deduplicated the logins array."); + + // Verify that the remaining login have the most recent date. + let loginTimeLastUsed = deduped[0].QueryInterface( + Ci.nsILoginMetaInfo + ).timeLastUsed; + Assert.equal( + loginTimeLastUsed, + Date.UTC(2015, 11, 4, 0, 0, 0), + "Most recent login was kept." + ); + + // Deduplicate the reverse logins array. + deduped = LoginHelper.dedupeLogins(logins.reverse()); + Assert.equal(deduped.length, 1, "Deduplicated the reversed logins array."); + + // Verify that the remaining login have the most recent date. + loginTimeLastUsed = deduped[0].QueryInterface( + Ci.nsILoginMetaInfo + ).timeLastUsed; + Assert.equal( + loginTimeLastUsed, + Date.UTC(2015, 11, 4, 0, 0, 0), + "Most recent login was kept." + ); +}); + +/** + * Tests handling when adding a login with bad date values + */ +add_task(async function test_addLogin_badDates() { + LoginTestUtils.clearData(); + + let now = Date.now(); + let defaultLoginDates = { + timeCreated: now, + timeLastUsed: now, + timePasswordChanged: now, + }; + + let defaultsLogin = TestData.formLogin(); + for (let pname of ["timeCreated", "timeLastUsed", "timePasswordChanged"]) { + Assert.ok(!defaultsLogin[pname]); + } + Assert.ok( + !!(await Services.logins.addLoginAsync(defaultsLogin)), + "Sanity check adding defaults formLogin" + ); + Services.logins.removeAllUserFacingLogins(); + + // 0 is a valid date in this context - new nsLoginInfo timestamps init to 0 + for (let pname of ["timeCreated", "timeLastUsed", "timePasswordChanged"]) { + let loginInfo = TestData.formLogin( + Object.assign({}, defaultLoginDates, { + [pname]: 0, + }) + ); + Assert.ok( + !!(await Services.logins.addLoginAsync(loginInfo)), + "Check 0 value for " + pname + ); + Services.logins.removeAllUserFacingLogins(); + } + + // negative dates get clamped to 0 and are ok + for (let pname of ["timeCreated", "timeLastUsed", "timePasswordChanged"]) { + let loginInfo = TestData.formLogin( + Object.assign({}, defaultLoginDates, { + [pname]: -1, + }) + ); + Assert.ok( + !!(await Services.logins.addLoginAsync(loginInfo)), + "Check -1 value for " + pname + ); + Services.logins.removeAllUserFacingLogins(); + } + + // out-of-range dates will throw + for (let pname of ["timeCreated", "timeLastUsed", "timePasswordChanged"]) { + let loginInfo = TestData.formLogin( + Object.assign({}, defaultLoginDates, { + [pname]: MAX_DATE_MS + 1, + }) + ); + await Assert.rejects( + Services.logins.addLoginAsync(loginInfo), + /invalid date properties/ + ); + Assert.equal(Services.logins.getAllLogins().length, 0); + } + + LoginTestUtils.checkLogins([]); +}); + +/** + * Tests handling when adding multiple logins with bad date values + */ +add_task(async function test_addLogins_badDates() { + LoginTestUtils.clearData(); + + let defaultsLogin = TestData.formLogin({ + username: "defaults", + }); + await Services.logins.addLoginAsync(defaultsLogin); + + // -11644473600000 is the value you get if you convert Dec 31 1600 16:07:02 to unix epoch time + let timeCreatedLogin = TestData.formLogin({ + username: "tc", + timeCreated: -11644473600000, + }); + await Assert.rejects( + Services.logins.addLoginAsync(timeCreatedLogin), + /Can\'t add a login with invalid date properties./ + ); + + let timeLastUsedLogin = TestData.formLogin({ + username: "tlu", + timeLastUsed: -11644473600000, + }); + await Assert.rejects( + Services.logins.addLoginAsync(timeLastUsedLogin), + /Can\'t add a login with invalid date properties./ + ); + + let timePasswordChangedLogin = TestData.formLogin({ + username: "tpc", + timePasswordChanged: -11644473600000, + }); + await Assert.rejects( + Services.logins.addLoginAsync(timePasswordChangedLogin), + /Can\'t add a login with invalid date properties./ + ); + + Services.logins.removeAllUserFacingLogins(); +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_logins_decrypt_failure.js b/toolkit/components/passwordmgr/test/unit/test_logins_decrypt_failure.js new file mode 100644 index 0000000000..30c7aa1be9 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_logins_decrypt_failure.js @@ -0,0 +1,172 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +/** + * Tests the case where there are logins that cannot be decrypted. + */ + +"use strict"; + +// Globals + +/** + * Resets the token used to decrypt logins. This is equivalent to resetting the + * primary password when it is not known. + */ +function resetPrimaryPassword() { + let token = Cc["@mozilla.org/security/pk11tokendb;1"] + .getService(Ci.nsIPK11TokenDB) + .getInternalKeyToken(); + token.reset(); + token.initPassword(""); +} + +// Tests + +/** + * Resets the primary password after some logins were added to the database. + */ +add_task(async function test_logins_decrypt_failure() { + let logins = TestData.loginList(); + await Services.logins.addLogins(logins); + + // This makes the existing logins non-decryptable. + resetPrimaryPassword(); + + // These functions don't see the non-decryptable entries anymore. + Assert.equal(Services.logins.getAllLogins().length, 0); + Assert.equal( + (await Services.logins.getAllLoginsAsync()).length, + 0, + "getAllLoginsAsync length" + ); + Assert.equal(Services.logins.findLogins("", "", "").length, 0); + Assert.equal(Services.logins.searchLogins(newPropertyBag()).length, 0); + Assert.throws( + () => Services.logins.modifyLogin(logins[0], newPropertyBag()), + /No matching logins/ + ); + Assert.throws( + () => Services.logins.removeLogin(logins[0]), + /No matching logins/ + ); + + // The function that counts logins sees the non-decryptable entries also. + Assert.equal(Services.logins.countLogins("", "", ""), logins.length); + + // Equivalent logins can be added. + await Services.logins.addLogins(logins); + LoginTestUtils.checkLogins(logins); + Assert.equal( + (await Services.logins.getAllLoginsAsync()).length, + logins.length, + "getAllLoginsAsync length" + ); + Assert.equal(Services.logins.countLogins("", "", ""), logins.length * 2); + + // Finding logins doesn't return the non-decryptable duplicates. + Assert.equal( + Services.logins.findLogins("http://www.example.com", "", "").length, + 1 + ); + let matchData = newPropertyBag({ origin: "http://www.example.com" }); + Assert.equal(Services.logins.searchLogins(matchData).length, 1); + + // Removing single logins does not remove non-decryptable logins. + for (let loginInfo of TestData.loginList()) { + Services.logins.removeLogin(loginInfo); + } + Assert.equal(Services.logins.getAllLogins().length, 0); + Assert.equal(Services.logins.countLogins("", "", ""), logins.length); + + // Removing all logins removes the non-decryptable entries also. + Services.logins.removeAllUserFacingLogins(); + Assert.equal(Services.logins.getAllLogins().length, 0); + Assert.equal(Services.logins.countLogins("", "", ""), 0); +}); + +// Bug 621846 - If a login has a GUID but can't be decrypted, a search for +// that GUID will (correctly) fail. Ensure we can add a new login with that +// same GUID. +add_task(async function test_add_logins_with_decrypt_failure() { + // a login with a GUID. + let login = new LoginInfo( + "http://www.example2.com", + "http://www.example2.com", + null, + "the username", + "the password for www.example.com", + "form_field_username", + "form_field_password" + ); + + login.QueryInterface(Ci.nsILoginMetaInfo); + login.guid = "{4bc50d2f-dbb6-4aa3-807c-c4c2065a2c35}"; + + // A different login but with the same GUID. + let loginDupeGuid = new LoginInfo( + "http://www.example3.com", + "http://www.example3.com", + null, + "the username", + "the password", + "form_field_username", + "form_field_password" + ); + loginDupeGuid.QueryInterface(Ci.nsILoginMetaInfo); + loginDupeGuid.guid = login.guid; + + await Services.logins.addLoginAsync(login); + + // We can search for this login by GUID. + let searchProp = Cc["@mozilla.org/hash-property-bag;1"].createInstance( + Ci.nsIWritablePropertyBag2 + ); + searchProp.setPropertyAsAUTF8String("guid", login.guid); + + equal(Services.logins.searchLogins(searchProp).length, 1); + + // We should fail to re-add it as it remains good. + await Assert.rejects( + Services.logins.addLoginAsync(login), + /This login already exists./ + ); + // We should fail to re-add a different login with the same GUID. + await Assert.rejects( + Services.logins.addLoginAsync(loginDupeGuid), + /specified GUID already exists/ + ); + + // This makes the existing login non-decryptable. + resetPrimaryPassword(); + + // We can no longer find it in our search. + equal(Services.logins.searchLogins(searchProp).length, 0); + + // So we should be able to re-add a login with that same GUID. + await Services.logins.addLoginAsync(login); + equal(Services.logins.searchLogins(searchProp).length, 1); + + Services.logins.removeAllUserFacingLogins(); +}); + +// Test the "syncID" metadata works as expected on decryption failure. +add_task(async function test_sync_metadata_with_decrypt_failure() { + // And some sync metadata + await Services.logins.setSyncID("sync-id"); + await Services.logins.setLastSync(123); + equal(await Services.logins.getSyncID(), "sync-id"); + equal(await Services.logins.getLastSync(), 123); + + // This makes the existing login and syncID non-decryptable. + resetPrimaryPassword(); + + // The syncID is now null. + equal(await Services.logins.getSyncID(), null); + // The sync timestamp isn't impacted. + equal(await Services.logins.getLastSync(), 123); + + // But we should be able to set it again. + await Services.logins.setSyncID("new-id"); + equal(await Services.logins.getSyncID(), "new-id"); +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_logins_metainfo.js b/toolkit/components/passwordmgr/test/unit/test_logins_metainfo.js new file mode 100644 index 0000000000..8f31fba02b --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_logins_metainfo.js @@ -0,0 +1,295 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +/** + * Tests the handling of nsILoginMetaInfo by methods that add, remove, modify, + * and find logins. + */ + +"use strict"; + +// Globals + +const gLooksLikeUUIDRegex = /^\{\w{8}-\w{4}-\w{4}-\w{4}-\w{12}\}$/; + +/** + * Retrieves the only login among the current data that matches the origin of + * the given nsILoginInfo. In case there is more than one login for the + * origin, the test fails. + */ +function retrieveLoginMatching(aLoginInfo) { + let logins = Services.logins.findLogins(aLoginInfo.origin, "", ""); + Assert.equal(logins.length, 1); + return logins[0].QueryInterface(Ci.nsILoginMetaInfo); +} + +/** + * Checks that the nsILoginInfo and nsILoginMetaInfo properties of two different + * login instances are equal. + */ +function assertMetaInfoEqual(aActual, aExpected) { + Assert.notEqual(aActual, aExpected); + + // Check the nsILoginInfo properties. + Assert.ok(aActual.equals(aExpected)); + + // Check the nsILoginMetaInfo properties. + Assert.equal(aActual.guid, aExpected.guid); + Assert.equal(aActual.timeCreated, aExpected.timeCreated); + Assert.equal(aActual.timeLastUsed, aExpected.timeLastUsed); + Assert.equal(aActual.timePasswordChanged, aExpected.timePasswordChanged); + Assert.equal(aActual.timesUsed, aExpected.timesUsed); +} + +/** + * nsILoginInfo instances with or without nsILoginMetaInfo properties. + */ +let gLoginInfo1; +let gLoginInfo2; +let gLoginInfo3; + +/** + * nsILoginInfo instances reloaded with all the nsILoginMetaInfo properties. + * These are often used to provide the reference values to test against. + */ +let gLoginMetaInfo1; +let gLoginMetaInfo2; +let gLoginMetaInfo3; + +// Tests + +/** + * Prepare the test objects that will be used by the following tests. + */ +add_task(function test_initialize() { + // Use a reference time from ten minutes ago to initialize one instance of + // nsILoginMetaInfo, to test that reference times are updated when needed. + let baseTimeMs = Date.now() - 600000; + + gLoginInfo1 = TestData.formLogin(); + gLoginInfo2 = TestData.formLogin({ + origin: "http://other.example.com", + guid: Services.uuid.generateUUID().toString(), + timeCreated: baseTimeMs, + timeLastUsed: baseTimeMs + 2, + timePasswordChanged: baseTimeMs + 1, + timesUsed: 2, + }); + gLoginInfo3 = TestData.authLogin(); +}); + +/** + * Tests the behavior of addLogin with regard to metadata. The logins added + * here are also used by the following tests. + */ +add_task(async function test_addLogin_metainfo() { + // Add a login without metadata to the database. + await Services.logins.addLoginAsync(gLoginInfo1); + + // The object provided to addLogin should not have been modified. + Assert.equal(gLoginInfo1.guid, null); + Assert.equal(gLoginInfo1.timeCreated, 0); + Assert.equal(gLoginInfo1.timeLastUsed, 0); + Assert.equal(gLoginInfo1.timePasswordChanged, 0); + Assert.equal(gLoginInfo1.timesUsed, 0); + + // A login with valid metadata should have been stored. + gLoginMetaInfo1 = retrieveLoginMatching(gLoginInfo1); + Assert.ok(gLooksLikeUUIDRegex.test(gLoginMetaInfo1.guid)); + let creationTime = gLoginMetaInfo1.timeCreated; + LoginTestUtils.assertTimeIsAboutNow(creationTime); + Assert.equal(gLoginMetaInfo1.timeLastUsed, creationTime); + Assert.equal(gLoginMetaInfo1.timePasswordChanged, creationTime); + Assert.equal(gLoginMetaInfo1.timesUsed, 1); + + // Add a login without metadata to the database. + let originalLogin = gLoginInfo2.clone().QueryInterface(Ci.nsILoginMetaInfo); + await Services.logins.addLoginAsync(gLoginInfo2); + + // The object provided to addLogin should not have been modified. + assertMetaInfoEqual(gLoginInfo2, originalLogin); + + // A login with the provided metadata should have been stored. + gLoginMetaInfo2 = retrieveLoginMatching(gLoginInfo2); + assertMetaInfoEqual(gLoginMetaInfo2, gLoginInfo2); + + // Add an authentication login to the database before continuing. + await Services.logins.addLoginAsync(gLoginInfo3); + gLoginMetaInfo3 = retrieveLoginMatching(gLoginInfo3); + LoginTestUtils.checkLogins([gLoginInfo1, gLoginInfo2, gLoginInfo3]); +}); + +/** + * Tests that adding a login with a duplicate GUID throws an exception. + */ +add_task(async function test_addLogin_metainfo_duplicate() { + let loginInfo = TestData.formLogin({ + origin: "http://duplicate.example.com", + guid: gLoginMetaInfo2.guid, + }); + await Assert.rejects( + Services.logins.addLoginAsync(loginInfo), + /specified GUID already exists/ + ); + + // Verify that no data was stored by the previous call. + LoginTestUtils.checkLogins([gLoginInfo1, gLoginInfo2, gLoginInfo3]); +}); + +/** + * Tests that the existing metadata is not changed when modifyLogin is called + * with an nsILoginInfo argument. + */ +add_task(function test_modifyLogin_nsILoginInfo_metainfo_ignored() { + let newLoginInfo = gLoginInfo1.clone().QueryInterface(Ci.nsILoginMetaInfo); + newLoginInfo.guid = Services.uuid.generateUUID().toString(); + newLoginInfo.timeCreated = Date.now(); + newLoginInfo.timeLastUsed = Date.now(); + newLoginInfo.timePasswordChanged = Date.now(); + newLoginInfo.timesUsed = 12; + Services.logins.modifyLogin(gLoginInfo1, newLoginInfo); + + newLoginInfo = retrieveLoginMatching(gLoginInfo1); + assertMetaInfoEqual(newLoginInfo, gLoginMetaInfo1); +}); + +/** + * Tests the modifyLogin function with an nsIProperyBag argument. + */ +add_task(function test_modifyLogin_nsIProperyBag_metainfo() { + // Use a new reference time that is two minutes from now. + let newTimeMs = Date.now() + 120000; + let newUUIDValue = Services.uuid.generateUUID().toString(); + + // Check that properties are changed as requested. + Services.logins.modifyLogin( + gLoginInfo1, + newPropertyBag({ + guid: newUUIDValue, + timeCreated: newTimeMs, + timeLastUsed: newTimeMs + 2, + timePasswordChanged: newTimeMs + 1, + timesUsed: 2, + }) + ); + + gLoginMetaInfo1 = retrieveLoginMatching(gLoginInfo1); + Assert.equal(gLoginMetaInfo1.guid, newUUIDValue); + Assert.equal(gLoginMetaInfo1.timeCreated, newTimeMs); + Assert.equal(gLoginMetaInfo1.timeLastUsed, newTimeMs + 2); + Assert.equal(gLoginMetaInfo1.timePasswordChanged, newTimeMs + 1); + Assert.equal(gLoginMetaInfo1.timesUsed, 2); + + // Check that timePasswordChanged is updated when changing the password. + let originalLogin = gLoginInfo2.clone().QueryInterface(Ci.nsILoginMetaInfo); + Services.logins.modifyLogin( + gLoginInfo2, + newPropertyBag({ + password: "new password", + }) + ); + gLoginInfo2.password = "new password"; + + gLoginMetaInfo2 = retrieveLoginMatching(gLoginInfo2); + Assert.equal(gLoginMetaInfo2.password, gLoginInfo2.password); + Assert.equal(gLoginMetaInfo2.timeCreated, originalLogin.timeCreated); + Assert.equal(gLoginMetaInfo2.timeLastUsed, originalLogin.timeLastUsed); + LoginTestUtils.assertTimeIsAboutNow(gLoginMetaInfo2.timePasswordChanged); + + // Check that timePasswordChanged is not set to the current time when changing + // the password and specifying a new value for the property at the same time. + Services.logins.modifyLogin( + gLoginInfo2, + newPropertyBag({ + password: "other password", + timePasswordChanged: newTimeMs, + }) + ); + gLoginInfo2.password = "other password"; + + gLoginMetaInfo2 = retrieveLoginMatching(gLoginInfo2); + Assert.equal(gLoginMetaInfo2.password, gLoginInfo2.password); + Assert.equal(gLoginMetaInfo2.timeCreated, originalLogin.timeCreated); + Assert.equal(gLoginMetaInfo2.timeLastUsed, originalLogin.timeLastUsed); + Assert.equal(gLoginMetaInfo2.timePasswordChanged, newTimeMs); + + // Check the special timesUsedIncrement property. + Services.logins.modifyLogin( + gLoginInfo2, + newPropertyBag({ + timesUsedIncrement: 2, + }) + ); + + gLoginMetaInfo2 = retrieveLoginMatching(gLoginInfo2); + Assert.equal(gLoginMetaInfo2.timeCreated, originalLogin.timeCreated); + Assert.equal(gLoginMetaInfo2.timeLastUsed, originalLogin.timeLastUsed); + Assert.equal(gLoginMetaInfo2.timePasswordChanged, newTimeMs); + Assert.equal(gLoginMetaInfo2.timesUsed, 4); +}); + +/** + * Tests that modifying a login to a duplicate GUID throws an exception. + */ +add_task(function test_modifyLogin_nsIProperyBag_metainfo_duplicate() { + Assert.throws( + () => + Services.logins.modifyLogin( + gLoginInfo1, + newPropertyBag({ + guid: gLoginInfo2.guid, + }) + ), + /specified GUID already exists/ + ); + LoginTestUtils.checkLogins([gLoginInfo1, gLoginInfo2, gLoginInfo3]); +}); + +/** + * Tests searching logins using nsILoginMetaInfo properties. + */ +add_task(function test_searchLogins_metainfo() { + // Find by GUID. + let logins = Services.logins.searchLogins( + newPropertyBag({ + guid: gLoginMetaInfo1.guid, + }) + ); + Assert.equal(logins.length, 1); + let foundLogin = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + assertMetaInfoEqual(foundLogin, gLoginMetaInfo1); + + // Find by timestamp. + logins = Services.logins.searchLogins( + newPropertyBag({ + timePasswordChanged: gLoginMetaInfo2.timePasswordChanged, + }) + ); + Assert.equal(logins.length, 1); + foundLogin = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + assertMetaInfoEqual(foundLogin, gLoginMetaInfo2); + + // Find using two properties at the same time. + logins = Services.logins.searchLogins( + newPropertyBag({ + guid: gLoginMetaInfo3.guid, + timePasswordChanged: gLoginMetaInfo3.timePasswordChanged, + }) + ); + Assert.equal(logins.length, 1); + foundLogin = logins[0].QueryInterface(Ci.nsILoginMetaInfo); + assertMetaInfoEqual(foundLogin, gLoginMetaInfo3); +}); + +/** + * Tests that the default nsILoginManagerStorage module attached to the Login + * Manager service is able to save and reload nsILoginMetaInfo properties. + */ +add_task(async function test_storage_metainfo() { + await LoginTestUtils.reloadData(); + LoginTestUtils.checkLogins([gLoginInfo1, gLoginInfo2, gLoginInfo3]); + + assertMetaInfoEqual(retrieveLoginMatching(gLoginInfo1), gLoginMetaInfo1); + assertMetaInfoEqual(retrieveLoginMatching(gLoginInfo2), gLoginMetaInfo2); + assertMetaInfoEqual(retrieveLoginMatching(gLoginInfo3), gLoginMetaInfo3); +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_logins_search.js b/toolkit/components/passwordmgr/test/unit/test_logins_search.js new file mode 100644 index 0000000000..89337f872e --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_logins_search.js @@ -0,0 +1,232 @@ +/** + * Tests methods that find specific logins in the store (findLogins, + * searchLogins, and countLogins). + * + * The getAllLogins method is not tested explicitly here, because it is used by + * all tests to verify additions, removals and modifications to the login store. + */ + +"use strict"; + +// Globals + +/** + * Returns a list of new nsILoginInfo objects that are a subset of the test + * data, built to match the specified query. + * + * @param aQuery + * Each property and value of this object restricts the search to those + * entries from the test data that match the property exactly. + */ +function buildExpectedLogins(aQuery) { + return TestData.loginList().filter(entry => + Object.keys(aQuery).every(name => entry[name] === aQuery[name]) + ); +} + +/** + * Tests the searchLogins function. + * + * @param aQuery + * Each property and value of this object is translated to an entry in + * the nsIPropertyBag parameter of searchLogins. + * @param aExpectedCount + * Number of logins from the test data that should be found. The actual + * list of logins is obtained using the buildExpectedLogins helper, and + * this value is just used to verify that modifications to the test data + * don't make the current test meaningless. + */ +function checkSearchLogins(aQuery, aExpectedCount) { + info("Testing searchLogins for " + JSON.stringify(aQuery)); + + let expectedLogins = buildExpectedLogins(aQuery); + Assert.equal(expectedLogins.length, aExpectedCount); + + let logins = Services.logins.searchLogins(newPropertyBag(aQuery)); + LoginTestUtils.assertLoginListsEqual(logins, expectedLogins); +} + +/** + * Tests findLogins, searchLogins, and countLogins with the same query. + * + * @param aQuery + * The "origin", "formActionOrigin", and "httpRealm" properties of this + * object are passed as parameters to findLogins and countLogins. The + * same object is then passed to the checkSearchLogins function. + * @param aExpectedCount + * Number of logins from the test data that should be found. The actual + * list of logins is obtained using the buildExpectedLogins helper, and + * this value is just used to verify that modifications to the test data + * don't make the current test meaningless. + */ +function checkAllSearches(aQuery, aExpectedCount) { + info("Testing all search functions for " + JSON.stringify(aQuery)); + + let expectedLogins = buildExpectedLogins(aQuery); + Assert.equal(expectedLogins.length, aExpectedCount); + + // The findLogins and countLogins functions support wildcard matches by + // specifying empty strings as parameters, while searchLogins requires + // omitting the property entirely. + let origin = "origin" in aQuery ? aQuery.origin : ""; + let formActionOrigin = + "formActionOrigin" in aQuery ? aQuery.formActionOrigin : ""; + let httpRealm = "httpRealm" in aQuery ? aQuery.httpRealm : ""; + + // Test findLogins. + let logins = Services.logins.findLogins(origin, formActionOrigin, httpRealm); + LoginTestUtils.assertLoginListsEqual(logins, expectedLogins); + + // Test countLogins. + let count = Services.logins.countLogins(origin, formActionOrigin, httpRealm); + Assert.equal(count, expectedLogins.length); + + // Test searchLogins. + checkSearchLogins(aQuery, aExpectedCount); +} + +// Tests + +/** + * Prepare data for the following tests. + */ +add_setup(async () => { + await Services.logins.addLogins(TestData.loginList()); +}); + +/** + * Tests findLogins, searchLogins, and countLogins with basic queries. + */ +add_task(function test_search_all_basic() { + // Find all logins, using no filters in the search functions. + checkAllSearches({}, 27); + + // Find all form logins, then all authentication logins. + checkAllSearches({ httpRealm: null }, 17); + checkAllSearches({ formActionOrigin: null }, 10); + + // Find all form logins on one host, then all authentication logins. + checkAllSearches({ origin: "http://www4.example.com", httpRealm: null }, 3); + checkAllSearches( + { origin: "http://www2.example.org", formActionOrigin: null }, + 2 + ); + + // Verify that scheme and subdomain are distinct in the origin. + checkAllSearches({ origin: "http://www.example.com" }, 1); + checkAllSearches({ origin: "https://www.example.com" }, 1); + checkAllSearches({ origin: "https://example.com" }, 1); + checkAllSearches({ origin: "http://www3.example.com" }, 3); + + // Verify that scheme and subdomain are distinct in formActionOrigin. + checkAllSearches({ formActionOrigin: "http://www.example.com" }, 2); + checkAllSearches({ formActionOrigin: "https://www.example.com" }, 2); + checkAllSearches({ formActionOrigin: "http://example.com" }, 1); + + // Find by formActionOrigin on a single host. + checkAllSearches( + { + origin: "http://www3.example.com", + formActionOrigin: "http://www.example.com", + }, + 1 + ); + checkAllSearches( + { + origin: "http://www3.example.com", + formActionOrigin: "https://www.example.com", + }, + 1 + ); + checkAllSearches( + { + origin: "http://www3.example.com", + formActionOrigin: "http://example.com", + }, + 1 + ); + + // Find by httpRealm on all hosts. + checkAllSearches({ httpRealm: "The HTTP Realm" }, 3); + checkAllSearches({ httpRealm: "ftp://ftp.example.org" }, 1); + checkAllSearches({ httpRealm: "The HTTP Realm Other" }, 2); + + // Find by httpRealm on a single host. + checkAllSearches( + { origin: "http://example.net", httpRealm: "The HTTP Realm" }, + 1 + ); + checkAllSearches( + { origin: "http://example.net", httpRealm: "The HTTP Realm Other" }, + 1 + ); + checkAllSearches( + { origin: "ftp://example.net", httpRealm: "ftp://example.net" }, + 1 + ); +}); + +/** + * Tests searchLogins with advanced queries. + */ +add_task(function test_searchLogins() { + checkSearchLogins({ usernameField: "form_field_username" }, 12); + checkSearchLogins({ passwordField: "form_field_password" }, 13); + + // Find all logins with an empty usernameField, including for authentication. + checkSearchLogins({ usernameField: "" }, 15); + + // Find form logins with an empty usernameField. + checkSearchLogins({ httpRealm: null, usernameField: "" }, 5); + + // Find logins with an empty usernameField on one host. + checkSearchLogins( + { origin: "http://www6.example.com", usernameField: "" }, + 1 + ); +}); + +/** + * Tests searchLogins with invalid arguments. + */ +add_task(function test_searchLogins_invalid() { + Assert.throws( + () => Services.logins.searchLogins(newPropertyBag({ username: "value" })), + /Unexpected field/ + ); +}); + +/** + * Tests that matches are case-sensitive, compare the full field value, and are + * strict when interpreting the prePath of URIs. + */ +add_task(function test_search_all_full_case_sensitive() { + checkAllSearches({ origin: "http://www.example.com" }, 1); + checkAllSearches({ origin: "http://www.example.com/" }, 0); + checkAllSearches({ origin: "example.com" }, 0); + + checkAllSearches({ formActionOrigin: "http://www.example.com" }, 2); + checkAllSearches({ formActionOrigin: "http://www.example.com/" }, 0); + checkAllSearches({ formActionOrigin: "http://" }, 0); + checkAllSearches({ formActionOrigin: "example.com" }, 0); + + checkAllSearches({ httpRealm: "The HTTP Realm" }, 3); + checkAllSearches({ httpRealm: "The http Realm" }, 0); + checkAllSearches({ httpRealm: "The HTTP" }, 0); + checkAllSearches({ httpRealm: "Realm" }, 0); +}); + +/** + * Tests findLogins, searchLogins, and countLogins with queries that should + * return no values. + */ +add_task(function test_search_all_empty() { + checkAllSearches({ origin: "http://nonexistent.example.com" }, 0); + checkAllSearches( + { formActionOrigin: "http://www.example.com", httpRealm: "The HTTP Realm" }, + 0 + ); + + checkSearchLogins({ origin: "" }, 0); + checkSearchLogins({ id: "1000" }, 0); +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_maybeImportLogin.js b/toolkit/components/passwordmgr/test/unit/test_maybeImportLogin.js new file mode 100644 index 0000000000..ff60ceb1d5 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_maybeImportLogin.js @@ -0,0 +1,368 @@ +"use strict"; + +const HOST1 = "https://www.example.com"; +const HOST2 = "https://www.mozilla.org"; + +const USER1 = "myuser"; +const USER2 = "anotheruser"; + +const PASS1 = "mypass"; +const PASS2 = "anotherpass"; +const PASS3 = "yetanotherpass"; + +async function maybeImportLogins(logins) { + let summary = await LoginHelper.maybeImportLogins(logins); + return summary.filter(ir => ir.result == "added").map(ir => ir.login); +} + +add_task(async function test_invalid_logins() { + let importedLogins = await maybeImportLogins([ + { + username: USER1, + password: PASS1, + origin: "example.com", // Not an origin + formActionOrigin: HOST1, + }, + { + username: USER1, + // no password + origin: HOST1, + formActionOrigin: HOST1, + }, + { + username: USER2, + password: "", // Empty password + origin: HOST1, + formActionOrigin: HOST1, + }, + ]); + Assert.equal( + importedLogins.length, + 0, + `Return value should indicate no imported login: ${JSON.stringify( + importedLogins, + null, + 2 + )}` + ); + let savedLogins = Services.logins.getAllLogins(); + Assert.equal( + savedLogins.length, + 0, + `Should have no logins in storage: ${JSON.stringify(savedLogins, null, 2)}` + ); + Services.logins.removeAllUserFacingLogins(); +}); + +add_task(async function test_new_logins() { + let [importedLogin] = await maybeImportLogins([ + { + username: USER1, + password: PASS1, + origin: HOST1 + "/", + formActionOrigin: HOST1 + "/", + }, + ]); + Assert.ok(importedLogin, "Return value should indicate imported login."); + let matchingLogins = LoginHelper.searchLoginsWithObject({ origin: HOST1 }); + Assert.equal( + matchingLogins.length, + 1, + `There should be 1 login for ${HOST1}` + ); + + [importedLogin] = await maybeImportLogins([ + { + username: USER1, + password: PASS1, + origin: HOST2, + formActionOrigin: HOST2, + }, + ]); + + Assert.ok( + importedLogin, + "Return value should indicate another imported login." + ); + matchingLogins = LoginHelper.searchLoginsWithObject({ origin: HOST1 }); + Assert.equal( + matchingLogins.length, + 1, + `There should still be 1 login for ${HOST1}` + ); + + matchingLogins = LoginHelper.searchLoginsWithObject({ origin: HOST2 }); + Assert.equal( + matchingLogins.length, + 1, + `There should also be 1 login for ${HOST2}` + ); + Assert.equal( + Services.logins.getAllLogins().length, + 2, + "There should be 2 logins in total" + ); + Services.logins.removeAllUserFacingLogins(); +}); + +add_task(async function test_duplicate_logins() { + let [importedLogin] = await maybeImportLogins([ + { + username: USER1, + password: PASS1, + origin: HOST1, + formActionOrigin: HOST1, + }, + ]); + Assert.ok(importedLogin, "Return value should indicate imported login."); + let matchingLogins = LoginHelper.searchLoginsWithObject({ origin: HOST1 }); + Assert.equal( + matchingLogins.length, + 1, + `There should be 1 login for ${HOST1}` + ); + + [importedLogin] = await maybeImportLogins([ + { + username: USER1, + password: PASS1, + origin: HOST1, + formActionOrigin: HOST1, + }, + ]); + Assert.ok( + !importedLogin, + "Return value should indicate no new login was imported." + ); + matchingLogins = LoginHelper.searchLoginsWithObject({ origin: HOST1 }); + Assert.equal( + matchingLogins.length, + 1, + `There should still be 1 login for ${HOST1}` + ); + Services.logins.removeAllUserFacingLogins(); +}); + +add_task(async function test_different_passwords() { + let [importedLogin] = await maybeImportLogins([ + { + username: USER1, + password: PASS1, + origin: HOST1, + formActionOrigin: HOST1, + timeCreated: new Date(Date.now() - 1000), + }, + ]); + Assert.ok(importedLogin, "Return