peach-browser / history

601ee3c2c1ab

fix: skip individual OTP digit boxes (maxlength=1) in all icon injection paths (v3.6.103)

time
2026-05-28 03:49 UTC · 5 months ago
machine
koh2
parent
f262c65e6083

↓ peach-browser-601ee3c2.tar.gzatlas at this save

files changed5 files manifest.firefox.json+1 −1manifest.json+1 −1package-lock.json+2 −2package.json+1 −1src/content/detect.ts+5 −0
manifest.firefox.json+1 −1 
@@ -2,7 +2,7 @@22   "_comment_audio_capture": "Firefox does not honor the Chrome 'audioCapture' optional_permission — getUserMedia in WebExtensions is gated solely by the runtime permission prompt. Microphone access for chirp pairing works from the popup under the existing '<all_urls>' host permission; no manifest entry is required or accepted here.",33   "manifest_version": 3,44   "name": "Peach Password Manager",5-  "version": "3.6.102",5+  "version": "3.6.103",66   "description": "Zero-knowledge password manager",77   "browser_specific_settings": {88     "gecko": {

view file

manifest.json+1 −1 
@@ -1,7 +1,7 @@11 {22   "manifest_version": 3,33   "name": "Peach Password Manager",4-  "version": "3.6.102",4+  "version": "3.6.103",55   "description": "Zero-knowledge password manager",66   "action": {77     "default_popup": "src/popup/index.html",

view file

package-lock.json+2 −2 
@@ -1,12 +1,12 @@11 {22   "name": "peach",3-  "version": "3.6.102",3+  "version": "3.6.103",44   "lockfileVersion": 3,55   "requires": true,66   "packages": {77     "": {88       "name": "peach",9-      "version": "3.6.102",9+      "version": "3.6.103",1010       "dependencies": {1111         "@bokuweb/zstd-wasm": "^0.0.27",1212         "@stablelib/blake2s": "^2.0.1",

view file

package.json+1 −1 
@@ -1,6 +1,6 @@11 {22   "name": "peach",3-  "version": "3.6.102",3+  "version": "3.6.103",44   "description": "Zero-knowledge password manager",55   "type": "module",66   "scripts": {

view file

src/content/detect.ts+5 −0 
@@ -87,6 +87,9 @@8787 8888 export function isTOTPField(input: HTMLInputElement): boolean {8989   if (!isVisible(input)) return false;90+  // Single-character inputs are individual OTP digit boxes — treat the form's91+  // full-code input (if any) as the TOTP field, not each individual digit box.92+  if (input.maxLength === 1) return false;9093   const autocomplete = input.autocomplete.toLowerCase();9194   const fieldText = `${input.name} ${input.id} ${input.placeholder}`.toLowerCase();9295   if (@@ -193,6 +196,8 @@193196     const type = el.type.toLowerCase();194197     // Never treat buttons, checkboxes, hidden fields, etc. as autofill targets195198     if (SKIP_INPUT_TYPES.has(type)) continue;199+    // Single-character inputs are individual OTP digit boxes — never credential fields200+    if (el.maxLength === 1) continue;196201     // Catch <input> with no type attribute whose value text identifies it as a submit button197202     if (looksLikeSubmitButton(el)) continue;198203     const ac = el.autocomplete;

view file