From e7f4910e549562272e8100b708799234af2226ea Mon Sep 17 00:00:00 2001 From: varjolintu Date: Sat, 8 Feb 2025 10:06:44 +0200 Subject: [PATCH] Add extra check for TOTP field input type --- keepassxc-browser/content/totp-field.js | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/keepassxc-browser/content/totp-field.js b/keepassxc-browser/content/totp-field.js index a12032b..2df7445 100644 --- a/keepassxc-browser/content/totp-field.js +++ b/keepassxc-browser/content/totp-field.js @@ -2,6 +2,7 @@ const ignoreRegex = /(bank|coupon|postal|user|zip).*code|(en|de)code(d|r)*|comment|author|error/i; const ignoredTypes = [ 'email', 'password', 'username' ]; +const allowedInputTypes = [ 'number', 'password', 'tel', 'text' ]; const acceptedOTPFields = [ '2fa', @@ -52,6 +53,12 @@ kpxcTOTPIcons.isAcceptedTOTPField = function(field) { const id = field.getLowerCaseAttribute('id'); const name = field.getLowerCaseAttribute('name'); const placeholder = field.getLowerCaseAttribute('placeholder'); + const type = field.getLowerCaseAttribute('type'); + + // Checks if input type is allowed + if (!allowedInputTypes.some(t => type === t)) { + return false; + } // Checks if the field id, name or placeholder includes some of the acceptedOTPFields but not any from ignoredTypes if ((acceptedOTPFields.some(f => id?.includes(f) || (name?.includes(f) || placeholder?.includes(f))) || acceptedParents.some(s => field.closest(s)))