value should indicate imported login."); + let matchingLogins = LoginHelper.searchLoginsWithObject({ origin: HOST1 }); + Assert.equal( + matchingLogins.length, + 1, + `There should be 1 login for ${HOST1}` + ); + + // This item will be newer, so its password should take precedence. + [importedLogin] = await maybeImportLogins([ + { + username: USER1, + password: PASS2, + origin: HOST1, + formActionOrigin: HOST1, + timeCreated: new Date(), + }, + ]); + Assert.ok( + !importedLogin, + "Return value should not indicate imported login (as we updated an existing one)." + ); + matchingLogins = LoginHelper.searchLoginsWithObject({ origin: HOST1 }); + Assert.equal( + matchingLogins.length, + 1, + `There should still be 1 login for ${HOST1}` + ); + Assert.equal( + matchingLogins[0].password, + PASS2, + "We should have updated the password for this login." + ); + + // Now try to update with an older password: + [importedLogin] = await maybeImportLogins([ + { + username: USER1, + password: PASS3, + origin: HOST1, + formActionOrigin: HOST1, + timeCreated: new Date(Date.now() - 1000000), + }, + ]); + Assert.ok( + !importedLogin, + "Return value should not indicate imported login (as we didn't update anything)." + ); + matchingLogins = LoginHelper.searchLoginsWithObject({ origin: HOST1 }); + Assert.equal( + matchingLogins.length, + 1, + `There should still be 1 login for ${HOST1}` + ); + Assert.equal( + matchingLogins[0].password, + PASS2, + "We should NOT have updated the password for this login." + ); + + Services.logins.removeAllUserFacingLogins(); +}); + +add_task(async function test_different_usernames_without_guid() { + let [importedLogin] = await maybeImportLogins([ + { + username: USER1, + password: PASS1, + origin: HOST1, + formActionOrigin: HOST1, + }, + ]); + Assert.ok(importedLogin, "Return value should indicate imported login."); + let matchingLogins = LoginHelper.searchLoginsWithObject({ origin: HOST1 }); + Assert.equal( + matchingLogins.length, + 1, + `There should be 1 login for ${HOST1}` + ); + + [importedLogin] = await maybeImportLogins([ + { + username: USER2, + password: PASS1, + origin: HOST1, + formActionOrigin: HOST1, + }, + ]); + Assert.ok( + importedLogin, + "Return value should indicate another imported login." + ); + matchingLogins = LoginHelper.searchLoginsWithObject({ origin: HOST1 }); + Assert.equal( + matchingLogins.length, + 2, + `There should now be 2 logins for ${HOST1}` + ); + + Services.logins.removeAllUserFacingLogins(); +}); + +add_task(async function test_different_usernames_with_guid() { + let [{ login: importedLogin }] = await LoginHelper.maybeImportLogins([ + { + username: USER1, + password: PASS1, + origin: HOST1, + formActionOrigin: HOST1, + }, + ]); + Assert.ok(importedLogin, "Return value should indicate imported login."); + let matchingLogins = LoginHelper.searchLoginsWithObject({ origin: HOST1 }); + Assert.equal( + matchingLogins.length, + 1, + `There should be 1 login for ${HOST1}` + ); + + info("Changing both the origin and username using the GUID"); + let importedLogins = await LoginHelper.maybeImportLogins([ + { + username: USER2, + password: PASS1, + origin: HOST2, + formActionOrigin: HOST1, + guid: importedLogin.guid, + }, + ]); + Assert.equal( + importedLogins[0].result, + "modified", + "Return value should indicate an update" + ); + matchingLogins = LoginHelper.searchLoginsWithObject({ origin: HOST2 }); + Assert.equal( + matchingLogins.length, + 1, + `The 1 login for ${HOST1} should have been updated` + ); + let storageLogin = matchingLogins[0]; + Assert.equal(storageLogin.guid, importedLogin.guid, "Check same guid"); + Assert.equal(storageLogin.username, USER2, "Check username updated"); + Assert.equal(storageLogin.origin, HOST2, "Check origin updated"); + + Services.logins.removeAllUserFacingLogins(); +}); + +add_task(async function test_different_targets() { + let [importedLogin] = await maybeImportLogins([ + { + username: USER1, + password: PASS1, + origin: HOST1, + formActionOrigin: HOST1, + }, + ]); + Assert.ok(importedLogin, "Return value should indicate imported login."); + let matchingLogins = LoginHelper.searchLoginsWithObject({ origin: HOST1 }); + Assert.equal( + matchingLogins.length, + 1, + `There should be 1 login for ${HOST1}` + ); + + // Not passing either a formActionOrigin or a httpRealm should be treated as + // the same as the previous login + [importedLogin] = await maybeImportLogins([ + { + username: USER1, + password: PASS1, + origin: HOST1, + }, + ]); + Assert.ok( + !importedLogin, + "Return value should NOT indicate imported login " + + "(because a missing formActionOrigin and httpRealm should be duped to the existing login)." + ); + matchingLogins = LoginHelper.searchLoginsWithObject({ origin: HOST1 }); + Assert.equal( + matchingLogins.length, + 1, + `There should still be 1 login for ${HOST1}` + ); + Assert.equal( + matchingLogins[0].formActionOrigin, + HOST1, + "The form submission URL should have been kept." + ); + + [importedLogin] = await maybeImportLogins([ + { + username: USER1, + password: PASS1, + origin: HOST1, + httpRealm: HOST1, + }, + ]); + Assert.ok( + importedLogin, + "Return value should indicate another imported login " + + "as an httpRealm login shouldn't be duped." + ); + matchingLogins = LoginHelper.searchLoginsWithObject({ origin: HOST1 }); + Assert.equal( + matchingLogins.length, + 2, + `There should now be 2 logins for ${HOST1}` + ); + + Services.logins.removeAllUserFacingLogins(); +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_module_LoginCSVImport.js b/toolkit/components/passwordmgr/test/unit/test_module_LoginCSVImport.js new file mode 100644 index 0000000000..12e040eb60 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_module_LoginCSVImport.js @@ -0,0 +1,870 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/** + * Tests the LoginCSVImport module. + */ + +"use strict"; + +const { LoginCSVImport } = ChromeUtils.importESModule( + "resource://gre/modules/LoginCSVImport.sys.mjs" +); +const { LoginExport } = ChromeUtils.importESModule( + "resource://gre/modules/LoginExport.sys.mjs" +); +const { TelemetryTestUtils: TTU } = ChromeUtils.importESModule( + "resource://testing-common/TelemetryTestUtils.sys.mjs" +); + +// Enable the collection (during test) for all products so even products +// that don't collect the data will be able to run the test without failure. +Services.prefs.setBoolPref( + "toolkit.telemetry.testing.overrideProductsCheck", + true +); + +const CATEGORICAL_HISTOGRAM = "PWMGR_IMPORT_LOGINS_FROM_FILE_CATEGORICAL"; +const IMPORT_TIMER_HISTOGRAM = "PWMGR_IMPORT_LOGINS_FROM_FILE_MS"; +const IMPORT_JANK_HISTOGRAM = "PWMGR_IMPORT_LOGINS_FROM_FILE_JANK_MS"; +/** + * Given an array of strings it creates a temporary CSV file that has them as content. + * + * @param {string[]} csvLines + * The lines that make up the CSV file. + * @param {string} extension + * Optional parameter. Either 'csv' or 'tsv'. Default is 'csv'. + * @returns {string} The path to the CSV file that was created. + */ +async function setupCsv(csvLines, extension) { + // Cleanup state. + TTU.getAndClearHistogram(CATEGORICAL_HISTOGRAM); + TTU.getAndClearHistogram(IMPORT_TIMER_HISTOGRAM); + TTU.getAndClearHistogram(IMPORT_JANK_HISTOGRAM); + Services.logins.removeAllUserFacingLogins(); + let tmpFile = await LoginTestUtils.file.setupCsvFileWithLines( + csvLines, + extension + ); + return tmpFile.path; +} + +function checkMetaInfo( + actual, + expected, + props = ["timesUsed", "timeCreated", "timePasswordChanged", "timeLastUsed"] +) { + for (let prop of props) { + // This will throw if not equal. + equal(actual[prop], expected[prop], `Check ${prop}`); + } + return true; +} + +function checkLoginNewlyCreated(login) { + // These will throw if not equal. + LoginTestUtils.assertTimeIsAboutNow(login.timeCreated); + LoginTestUtils.assertTimeIsAboutNow(login.timePasswordChanged); + LoginTestUtils.assertTimeIsAboutNow(login.timeLastUsed); + return true; +} + +/** + * Asserts histogram telemetry for the categories of logins + * + * @param {Object} histogram Histogram object returned from `TelemetryTestUtils.getAndClearHistogram()` + * @param {Number} index Index representing one of the following values in order: ["added", "modified", "error", "no_change"]. See `toolkit/components/telemetry/Histogram.json` for more information + * @param {Number} expected The expected number of entries in the histogram at the passed index + */ +function assertHistogramTelemetry(histogram, index, expected) { + TTU.assertHistogram(histogram, index, expected); +} + +/** + * Ensure that an import works with TSV. + */ +add_task(async function test_import_tsv() { + let histogram = TTU.getAndClearHistogram(CATEGORICAL_HISTOGRAM); + let tsvFilePath = await setupCsv( + [ + "url\tusername\tpassword\thttpRealm\tformActionOrigin\tguid\ttimeCreated\ttimeLastUsed\ttimePasswordChanged", + `https://example.com:8080\tjoe@example.com\tqwerty\tMy realm\t""\t{5ec0d12f-e194-4279-ae1b-d7d281bb46f0}\t1589617814635\t1589710449871\t1589617846802`, + ], + "tsv" + ); + + await LoginCSVImport.importFromCSV(tsvFilePath); + assertHistogramTelemetry(histogram, 0, 1); + + LoginTestUtils.checkLogins( + [ + TestData.authLogin({ + formActionOrigin: null, + guid: "{5ec0d12f-e194-4279-ae1b-d7d281bb46f0}", + httpRealm: "My realm", + origin: "https://example.com:8080", + password: "qwerty", + passwordField: "", + timeCreated: 1589617814635, + timeLastUsed: 1589710449871, + timePasswordChanged: 1589617846802, + timesUsed: 1, + username: "joe@example.com", + usernameField: "", + }), + ], + "Check that a new login was added with the correct fields", + (a, e) => a.equals(e) && checkMetaInfo(a, e) + ); +}); + +/** + * Ensure that an import fails if there is no username column in a TSV file. + */ +add_task(async function test_import_tsv_with_missing_columns() { + let csvFilePath = await setupCsv( + [ + "url\tusernameTypo\tpassword\thttpRealm\tformActionOrigin\tguid\ttimeCreated\ttimeLastUsed\ttimePasswordChanged", + "https://example.com\tkramer@example.com\tqwerty\tMy realm\t\t{5ec0d12f-e194-4279-ae1b-d7d281bb46f7}\t1589617814635\t1589710449871\t1589617846802", + ], + "tsv" + ); + + await Assert.rejects( + LoginCSVImport.importFromCSV(csvFilePath), + /FILE_FORMAT_ERROR/, + "Ensure missing username throws" + ); + + LoginTestUtils.checkLogins( + [], + "Check that no login was added without finding columns" + ); +}); + +/** + * Ensure that an import fails if there is no username column. We don't want + * to accidentally import duplicates due to a name mismatch for the username column. + */ +add_task(async function test_import_lacking_username_column() { + let csvFilePath = await setupCsv([ + "url,usernameTypo,password,httpRealm,formActionOrigin,guid,timeCreated,timeLastUsed,timePasswordChanged", + `https://example.com,joe@example.com,qwerty,My realm,,{5ec0d12f-e194-4279-ae1b-d7d281bb46f0},1589617814635,1589710449871,1589617846802`, + ]); + + await Assert.rejects( + LoginCSVImport.importFromCSV(csvFilePath), + /FILE_FORMAT_ERROR/, + "Ensure missing username throws" + ); + + LoginTestUtils.checkLogins( + [], + "Check that no login was added without finding a username column" + ); +}); + +/** + * Ensure that an import fails if there are two columns that map to one login field. + */ +add_task(async function test_import_with_duplicate_fields() { + // Two origin columns (url & login_uri). + // One row has different values and the other has the same. + let csvFilePath = await setupCsv([ + "url,login_uri,username,login_password", + "https://example.com/path,https://example.com,john@example.com,azerty", + "https://mozilla.org,https://mozilla.org,jdoe@example.com,qwerty", + ]); + + await Assert.rejects( + LoginCSVImport.importFromCSV(csvFilePath), + /CONFLICTING_VALUES_ERROR/, + "Check that the errorType is file format error" + ); + + LoginTestUtils.checkLogins( + [], + "Check that no login was added from a file with duplicated columns" + ); +}); + +/** + * Ensure that an import fails if there are two identical columns. + */ +add_task(async function test_import_with_duplicate_columns() { + let csvFilePath = await setupCsv([ + "url,username,password,password", + "https://example.com/path,john@example.com,azerty,12345", + ]); + + await Assert.rejects( + LoginCSVImport.importFromCSV(csvFilePath), + /CONFLICTING_VALUES_ERROR/, + "Check that the errorType is file format error" + ); + + LoginTestUtils.checkLogins( + [], + "Check that no login was added from a file with duplicated columns" + ); +}); + +/** + * Ensure that import is allowed with only origin, username, password and that + * one can mix and match column naming between conventions from different + * password managers (so that we better support new/unknown password managers). + */ +add_task(async function test_import_minimal_with_mixed_naming() { + let csvFilePath = await setupCsv([ + "url,username,login_password", + "ftp://example.com,john@example.com,azerty", + ]); + + await LoginCSVImport.importFromCSV(csvFilePath); + LoginTestUtils.checkLogins( + [ + TestData.formLogin({ + formActionOrigin: "", + httpRealm: null, + origin: "ftp://example.com", + password: "azerty", + passwordField: "", + timesUsed: 1, + username: "john@example.com", + usernameField: "", + }), + ], + "Check that a new login was added with the correct fields", + (a, e) => + a.equals(e) && + checkMetaInfo(a, e, ["timesUsed"]) && + checkLoginNewlyCreated(a) + ); +}); + +/** + * Imports login data from the latest Firefox CSV file for various logins from + * LoginTestUtils.testData.loginList(). + */ +add_task(async function test_import_from_firefox_various_latest() { + await setupCsv([]); + info("Populate the login list for export"); + let logins = LoginTestUtils.testData.loginList(); + await Services.logins.addLogins(logins); + + let tmpFilePath = FileTestUtils.getTempFile("logins.csv").path; + await LoginExport.exportAsCSV(tmpFilePath); + + await LoginCSVImport.importFromCSV(tmpFilePath); + + LoginTestUtils.checkLogins( + logins, + "Check that all of LoginTestUtils.testData.loginList can be re-imported" + ); +}); + +/** + * Imports login data from a Firefox CSV file without quotes. + */ +add_task(async function test_import_from_firefox_auth() { + let csvFilePath = await setupCsv([ + "url,username,password,httpRealm,formActionOrigin,guid,timeCreated,timeLastUsed,timePasswordChanged", + `https://example.com:8080,joe@example.com,qwerty,My realm,"",{5ec0d12f-e194-4279-ae1b-d7d281bb46f0},1589617814635,1589710449871,1589617846802`, + ]); + + await LoginCSVImport.importFromCSV(csvFilePath); + + LoginTestUtils.checkLogins( + [ + TestData.authLogin({ + formActionOrigin: null, + guid: "{5ec0d12f-e194-4279-ae1b-d7d281bb46f0}", + httpRealm: "My realm", + origin: "https://example.com:8080", + password: "qwerty", + passwordField: "", + timeCreated: 1589617814635, + timeLastUsed: 1589710449871, + timePasswordChanged: 1589617846802, + timesUsed: 1, + username: "joe@example.com", + usernameField: "", + }), + ], + "Check that a new login was added with the correct fields", + (a, e) => a.equals(e) && checkMetaInfo(a, e) + ); +}); + +/** + * Imports login data from a Firefox CSV file with quotes. + */ +add_task(async function test_import_from_firefox_auth_with_quotes() { + let csvFilePath = await setupCsv([ + '"url","username","password","httpRealm","formActionOrigin","guid","timeCreated","timeLastUsed","timePasswordChanged"', + '"https://example.com","joe@example.com","qwerty2","My realm",,"{5ec0d12f-e194-4279-ae1b-d7d281bb46f0}","1589617814635","1589710449871","1589617846802"', + ]); + + await LoginCSVImport.importFromCSV(csvFilePath); + + LoginTestUtils.checkLogins( + [ + TestData.authLogin({ + formActionOrigin: null, + httpRealm: "My realm", + origin: "https://example.com", + password: "qwerty2", + passwordField: "", + timeCreated: 