Slide: When making a new post, text fields are treated as login fields by Oreo autofill

Created on 26 May 2018  路  5Comments  路  Source: ccrama/Slide

Slide version: 5.8.6
Android version: 8.0

Whenever I create a new post in Slide, all text fields in all submission types (selftext/image/link) are detected by password manager. which shows autofill option on each of them. The only exception is the URL field in Link submission type. Here's a screenshot of Bitwarden offering filling credentials into Title field, but the same thing is happening with Subreddit name and Text.

screenshot_20180526-201209

Bitwarden uses Android Oreo's autofill service, so I suspect that other password managers that use it instead of Accessibility service are doing the same thing.
I'm experiencing the issue on Sony Xperia XZ2 Compact, but I've also had it on other phones running Android Oreo.

Bug

Most helpful comment

We could just override the method in the login subclass, should be the only place we might want it!

All 5 comments

On our end we can mark everything as unimportant for autofill. The Autofill API is a weird text-field scraping deal so something in these fields must be causing these apps to think they have to autofill into the field, either from the text or some other sort of heuristic that is probably "standard". It may be valuable to bring up to Bitwarden, but notably, that field is pretty basic:

<android.support.design.widget.TextInputLayout
          android:layout_width="match_parent"
          android:layout_height="wrap_content">

      <EditText
              android:id="@+id/titletext"
              android:layout_width="match_parent"
              android:layout_height="wrap_content"
              android:backgroundTint="?attr/tintColor"
              android:textCursorDrawable="@drawable/cursor"
              android:hint="@string/editor_title"
              android:inputType="text|textCapSentences"
              android:maxLines="1"
              android:maxLength="300" />
</android.support.design.widget.TextInputLayout>

Really, the app with the API should be handling this but we can help out by just specifying in views that it's not important to check the fields.

EDIT: If anyone happens to know Bitwarden better, I believe there is some funk happening in this class:
https://github.com/bitwarden/mobile/blob/master/src/Android/Autofill/Field.cs

Trying to figure out where those constants even are though that they have in that switch statement.

EDIT EDIT: Now I am starting to blame Xamarin and monodroid so this is becoming a dark rabbit hole I may never escape.

EDIT EDIT EDIT: LastPass, which I assume is native Android and not Xamarin.Forms, also shows "AUTOFILL" in the context menu when long pressing. So maybe this is straight outta Oreo. No clue what is happening in this view that makes the API think we want that to happen.

@PiwwowPants I believe we can fix it by adding this method to the base activity

@Override
    public void onCreate(Bundle savedInstanceState) {
       super.onCreate(savedInstanceState);
       disableAutoFill();
    }

    @TargetApi(Build.VERSION_CODES.O)
    private void disableAutoFill() { 
        getWindow().getDecorView().setImportantForAutofill(View.IMPORTANT_FOR_AUTOFILL_NO_EXCLUDE_DESCENDANTS);
    }

per https://stackoverflow.com/a/46082925/3697225

@ccrama is there no where in the app where we want to have autofill happening? Would this make autofill in the OAuth view break, assuming it opens internally in the app as a WebView?
Things I could probably just check instead of asking.

We could just override the method in the login subclass, should be the only place we might want it!

Issue resolved in PR #2792

Was this page helpful?
0 / 5 - 0 ratings