Reporter: Breaks when using BitWarden

Bug #2052567 reported by James Fournie
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Evergreen
Fix Released
Low
Unassigned
3.11
Fix Released
Low
Unassigned

Bug Description

Howdy.

I've been having issues where when I open the Reporter, I get a white screen. I noticed in the Console, I get the following error:

Uncaught SyntaxError: Invalid left-hand side in assignment. This error references oils_rpt_utils.js:204

Here is the code causing the issue:

/* scours the doc for elements with IDs. When it finds one,
 it grabs the dom node and sets a reference to the node at DOM[id]; */

function oilsRptIdObjects(node) {
 if(!node) node = document.documentElement;
 if( node.nodeType != 1 ) return;
 var id = node.getAttribute('id');
 if( id ) eval("DOM."+id+"=$('"+id+"');");
 var children = node.childNodes;
 for( var c = 0; c < children.length; c++ )
  oilsRptIdObjects(children[c]);
}

Adding some debugging stops to this, I found it was failing at a node when id resolved as "bw-fido2-page-script". It turns out that BitWarden Chrome extension injects a <script> tag in order to support passkeys. More info:
https://github.com/bitwarden/clients/issues/7080
https://www.reddit.com/r/Bitwarden/comments/17rc6pi/bitwarden_recently_started_injecting_a_javascript/

While there seems to be grumbling elsewhere online about Bitwarden injecting this, it doesn't seem like that's going to change given that increasingly Google and Microsoft are pushing passkeys.

This code seems like it could use improvement as there's something off here - (why are we creating DOM.foo style getters? Why is it looking for anything with an id field when getElementById exists?

Anyway, hoping just "this will get rewritten in Angular" is the solution here, but at the same time thought I'd report it in case anyone else hits this issue. I'm guessing other password managers or extensions may have similar issues as well.

Revision history for this message
Jason Boyer (jboyer) wrote :

The good news is that bug 1993823 is coming along so you're right about that being the real fix. The point about DOM.whatevs is a good one, I wonder if that was leftover from the XUL days or something, ick.

This bug probably shouldn't be marked invalid or won't fix or anything like until the Angular reporter is available that so that people can find this bug in case they run into it; thanks for tracking this down James!

Galen Charlton (gmc)
Changed in evergreen:
status: New → Confirmed
importance: Undecided → Low
Revision history for this message
Galen Charlton (gmc) wrote :

Since the Angular reports interface won't be available instantly, I've created a patch to work around the issue: working/user/gmcharlt/lp2052567_who_watches_the_bitwarden / https://git.evergreen-ils.org/?p=working/Evergreen.git;a=shortlog;h=refs/heads/user/gmcharlt/lp2052567_who_watches_the_bitwarden

tags: added: pullrequest reports
Revision history for this message
Galen Charlton (gmc) wrote :

Force pushed a corrected patch to the branch, both to rebase and to remove an unrelated change that I had let slip in.

Revision history for this message
Brett French (bsfrench) wrote :

I have tested this in Chrome and Firefox and the patch seems to have fixed the issue. I was able to access the Legacy reporter with Bitwarden installed with no issue.

I have tested this code and sign off on it with my name, Brett French and my email address <email address hidden>.

Galen Charlton (gmc)
tags: added: signedoff
Changed in evergreen:
milestone: none → 3.12.3
Revision history for this message
Terran McCanna (tmccanna) wrote :

Thanks Galen and Brett!

Fix committed to 3.11 and up

Changed in evergreen:
assignee: nobody → Terran McCanna (tmccanna)
status: Confirmed → Fix Committed
Changed in evergreen:
assignee: Terran McCanna (tmccanna) → nobody
Changed in evergreen:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.