1589617814635, + timeLastUsed: 1589710449871, + timePasswordChanged: 1589617846802, + timesUsed: 1, + username: "joe@example.com", + usernameField: "", + }), + ], + "Check that a new login was added with the correct fields", + (a, e) => a.equals(e) && checkMetaInfo(a, e) + ); +}); + +/** + * Imports login data from a Firefox CSV file where only cells containing a comma are quoted. + */ +add_task(async function test_import_from_firefox_auth_some_quoted_fields() { + let csvFilePath = await setupCsv([ + "url,username,password,httpRealm,formActionOrigin,guid,timeCreated,timeLastUsed,timePasswordChanged", + 'https://example.com,joe@example.com,"one,two,tree","My realm",,{5ec0d12f-e194-4279-ae1b-d7d281bb46f0},1589617814635,1589710449871,1589617846802', + ]); + + await LoginCSVImport.importFromCSV(csvFilePath); + + LoginTestUtils.checkLogins( + [ + TestData.authLogin({ + formActionOrigin: null, + httpRealm: "My realm", + origin: "https://example.com", + password: "one,two,tree", + passwordField: "", + timeCreated: 1589617814635, + timePasswordChanged: 1589617846802, + timeLastUsed: 1589710449871, + timesUsed: 1, + username: "joe@example.com", + usernameField: "", + }), + ], + "Check that a new login was added with the correct fields", + (a, e) => a.equals(e) && checkMetaInfo(a, e) + ); +}); + +/** + * Imports login data from a Firefox CSV file with an empty formActionOrigin and null httpRealm + */ +add_task(async function test_import_from_firefox_form_empty_formActionOrigin() { + let csvFilePath = await setupCsv([ + "url,username,password,httpRealm,formActionOrigin,guid,timeCreated,timeLastUsed,timePasswordChanged", + "https://example.com,joe@example.com,s3cret1,,,{5ec0d12f-e194-4279-ae1b-d7d281bb46f0},1589617814636,1589710449872,1589617846803", + ]); + + await LoginCSVImport.importFromCSV(csvFilePath); + + LoginTestUtils.checkLogins( + [ + TestData.formLogin({ + formActionOrigin: "", + httpRealm: null, + origin: "https://example.com", + password: "s3cret1", + passwordField: "", + timeCreated: 1589617814636, + timePasswordChanged: 1589617846803, + timeLastUsed: 1589710449872, + timesUsed: 1, + username: "joe@example.com", + usernameField: "", + }), + ], + "Check that a new login was added with the correct fields", + (a, e) => a.equals(e) && checkMetaInfo(a, e) + ); +}); + +/** + * Imports login data from a Firefox CSV file with a non-empty formActionOrigin and null httpRealm. + */ +add_task(async function test_import_from_firefox_form_with_formActionOrigin() { + let csvFilePath = await setupCsv([ + "url,username,password,httpRealm,formActionOrigin,guid,timeCreated,timeLastUsed,timePasswordChanged", + "http://example.com,joe@example.com,s3cret1,,https://other.example.com,{5ec0d12f-e194-4279-ae1b-d7d281bb46f1},1589617814635,1589710449871,1589617846802", + ]); + + await LoginCSVImport.importFromCSV(csvFilePath); + + LoginTestUtils.checkLogins( + [ + TestData.formLogin({ + formActionOrigin: "https://other.example.com", + httpRealm: null, + origin: "http://example.com", + password: "s3cret1", + passwordField: "", + timeCreated: 1589617814635, + timePasswordChanged: 1589617846802, + timeLastUsed: 1589710449871, + timesUsed: 1, + username: "joe@example.com", + usernameField: "", + }), + ], + "Check that a new login was added with the correct fields", + (a, e) => a.equals(e) && checkMetaInfo(a, e) + ); +}); + +/** + * Imports login data from a Bitwarden CSV file. + * `name` is ignored until bug 1433770. + */ +add_task(async function test_import_from_bitwarden_csv() { + let csvFilePath = await setupCsv([ + "folder,favorite,type,name,notes,fields,login_uri,login_username,login_password,login_totp", + `,,note,jane's note,"secret note, ignore me!",,,,,`, + ",,login,example.com,,,https://example.com/login,jane@example.com,secret_password", + ]); + + await LoginCSVImport.importFromCSV(csvFilePath); + + LoginTestUtils.checkLogins( + [ + TestData.formLogin({ + formActionOrigin: "", + httpRealm: null, + origin: "https://example.com", + password: "secret_password", + passwordField: "", + timesUsed: 1, + username: "jane@example.com", + usernameField: "", + }), + ], + "Check that a new Bitwarden login was added with the correct fields", + (a, e) => + a.equals(e) && + checkMetaInfo(a, e, ["timesUsed"]) && + checkLoginNewlyCreated(a) + ); +}); + +/** + * Imports login data from a Chrome CSV file. + * `name` is ignored until bug 1433770. + */ +add_task(async function test_import_from_chrome_csv() { + let csvFilePath = await setupCsv([ + "name,url,username,password", + "example.com,https://example.com/login,jane@example.com,secret_chrome_password", + ]); + + await LoginCSVImport.importFromCSV(csvFilePath); + + LoginTestUtils.checkLogins( + [ + TestData.formLogin({ + formActionOrigin: "", + httpRealm: null, + origin: "https://example.com", + password: "secret_chrome_password", + passwordField: "", + timesUsed: 1, + username: "jane@example.com", + usernameField: "", + }), + ], + "Check that a new Chrome login was added with the correct fields", + (a, e) => + a.equals(e) && + checkMetaInfo(a, e, ["timesUsed"]) && + checkLoginNewlyCreated(a) + ); +}); + +/** + * Imports login data with an item without the username. + */ +add_task(async function test_import_login_without_username() { + let csvFilePath = await setupCsv([ + "url,username,password", + "https://example.com/login,,secret_password", + ]); + + await LoginCSVImport.importFromCSV(csvFilePath); + + LoginTestUtils.checkLogins( + [ + TestData.formLogin({ + formActionOrigin: "", + httpRealm: null, + origin: "https://example.com", + password: "secret_password", + passwordField: "", + timesUsed: 1, + username: "", + usernameField: "", + }), + ], + "Check that a Login is added without an username", + (a, e) => + a.equals(e) && + checkMetaInfo(a, e, ["timesUsed"]) && + checkLoginNewlyCreated(a) + ); +}); + +/** + * Imports login data from a KeepassXC CSV file. + * `Title` is ignored until bug 1433770. + */ +add_task(async function test_import_from_keepassxc_csv() { + let csvFilePath = await setupCsv([ + `"Group","Title","Username","Password","URL","Notes"`, + `"NewDatabase/Internet","Amazing","test@example.com","<password>","https://example.org",""`, + ]); + + await LoginCSVImport.importFromCSV(csvFilePath); + + LoginTestUtils.checkLogins( + [ + TestData.formLogin({ + formActionOrigin: "", + httpRealm: null, + origin: "https://example.org", + password: "<password>", + passwordField: "", + timesUsed: 1, + username: "test@example.com", + usernameField: "", + }), + ], + "Check that a new KeepassXC login was added with the correct fields", + (a, e) => + a.equals(e) && + checkMetaInfo(a, e, ["timesUsed"]) && + checkLoginNewlyCreated(a) + ); +}); + +/** + * Imports login data summary contains added logins. + */ +add_task(async function test_import_summary_contains_added_login() { + let csvFilePath = await setupCsv([ + "url,username,password,httpRealm,formActionOrigin,guid,timeCreated,timeLastUsed,timePasswordChanged", + "https://added.example.com,jane@example.com,added_passwordd,My realm,,{5ec0d12f-e194-4279-ae1b-d7d281bb0003},1589617814635,1589710449871,1589617846802", + ]); + + let [added] = await LoginCSVImport.importFromCSV(csvFilePath); + + equal(added.result, "added", `Check that the login was added`); +}); + +/** + * Imports login data summary contains modified logins without guid. + */ +add_task(async function test_import_summary_modified_login_without_guid() { + let histogram = TTU.getAndClearHistogram(CATEGORICAL_HISTOGRAM); + let initialDataFile = await setupCsv([ + "url,username,password,httpRealm,formActionOrigin,guid,timeCreated,timeLastUsed,timePasswordChanged", + "https://modifiedwithoutguid.example.com,gini@example.com,initial_password,My realm,,,1589617814635,1589710449871,1589617846802", + ]); + await LoginCSVImport.importFromCSV(initialDataFile); + assertHistogramTelemetry(histogram, 0, 1); + histogram = TTU.getAndClearHistogram(CATEGORICAL_HISTOGRAM); + + let csvFile = await LoginTestUtils.file.setupCsvFileWithLines([ + "url,username,password,httpRealm,formActionOrigin,guid,timeCreated,timeLastUsed,timePasswordChanged", + "https://modifiedwithoutguid.example.com,gini@example.com,modified_password,My realm,,,1589617814635,1589710449871,1589617846999", + ]); + + let [modifiedWithoutGuid] = await LoginCSVImport.importFromCSV(csvFile.path); + assertHistogramTelemetry(histogram, 1, 1); + equal( + modifiedWithoutGuid.result, + "modified", + `Check that the login was modified when there was no guid data` + ); + LoginTestUtils.checkLogins( + [ + TestData.authLogin({ + formActionOrigin: null, + guid: null, + httpRealm: "My realm", + origin: "https://modifiedwithoutguid.example.com", + password: "modified_password", + passwordField: "", + timeCreated: 1589617814635, + timeLastUsed: 1589710449871, + timePasswordChanged: 1589617846999, + timesUsed: 1, + username: "gini@example.com", + usernameField: "", + }), + ], + "Check that logins were updated with the correct fields", + (a, e) => a.equals(e) && checkMetaInfo(a, e) + ); +}); + +/** + * Imports login data summary contains modified logins with guid. + */ +add_task(async function test_import_summary_modified_login_with_guid() { + let initialDataFile = await setupCsv([ + "url,username,password,httpRealm,formActionOrigin,guid,timeCreated,timeLastUsed,timePasswordChanged", + "https://modifiedwithguid.example.com,jane@example.com,initial_password,My realm,,{5ec0d12f-e194-4279-ae1b-d7d281bb0001},1589617814635,1589710449871,1589617846802", + ]); + await LoginCSVImport.importFromCSV(initialDataFile); + + let csvFile = await LoginTestUtils.file.setupCsvFileWithLines([ + "url,username,password,httpRealm,formActionOrigin,guid,timeCreated,timeLastUsed,timePasswordChanged", + "https://modified.example.com,jane@example.com,modified_password,My realm,,{5ec0d12f-e194-4279-ae1b-d7d281bb0001},1589617814635,1589710449871,1589617846999", + ]); + + let [modifiedWithGuid] = await LoginCSVImport.importFromCSV(csvFile.path); + + equal( + modifiedWithGuid.result, + "modified", + `Check that the login was modified when it had the same guid` + ); + LoginTestUtils.checkLogins( + [ + TestData.authLogin({ + formActionOrigin: null, + guid: "{5ec0d12f-e194-4279-ae1b-d7d281bb0001}", + httpRealm: "My realm", + origin: "https://modified.example.com", + password: "modified_password", + passwordField: "", + timeCreated: 1589617814635, + timeLastUsed: 1589710449871, + timePasswordChanged: 1589617846999, + timesUsed: 1, + username: "jane@example.com", + usernameField: "", + }), + ], + "Check that logins were updated with the correct fields", + (a, e) => a.equals(e) && checkMetaInfo(a, e) + ); +}); + +/** + * Imports login data summary contains unchanged logins. + */ +add_task(async function test_import_summary_contains_unchanged_login() { + let histogram = TTU.getAndClearHistogram(CATEGORICAL_HISTOGRAM); + let initialDataFile = await setupCsv([ + "url,username,password,httpRealm,formActionOrigin,guid,timeCreated,timeLastUsed,timePasswordChanged", + "https://nochange.example.com,jane@example.com,nochange_password,My realm,,{5ec0d12f-e194-4279-ae1b-d7d281bb0002},1589617814635,1589710449871,1589617846802", + ]); + await LoginCSVImport.importFromCSV(initialDataFile); + assertHistogramTelemetry(histogram, 0, 1); + histogram = TTU.getAndClearHistogram(CATEGORICAL_HISTOGRAM); + + let csvFile = await LoginTestUtils.file.setupCsvFileWithLines([ + "url,username,password,httpRealm,formActionOrigin,guid,timeCreated,timeLastUsed,timePasswordChanged", + "https://nochange.example.com,jane@example.com,nochange_password,My realm,,{5ec0d12f-e194-4279-ae1b-d7d281bb0002},1589617814635,1589710449871,1589617846802", + ]); + + let [noChange] = await LoginCSVImport.importFromCSV(csvFile.path); + assertHistogramTelemetry(histogram, 3, 1); + equal(noChange.result, "no_change", `Check that the login was not changed`); +}); + +/** + * Imports login data summary contains logins with errors in case of missing fields. + */ +add_task(async function test_import_summary_contains_missing_fields_errors() { + let histogram = TTU.getAndClearHistogram(CATEGORICAL_HISTOGRAM); + const missingFieldsToCheck = ["url", "password"]; + const sourceObject = { + url: "https://invalid.password.example.com", + username: "jane@example.com", + password: "qwerty", + }; + for (const missingField of missingFieldsToCheck) { + const clonedUser = { ...sourceObject }; + clonedUser[missingField] = ""; + let csvFilePath = await setupCsv([ + "url,username,password", + `${clonedUser.url},${clonedUser.username},${clonedUser.password}`, + ]); + + let [importLogin] = await LoginCSVImport.importFromCSV(csvFilePath); + + equal( + importLogin.result, + "error_missing_field", + `Check that the missing field error is reported for ${missingField}` + ); + equal( + importLogin.field_name, + missingField, + `Check that the invalid field name is correctly reported for the ${missingField}` + ); + } + assertHistogramTelemetry(histogram, 2, 1); +}); + +/** + * Imports login with wrong file format will have correct errorType. + */ +add_task(async function test_import_summary_with_bad_format() { + let csvFilePath = await setupCsv(["password", "123qwe!@#QWE"]); + + await Assert.rejects( + LoginCSVImport.importFromCSV(csvFilePath), + /FILE_FORMAT_ERROR/, + "Check that the errorType is file format error" + ); + + LoginTestUtils.checkLogins( + [], + "Check that no login was added with bad format" + ); +}); + +/** + * Imports login with wrong file type will have correct errorType. + */ +add_task(async function test_import_summary_with_non_csv_file() { + let csvFilePath = await setupCsv([ + "<body>this is totally not a csv file</body>", + ]); + + await Assert.rejects( + LoginCSVImport.importFromCSV(csvFilePath), + /FILE_FORMAT_ERROR/, + "Check that the errorType is file format error" + ); + + LoginTestUtils.checkLogins( + [], + "Check that no login was added with file of different format" + ); +}); + +/** + * Imports login multiple url and user will import the first and skip the second. + */ +add_task(async function test_import_summary_with_url_user_multiple_values() { + let csvFilePath = await setupCsv([ + "url,username,password,httpRealm,formActionOrigin,guid,timeCreated,timeLastUsed,timePasswordChanged", + "https://example.com,jane@example.com,password1,My realm", + "https://example.com,jane@example.com,password2,My realm", + ]); + + let initialLoginCount = Services.logins.getAllLogins().length; + + let results = await LoginCSVImport.importFromCSV(csvFilePath); + let afterImportLoginCount = Services.logins.getAllLogins().length; + + equal(results.length, 2, `Check that we got a result for each imported row`); + equal(results[0].result, "added", `Check that the first login was added`); + equal( + results[1].result, + "no_change", + `Check that the second login was skipped` + ); + equal(initialLoginCount, 0, `Check that initially we had no logins`); + equal(afterImportLoginCount, 1, `Check that we imported only one login`); +}); + +/** + * Imports login with duplicated guid values throws error. + */ +add_task(async function test_import_summary_with_duplicated_guid_values() { + let csvFilePath = await setupCsv([ + "url,username,password,httpRealm,formActionOrigin,guid,timeCreated,timeLastUsed,timePasswordChanged", + "https://example1.com,jane1@example.com,password1,My realm,,{5ec0d12f-e194-4279-ae1b-d7d281bb0004},1589617814635,1589710449871,1589617846802", + "https://example2.com,jane2@example.com,password2,My realm,,{5ec0d12f-e194-4279-ae1b-d7d281bb0004},1589617814635,1589710449871,1589617846802", + ]); + let initialLoginCount = Services.logins.getAllLogins().length; + + let results = await LoginCSVImport.importFromCSV(csvFilePath); + let afterImportLoginCount = Services.logins.getAllLogins().length; + + equal(results.length, 2, `Check that we got a result for each imported row`); + equal(results[0].result, "added", `Check