Is there a possible leak with the spell checker?

clhomme · April 14, 2021, 6:32pm

Hello, it seems that if you ask to see the content of the password field during login, the spell checker analyse the field. Is it a possible leak of the main password through the spell checker? Thank you

Peter_H · April 14, 2021, 7:43pm

Perhaps you should figure out a way to live without that spell checker.
Or check if it at least has an option not to be nosy around password fields.

clhomme · April 14, 2021, 7:55pm

It seems embedded by default. Maybe Chrome detects it and then use it.

cho-m · April 14, 2021, 8:19pm

Which OS and exact password field (Bitwarden master password or website password) are you referring to?

For example, on my macOS Bitwarden Chrome extension, password fields are usually set to disable spellcheck, etc.
Looking at a snippet of HTML for master password:

...
name="MasterPassword" required="" autocomplete="off"
autocapitalize="none" autocorrect="none" spellcheck="false"
...

clhomme · April 14, 2021, 10:06pm

It happens on the desktop app on Linux. Have to test on Windows. And it’s the Bitwarden master password.

cho-m · April 14, 2021, 10:34pm

Okay. I am also able to reproduce this on Desktop app.

Enabling developer tools, I see that the "spellcheck" attribute is not set for Desktop App, which probably means it uses default setting (in this particular case, it is enabled).

Some more technical details:

I think Bitwarden Desktop uses an appAutofocus directive, which doesn’t really set much:

github.com

bitwarden/desktop/blob/v1.25.1/src/app/accounts/lock.component.html#L15-L16


<input id="masterPassword" type="{{showPassword ? 'text' : 'password'}}" name="MasterPassword"
    class="monospaced" [(ngModel)]="masterPassword" required appAutofocus>

github.com

bitwarden/jslib/blob/7cc23dab72e505ab3cc255f2d035dc0c79ec7a53/src/angular/directives/autofocus.directive.ts#L21-L25


ngOnInit() {
    if (!Utils.isMobileBrowser && this.autofocus) {
        this.el.nativeElement.focus();
    }
}

On the other hand, the Bitwarden browser extension uses the appInputVerbatim directive, which disables spellcheck and so on.

github.com

bitwarden/browser/blob/v1.49.1/src/popup/accounts/lock.component.html#L22-L23


<input id="masterPassword" type="{{showPassword ? 'text' : 'password'}}" name="MasterPassword"
    class="monospaced" [(ngModel)]="masterPassword" required appInputVerbatim>

github.com

bitwarden/jslib/blob/f80e89465ffc004705d2941301c0ffb6bfd71d1a/src/angular/directives/input-verbatim.directive.ts#L20-L35


ngOnInit() {
    if (this.disableComplete && !this.el.nativeElement.hasAttribute('autocomplete')) {
        this.renderer.setAttribute(this.el.nativeElement, 'autocomplete', 'off');
    }
    if (!this.el.nativeElement.hasAttribute('autocapitalize')) {
        this.renderer.setAttribute(this.el.nativeElement, 'autocapitalize', 'none');
    }
    if (!this.el.nativeElement.hasAttribute('autocorrect')) {
        this.renderer.setAttribute(this.el.nativeElement, 'autocorrect', 'none');
    }
    if (!this.el.nativeElement.hasAttribute('spellcheck')) {
        this.renderer.setAttribute(this.el.nativeElement, 'spellcheck', 'false');
    }
    if (!this.el.nativeElement.hasAttribute('inputmode')) {
        this.renderer.setAttribute(this.el.nativeElement, 'inputmode', 'verbatim');
    }

clhomme · April 15, 2021, 1:27am

Does appAutofocus and appInputVerbatim can coexist?

cho-m · April 15, 2021, 2:07am

Probably. At least both are used together in one HTML tag for browser extension:

github.com

bitwarden/browser/blob/v1.49.1/src/popup/settings/export.component.html#L30-L31


<input id="masterPassword" type="{{showPassword ? 'text' : 'password'}}" name="MasterPassword"
    class="monospaced" [(ngModel)]="masterPassword" required appInputVerbatim appAutofocus>

There are various locations that the browser extension adds appInputVerbatim directive. All corresponding HTML files should probably be checked to see if the directive should be ported to Desktop App.

It may be worth opening a GitHub issue at Issues · bitwarden/desktop · GitHub to get input from developers as this is closer to a bug than a feature request.

clhomme · April 15, 2021, 3:06am

Issue opened: Possible leak of password due to spell checker · Issue #842 · bitwarden/desktop · GitHub
Thanks for all the research already done!