Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Text exceeding maxlength will no longer be truncated when pasted in Firefox 77

fxsitecompat.dev

Post reply on HN
Print view View original

31–40 of 145 posts

Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77

#31

Post by jeroenhd »

renewiltord wrote: post #24
Someone1234 wrote: post #13

Earlier quoted context omitted.

And a lot of sites don't. "This breaks a ton of things but not everything" isn't a good attitude to browser compatibility, particularly from a browser that already has a small market share. > No putting them in a form also breaks accessibility Nope. Screen readers have no concept of fields, nor any concept of how the piping works below the surface when a is pressed. I run a screen reader every single day.

Am I missing something? This seems less surprising than the alternative.

One breaks the expectations of users, the other breaks the expectations of developers. On a website full of developers you'll probably see a lot more from one side than from the other.

Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77

#32

Post by Someone1234 »

jeroenhd wrote: post #31
renewiltord wrote: post #24

Earlier quoted context omitted.

Am I missing something? This seems less surprising than the alternative.

One breaks the expectations of users, the other breaks the expectations of developers. On a website full of developers you'll probably see a lot more from one side than from the other.

I'm pretty sure being able to input text longer than the maximum allowable text into a field breaks user's expectations too. Users don't "win" because you made how a site works more confusing.

Their justification for this change is the only user-win (password truncation), and they could have trivially restricted this to passwords then body is hurt.

Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77

#33

Post by Wowfunhappy »

lucb1e wrote: post #25
Someone1234 wrote: post #22

Earlier quoted context omitted.

That's their justification, not a restriction on the change, this impacts non-password fields too.

Yeah that's the weird thing. They write "for password fields" and then apply it to non-password fields and even multi-line fields. Have you ever seen a multi-line password field?! I understand that people might abuse for it but that's definitely not the common thing and just crazy talk. It's an excuse but I don't understand the reason behind this change. I've been setting maxlength to generous values on my fields in…

I imagine the goal is to make behavior consistent instead of adding weird exceptions.

Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77

#34

Post by [deleted] »

jagged-chisel wrote: post #4
turnipla wrote: post #3

This breaks my use case function shorten(text, length) const t = document.createElement('input') t.maxlength = length t.value = text return t.value }

Indeed. I'd suggest a change in this code even if this change in FF hadn't arrived.

[deleted]

Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77

#36

Post by jeroenhd »

From the WHATWG/W3C definitions of the maxlength attribute:

> Constraint validation: If an element has a maximum allowed value length, its dirty value flag is true, its value was last changed by a user edit (as opposed to a change made by a script), and the code-unit length of the element’s value is greater than the element’s maximum allowed value length, then the element is suffering from being too long. > User agents may prevent the user from causing the element’s value to be set to a value whose code-unit length is greater than the element’s maximum allowed value length.

The key word, I think, is "may" in that user agents do not seem to be obligated to truncate text from what I can find in the standard.

While this does break the expectations from a developer point of view, I think it is perfectly in line with what users expect when they paste text. I think text falling off at the end after a paste with no explanation is more confusing than an the field glowing red with a message "you can only enter X characters here".

The old behaviour famously made people lose access to their PayPal account where the login form had a different maxlength as the registration form and where the password manager had put in a nice, long password. Preventing this sounds like a fine change for me, despite the compatibility break.

Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77

#37

Post by masklinn »

arkadiyt wrote: post #20
nikanj wrote: post #15

Why would you have a maxlength on password in the first place?!

It's common in practice even if it shouldn't be. Also many bcrypt implementations truncate input longer than 72 characters.

> It's common in practice even if it shouldn't be.

It should be though, the backend should reject overlong passwords, and the frontend should have such limits as well.

Though by "overlong" I mean kbyte range, not 32 character. The point of the limitation is to avoid randos feeding megabytes of data into your KDF and DOSing your server.

> Also many bcrypt implementations truncate input longer than 72 characters.

The alternative would be to error as bcrypt works on 18 words (of 32 bits). You need special handling (pre-hashing with a non-broken cryptographic hash function) to fix this issue.

Also it's 72 bytes not characters. And your pre-hash needs to generate some sort of textual representation (hex, base64, base85, …), as bcrypt will also truncate at the first NUL byte.

The original paper actually specifies 56 bytes.

Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77

#38

Post by lonelappde »

Someone1234 wrote: post #10

> The form cannot be submitted until the user fixes the error, so the server shouldn’t receive an excessively long text or password (a server-side validation has to be put in place anyway.) However, this could potentially affect a front-end implementation if it expects the entered text never to exceed maxlength. What century are Mozilla living in? Most, even simple forms, don't use elements and submit buttons anymore…

https://html.spec.whatwg.org/multipage/forms.html#client-sid...

Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77

#40

Post by _0w8t »

seanmcdirmid wrote: post #23
1f60c wrote: post #14

Earlier quoted context omitted.

I think GP was joking. A far more straightforward way to shorten text to a given length is: const shorten = (text, length) => text.substring(0, length);

Probably way more efficient than relying on a side effect to a DOM update as well.

But it is the Web. Somebody must be using it.
Post reply on HN