that the first login was added`); + equal(results[1].result, "error", `Check that the second login was an error`); + equal(initialLoginCount, 0, `Check that initially we had no logins`); + equal(afterImportLoginCount, 1, `Check that we imported only one login`); +}); + +/** + * Imports login with different passwords will pick up the newest one and ignore the oldest one. + */ +add_task(async function test_import_summary_with_different_time_changed() { + let csvFilePath = await setupCsv([ + "url,username,password,timeCreated,timeLastUsed,timePasswordChanged", + "https://example.com,eve@example.com,old password,1589617814635,1589710449800,1589617846800", + "https://example.com,eve@example.com,new password,1589617814635,1589710449801,1589617846801", + ]); + let initialLoginCount = Services.logins.getAllLogins().length; + + let results = await LoginCSVImport.importFromCSV(csvFilePath); + let afterImportLoginCount = Services.logins.getAllLogins().length; + + equal(results.length, 2, `Check that we got a result for each imported row`); + equal( + results[0].result, + "no_change", + `Check that the oldest password is skipped` + ); + equal( + results[1].login.password, + "new password", + `Check that the newest password is imported` + ); + equal( + results[1].result, + "added", + `Check that the newest password result is correct` + ); + equal(initialLoginCount, 0, `Check that initially we had no logins`); + equal(afterImportLoginCount, 1, `Check that we imported only one login`); +}); + +/** + * Imports duplicate logins as one without an error. + */ +add_task(async function test_import_duplicate_logins_as_one() { + let csvFilePath = await setupCsv([ + "name,url,username,password", + "somesite,https://example.com/,user@example.com,asdasd123123", + "somesite,https://example.com/,user@example.com,asdasd123123", + ]); + let initialLoginCount = Services.logins.getAllLogins().length; + + let results = await LoginCSVImport.importFromCSV(csvFilePath); + let afterImportLoginCount = Services.logins.getAllLogins().length; + + equal(results.length, 2, `Check that we got a result for each imported row`); + equal( + results[0].result, + "added", + `Check that the first login login was added` + ); + equal( + results[1].result, + "no_change", + `Check that the second login was not changed` + ); + + equal(initialLoginCount, 0, `Check that initially we had no logins`); + equal(afterImportLoginCount, 1, `Check that we imported only one login`); +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_module_LoginExport.js b/toolkit/components/passwordmgr/test/unit/test_module_LoginExport.js new file mode 100644 index 0000000000..d7df6168c9 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_module_LoginExport.js @@ -0,0 +1,219 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/** + * Tests the LoginExport module. + */ + +"use strict"; + +let { LoginExport } = ChromeUtils.importESModule( + "resource://gre/modules/LoginExport.sys.mjs" +); +let { sinon } = ChromeUtils.importESModule( + "resource://testing-common/Sinon.sys.mjs" +); + +/** + * Saves the logins to a temporary CSV file, reads the lines and returns the CSV lines. + * After extracting the CSV lines, it deletes the tmp file. + */ +async function exportAsCSVInTmpFile() { + const tmpFilePath = FileTestUtils.getTempFile("logins.csv").path; + await LoginExport.exportAsCSV(tmpFilePath); + const csvString = await IOUtils.readUTF8(tmpFilePath); + await IOUtils.remove(tmpFilePath); + // CSV uses CRLF + return csvString.split(/\r\n/); +} + +const COMMON_LOGIN_MODS = { + guid: "{5ec0d12f-e194-4279-ae1b-d7d281bb46f0}", + timeCreated: 1589617814635, + timeLastUsed: 1589710449871, + timePasswordChanged: 1589617846802, + timesUsed: 1, + username: "joe@example.com", + password: "qwerty", + origin: "https://example.com", +}; + +/** + * Generates a new login object with all the form login fields populated. + */ +function exportFormLogin(modifications) { + return LoginTestUtils.testData.formLogin({ + ...COMMON_LOGIN_MODS, + formActionOrigin: "https://action.example.com", + ...modifications, + }); +} + +function exportAuthLogin(modifications) { + return LoginTestUtils.testData.authLogin({ + ...COMMON_LOGIN_MODS, + httpRealm: "My realm", + ...modifications, + }); +} + +add_setup(async () => { + let oldLogins = Services.logins; + Services.logins = { getAllLoginsAsync: sinon.stub() }; + registerCleanupFunction(() => { + Services.logins = oldLogins; + }); +}); + +add_task(async function test_buildCSVRow() { + let testObject = { + null: null, + emptyString: "", + number: 99, + string: "Foo", + }; + Assert.deepEqual( + LoginExport._buildCSVRow(testObject, [ + "null", + "emptyString", + "number", + "string", + ]), + ["", `""`, `"99"`, `"Foo"`], + "Check _buildCSVRow with different types" + ); +}); + +add_task(async function test_no_new_properties_to_export() { + let login = exportFormLogin(); + Assert.deepEqual( + Object.keys(login), + [ + "QueryInterface", + "displayOrigin", + "origin", + "hostname", + "formActionOrigin", + "formSubmitURL", + "httpRealm", + "username", + "usernameField", + "password", + "passwordField", + "unknownFields", + "init", + "equals", + "matches", + "clone", + "guid", + "timeCreated", + "timeLastUsed", + "timePasswordChanged", + "timesUsed", + ], + "Check that no new properties were added to a login that should maybe be exported" + ); +}); + +add_task(async function test_export_one_form_login() { + let login = exportFormLogin(); + Services.logins.getAllLoginsAsync.returns([login]); + + let rows = await exportAsCSVInTmpFile(); + + Assert.equal( + rows[0], + '"url","username","password","httpRealm","formActionOrigin","guid","timeCreated","timeLastUsed","timePasswordChanged"', + "checking csv headers" + ); + Assert.equal( + rows[1], + '"https://example.com","joe@example.com","qwerty",,"https://action.example.com","{5ec0d12f-e194-4279-ae1b-d7d281bb46f0}","1589617814635","1589710449871","1589617846802"', + `checking login is saved as CSV row\n${JSON.stringify(login)}\n` + ); +}); + +add_task(async function test_export_one_auth_login() { + let login = exportAuthLogin(); + Services.logins.getAllLoginsAsync.returns([login]); + + let rows = await exportAsCSVInTmpFile(); + + Assert.equal( + rows[0], + '"url","username","password","httpRealm","formActionOrigin","guid","timeCreated","timeLastUsed","timePasswordChanged"', + "checking csv headers" + ); + Assert.equal( + rows[1], + '"https://example.com","joe@example.com","qwerty","My realm",,"{5ec0d12f-e194-4279-ae1b-d7d281bb46f0}","1589617814635","1589710449871","1589617846802"', + `checking login is saved as CSV row\n${JSON.stringify(login)}\n` + ); +}); + +add_task(async function test_export_escapes_values() { + let login = exportFormLogin({ + password: "!@#$%^&*()_+,'", + }); + Services.logins.getAllLoginsAsync.returns([login]); + + let rows = await exportAsCSVInTmpFile(); + + Assert.equal( + rows[1], + '"https://example.com","joe@example.com","!@#$%^&*()_+,\'",,"https://action.example.com","{5ec0d12f-e194-4279-ae1b-d7d281bb46f0}","1589617814635","1589710449871","1589617846802"', + `checking login correctly escapes CSV characters \n${JSON.stringify(login)}` + ); +}); + +add_task(async function test_export_multiple_rows() { + let logins = await LoginTestUtils.testData.loginList(); + // Note, because we're stubbing this method and avoiding the actual login manager logic, + // login de-duplication does not occur + Services.logins.getAllLoginsAsync.returns(logins); + + let actualRows = await exportAsCSVInTmpFile(); + let expectedRows = [ + '"url","username","password","httpRealm","formActionOrigin","guid","timeCreated","timeLastUsed","timePasswordChanged"', + '"http://www.example.com","the username","the password for www.example.com",,"http://www.example.com",,,,', + '"https://www.example.com","the username","the password for https",,"https://www.example.com",,,,', + '"https://example.com","the username","the password for example.com",,"https://example.com",,,,', + '"http://www3.example.com","the username","the password",,"http://www.example.com",,,,', + '"http://www3.example.com","the username","the password",,"https://www.example.com",,,,', + '"http://www3.example.com","the username","the password",,"http://example.com",,,,', + '"http://www4.example.com","username one","password one",,"http://www4.example.com",,,,', + '"http://www4.example.com","username two","password two",,"http://www4.example.com",,,,', + '"http://www4.example.com","","password three",,"http://www4.example.com",,,,', + '"http://www5.example.com","multi username","multi password",,"http://www5.example.com",,,,', + '"http://www6.example.com","","12345",,"http://www6.example.com",,,,', + '"https://www7.example.com:8080","8080_username","8080_pass",,"https://www7.example.com:8080",,,,', + '"https://www7.example.com:8080","8080_username2","8080_pass2","My dev server",,,,,', + '"http://www.example.org","the username","the password","The HTTP Realm",,,,,', + '"ftp://ftp.example.org","the username","the password","ftp://ftp.example.org",,,,,', + '"http://www2.example.org","the username","the password","The HTTP Realm",,,,,', + '"http://www2.example.org","the username other","the password other","The HTTP Realm Other",,,,,', + '"http://example.net","the username","the password",,"http://example.net",,,,', + '"http://example.net","the username","the password",,"http://www.example.net",,,,', + '"http://example.net","username two","the password",,"http://www.example.net",,,,', + '"http://example.net","the username","the password","The HTTP Realm",,,,,', + '"http://example.net","username two","the password","The HTTP Realm Other",,,,,', + '"ftp://example.net","the username","the password","ftp://example.net",,,,,', + '"chrome://example_extension","the username","the password one","Example Login One",,,,,', + '"chrome://example_extension","the username","the password two","Example Login Two",,,,,', + '"file://","file: username","file: password",,"file://",,,,', + '"https://js.example.com","javascript: username","javascript: password",,"javascript:",,,,', + ]; + + Assert.equal(actualRows.length, expectedRows.length, "Check number of lines"); + for (let i = 0; i < logins.length; i++) { + let login = logins[i]; + Assert.equal( + actualRows[i], + expectedRows[i], + `checking CSV correctly writes row at index=${i} \n${JSON.stringify( + login + )}\n` + ); + } +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_module_LoginManager.js b/toolkit/components/passwordmgr/test/unit/test_module_LoginManager.js new file mode 100644 index 0000000000..8ab75bdeef --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_module_LoginManager.js @@ -0,0 +1,37 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/** + * Tests the LoginManager module. + */ + +"use strict"; + +const { LoginManager } = ChromeUtils.importESModule( + "resource://gre/modules/LoginManager.sys.mjs" +); + +add_task(async function test_ensureCurrentSyncID() { + let loginManager = new LoginManager(); + await loginManager.setSyncID(1); + await loginManager.setLastSync(100); + + // test calling ensureCurrentSyncID with the current sync ID + Assert.equal(await loginManager.ensureCurrentSyncID(1), 1); + Assert.equal(await loginManager.getSyncID(), 1, "sync ID shouldn't change"); + Assert.equal( + await loginManager.getLastSync(), + 100, + "last sync shouldn't change" + ); + + // test calling ensureCurrentSyncID with the different sync ID + Assert.equal(await loginManager.ensureCurrentSyncID(2), 2); + Assert.equal(await loginManager.getSyncID(), 2, "sync ID should be updated"); + Assert.equal( + await loginManager.getLastSync(), + 0, + "last sync should be reset" + ); +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_module_LoginStore.js b/toolkit/components/passwordmgr/test/unit/test_module_LoginStore.js new file mode 100644 index 0000000000..f7e764c789 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_module_LoginStore.js @@ -0,0 +1,337 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +/** + * Tests the LoginStore object. + */ + +"use strict"; + +// Globals + +ChromeUtils.defineESModuleGetters(this, { + LoginStore: "resource://gre/modules/LoginStore.sys.mjs", +}); + +const TEST_STORE_FILE_NAME = "test-logins.json"; + +const MAX_DATE_MS = 8640000000000000; + +// Tests + +/** + * Saves login data to a file, then reloads it. + */ +add_task(async function test_save_reload() { + let storeForSave = new LoginStore(getTempFile(TEST_STORE_FILE_NAME).path); + + // The "load" method must be called before preparing the data to be saved. + await storeForSave.load(); + + let rawLoginData = { + id: storeForSave.data.nextId++, + hostname: "http://www.example.com", + httpRealm: null, + formSubmitURL: "http://www.example.com", + usernameField: "field_" + String.fromCharCode(533, 537, 7570, 345), + passwordField: "field_" + String.fromCharCode(421, 259, 349, 537), + encryptedUsername: "(test)", + encryptedPassword: "(test)", + guid: "(test)", + encType: Ci.nsILoginManagerCrypto.ENCTYPE_SDR, + timeCreated: Date.now(), + timeLastUsed: Date.now(), + timePasswordChanged: Date.now(), + timesUsed: 1, + }; + storeForSave.data.logins.push(rawLoginData); + + await storeForSave._save(); + + // Test the asynchronous initialization path. + let storeForLoad = new LoginStore(storeForSave.path); + await storeForLoad.load(); + + Assert.equal(storeForLoad.data.logins.length, 1); + Assert.deepEqual(storeForLoad.data.logins[0], rawLoginData); + + // Test the synchronous initialization path. + storeForLoad = new LoginStore(storeForSave.path); + storeForLoad.ensureDataReady(); + + Assert.equal(storeForLoad.data.logins.length, 1); + Assert.deepEqual(storeForLoad.data.logins[0], rawLoginData); +}); + +/** + * Checks that loading from a missing file results in empty arrays. + */ +add_task(async function test_load_empty() { + let store = new LoginStore(getTempFile(TEST_STORE_FILE_NAME).path); + + Assert.equal(false, await IOUtils.exists(store.path)); + + await store.load(); + + Assert.equal(false, await IOUtils.exists(store.path)); + + Assert.equal(store.data.logins.length, 0); +}); + +/** + * Checks that saving empty data still overwrites any existing file. + */ +add_task(async function test_save_empty() { + const store = new LoginStore(getTempFile(TEST_STORE_FILE_NAME).path); + + await store.load(); + await IOUtils.writeUTF8(store.path, "", { writeMode: "create" }); + await store._save(); + + Assert.ok(await IOUtils.exists(store.path)); +}); + +/** + * Loads data from a string in a predefined format. The purpose of this test is + * to verify that the JSON format used in previous versions can be loaded. + */ +add_task(async function test_load_string_predefined() { + let store = new LoginStore(getTempFile(TEST_STORE_FILE_NAME).path); + + let string = + '{"logins":[{' + + '"id":1,' + + '"hostname":"http://www.example.com",' + + '"httpRealm":null,' + + '"formSubmitURL":"http://www.example.com",' + + '"usernameField":"usernameField",' + + '"passwordField":"passwordField",' + + '"encryptedUsername":"(test)",' + + '"encryptedPassword":"(test)",' + + '"guid":"(test)",' + + '"encType":1,' + + '"timeCreated":1262304000000,' + + '"timeLastUsed":1262390400000,' + + '"timePasswordChanged":1262476800000,' + + '"timesUsed":1}],"disabledHosts":[' + + '"http://www.example.org"]}'; + + await IOUtils.writeUTF8(store.path, string, { + tmpPath: store.path + ".tmp", + }); + + await store.load(); + + Assert.equal(store.data.logins.length, 1); + Assert.deepEqual(store.data.logins[0], { + id: 1, + hostname: "http://www.example.com", + httpRealm: null, + formSubmitURL: "http://www.example.com", + usernameField: "usernameField", + passwordField: "passwordField", + encryptedUsername: "(test)", + encryptedPassword: "(test)", + guid: "(test)", + encType: Ci.nsILoginManagerCrypto.ENCTYPE_SDR, + timeCreated: 1262304000000, + timeLastUsed: 