Leave sign-in and verification fields alone #848
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,83 @@ | ||
| import ApplicationServices | ||
| import Foundation | ||
|
|
||
| /// File overview: | ||
| /// Recognizes sign-in and verification fields (email, username, phone, one-time codes, card | ||
| /// numbers) where Cotabby stands down, alongside password fields, which arrive as secure fields | ||
| /// and are already blocked by the resolver. | ||
| /// | ||
| /// Why: a completion in "Email or phone" guesses at the user's identity. Accepting one types a | ||
| /// wrong address into a login form, and showing one paints a guessed address beside the real one. | ||
| /// Nothing in such a field is prose a writer wants continued. Browsers mark only passwords as | ||
| /// secure, so these fields are recognized from what the page says about them: its label (title, | ||
| /// description, placeholder) and its DOM id, plus the typed text itself looking like an address. | ||
| /// | ||
| /// Scope: single-line fields only (text fields and combo boxes). A multi-line field labelled | ||
| /// "email" is an email *body*, which is exactly where completions belong. Pure: the resolver reads | ||
| /// the attributes and asks here. | ||
| enum CredentialFieldDetector { | ||
| static let blockedReason = "Sign-in and verification fields are left alone." | ||
|
|
||
| /// Words in a field's label that name a credential or verification input, matched as whole | ||
| /// words in the lowercased label ("pin" matches "Enter PIN", not "shipping"). | ||
| static let labelKeywords: [String] = [ | ||
| "email", "e-mail", "username", "user name", "user id", "userid", "login", "log in", "sign in", | ||
| "phone", "mobile number", "password", "passcode", "pin", "one-time", "one time code", | ||
| "verification code", "security code", "otp", "2fa", "two-factor", "authentication code", | ||
| "card number", "cvc", "cvv", "expiry", "expiration" | ||
| ] | ||
|
|
||
| /// DOM ids used by common sign-in forms (Google's `identifierId`, and the generic names). | ||
| static let identifierKeywords: [String] = [ | ||
| "identifierid", "username", "userid", "email", "login", "passwd", "password", "otp", "totp", "phone" | ||
| ] | ||
|
|
||
| /// Cheap pre-check so labels are only fetched for single-line fields. | ||
| static func mightBeCredentialField(role: String) -> Bool { | ||
| role == kAXTextFieldRole as String || role == kAXComboBoxRole as String | ||
| } | ||
|
|
||
| static func isCredentialField( | ||
| role: String, | ||
| labels: [String?], | ||
| domIdentifier: String?, | ||
| text: String? | ||
| ) -> Bool { | ||
| guard mightBeCredentialField(role: role) else { return false } | ||
|
|
||
| for label in labels.compactMap({ $0?.lowercased() }) where !label.isEmpty { | ||
| if labelKeywords.contains(where: { containsWord($0, in: label) }) { | ||
| return true | ||
| } | ||
| } | ||
|
|
||
| if let id = domIdentifier?.lowercased(), !id.isEmpty, | ||
| identifierKeywords.contains(where: { id.contains($0) }) { | ||
|
Contributor
There was a problem hiding this comment.
Knowledge Base Used: Focus tracking and text-surface resolution |
||
| return true | ||
|
Comment on lines
+54
to
+56
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win Match DOM identifiers as field names, not arbitrary substrings. A single-line search field with 🤖 Prompt for AI Agents |
||
| } | ||
|
|
||
| return looksLikeEmailAddress(text) | ||
|
Contributor
There was a problem hiding this comment.
Knowledge Base Used: Focus tracking and text-surface resolution |
||
| } | ||
|
|
||
| /// The whole value is one address-shaped token ("name@domain.tld"), as typed into a login box. | ||
| static func looksLikeEmailAddress(_ text: String?) -> Bool { | ||
| guard let text = text?.trimmingCharacters(in: .whitespacesAndNewlines), !text.isEmpty else { return false } | ||
| return text.range(of: #"^[^\s@]+@[^\s@]+\.[^\s@]+$"#, options: .regularExpression) != nil | ||
| } | ||
|
|
||
| /// `keyword` appears in `label` with no letter or digit directly before or after it, so "pin" | ||
| /// matches "Enter PIN" but not "shipping". | ||
| private static func containsWord(_ keyword: String, in label: String) -> Bool { | ||
| var searchRange = label.startIndex..<label.endIndex | ||
| while let found = label.range(of: keyword, range: searchRange) { | ||
| let before = found.lowerBound == label.startIndex ? nil : label[label.index(before: found.lowerBound)] | ||
| let after = found.upperBound == label.endIndex ? nil : label[found.upperBound] | ||
| let isBoundary: (Character?) -> Bool = { $0.map { !$0.isLetter && !$0.isNumber } ?? true } | ||
| if isBoundary(before) && isBoundary(after) { | ||
| return true | ||
| } | ||
| searchRange = found.upperBound..<label.endIndex | ||
| } | ||
| return false | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| import ApplicationServices | ||
| import XCTest | ||
| @testable import Cotabby | ||
|
|
||
| final class CredentialFieldDetectorTests: XCTestCase { | ||
| private let textField = kAXTextFieldRole as String | ||
|
|
||
| func test_googleSignInFieldIsBlocked() { | ||
| XCTAssertTrue(CredentialFieldDetector.isCredentialField( | ||
| role: textField, labels: ["Email or phone", nil, nil], domIdentifier: "identifierId", text: "realdeepdark" | ||
| )) | ||
| XCTAssertTrue(CredentialFieldDetector.isCredentialField( | ||
| role: textField, labels: [nil, nil, nil], domIdentifier: "identifierId", text: "" | ||
| )) | ||
| } | ||
|
|
||
| func test_commonLabelsAreBlocked() { | ||
| for label in ["Username", "Enter PIN", "Verification code", "Phone number", "Card number", "Log in"] { | ||
| XCTAssertTrue( | ||
| CredentialFieldDetector.isCredentialField(role: textField, labels: [label], domIdentifier: nil, text: nil), | ||
| label | ||
| ) | ||
| } | ||
| } | ||
|
|
||
| func test_typedAddressIsBlockedEvenWithoutLabel() { | ||
| XCTAssertTrue(CredentialFieldDetector.isCredentialField( | ||
| role: textField, labels: [], domIdentifier: nil, text: "senad@imperum.io" | ||
| )) | ||
| XCTAssertFalse(CredentialFieldDetector.looksLikeEmailAddress("mail senad@imperum.io today")) | ||
| } | ||
|
|
||
| func test_ordinaryFieldsAreNotBlocked() { | ||
| XCTAssertFalse(CredentialFieldDetector.isCredentialField( | ||
| role: textField, labels: ["Shipping notes", "Type a message", "Search"], domIdentifier: "q", text: "hello there" | ||
| )) | ||
| XCTAssertFalse(CredentialFieldDetector.isCredentialField( | ||
| role: textField, labels: ["Spinning"], domIdentifier: nil, text: nil | ||
| )) | ||
| } | ||
|
|
||
| func test_multiLineFieldsAreNeverBlocked() { | ||
| XCTAssertFalse(CredentialFieldDetector.isCredentialField( | ||
| role: kAXTextAreaRole as String, labels: ["Email body"], domIdentifier: "email", text: "a@b.co" | ||
| )) | ||
| } | ||
| } |
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Knowledge Base Used: Restore the AX bounds gate and ease focus polling