Hide password form fields by default by daniel-beck · Pull Request #3991 · jenkinsci/jenkins

daniel-beck · 2019-04-18T23:30:49Z

The goal here is twofold:

To prevent password auto-fill
To reduce the times browsers will offer to save (unrelated) passwords that are part of form submissions.

Example: Proxy Configuration

When the field value is empty to begin with, show a text field to prevent auto-fill.

When the user enters a value, the field type is switched to password to mask it.

When a value is already filled in, show just a placeholder:

Clicking the button will revert to how it looks in the second screen shot (different from f:multilineSecret which has some extra UI around the text area that appears).

Example: Parameterized Build

All concealed by default

Changing one password

Proposed changelog entries

Redesign password fields to prevent password auto-fill (undesirable except for the login form) and reduce the instances of browsers offering to update stored passwords. This change can be reverted any time by setting the system property hudson.Functions.hidingPasswordFields to false.

Submitter checklist

[n/a] JIRA issue is well described
Changelog entry appropriate for the audience affected by the change (users or developer, depending on the change). Examples
* Use the Internal: prefix if the change has no user-visible impact (API, test frameworks, etc.)
Appropriate autotests or explanation to why this change has no tests
[n/a] For dependency updates: links to external changelogs and, if possible, full diffs

daniel-beck · 2019-04-18T23:33:45Z

I want a CI build so I cannot keep this in draft 😭

daniel-beck · 2019-04-19T14:28:41Z

the problem that browsers will autofill forms with username and password fields if they're empty

Even adding a password field long after the page is loaded (e.g. getting rid of the choose/when in the view) will autofill saved credentials in Firefox. 😭

daniel-beck · 2019-04-19T15:14:26Z

Right now I have something that appears to not crash & burn while preventing autofill or offers to save or update credentials in most cases.

Assuming of course, that Javascript is enabled.

How do we ensure this doesn't introduce worse problems than the one this is attempting to fix?

jvz · 2019-04-19T15:29:49Z

+                 ATTRIBUTES="${attrs}" EXCEPT="field clazz value" />
+        <div class="hidden-password-placeholder">
+          <div class="hidden-password-legend">
+            <svg width="20px" height="25px" viewBox="0 0 25 32" version="1.1" xmlns="http://www.w3.org/2000/svg">


Come to think of it, I think we don't need to inline this svg anymore. It was inlined in the standalone library because there was no good way to reference a static asset from a jar. This could be moved to a more appropriate location in jenkins to be a reusable static asset.

zbynek · 2019-04-19T18:30:43Z

@daniel-beck to disable autocomplete in Chrome you can just add autocomplete="new-password" to the input element. Hopefully this will get implemnted in FF in the future, given that it's mentioned in MDN

EDIT: it is also working in Firefox Beta, see https://bugzilla.mozilla.org/show_bug.cgi?id=1119063

daniel-beck · 2019-04-19T21:03:36Z

@zbynek I saw that on MDN, tried it, and failed. Thanks for linking the Firefox bug. Once that works and is reasonably widely supported (is Firefox ESR still around?) we can always change how we prevent autofill, but would rather not hold this change to wait for that (assuming it works otherwise).

josephbrueggen · 2019-05-07T16:10:58Z

@daniel-beck in the final screenshot (Changing one password) does selecting 'Build' beneath the form save the new password?

daniel-beck · 2019-05-07T16:46:03Z

@josephbrueggen No. It's just valid for the current build you're starting, behavior in general in unchanged from before.

josephbrueggen · 2019-05-07T17:04:43Z

@daniel-beck understood, thanks. This looks good to me.

Wadeck

Tested with Chrome 74.0.3729.131, FireFox 66.0.3 (and 66.0.5), IE 11.706.17134.0, Edge 42.17134.1.0 under Windows 10.
Feature tested:

writing directly,
copy-pasting
drag&dropping text

Every feature works as expected with all browsers.

My only concern was about the design, as in the multiline secret, the button is encapsulated in the border, with larger padding. But as Joe approved it, that's fine.

👍 for the proposal, but require to have tests to be approved :)

…at first Something like onfocus didn't work, you'd tab through form elements and unless you filled in the user name, changing the form field to password would cause it to autocomplete. It looks like, at least in Mac/Firefox, going from plain text to password in the 'oninput' event handler works. The plain text is revealed neither with typing nor pasting.

Co-Authored-By: daniel-beck <daniel-beck@users.noreply.github.com>

daniel-beck · 2019-10-08T21:02:34Z

Anyone brave enough to write a noscript compatible variant of this the empty password field? I.e. only show it as a text field with the event handler if JavaScript is enabled? Perhaps @Wadeck has an idea how to do that?