1262390400000, + timePasswordChanged: 1262476800000, + timesUsed: 1, + }); +}); + +/** + * Loads login data from a malformed JSON string. + */ +add_task(async function test_load_string_malformed() { + let store = new LoginStore(getTempFile(TEST_STORE_FILE_NAME).path); + + let string = '{"logins":[{"hostname":"http://www.example.com","id":1,'; + + await IOUtils.writeUTF8(store.path, string, { + tmpPath: store.path + ".tmp", + }); + + await store.load(); + + // A backup file should have been created. + Assert.ok(await IOUtils.exists(store.path + ".corrupt")); + await IOUtils.remove(store.path + ".corrupt"); + + // The store should be ready to accept new data. + Assert.equal(store.data.logins.length, 0); +}); + +/** + * Loads login data from a malformed JSON string, using the synchronous + * initialization path. + */ +add_task(async function test_load_string_malformed_sync() { + let store = new LoginStore(getTempFile(TEST_STORE_FILE_NAME).path); + + let string = '{"logins":[{"hostname":"http://www.example.com","id":1,'; + + await IOUtils.writeUTF8(store.path, string, { + tmpPath: store.path + ".tmp", + }); + + store.ensureDataReady(); + + // A backup file should have been created. + Assert.ok(await IOUtils.exists(store.path + ".corrupt")); + await IOUtils.remove(store.path + ".corrupt"); + + // The store should be ready to accept new data. + Assert.equal(store.data.logins.length, 0); +}); + +/** + * Fix bad dates when loading login data + */ +add_task(async function test_load_bad_dates() { + let rawLoginData = { + encType: 1, + encryptedPassword: "(test)", + encryptedUsername: "(test)", + formSubmitURL: "https://www.example.com", + guid: "{2a97313f-873b-4048-9a3d-4f442b46c1e5}", + hostname: "https://www.example.com", + httpRealm: null, + id: 1, + passwordField: "pass", + timesUsed: 1, + usernameField: "email", + }; + let rawStoreData = { + dismissedBreachAlertsByLoginGUID: {}, + logins: [], + nextId: 2, + potentiallyVulnerablePasswords: [], + version: 2, + }; + + /** + * test that: + * - bogus (0 or out-of-range) date values in any of the date fields are replaced with the + * earliest time marked by the other date fields + * - bogus bogus (0 or out-of-range) date values in all date fields are replaced with the time of import + */ + let tests = [ + { + name: "Out-of-range time values", + savedProps: { + timePasswordChanged: MAX_DATE_MS + 1, + timeLastUsed: MAX_DATE_MS + 1, + timeCreated: MAX_DATE_MS + 1, + }, + expectedProps: { + timePasswordChanged: "now", + timeLastUsed: "now", + timeCreated: "now", + }, + }, + { + name: "All zero time values", + savedProps: { + timePasswordChanged: 0, + timeLastUsed: 0, + timeCreated: 0, + }, + expectedProps: { + timePasswordChanged: "now", + timeLastUsed: "now", + timeCreated: "now", + }, + }, + { + name: "Only timeCreated has value", + savedProps: { + timePasswordChanged: 0, + timeLastUsed: 0, + timeCreated: 946713600000, + }, + expectedProps: { + timePasswordChanged: 946713600000, + timeLastUsed: 946713600000, + timeCreated: 946713600000, + }, + }, + { + name: "timeCreated has 0 value", + savedProps: { + timePasswordChanged: 946713600000, + timeLastUsed: 946713600000, + timeCreated: 0, + }, + expectedProps: { + timePasswordChanged: 946713600000, + timeLastUsed: 946713600000, + timeCreated: 946713600000, + }, + }, + { + name: "timeCreated has out-of-range value", + savedProps: { + timePasswordChanged: 946713600000, + timeLastUsed: 946713600000, + timeCreated: MAX_DATE_MS + 1, + }, + expectedProps: { + timePasswordChanged: 946713600000, + timeLastUsed: 946713600000, + timeCreated: 946713600000, + }, + }, + { + name: "Use earliest time for missing value", + savedProps: { + timePasswordChanged: 0, + timeLastUsed: 946713600000, + timeCreated: 946540800000, + }, + expectedProps: { + timePasswordChanged: 946540800000, + timeLastUsed: 946713600000, + timeCreated: 946540800000, + }, + }, + ]; + + for (let testData of tests) { + let store = new LoginStore(getTempFile(TEST_STORE_FILE_NAME).path); + let string = JSON.stringify( + Object.assign({}, rawStoreData, { + logins: [Object.assign({}, rawLoginData, testData.savedProps)], + }) + ); + await IOUtils.writeUTF8(store.path, string, { + tmpPath: store.path + ".tmp", + }); + let now = Date.now(); + await store.load(); + + Assert.equal( + store.data.logins.length, + 1, + `${testData.name}: Expected a single login` + ); + + let login = store.data.logins[0]; + for (let pname of ["timeCreated", "timeLastUsed", "timePasswordChanged"]) { + if (testData.expectedProps[pname] === "now") { + Assert.ok( + login[pname] >= now, + `${testData.name}: Check ${pname} is at/near now` + ); + } else { + Assert.equal( + login[pname], + testData.expectedProps[pname], + `${testData.name}: Check expected ${pname}` + ); + } + } + Assert.equal(store.data.version, 3, "Check version was bumped"); + } +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_notifications.js b/toolkit/components/passwordmgr/test/unit/test_notifications.js new file mode 100644 index 0000000000..d13ecdcab6 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_notifications.js @@ -0,0 +1,193 @@ +/** + * Tests notifications dispatched when modifying stored logins. + */ + +let expectedNotification; +let expectedData; + +let TestObserver = { + QueryInterface: ChromeUtils.generateQI([ + "nsIObserver", + "nsISupportsWeakReference", + ]), + + observe(subject, topic, data) { + Assert.equal(topic, "passwordmgr-storage-changed"); + Assert.equal(data, expectedNotification); + + switch (data) { + case "addLogin": + Assert.ok(subject instanceof Ci.nsILoginInfo); + Assert.ok(subject instanceof Ci.nsILoginMetaInfo); + Assert.ok(expectedData.equals(subject)); // nsILoginInfo.equals() + break; + case "modifyLogin": + Assert.ok(subject instanceof Ci.nsIArray); + Assert.equal(subject.length, 2); + let oldLogin = subject.queryElementAt(0, Ci.nsILoginInfo); + let newLogin = subject.queryElementAt(1, Ci.nsILoginInfo); + Assert.ok(expectedData[0].equals(oldLogin)); // nsILoginInfo.equals() + Assert.ok(expectedData[1].equals(newLogin)); + break; + case "removeLogin": + Assert.ok(subject instanceof Ci.nsILoginInfo); + Assert.ok(subject instanceof Ci.nsILoginMetaInfo); + Assert.ok(expectedData.equals(subject)); // nsILoginInfo.equals() + break; + case "removeAllLogins": + Assert.ok(subject instanceof Ci.nsIArray); + break; + case "hostSavingEnabled": + case "hostSavingDisabled": + Assert.ok(subject instanceof Ci.nsISupportsString); + Assert.equal(subject.data, expectedData); + break; + default: + do_throw("Unhandled notification: " + data + " / " + topic); + } + + expectedNotification = null; // ensure a duplicate is flagged as unexpected. + expectedData = null; + }, +}; + +add_task(async function test_notifications() { + let testnum = 0; + let testdesc = "Setup of nsLoginInfo test-users"; + + try { + let testuser1 = new LoginInfo( + "http://testhost1", + "", + null, + "dummydude", + "itsasecret", + "put_user_here", + "put_pw_here" + ); + + let testuser2 = new LoginInfo( + "http://testhost2", + "", + null, + "dummydude2", + "itsasecret2", + "put_user2_here", + "put_pw2_here" + ); + + Services.obs.addObserver(TestObserver, "passwordmgr-storage-changed"); + + /* ========== 1 ========== */ + testnum = 1; + testdesc = "Initial connection to storage module"; + + /* ========== 2 ========== */ + testnum++; + testdesc = "addLogin"; + + expectedNotification = "addLogin"; + expectedData = testuser1; + await Services.logins.addLoginAsync(testuser1); + LoginTestUtils.checkLogins([testuser1]); + Assert.equal(expectedNotification, null); // check that observer got a notification + + /* ========== 3 ========== */ + testnum++; + testdesc = "modifyLogin"; + + expectedNotification = "modifyLogin"; + expectedData = [testuser1, testuser2]; + Services.logins.modifyLogin(testuser1, testuser2); + Assert.equal(expectedNotification, null); + LoginTestUtils.checkLogins([testuser2]); + + /* ========== 4 ========== */ + testnum++; + testdesc = "removeLogin"; + + expectedNotification = "removeLogin"; + expectedData = testuser2; + Services.logins.removeLogin(testuser2); + Assert.equal(expectedNotification, null); + LoginTestUtils.checkLogins([]); + + /* ========== 5 ========== */ + testnum++; + testdesc = "removeAllLogins"; + + expectedNotification = "removeAllLogins"; + expectedData = null; + Services.logins.removeAllLogins(); + Assert.equal(expectedNotification, null); + LoginTestUtils.checkLogins([]); + + /* ========== 6 ========== */ + testnum++; + testdesc = "removeAllLogins (again)"; + + expectedNotification = "addLogin"; + expectedData = testuser1; + await Services.logins.addLoginAsync(testuser1); + + expectedNotification = "removeAllLogins"; + expectedData = null; + Services.logins.removeAllLogins(); + Assert.equal(expectedNotification, null); + LoginTestUtils.checkLogins([]); + + /* ========== 7 ========== */ + testnum++; + testdesc = "setLoginSavingEnabled / false"; + + expectedNotification = "hostSavingDisabled"; + expectedData = "http://site.com"; + Services.logins.setLoginSavingEnabled("http://site.com", false); + Assert.equal(expectedNotification, null); + LoginTestUtils.assertDisabledHostsEqual( + Services.logins.getAllDisabledHosts(), + ["http://site.com"] + ); + + /* ========== 8 ========== */ + testnum++; + testdesc = "setLoginSavingEnabled / false (again)"; + + expectedNotification = "hostSavingDisabled"; + expectedData = "http://site.com"; + Services.logins.setLoginSavingEnabled("http://site.com", false); + Assert.equal(expectedNotification, null); + LoginTestUtils.assertDisabledHostsEqual( + Services.logins.getAllDisabledHosts(), + ["http://site.com"] + ); + + /* ========== 9 ========== */ + testnum++; + testdesc = "setLoginSavingEnabled / true"; + + expectedNotification = "hostSavingEnabled"; + expectedData = "http://site.com"; + Services.logins.setLoginSavingEnabled("http://site.com", true); + Assert.equal(expectedNotification, null); + LoginTestUtils.checkLogins([]); + + /* ========== 10 ========== */ + testnum++; + testdesc = "setLoginSavingEnabled / true (again)"; + + expectedNotification = "hostSavingEnabled"; + expectedData = "http://site.com"; + Services.logins.setLoginSavingEnabled("http://site.com", true); + Assert.equal(expectedNotification, null); + LoginTestUtils.checkLogins([]); + + Services.obs.removeObserver(TestObserver, "passwordmgr-storage-changed"); + + LoginTestUtils.clearData(); + } catch (e) { + throw new Error( + "FAILED in test #" + testnum + " -- " + testdesc + ": " + e + ); + } +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_recipes_add.js b/toolkit/components/passwordmgr/test/unit/test_recipes_add.js new file mode 100644 index 0000000000..253556232e --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_recipes_add.js @@ -0,0 +1,288 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +/** + * Tests adding and retrieving LoginRecipes in the parent process. + */ + +"use strict"; + +add_task(async function test_init() { + let parent = new LoginRecipesParent({ defaults: null }); + let initPromise1 = parent.initializationPromise; + let initPromise2 = parent.initializationPromise; + Assert.strictEqual( + initPromise1, + initPromise2, + "Check that the same promise is returned" + ); + + let recipesParent = await initPromise1; + Assert.ok( + recipesParent instanceof LoginRecipesParent, + "Check init return value" + ); + Assert.strictEqual( + recipesParent._recipesByHost.size, + 0, + "Initially 0 recipes" + ); +}); + +add_task(async function test_get_missing_host() { + let recipesParent = await RecipeHelpers.initNewParent(); + let exampleRecipes = recipesParent.getRecipesForHost("example.invalid"); + Assert.strictEqual( + exampleRecipes.size, + 0, + "Check recipe count for example.invalid" + ); +}); + +add_task(async function test_add_get_simple_host() { + let recipesParent = await RecipeHelpers.initNewParent(); + Assert.strictEqual( + recipesParent._recipesByHost.size, + 0, + "Initially 0 recipes" + ); + recipesParent.add({ + hosts: ["example.com"], + }); + Assert.strictEqual( + recipesParent._recipesByHost.size, + 1, + "Check number of hosts after the addition" + ); + + let exampleRecipes = recipesParent.getRecipesForHost("example.com"); + Assert.strictEqual( + exampleRecipes.size, + 1, + "Check recipe count for example.com" + ); + let recipe = [...exampleRecipes][0]; + Assert.strictEqual(typeof recipe, "object", "Check recipe type"); + Assert.strictEqual(recipe.hosts.length, 1, "Check that one host is present"); + Assert.strictEqual(recipe.hosts[0], "example.com", "Check the one host"); +}); + +add_task(async function test_add_get_non_standard_port_host() { + let recipesParent = await RecipeHelpers.initNewParent(); + recipesParent.add({ + hosts: ["example.com:8080"], + }); + Assert.strictEqual( + recipesParent._recipesByHost.size, + 1, + "Check number of hosts after the addition" + ); + + let exampleRecipes = recipesParent.getRecipesForHost("example.com:8080"); + Assert.strictEqual( + exampleRecipes.size, + 1, + "Check recipe count for example.com:8080" + ); + let recipe = [...exampleRecipes][0]; + Assert.strictEqual(typeof recipe, "object", "Check recipe type"); + Assert.strictEqual(recipe.hosts.length, 1, "Check that one host is present"); + Assert.strictEqual(recipe.hosts[0], "example.com:8080", "Check the one host"); +}); + +add_task(async function test_add_multiple_hosts() { + let recipesParent = await RecipeHelpers.initNewParent(); + recipesParent.add({ + hosts: ["example.com", "foo.invalid"], + }); + Assert.strictEqual( + recipesParent._recipesByHost.size, + 2, + "Check number of hosts after the addition" + ); + + let exampleRecipes = recipesParent.getRecipesForHost("example.com"); + Assert.strictEqual( + exampleRecipes.size, + 1, + "Check recipe count for example.com" + ); + let recipe = [...exampleRecipes][0]; + Assert.strictEqual(typeof recipe, "object", "Check recipe type"); + Assert.strictEqual( + recipe.hosts.length, + 2, + "Check that two hosts are present" + ); + Assert.strictEqual(recipe.hosts[0], "example.com", "Check the first host"); + Assert.strictEqual(recipe.hosts[1], "foo.invalid", "Check the second host"); + + let fooRecipes = recipesParent.getRecipesForHost("foo.invalid"); + Assert.strictEqual(fooRecipes.size, 1, "Check recipe count for foo.invalid"); + let fooRecipe = [...fooRecipes][0]; + Assert.strictEqual(fooRecipe, recipe, "Check that the recipe is shared"); + Assert.strictEqual(typeof fooRecipe, "object", "Check recipe type"); + Assert.strictEqual( + fooRecipe.hosts.length, + 2, + "Check that two hosts are present" + ); + Assert.strictEqual(fooRecipe.hosts[0], "example.com", "Check the first host"); + Assert.strictEqual( + fooRecipe.hosts[1], + "foo.invalid", + "Check the second host" + ); +}); + +add_task(async function test_add_pathRegex() { + let recipesParent = await RecipeHelpers.initNewParent(); + recipesParent.add({ + hosts: ["example.com"], + pathRegex: /^\/mypath\//, + }); + Assert.strictEqual( + recipesParent._recipesByHost.size, + 1, + "Check number of hosts after the addition" + ); + + let exampleRecipes = recipesParent.getRecipesForHost("example.com"); + Assert.strictEqual( + exampleRecipes.size, + 1, + "Check recipe count for example.com" + ); + let recipe = [...exampleRecipes][0]; + Assert.strictEqual(typeof recipe, "object", "Check recipe type"); + Assert.strictEqual(recipe.hosts.length, 1, "Check that one host is present"); + Assert.strictEqual(recipe.hosts[0], "example.com", "Check the one host"); + Assert.strictEqual( + recipe.pathRegex.toString(), + "/^\\/mypath\\//", + "Check the pathRegex" + ); +}); + +add_task(async function test_add_selectors() { + let recipesParent = await RecipeHelpers.initNewParent(); + recipesParent.add({ + hosts: ["example.com"], + usernameSelector: "#my-username", + passwordSelector: "#my-form > input.password", + }); + Assert.strictEqual( + recipesParent._recipesByHost.size, + 