Valid Autocomplete Tokens In JSX
ID |
javascript.jsx_autocomplete_valid |
Severity |
high |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
JavaScript |
Tags |
accessibility, jsx, reliability |
Description
Reports an autoComplete attribute on a JSX form control whose value is not a token of the HTML
autofill vocabulary.
Rationale
The autofill vocabulary is closed. A browser that does not recognise the value treats the field as
on and guesses from the surrounding markup, which is the behaviour the author was trying to
replace — so a misspelt token does not fail loudly, it silently restores the default. A password
manager filling the wrong field, or an address form the browser refuses to complete, is usually
this.
<input autoComplete="fullname" /> // FLAW - the token is "name"
<input autoComplete="disabled" /> // FLAW - the value is "off"
<input autoComplete="on name" /> // FLAW - "on" stands alone
<input autoComplete="name" /> // OK
<input autoComplete="off" /> // OK
<input autoComplete="shipping postal-code" /> // OK - a modifier and a field name
<input autoComplete="section-work tel" /> // OK - a named autofill section
Every whitespace-separated token has to come from the vocabulary: the field names, the grouping
modifiers (shipping, billing, the telephone kinds), the webauthn suffix, or a section-
prefixed section name, whose remainder is author-chosen and therefore not checked. Only the controls
that support autofill are judged — input, select and textarea.