Wadeck · 2019-10-09T12:56:28Z

No-JavaScript proposal in #4280.

daniel-beck · 2019-10-09T23:58:36Z

Given how broken the Jenkins UI is without JavaScript, we don't need to specifically take additional care of that.

daniel-beck · 2019-10-10T12:30:01Z

I do not want this to be merged in the same weekly as #4239.

daniel-beck · 2019-10-18T13:48:16Z

Manually tested that form field validation continues to work, and it will show on the "concealed" field when the page is loaded.

oleg-nenashev

Looks fine from the code standpoint, did not test manually.
I plan to merge it tomorrow if no negative feedback

oleg-nenashev · 2019-11-11T11:25:56Z

Ugh, I missed it during the reviews, because it was on the third page. Will go ahead and merge it

oleg-nenashev · 2019-11-11T11:27:46Z

@daniel-beck Just in case, did you have a chance to run ATH against it? The change is unlikely covered by smoke tests

oleg-nenashev

This change is likely to cause regressions in ATH. CC @olivergondza . I still think it worth merging even if we get a number of extra regressions there. I plan to merge it on Friday if no negative feedback

olivergondza

Agreed, if this is to improve things, we can handle som ATH breakage. We are looking for contributors, btw :P

oleg-nenashev · 2019-11-13T09:22:55Z

Maybe it should be a major RFE

msmitty12 · 2019-11-26T19:31:59Z

How long would this change be expected to take before making it into an LTS release? We've had a lot of issues with a user's browser auto-filling forms in the Jenkins System Configuration without their knowledge and it seems like this change would address that.

MarkEWaite · 2019-11-26T20:50:08Z

It was first included in Jenkins 2.205. Jenkins 2.204 was selected as the basis for the next long term support release. Jenkins 2.204.1 will be released in January and will be the long term support base for 3 months.

An LTS release including this capability will most likely be available in April 2020.

oleg-nenashev · 2019-11-26T21:09:01Z

ETA for the new LTS baseline is Mar 2020, but indeed it will take a while before it lands in LTS

…

On Tue, Nov 26, 2019, 21:50 Mark Waite ***@***.***> wrote: It was first included in Jenkins 2.205. Jenkins 2.204 was selected as the basis for the next long term support release. Jenkins 2.204.1 will be released in January and will be the long term support base for 3 months. An LTS release including this capability will most likely be available in April 2020. — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub <#3991?email_source=notifications&email_token=AAW4RIAYORYKPZHJANMKEMTQVWDYDA5CNFSM4HHBABZ2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEFHMSTY#issuecomment-558811471>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAW4RICRPPZAG3HXNGTP3FDQVWDYDANCNFSM4HHBABZQ> .

msmitty12 · 2019-11-26T22:18:29Z

I see, thanks for the update. Am I correct that this fix will avoid issues with auto-fill (Chrome, LastPass, etc.) populating data in Jenkins system configuration? Is there another workaround other than having every Jenkins admin disable auto-fill in their applications?

…

On Tue, Nov 26, 2019 at 12:50 PM Mark Waite ***@***.***> wrote: It was first included in Jenkins 2.205. Jenkins 2.204 was selected as the basis for the next long term support release. Jenkins 2.204.1 will be released in January and will be the long term support base for 3 months. An LTS release including this capability will most likely be available in April 2020. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#3991?email_source=notifications&email_token=ABJ2FQ4EI6QVMRDEEEFUXGDQVWDYFA5CNFSM4HHBABZ2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEFHMSTY#issuecomment-558811471>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABJ2FQZD6LW6IMCH4GNAMMDQVWDYFANCNFSM4HHBABZQ> .

MarkEWaite · 2019-11-26T22:24:09Z

@msmitty12 that matches with my reading of the pull request description. Because it has released with Jenkins 2.205, you could test drive it yourself and verify the behavior with:

$ docker run --rm -i -t -p 8080:8080 jenkins/jenkins:2.205

That will provide you a locally running copy of Jenkins 2.205 that can be accessed on port 8080.

I'm not aware of any other workaround.

daniel-beck requested review from Wadeck and jvz April 18, 2019 23:30

daniel-beck added work-in-progress The PR is under active development, not ready to the final review web-ui The PR includes WebUI changes which may need special expertise labels Apr 18, 2019

daniel-beck marked this pull request as ready for review April 18, 2019 23:33

jvz reviewed Apr 19, 2019

View reviewed changes

Comment thread core/src/main/resources/lib/form/password.jelly Outdated

jvz reviewed Apr 19, 2019

View reviewed changes

Wadeck reviewed May 8, 2019

View reviewed changes

daniel-beck and others added 4 commits October 5, 2019 20:37

Hide password form fields by default

a319460

Update core/src/main/resources/lib/form/password.jelly

4991e54

Co-Authored-By: daniel-beck <daniel-beck@users.noreply.github.com>

Use previously defined value

9c694b4

daniel-beck force-pushed the hidden-password-fields branch from a90d18a to 9c694b4 Compare October 5, 2019 18:37

daniel-beck added 5 commits October 5, 2019 20:44

Make new password form fields opt-out

15f4c4e

Add support for redacting form secrets in new password field

7765860

Have a password value pre-set in Jelly

0d5eb38

Fix method

25ddc85

Fix test by clicking on the button to change the password

bcda7cf

daniel-beck removed the work-in-progress The PR is under active development, not ready to the final review label Oct 5, 2019

daniel-beck requested review from Wadeck, jeffret-b and jvz October 5, 2019 22:17

