131–140 of 173 posts
Earlier quoted context omitted.
I believe using `defaultValue` instead of `value` would be an appropriate remediation.
Do you mind expanding on this a little? Or linking to a documentation or something
https://reactjs.org/docs/uncontrolled-components.html#defaul...
Hmm, that's pretty bad. CSS probably shouldn't be able to read password inputs. Edit: This doesn't seem to work for me in Chrome 63.0.3239.132 Edit 2: OK, so it appears that this will only work on a password input that updates its "value" attribute with the typed in value. This doesn't happen unless there is JavaScript that updates the value attr with the input.value
I think it would work against password managers like LastPass which fill in passwords using JS.
Earlier quoted context omitted.
React doesn't work that way. It's a convention which I persoally have always found questionable.
It's more than a convention. It's presented as the default way to do it in the official docs. https://reactjs.org/docs/forms.html#controlled-components
For simple username/password entry I see no reason to use a controlled component.
Hmm, that's pretty bad. CSS probably shouldn't be able to read password inputs. Edit: This doesn't seem to work for me in Chrome 63.0.3239.132 Edit 2: OK, so it appears that this will only work on a password input that updates its "value" attribute with the typed in value. This doesn't happen unless there is JavaScript that updates the value attr with the input.value
One more reason to hate javascript as used and abused by modern "webdevs" and block it all unless absolutely necessary. I try very hard to keep my pages pure css and html.
Earlier quoted context omitted.
So with frameworks like React/Vue, every change to a field generates a request? Or are those handled locally in the shadow dom?
The pattern is to handle form fields locally in the browser as part of the application state. Basically, the value of the input is tied to a "state engine" that acts as a single source of truth and when the user types in the input you'll update the state so that the rest of the application can know what's going on in the form without accessing the DOM. The state engine is a fancy word for a variable that has a specia…
Earlier quoted context omitted.
> The Instagram password field mentioned in the readme.md DOES work this way due to some custom javascript, for reasons that escape me Instagram is a React app and React works that way.
React doesn't work that way. It's a convention which I persoally have always found questionable.
Earlier quoted context omitted.
It's more than a convention. It's presented as the default way to do it in the official docs. https://reactjs.org/docs/forms.html#controlled-components
Could use an uncontrolled component, which I don't think is vulnerable? https://reactjs.org/docs/uncontrolled-components.html For simple username/password entry I see no reason to use a controlled component.
In general, though, there are solid reasons to use this pattern in React. With uncontrolled components, you won’t be able to use React to do form validation or AJAX form submission. You would need to bypass the React virtual DOM and attach listeners on the actual DOM elements.
Hmm, that's pretty bad. CSS probably shouldn't be able to read password inputs. Edit: This doesn't seem to work for me in Chrome 63.0.3239.132 Edit 2: OK, so it appears that this will only work on a password input that updates its "value" attribute with the typed in value. This doesn't happen unless there is JavaScript that updates the value attr with the input.value
One more reason to hate javascript as used and abused by modern "webdevs" and block it all unless absolutely necessary. I try very hard to keep my pages pure css and html.
That's cool, but you obviously have different requirements for the pages you build, and likely aren't in the SPA space, so your better-than-thou outlook doesn't apply.
Earlier quoted context omitted.
The input has to have the "value" set in the HTML. https://jsfiddle.net/tdwsw6zo/4/
Well, yes of course but that's simply an attribute selector parsing the raw HTML. This can be done with any attribute: input[type="password"][hackernews$="isthebestwebsite"] { background-image: url(" http://placehold.it/15x15?text=h4x0r "); } That's not a keylogger at all, the data is already printed in the HTML source.
Most people in the comments don't seem to understand how this works.
i.e. you don't need to have rules for all possible passwords, just one for each character.