1, + "Check number of hosts after the addition" + ); + + let exampleRecipes = recipesParent.getRecipesForHost("example.com"); + Assert.strictEqual( + exampleRecipes.size, + 1, + "Check recipe count for example.com" + ); + let recipe = [...exampleRecipes][0]; + Assert.strictEqual(typeof recipe, "object", "Check recipe type"); + Assert.strictEqual(recipe.hosts.length, 1, "Check that one host is present"); + Assert.strictEqual(recipe.hosts[0], "example.com", "Check the one host"); + Assert.strictEqual( + recipe.usernameSelector, + "#my-username", + "Check the usernameSelector" + ); + Assert.strictEqual( + recipe.passwordSelector, + "#my-form > input.password", + "Check the passwordSelector" + ); +}); + +/* Begin checking errors with add */ + +add_task(async function test_add_missing_prop() { + let recipesParent = await RecipeHelpers.initNewParent(); + Assert.throws( + () => recipesParent.add({}), + /required/, + "Some properties are required" + ); +}); + +add_task(async function test_add_unknown_prop() { + let recipesParent = await RecipeHelpers.initNewParent(); + Assert.throws( + () => + recipesParent.add({ + unknownProp: true, + }), + /supported/, + "Unknown properties should cause an error to help with typos" + ); +}); + +add_task(async function test_add_invalid_hosts() { + let recipesParent = await RecipeHelpers.initNewParent(); + Assert.throws( + () => + recipesParent.add({ + hosts: 404, + }), + /array/, + "hosts should be an array" + ); +}); + +add_task(async function test_add_empty_host_array() { + let recipesParent = await RecipeHelpers.initNewParent(); + Assert.throws( + () => + recipesParent.add({ + hosts: [], + }), + /array/, + "hosts should be a non-empty array" + ); +}); + +add_task(async function test_add_pathRegex_non_regexp() { + let recipesParent = await RecipeHelpers.initNewParent(); + Assert.throws( + () => + recipesParent.add({ + hosts: ["example.com"], + pathRegex: "foo", + }), + /regular expression/, + "pathRegex should be a RegExp" + ); +}); + +add_task(async function test_add_usernameSelector_non_string() { + let recipesParent = await RecipeHelpers.initNewParent(); + Assert.throws( + () => + recipesParent.add({ + hosts: ["example.com"], + usernameSelector: 404, + }), + /string/, + "usernameSelector should be a string" + ); +}); + +add_task(async function test_add_passwordSelector_non_string() { + let recipesParent = await RecipeHelpers.initNewParent(); + Assert.throws( + () => + recipesParent.add({ + hosts: ["example.com"], + passwordSelector: 404, + }), + /string/, + "passwordSelector should be a string" + ); +}); + +/* End checking errors with add */ diff --git a/toolkit/components/passwordmgr/test/unit/test_recipes_content.js b/toolkit/components/passwordmgr/test/unit/test_recipes_content.js new file mode 100644 index 0000000000..673bb50851 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_recipes_content.js @@ -0,0 +1,53 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +/** + * Test filtering recipes in LoginRecipesContent. + */ + +"use strict"; + +add_task(async function test_getFieldOverrides() { + let recipes = new Set([ + { + // path doesn't match but otherwise good + hosts: ["example.com:8080"], + passwordSelector: "#password", + pathRegex: /^\/$/, + usernameSelector: ".username", + }, + { + // match with no field overrides + hosts: ["example.com:8080"], + }, + { + // best match (field selectors + path match) + description: "best match", + hosts: ["a.invalid", "example.com:8080", "other.invalid"], + passwordSelector: "#password", + pathRegex: /^\/first\/second\/$/, + usernameSelector: ".username", + }, + ]); + + let form = MockDocument.createTestDocument( + "http://localhost:8080/first/second/", + "<form>" + ).forms[0]; + let override = LoginRecipesContent.getFieldOverrides(recipes, form); + Assert.strictEqual( + override.description, + "best match", + "Check the best field override recipe was returned" + ); + Assert.strictEqual( + override.usernameSelector, + ".username", + "Check usernameSelector" + ); + Assert.strictEqual( + override.passwordSelector, + "#password", + "Check passwordSelector" + ); +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_remote_recipes.js b/toolkit/components/passwordmgr/test/unit/test_remote_recipes.js new file mode 100644 index 0000000000..7d16e205e9 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_remote_recipes.js @@ -0,0 +1,162 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +/** + * Tests retrieving remote LoginRecipes in the parent process. + * See https://firefox-source-docs.mozilla.org/services/settings/#unit-tests for explanation of db.importChanges({}, Date.now()); + */ + +"use strict"; + +const { RemoteSettings } = ChromeUtils.importESModule( + "resource://services-settings/remote-settings.sys.mjs" +); + +const REMOTE_SETTINGS_COLLECTION = "password-recipes"; + +add_task(async function test_init_remote_recipe() { + const db = RemoteSettings(REMOTE_SETTINGS_COLLECTION).db; + await db.clear(); + const record1 = { + id: "some-fake-ID", + hosts: ["www.testDomain.com"], + description: "Some description here", + usernameSelector: "#username", + }; + await db.importChanges({}, Date.now(), [record1], { clear: true }); + let parent = new LoginRecipesParent({ defaults: true }); + + let recipesParent = await parent.initializationPromise; + Assert.ok( + recipesParent instanceof LoginRecipesParent, + "Check initialization promise value which should be an instance of LoginRecipesParent" + ); + Assert.strictEqual( + recipesParent._recipesByHost.size, + 1, + "Initially 1 recipe based on our test record" + ); + let rsClient = recipesParent._rsClient; + + recipesParent.reset(); + await recipesParent.initializationPromise; + Assert.ok( + recipesParent instanceof LoginRecipesParent, + "Ensure that the instance of LoginRecipesParent has not changed after resetting" + ); + Assert.strictEqual( + rsClient, + recipesParent._rsClient, + "Resetting recipes should not modify the rs client" + ); + Assert.strictEqual( + recipesParent._recipesByHost.size, + 1, + "Initially 1 recipe based on our test record" + ); + await db.clear(); + await db.importChanges({}, 42); +}); + +add_task(async function test_add_recipe_sync() { + const db = RemoteSettings(REMOTE_SETTINGS_COLLECTION).db; + const record1 = { + id: "some-fake-ID", + hosts: ["www.testDomain.com"], + description: "Some description here", + usernameSelector: "#username", + }; + await db.importChanges({}, Date.now(), [record1], { clear: true }); + let parent = new LoginRecipesParent({ defaults: true }); + let recipesParent = await parent.initializationPromise; + + const record2 = { + id: "some-fake-ID-2", + hosts: ["www.testDomain2.com"], + description: "Some description here. Wow it changed!", + usernameSelector: "#username", + }; + const payload = { + current: [record1, record2], + created: [record2], + updated: [], + deleted: [], + }; + await RemoteSettings(REMOTE_SETTINGS_COLLECTION).emit("sync", { + data: payload, + }); + Assert.strictEqual( + recipesParent._recipesByHost.size, + 2, + "New recipe from sync event added successfully" + ); + await db.clear(); + await db.importChanges({}, 42); +}); + +add_task(async function test_remove_recipe_sync() { + const db = RemoteSettings(REMOTE_SETTINGS_COLLECTION).db; + const record1 = { + id: "some-fake-ID", + hosts: ["www.testDomain.com"], + description: "Some description here", + usernameSelector: "#username", + }; + await db.importChanges({}, Date.now(), [record1], { clear: true }); + let parent = new LoginRecipesParent({ defaults: true }); + let recipesParent = await parent.initializationPromise; + + const deletePayload = { + current: [], + created: [], + updated: [], + deleted: [record1], + }; + await RemoteSettings(REMOTE_SETTINGS_COLLECTION).emit("sync", { + data: deletePayload, + }); + Assert.strictEqual( + recipesParent._recipesByHost.size, + 0, + "Recipes successfully deleted on sync event" + ); + await db.clear(); +}); + +add_task(async function test_malformed_recipes_in_db() { + const db = RemoteSettings(REMOTE_SETTINGS_COLLECTION).db; + const malformedRecord = { + id: "some-ID", + hosts: ["www.testDomain.com"], + description: "Some description here", + usernameSelector: "#username", + fieldThatDoesNotExist: "value", + }; + await db.importChanges({}, Date.now(), [malformedRecord], { clear: true }); + let parent = new LoginRecipesParent({ defaults: true }); + try { + await parent.initializationPromise; + } catch (e) { + Assert.ok( + e == "There were 1 recipe error(s)", + "It should throw an error because of field that does not match the schema" + ); + } + + await db.clear(); + const missingHostsRecord = { + id: "some-ID", + description: "Some description here", + usernameSelector: "#username", + }; + await db.importChanges({}, Date.now(), [missingHostsRecord], { clear: true }); + parent = new LoginRecipesParent({ defaults: true }); + try { + await parent.initializationPromise; + } catch (e) { + Assert.ok( + e == "There were 1 recipe error(s)", + "It should throw an error because of missing hosts field" + ); + } +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_search_schemeUpgrades.js b/toolkit/components/passwordmgr/test/unit/test_search_schemeUpgrades.js new file mode 100644 index 0000000000..9428d3f897 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_search_schemeUpgrades.js @@ -0,0 +1,239 @@ +/** + * Test Services.logins.searchLogins with the `schemeUpgrades` property. + */ + +const HTTP3_ORIGIN = "http://www3.example.com"; +const HTTPS_ORIGIN = "https://www.example.com"; +const HTTP_ORIGIN = "http://www.example.com"; + +/** + * Returns a list of new nsILoginInfo objects that are a subset of the test + * data, built to match the specified query. + * + * @param {Object} aQuery + * Each property and value of this object restricts the search to those + * entries from the test data that match the property exactly. + */ +function buildExpectedLogins(aQuery) { + return TestData.loginList().filter(entry => + Object.keys(aQuery).every(name => { + if (name == "schemeUpgrades") { + return true; + } + if (["origin", "formActionOrigin"].includes(name)) { + return LoginHelper.isOriginMatching(entry[name], aQuery[name], { + schemeUpgrades: aQuery.schemeUpgrades, + }); + } + return entry[name] === aQuery[name]; + }) + ); +} + +/** + * Tests the searchLogins function. + * + * @param {Object} aQuery + * Each property and value of this object is translated to an entry in + * the nsIPropertyBag parameter of searchLogins. + * @param {Number} aExpectedCount + * Number of logins from the test data that should be found. The actual + * list of logins is obtained using the buildExpectedLogins helper, and + * this value is just used to verify that modifications to the test data + * don't make the current test meaningless. + */ +function checkSearch(aQuery, aExpectedCount) { + info("Testing searchLogins for " + JSON.stringify(aQuery)); + + let expectedLogins = buildExpectedLogins(aQuery); + Assert.equal(expectedLogins.length, aExpectedCount); + + let logins = Services.logins.searchLogins(newPropertyBag(aQuery)); + LoginTestUtils.assertLoginListsEqual(logins, expectedLogins); +} + +/** + * Prepare data for the following tests. + */ +add_setup(async () => { + await Services.logins.addLogins(TestData.loginList()); +}); + +/** + * Tests searchLogins with the `schemeUpgrades` property + */ +add_task(function test_search_schemeUpgrades_origin() { + // Origin-only + checkSearch( + { + origin: HTTPS_ORIGIN, + }, + 1 + ); + checkSearch( + { + origin: HTTPS_ORIGIN, + schemeUpgrades: false, + }, + 1 + ); + checkSearch( + { + origin: HTTPS_ORIGIN, + schemeUpgrades: undefined, + }, + 1 + ); + checkSearch( + { + origin: HTTPS_ORIGIN, + schemeUpgrades: true, + }, + 2 + ); +}); + +/** + * Same as above but replacing origin with formActionOrigin. + */ +add_task(function test_search_schemeUpgrades_formActionOrigin() { + checkSearch( + { + formActionOrigin: HTTPS_ORIGIN, + }, + 2 + ); + checkSearch( + { + formActionOrigin: HTTPS_ORIGIN, + schemeUpgrades: false, + }, + 2 + ); + checkSearch( + { + formActionOrigin: HTTPS_ORIGIN, + schemeUpgrades: undefined, + }, + 2 + ); + checkSearch( + { + formActionOrigin: HTTPS_ORIGIN, + schemeUpgrades: true, + }, + 4 + ); +}); + +add_task(function test_search_schemeUpgrades_origin_formActionOrigin() { + checkSearch( + { + formActionOrigin: HTTPS_ORIGIN, + origin: HTTPS_ORIGIN, + }, + 1 + ); + checkSearch( + { + formActionOrigin: HTTPS_ORIGIN, + origin: HTTPS_ORIGIN, + schemeUpgrades: false, + }, + 1 + ); + checkSearch( + { + formActionOrigin: HTTPS_ORIGIN, + origin: HTTPS_ORIGIN, + schemeUpgrades: undefined, + }, + 1 + ); + checkSearch( + { + formActionOrigin: HTTPS_ORIGIN, + origin: HTTPS_ORIGIN, + schemeUpgrades: true, + }, + 2 + ); + checkSearch( + { + formActionOrigin: HTTPS_ORIGIN, + origin: HTTPS_ORIGIN, + schemeUpgrades: true, + usernameField: "form_field_username", + }, + 2 + ); + checkSearch( + { + formActionOrigin: HTTPS_ORIGIN, + origin: HTTPS_ORIGIN, + passwordField: "form_field_password", + schemeUpgrades: true, + usernameField: "form_field_username", + }, + 2 + ); + checkSearch( + { + formActionOrigin: HTTPS_ORIGIN, + origin: HTTPS_ORIGIN, + httpRealm: null, + passwordField: "form_field_password", + schemeUpgrades: true, + usernameField: "form_field_username", + }, + 2 + ); +}); + +/** + * HTTP submitting to HTTPS + */ +add_task(function test_http_to_https() { + checkSearch( + { + formActionOrigin: HTTPS_ORIGIN, + origin: HTTP3_ORIGIN, + httpRealm: null, + schemeUpgrades: false, + }, + 1 + ); + checkSearch( + { + formActionOrigin: HTTPS_ORIGIN, + origin: HTTP3_ORIGIN, + httpRealm: null, + schemeUpgrades: true, + }, + 2 + ); +}); + +/** + * schemeUpgrades shouldn't cause downgrades + */ +add_task(function test_search_schemeUpgrades_downgrade() { + checkSearch( + { + formActionOrigin: HTTP_ORIGIN, + origin: HTTP_ORIGIN, + }, + 1 + ); + info( + "The same number should be found with schemeUpgrades since we're searching for HTTP" + ); + checkSearch( + { + formActionOrigin: HTTP_ORIGIN, + origin: HTTP_ORIGIN, + schemeUpgrades: true, + }, + 1 + ); +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_shadowHTTPLogins.js b/toolkit/components/passwordmgr/test/unit/test_shadowHTTPLogins.js new file mode 100644 index 0000000000..86a9a08ac3 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_shadowHTTPLogins.js @@ -0,0 +1,82 @@ +/** + * Test LoginHelper.shadowHTTPLogins + */ + +"use strict"; + +const DOMAIN1_HTTP_TO_HTTP_U1_P1 = TestData.formLogin({}); +const DOMAIN1_HTTP_TO_HTTP_U2_P1 = TestData.formLogin({ + username: "user2", +}); +const DOMAIN1_HTTPS_TO_HTTPS_U1_P1 = TestData.formLogin({ + origin: "https://www3.example.com", + formActionOrigin: "https://login.example.com", +}); +const DOMAIN1_HTTPS_TO_HTTPS_U1_P2 = TestData.formLogin({ + origin: "https://www3.example.com", + formActionOrigin: "https://login.example.com", + password: "password two", +}); +const DOMAIN1_HTTP_TO_HTTP_U1_P2 = TestData.formLogin({ + password: "password two", +}); +const DOMAIN1_HTTP_TO_HTTP_U1_P1_DIFFERENT_PORT = TestData.formLogin({ + origin: "http://www3.example.com:8080", +}); +const DOMAIN2_HTTP_TO_HTTP_U1_P1 = TestData.formLogin({ + origin: "http://different.example.com", +}); + +add_task(function test_shadowHTTPLogins() { + let testcases = [ + { + description: "same hostPort, same username, different scheme", + logins: [DOMAIN1_HTTPS_TO_HTTPS_U1_P1, DOMAIN1_HTTP_TO_HTTP_U1_P1], + expected: [DOMAIN1_HTTPS_TO_HTTPS_U1_P1], + }, + { + description: "different passwords, different scheme", + logins: [DOMAIN1_HTTPS_TO_HTTPS_U1_P1, DOMAIN1_HTTP_TO_HTTP_U1_P2], + expected: [DOMAIN1_HTTPS_TO_HTTPS_U1_P1], + }, + { + description: "both https, same username, different password", + logins: [DOMAIN1_HTTPS_TO_HTTPS_U1_P1, DOMAIN1_HTTPS_TO_HTTPS_U1_P2], + expected: [DOMAIN1_HTTPS_TO_HTTPS_U1_P1, DOMAIN1_HTTPS_TO_HTTPS_U1_P2], + }, + { + description: "same origin, different port, different scheme", + logins: [ + DOMAIN1_HTTPS_TO_HTTPS_U1_P1, + DOMAIN1_HTTP_TO_HTTP_U1_P1_DIFFERENT_PORT, + ], + expected: [ + DOMAIN1_HTTPS_TO_HTTPS_U1_P1, + DOMAIN1_HTTP_TO_HTTP_U1_P1_DIFFERENT_PORT, + ], + }, + { + description: "different origin, different scheme", + logins: [DOMAIN1_HTTPS_TO_HTTPS_U1_P1, DOMAIN2_HTTP_TO_HTTP_U1_P1], + expected: [DOMAIN1_HTTPS_TO_HTTPS_U1_P1, DOMAIN2_HTTP_TO_HTTP_U1_P1], + }, + { + description: "different username, different scheme", + logins: [DOMAIN1_HTTPS_TO_HTTPS_U1_P1, DOMAIN1_HTTP_TO_HTTP_U2_P1], + expected: [DOMAIN1_HTTPS_TO_HTTPS_U1_P1, DOMAIN1_HTTP_TO_HTTP_U2_P1], + }, + ]; + + for (let tc of testcases) { + info(tc.description); + let actual = LoginHelper.shadowHTTPLogins(tc.logins); + Assert.strictEqual( + actual.length, + tc.expected.length, + `Check result length` + ); + for (let [i, login] of tc.expected.entries()) { + Assert.strictEqual(actual[i], login, `Check index ${i}`); + } + } +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_storage.js b/toolkit/components/passwordmgr/test/unit/test_storage.js new file mode 100644 index 0000000000..97c54586f1 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_storage.js @@ -0,0 +1,93 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +/** + * Tests that the default nsILoginManagerStorage module attached to the Login + * Manager service is able to save and reload nsILoginInfo properties correctly, + * even when they include special characters. + */ + +"use strict"; + +// Globals + +async function reloadAndCheckLoginsGen(aExpectedLogins) { + await LoginTestUtils.reloadData(); + LoginTestUtils.checkLogins(aExpectedLogins); + LoginTestUtils.clearData(); +} + +// Tests + +/** + * Tests addLogin with valid non-ASCII characters. + */ +add_task(async function test_storage_addLogin_nonascii() { + let origin = "http://" + String.fromCharCode(355) + ".example.com"; + + // Store the strings "user" and "pass" using similarly looking glyphs. + let loginInfo = TestData.formLogin({ + origin, + formActionOrigin: origin, + username: String.fromCharCode(533, 537, 7570, 345), + password: String.fromCharCode(421, 259, 349, 537), + usernameField: "field_" + String.fromCharCode(533, 537, 7570, 345), + passwordField: "field_" + String.fromCharCode(421, 259, 349, 537), + }); + await Services.logins.addLoginAsync(loginInfo); + await reloadAndCheckLoginsGen([loginInfo]); + + // Store the string "test" using similarly looking glyphs. + loginInfo = TestData.authLogin({ + httpRealm: String.fromCharCode(355, 277, 349, 357), + }); + await Services.logins.addLoginAsync(loginInfo); + await reloadAndCheckLoginsGen([loginInfo]); +}); + +/** + * Tests addLogin with newline characters in the username and password. + */ +add_task(async function test_storage_addLogin_newlines() { + let loginInfo = TestData.formLogin({ + username: "user\r\nname", + password: "password\r\n", + }); + await Services.logins.addLoginAsync(loginInfo); + await reloadAndCheckLoginsGen([loginInfo]); +}); + +/** + * Tests addLogin with a single dot in fields where it is allowed. + * + * These tests exist to verify the legacy "signons.txt" storage format. + */ +add_task(async function test_storage_addLogin_dot() { + let loginInfo = TestData.formLogin({ origin: ".", passwordField: "." }); + await Services.logins.addLoginAsync(loginInfo); + await reloadAndCheckLoginsGen([loginInfo]); + + loginInfo = TestData.authLogin({ httpRealm: "." }); + await Services.logins.addLoginAsync(loginInfo); + await reloadAndCheckLoginsGen([loginInfo]); +}); + +/** + * Tests addLogin with parentheses in origins. + * + * These tests exist to verify the legacy "signons.txt" storage format. + */ +add_task(async function test_storage_addLogin_parentheses() { + let loginList = [ + TestData.authLogin({ httpRealm: "(realm" }), + TestData.authLogin({ httpRealm: "realm)" }), + TestData.authLogin({ httpRealm: "(realm)" }), + TestData.authLogin({ httpRealm: ")realm(" }), + TestData.authLogin({ origin: "http://parens(.example.com" }), + TestData.authLogin({ origin: "http://parens).example.com" }), + TestData.authLogin({ origin: "http://parens(example).example.com" }), + TestData.authLogin({ origin: "http://parens)example(.example.com" }), + ]; + await Services.logins.addLogins(loginList); + await reloadAndCheckLoginsGen(loginList); +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_telemetry.js b/toolkit/components/passwordmgr/test/unit/test_telemetry.js new file mode 100644 index 0000000000..56fe6233d9 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_telemetry.js @@ -0,0 +1,201 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +/** + * Tests the statistics and other counters reported through telemetry. + */ + +"use strict"; + +// Globals + +const { TestUtils } = ChromeUtils.importESModule( + "resource://testing-common/TestUtils.sys.mjs" +); + +const MS_PER_DAY = 24 * 60 * 60 * 1000; + +// To prevent intermittent failures when the test is executed at a time that is +// very close to a day boundary, we make it deterministic by using a static +// reference date for all the time-based statistics. +const gReferenceTimeMs = new Date("2000-01-01T00:00:00").getTime(); + +// Returns a milliseconds value to use with nsILoginMetaInfo properties, falling +// approximately in the middle of the specified number of days before the +// reference time, where zero days indicates a time within the past 24 hours. +const daysBeforeMs = days => gReferenceTimeMs - (days + 0.5) * MS_PER_DAY; + +/** + * Contains metadata that will be attached to test logins in order to verify + * that the statistics collection is working properly. Most properties of the + * logins are initialized to the default test values already. + * + * If you update this data or any of the telemetry histograms it checks, you'll + * probably need to update the expected statistics in the test below. + */ +const StatisticsTestData = [ + { + timeLastUsed: daysBeforeMs(0), + }, + { + timeLastUsed: daysBeforeMs(1), + }, + { + timeLastUsed: daysBeforeMs(7), + formActionOrigin: null, + httpRealm: "The HTTP Realm", + }, + { + username: "", + timeLastUsed: daysBeforeMs(7), + }, + { + username: "", + timeLastUsed: daysBeforeMs(30), + }, + { + username: "", + timeLastUsed: daysBeforeMs(31), + }, + { + timeLastUsed: daysBeforeMs(365), + }, + { + username: "", + timeLastUsed: daysBeforeMs(366), + }, + { + // If the login was saved in the future, it is ignored for statistiscs. + timeLastUsed: daysBeforeMs(-1), + }, + { + timeLastUsed: daysBeforeMs(1000), + }, +]; + +/** + * Triggers the collection of those statistics that are not accumulated each + * time an action is taken, but are a static snapshot of the current state. + */ +async function triggerStatisticsCollection() { + Services.obs.notifyObservers(null, "gather-telemetry", "" + gReferenceTimeMs); + await TestUtils.topicObserved("passwordmgr-gather-telemetry-complete"); +} + +/** + * Tests the telemetry histogram with the given ID contains only the specified + * non-zero ranges, expressed in the format { range1: value1, range2: value2 }. + */ +function testHistogram(histogramId, expectedNonZeroRanges) { + let snapshot = Services.telemetry.getHistogramById(histogramId).snapshot(); + + // Compute the actual ranges in the format { range1: value1, range2: value2 }. + let actualNonZeroRanges = {}; + for (let [range, value] of Object.entries(snapshot.values)) { + if (value > 0) { + actualNonZeroRanges[range] = value; + } + } + + // These are stringified to visualize the differences between the values. + info("Testing histogram: " + histogramId); + Assert.equal( + JSON.stringify(actualNonZeroRanges), + JSON.stringify(expectedNonZeroRanges) + ); +} + +// Tests + +/** + * Enable local telemetry recording for the duration of the tests, and prepare + * the test data that will be used by the following tests. + */ +add_setup(async () => { + let oldCanRecord = Services.telemetry.canRecordExtended; + Services.telemetry.canRecordExtended = true; + registerCleanupFunction(function () { + Services.telemetry.canRecordExtended = oldCanRecord; + }); + + let uniqueNumber = 1; + let logins = []; + for (let loginModifications of StatisticsTestData) { + loginModifications.origin = `http://${uniqueNumber++}.example.com`; + if (typeof loginModifications.httpRealm != "undefined") { + logins.push(TestData.authLogin(loginModifications)); + } else { + logins.push(TestData.formLogin(loginModifications)); + } + } + await Services.logins.addLogins(logins); +}); + +/** + * Tests the collection of statistics related to login metadata. + */ +add_task(async function test_logins_statistics() { + // Repeat the operation twice to test that histograms are not accumulated. + for (let pass of [1, 2]) { + info(`pass ${pass}`); + await triggerStatisticsCollection(); + + // Should record 1 in the bucket corresponding to the number of passwords. + testHistogram("PWMGR_NUM_SAVED_PASSWORDS", { 10: 1 }); + + // Should record 1 in the bucket corresponding to the number of passwords. + testHistogram("PWMGR_NUM_HTTPAUTH_PASSWORDS", { 1: 1 }); + + // For each saved login, should record 1 in the bucket corresponding to the + // age in days since the login was last used. + testHistogram("PWMGR_LOGIN_LAST_USED_DAYS", { + 0: 1, + 1: 1, + 7: 2, + 29: 2, + 356: 2, + 750: 1, + }); + + // Should record the number of logins without a username in bucket 0, and + // the number of logins with a username in bucket 1. + testHistogram("PWMGR_USERNAME_PRESENT", { 0: 4, 1: 6 }); + } +}); + +/** + * Tests the collection of statistics related to hosts for which passowrd saving + * has been explicitly disabled. + */ +add_task(async function test_disabledHosts_statistics() { + // Should record 1 in the bucket corresponding to the number of sites for + // which password saving is disabled. + Services.logins.setLoginSavingEnabled("http://www.example.com", false); + await triggerStatisticsCollection(); + testHistogram("PWMGR_BLOCKLIST_NUM_SITES", { 1: 1 }); + + Services.logins.setLoginSavingEnabled("http://www.example.com", true); + await triggerStatisticsCollection(); + testHistogram("PWMGR_BLOCKLIST_NUM_SITES", { 0: 1 }); +}); + +/** + * Tests the collection of statistics related to general settings. + */ +add_task(async function test_settings_statistics() { + let oldRememberSignons = Services.prefs.getBoolPref("signon.rememberSignons"); + registerCleanupFunction(function () { + Services.prefs.setBoolPref("signon.rememberSignons", oldRememberSignons); + }); + + // Repeat the operation twice per value to test that histograms are reset. + for (let remember of [false, true, false, true]) { + // This change should be observed immediately by the login service. + Services.prefs.setBoolPref("signon.rememberSignons", remember); + + await triggerStatisticsCollection(); + + // Should record 1 in either bucket 0 or bucket 1 based on the preference. + testHistogram("PWMGR_SAVING_ENABLED", remember ? { 1: 1 } : { 0: 1 }); + } +}); diff --git a/toolkit/components/passwordmgr/test/unit/test_vulnerable_passwords.js b/toolkit/components/passwordmgr/test/unit/test_vulnerable_passwords.js new file mode 100644 index 0000000000..b3250b9676 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/test_vulnerable_passwords.js @@ -0,0 +1,47 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +"use strict"; + +add_setup(async () => { + await Services.logins.initializationPromise; +}); + +add_task(async function test_vulnerable_password_methods() { + const storageJSON = Services.logins.wrappedJSObject._storage.wrappedJSObject; + + const logins = TestData.loginList(); + Assert.greater(logins.length, 0, "Initial logins length should be > 0."); + + for (const loginInfo of logins) { + await Services.logins.addLoginAsync(loginInfo); + Assert.ok( + !storageJSON.isPotentiallyVulnerablePassword(loginInfo), + "No logins should be vulnerable until addVulnerablePasswords is called." + ); + } + + const vulnerableLogin = logins.shift(); + storageJSON.addPotentiallyVulnerablePassword(vulnerableLogin); + + Assert.ok( + storageJSON.isPotentiallyVulnerablePassword(vulnerableLogin), + "Login should be vulnerable after calling addVulnerablePassword." + ); + for (const loginInfo of logins) { + Assert.ok( + !storageJSON.isPotentiallyVulnerablePassword(loginInfo), + "No other logins should be vulnerable when addVulnerablePassword is called" + + " with a single argument" + ); + } + + storageJSON.clearAllPotentiallyVulnerablePasswords(); + + for (const loginInfo of logins) { + Assert.ok( + !storageJSON.isPotentiallyVulnerablePassword(loginInfo), + "No logins should be vulnerable when clearAllPotentiallyVulnerablePasswords is called." + ); + } +}); diff --git a/toolkit/components/passwordmgr/test/unit/xpcshell.ini b/toolkit/components/passwordmgr/test/unit/xpcshell.ini new file mode 100644 index 0000000000..e576855b85 --- /dev/null +++ b/toolkit/components/passwordmgr/test/unit/xpcshell.ini @@ -0,0 +1,74 @@ +[DEFAULT] +head = head.js +skip-if = + os == "android" || toolkit == "android" # Not supported on GV because we can't add/remove from storage. +support-files = data/** + +# Test logins.json file access, not applicable to Android. +[test_module_LoginStore.js] +skip-if = os == "android" +[test_loginsBackup.js] +skip-if = os == "android" + +# The following tests apply to any storage back-end that supports add/modify/remove. +[test_context_menu.js] +skip-if = os == "android" # The context menu isn't used on Android. +# LoginManagerContextMenu is only included for MOZ_BUILD_APP == 'browser'. +run-if = buildapp == "browser" +[test_dedupeLogins.js] +[test_disabled_hosts.js] +[test_displayOrigin.js] +[test_doLoginsMatch.js] +[test_findRelatedRealms.js] +[test_getFormFields.js] +[test_getPasswordFields.js] +[test_getPasswordOrigin.js] +[test_getUserNameAndPasswordFields.js] +[test_getUsernameFieldFromUsernameOnlyForm.js] +[test_isInferredLoginForm.js] +[test_isInferredUsernameField.js] +[test_isOriginMatching.js] +[test_isProbablyANewPasswordField.js] +[test_isUsernameFieldType.js] +[test_legacy_empty_formActionOrigin.js] +[test_LoginManagerParent_doAutocompleteSearch.js] +skip-if = os == "android" # Password generation not packaged/used on Android +[test_LoginManagerParent_getGeneratedPassword.js] +skip-if = os == "android" # Password generation not packaged/used on Android +[test_LoginManagerParent_onPasswordEditedOrGenerated.js] +skip-if = os == "android" # Password generation not packaged/used on Android +[test_LoginManagerParent_searchAndDedupeLogins.js] +skip-if = os == "android" # schemeUpgrades aren't supported +[test_LoginManagerPrompter_getUsernameSuggestions.js] +skip-if = os == "android" # Tests desktop's prompter +[test_legacy_validation.js] +[test_login_autocomplete_result.js] +skip-if = os == "android" +[test_logins_change.js] +[test_logins_decrypt_failure.js] +skip-if = os == "android" # Bug 1171687: Needs fixing on Android +[test_logins_metainfo.js] +[test_logins_search.js] +[test_maybeImportLogin.js] +skip-if = os == "android" # Only used by migrator, which isn't on Android +[test_module_LoginCSVImport.js] +[test_CSVParser.js] +[test_module_LoginExport.js] +skip-if = os == "android" # there is no export for android +[test_module_LoginManager.js] +[test_notifications.js] +[test_OSCrypto_win.js] +skip-if = os != "win" +[test_PasswordGenerator.js] +skip-if = os == "android" # Not packaged/used on Android +[test_PasswordRulesManager_generatePassword.js] +[test_recipes_add.js] +[test_recipes_content.js] +[test_remote_recipes.js] +skip-if = os == "android" +[test_search_schemeUpgrades.js] +[test_shadowHTTPLogins.js] +[test_storage.js] +[test_telemetry.js] +[test_vulnerable_passwords.js] +skip-if = os == "android" # Not implemented for storage-mozStorage |