diff --git a/app/extensions/brave/content/scripts/passwordManager.js b/app/extensions/brave/content/scripts/passwordManager.js
index fd24f2a388b..a33d6db8142 100644
--- a/app/extensions/brave/content/scripts/passwordManager.js
+++ b/app/extensions/brave/content/scripts/passwordManager.js
@@ -198,6 +198,16 @@ if (chrome.contentSettings.passwordManager == 'allow') {
// Last resort: find the first text input in the form
username = username || form.querySelector('input[type=text i]')
+ // If the username turns out to be a password field, just ignore it so
+ // we don't show the password in plaintext.
+ if (username) {
+ let autocomplete = username.getAttribute('autocomplete')
+ if (username.getAttribute('type') === 'password' ||
+ (autocomplete && autocomplete.includes('password'))) {
+ username = null
+ }
+ }
+
// If not a submission, autofill the first password field and ignore the rest
if (!isSubmission || passwords.length === 1) {
return [username instanceof HTMLInputElement ? username : null, passwords[0], null]
diff --git a/test/components/notificationBarTest.js b/test/components/notificationBarTest.js
index da217957e6a..14410122607 100644
--- a/test/components/notificationBarTest.js
+++ b/test/components/notificationBarTest.js
@@ -19,6 +19,7 @@ describe('notificationBar', function () {
this.loginUrl3 = Brave.server.url('login3.html')
this.loginUrl4 = Brave.server.url('login4.html')
this.loginUrl5 = Brave.server.url('login5.html')
+ this.loginUrl6 = Brave.server.url('login6.html')
yield setup(this.app.client)
})
@@ -105,6 +106,19 @@ describe('notificationBar', function () {
}).click('button=No')
})
+ it('does not include a password in the notification bar', function * () {
+ yield this.app.client
+ .tabByIndex(0)
+ .loadUrl(this.loginUrl6)
+ .windowByUrl(Brave.browserWindowUrl)
+ .waitForExist(notificationBar)
+ .waitUntil(function () {
+ return this.getText(notificationBar).then((val) => {
+ return val.includes('your password') && !val.includes('secret')
+ })
+ }).click('button=No')
+ })
+
it('autofills remembered password on login form', function * () {
yield this.app.client
.tabByIndex(0)
diff --git a/test/fixtures/login6.html b/test/fixtures/login6.html
new file mode 100644
index 00000000000..7e97f9d72c8
--- /dev/null
+++ b/test/fixtures/login6.html
@@ -0,0 +1,21 @@
+
+
+
+