Wadeck mentioned this pull request Oct 9, 2019

[DO NOT MERGE] Hide password form fields by default + JavaScript disabled #4280

Closed

daniel-beck added the on-hold This pull request depends on another event/release, and it cannot be merged right now label Oct 10, 2019

daniel-beck removed the on-hold This pull request depends on another event/release, and it cannot be merged right now label Oct 12, 2019

oleg-nenashev added the rfe For changelog: Minor enhancement. use `major-rfe` for changes to be highlighted label Oct 31, 2019

oleg-nenashev approved these changes Oct 31, 2019

View reviewed changes

oleg-nenashev added the ready-for-merge The PR is ready to go, and it will be merged soon if there is no negative feedback label Oct 31, 2019

oleg-nenashev self-requested a review November 12, 2019 14:44

oleg-nenashev added the upgrade-guide-needed This change might be breaking in rare circumstances, an entry in the LTS upgrade guide is needed label Nov 12, 2019

oleg-nenashev approved these changes Nov 12, 2019

View reviewed changes

oleg-nenashev requested a review from olivergondza November 12, 2019 14:46

olivergondza approved these changes Nov 12, 2019

View reviewed changes

oleg-nenashev merged commit 90e693b into jenkinsci:master Nov 13, 2019

oleg-nenashev added major-rfe For changelog: Major enhancement. Will be highlighted on the top and removed rfe For changelog: Minor enhancement. use `major-rfe` for changes to be highlighted labels Nov 18, 2019

timja mentioned this pull request Apr 12, 2020

Add 2.222.x line jenkinsci/bom#214

Merged

dwnusbaum mentioned this pull request Jul 24, 2020

[JENKINS-62305] Make password parameters work with the build step in Jenkins 2.236+ jenkinsci/pipeline-build-step-plugin#46

Merged

ikedam mentioned this pull request Aug 2, 2020

Update parent pom + adjustments jenkinsci/authorize-project-plugin#46

Merged

Uh oh!

Uh oh!

Conversation

daniel-beck commented Apr 18, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Example: Proxy Configuration

Example: Parameterized Build

All concealed by default

Changing one password

Proposed changelog entries

Submitter checklist

Uh oh!

daniel-beck commented Apr 18, 2019

Uh oh!

daniel-beck commented Apr 19, 2019

Uh oh!

daniel-beck commented Apr 19, 2019

Uh oh!

Uh oh!

jvz Apr 19, 2019

Choose a reason for hiding this comment

Uh oh!

zbynek commented Apr 19, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

daniel-beck commented Apr 19, 2019

Uh oh!

josephbrueggen commented May 7, 2019

Uh oh!

daniel-beck commented May 7, 2019

Uh oh!

josephbrueggen commented May 7, 2019

Uh oh!

Wadeck left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

daniel-beck commented Oct 8, 2019

Uh oh!

Wadeck commented Oct 9, 2019

Uh oh!

daniel-beck commented Oct 9, 2019

Uh oh!

daniel-beck commented Oct 10, 2019

Uh oh!

daniel-beck commented Oct 18, 2019

Uh oh!

oleg-nenashev left a comment

Choose a reason for hiding this comment

Uh oh!

oleg-nenashev commented Nov 11, 2019

Uh oh!

oleg-nenashev commented Nov 11, 2019

Uh oh!

oleg-nenashev left a comment

Choose a reason for hiding this comment

Uh oh!

olivergondza left a comment

Choose a reason for hiding this comment

Uh oh!

oleg-nenashev commented Nov 13, 2019

Uh oh!

msmitty12 commented Nov 26, 2019

Uh oh!

MarkEWaite commented Nov 26, 2019

Uh oh!

oleg-nenashev commented Nov 26, 2019 via email

Uh oh!

msmitty12 commented Nov 26, 2019 via email

Uh oh!

MarkEWaite commented Nov 26, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

daniel-beck commented Apr 18, 2019 •

edited

Loading

zbynek commented Apr 19, 2019 •

edited

Loading

Wadeck left a comment •

edited

Loading

MarkEWaite commented Nov 26, 2019 •

edited

Loading