diff --git a/src/app/lib/preventSavingInputsToUserData.ts b/src/app/lib/preventSavingInputsToUserData.ts index c1dc3993e2..2588da047f 100644 --- a/src/app/lib/preventSavingInputsToUserData.ts +++ b/src/app/lib/preventSavingInputsToUserData.ts @@ -5,7 +5,8 @@ * Browsers write visible input fields from any website to user data to enable * restoring sessions. Browsers exclude inputs with autocomplete="off" from * cached form data in the session history (even though they ignore it and still - * offer autofill from saved passwords). + * offer autofill from saved passwords). Browsers with enhanced spellcheck also + * send it to the cloud. * * To ensure this fixes vulnerability: * - Manually checked @@ -17,5 +18,11 @@ * - https://coinyuppie.com/slow-mist-a-brief-analysis-of-the-metamask-wallet-demonic-vulnerability/ * - https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion * - https://nvd.nist.gov/vuln/detail/CVE-2022-0167 + * - https://www.otto-js.com/news/article/spell-jacking-enhanced-spellcheck-features-send-pii-even-passwords */ -export const preventSavingInputsToUserData = { autoComplete: 'off' } +export const preventSavingInputsToUserData = { + autoComplete: 'off', + autoCapitalize: 'off', + autoCorrect: 'off', + spellCheck: false, +} diff --git a/src/app/pages/OpenWalletPage/Features/FromMnemonic/__tests__/__snapshots__/index.test.tsx.snap b/src/app/pages/OpenWalletPage/Features/FromMnemonic/__tests__/__snapshots__/index.test.tsx.snap index 257236a563..f364fefc9a 100644 --- a/src/app/pages/OpenWalletPage/Features/FromMnemonic/__tests__/__snapshots__/index.test.tsx.snap +++ b/src/app/pages/OpenWalletPage/Features/FromMnemonic/__tests__/__snapshots__/index.test.tsx.snap @@ -405,7 +405,10 @@ exports[` should match snapshot 1`] = ` class="c2" >

should match snapshot 1`] = ` class="c6 " >