Disable spellcheck for all password fields for better privacy

[dziudek]

According to discovery described in this article: ​https://www.bleepingcomputer.com/news/security/google-microsoft-can-get-your-passwords-via-web-browsers-spellcheck/

All password fields generated in WordPress should have attribute spellcheck="false". It will prevent browser from sending passwords to the Google Chrome spellchecking service if Enhanced Spellcheck is enabled.

[dziudek]

Patch for the described issue with password fields

This pull request adds spellcheck="false" attributes to all password fields in order to avoid privacy problem described here: ​https://www.bleepingcomputer.com/news/security/google-microsoft-can-get-your-passwords-via-web-browsers-spellcheck/

In short: browsers like Chrome/Edge with Enhanced Spellchecker enabled (it is disabled by default) can send password fields values to the Google/Microsoft spellchecking services.

Trac ticket: https://core.trac.wordpress.org/ticket/56763

[dziudek]

Related Github pull request: ​https://github.com/WordPress/wordpress-develop/pull/3420

I'm good

[fosuahmed]

I have checked Github PR. I see changes are made in 8 files and 13 occurrences.

I have searched in my local clone with the text

type="password"

in .php files and found same number files and occurrences. So all change are made properly.
ScreenShot: ​https://prnt.sc/Eynib0CoHg7y

[audrasjb]

It is indeed a ​recommendation from MDN for elements that can contain sensible information, like password fields.

Self-assigning to test the patch, make sure it covers each occurrence, and hopefully commit.

[audrasjb]

I added two commits to the PR to remove some extra whitespaces.
Tests are passing.

The patch works fine and doesn't introduce any regression.

We're good to go with this implementation :)

[audrasjb]

In 55094:

Login and Registration: Disable spellcheck for password fields.

This changeset adds spellcheck="false" attribute to various password fields.

The spellcheck global attribute defines whether the element may be checked for spelling errors. The false value indicates that the element should not be checked for spelling errors, which is relevant for a password field.

Furthermore, and as per MDN specs, using spellchecking can have consequences for users' security and privacy. The specification does not regulate how spellchecking is done and the content of the element may be sent to a third party for spellchecking results. Thus, it is recommended to set spellcheck attribute to false for elements that can contain sensitive information. Which is the case for password fields.

Props dziudek, audrasjb, gainesm, fosuahmed.
Fixes #56763.

[audrasjb]

Reopening as I wanted to commit the Bundled Theme change separately.

Committed in https://core.trac.wordpress.org/changeset/55094

[audrasjb]

In 55095:

Twenty Twenty-One: Disable spellcheck for post password field.

This changeset adds spellcheck="false" attribute to various password fields.

Follow-up to [55094].

Props dziudek, audrasjb, gainesm, fosuahmed.
See #56763.

[audrasjb]

Application Password field

[audrasjb]

Also, we need a patch for Application Passwords (see screenshot above).

https://core.trac.wordpress.org/ticket/56763

[Spaceshipone]

Hello,

I added pull request for application forms.

[audrasjb]

In 55096:

Application Passwords: Disable spellcheck for password field.

This changeset adds spellcheck="false" attribute to application password field.

Follow-up to [55094], [55095].

Props Spaceshipone.
Fixes #56763.

Thanks for the PR! Committed in https://core.trac.wordpress.org/changeset/55096

[audrasjb]

In 55110:

Upgrade/Install: Disable spellcheck for password field on Setup screen.

This changeset adds spellcheck="false" attribute to Database Password field on the Database Setup screen.

Follow-up to [55094], [55095], [55096].

See #56763.

[milana_cap]

Added to misc dev note. Draft: ​https://make.wordpress.org/core/?p=103089&preview=1&_ppp=36765ffd5f