Keepassxc-browser: TOTP on type=email|tel|username

[bwbroersma]

~Example from Uptime Robot (related to #768):~
_Fixed in current develop:_

Still open:

_Fixed in current develop:_

<input id="showQR" class="checkbox" type="checkbox" value="0" name="userAuthSetting">

~Because of the Auth in the name, it's detected as TOTP field, while it is a checkbox.~

Still open:

<input type="email" name="mfa" placeholder="email"><br>
<input type="tel" name="mfa" placeholder="tel"><br>
<input type="number" name="mfa" placeholder="number"><br>
<input type="text" name="mfa" placeholder="text"><br>
<input type="username" name="mfa" placeholder="username">

Expected Behavior

~No Fill in TOTP on a checkbox.~
No TOTP on tel/email/username.

Current Behavior

Fill in TOTP overlay over a _tel/email/username field_. ~checkbox making it undetectable (I had to disable the addon to interact with the input).~

Possible Solution

So the generic whitelist is a bit to broad for TOTP I think:
https://github.com/keepassxreboot/keepassxc-browser/blob/280a561bb0276fec0ff5c5af37bd61e7cce5fb13/keepassxc-browser/content/keepassxc-browser.js#L622-L631

Add email/tel/username to the negative check:
https://github.com/keepassxreboot/keepassxc-browser/blob/280a561bb0276fec0ff5c5af37bd61e7cce5fb13/keepassxc-browser/content/totp-field.js#L30-L40

~There is a size check underway which would probably fix this specific issue, but not the underlying issue that there currently is no type checking:~
https://github.com/keepassxreboot/keepassxc-browser/blob/280a561bb0276fec0ff5c5af37bd61e7cce5fb13/keepassxc-browser/content/keepassxc-browser.js#L1031-L1041

Debug info

KeePassXC - 2.5.3
KeePassXC-Browser - ~1.5.4~ _develop (1.6.0)_
Operating system: Linux x86_64
Browser: Mozilla Firefox 75.0

[droidmonkey]

This will be fixed in 1.6.0 of the browser extension, already merged into develop.

[bwbroersma]

Thanks, I missed it! I just tested 1.6.0 (develop), I updated the main issue.

[varjolintu]

Some sites actually use tel type for TOTP, so that must not be ignored.

EDIT: Also, it seems that if the type is username, both Firefox and Chromium reverts that back to text.