Password managers try to autofill selectInput

[stuartfn]

System details

Browser Versions:

• Chrome: 125.0.6422.113
• Firefox: 124.0.2

Output of sessionInfo():

R version 4.4.0 (2024-04-24)
Platform: aarch64-apple-darwin20
Running under: macOS Sonoma 14.5

Matrix products: default
BLAS:   /Library/Frameworks/R.framework/Versions/4.4-arm64/Resources/lib/libRblas.0.dylib
LAPACK: /Library/Frameworks/R.framework/Versions/4.4-arm64/Resources/lib/libRlapack.dylib;  LAPACK version 3.12.0

locale:
[1] en_GB.UTF-8/en_GB.UTF-8/en_GB.UTF-8/C/en_GB.UTF-8/en_GB.UTF-8

time zone: Europe/London
tzcode source: internal

attached base packages:
[1] stats     graphics  grDevices datasets  utils     methods   base

other attached packages:
[1] shiny_1.8.1.1

loaded via a namespace (and not attached):
 [1] digest_0.6.35     later_1.3.2       R6_2.5.1          httpuv_1.6.15
 [5] fastmap_1.2.0     magrittr_2.0.3    htmltools_0.5.8.1 lifecycle_1.0.4
 [9] promises_1.3.0    cli_3.6.2         xtable_1.8-4      renv_1.0.7
[13] compiler_4.4.0    tools_4.4.0       mime_0.12         Rcpp_1.0.12
[17] rlang_1.1.3

Example application or steps to reproduce the problem

library(shiny)

ui <- fluidPage(
  # this is the input the password manager recognises as a password field
  selectInput("1", "test", choices = list(a=1, b=2))
)

server <- function(input, output, session) {
}

shinyApp(ui, server)

Describe the problem in detail

I noticed on new shiny apps my team created, our password manager software (Keeper) started recognising selectInput as a password field. The password manager then generates a popup to prompting to create a new password, creating an annoying experience for users. I have tested with LastPass, which does not recognise the input field or cause any issues.

With some testing, this behaviour was found in shiny versions 1.8.0 through to the current version (1.8.1.1 at the time of writing). Rolling back to version 1.7.5.1 stops this behaviour. Digging a bit deeper, I found this is due to a autocomplete="new-password" attribute in the HTML input element; whereas this tag is autocomplete="off" in older versions.

Input element generated using shiny version 1.8.1.1:

<input type="text" autocomplete="new-password" autofill="no" tabindex="" id="1-selectized" role="combobox" aria-expanded="false" haspopup="listbox" aria-owns="0bxb7sopar" style="width: 4px;">

Input element generated using shiny version 1.7.5.1:

<input type="text" autocomplete="off" tabindex="" id="1-selectized" role="combobox" aria-expanded="false" haspopup="listbox" aria-owns="8l4sn3d8vj" style="width: 4px;">

This appears to be due to the upgrade of the selectize.js shiny dependency from v0.12.4 to v0.15.2 in shiny version 1.8.0.

Work around

This problem can be solved by replacing selectInput with selectizeInput and using the autofill_disable plugin:

selectizeInput(
    "1",
    "test",
    choices = list(a=1, b=2),
    options = list(
        plugins=list('autofill_disable')
    )
)

[daattali]

Looks like this was introduced to selectize in v0.13.16 as a poor "fix" to an issue, and has been properly fixed in Jan 2023 but s electize hasn't had a new release since then