kee-org / browser-addon Goto Github PK

When activating the Kee addon, everything works as expected for some random amount of time.
Suddenly, while doing a web-based request (page load, resource load, xhr, ... via http or https), one of nightly's child processes goes to 25% CPU (single core max load) and no requests are resolved anymore.
Chrome pages (eg about:settings) still work. When opening the Network tab in the dev console, the requests don't even show up.

As soon as I kill the subprocess, all the requests do resolve, but now none of my addons work anymore.
Next to Kee this profile contains uBlock Origin and uMatrix, both on their beta channels, but the problem even occurs when disabling them. I have not met the problem while keeping Kee disabled.

I'm currently using Kee Alpha 15 in Nightly x64 on Windows 7.
Nightly is at rev/a80d568a417ea8410cd2d874c1e0267fb92888fe, yesterday's nighly build
This happened for some time now though, I just didn't make out Kee to be the cause until now.
I'm using a PAC-File to determine Proxies (which are HTTP based).
The browser log is appended by an entry Error: WebExtension context not found! in ExtensionParent.jsm;829;13, but this also appears sometimes when the lockup doesn't happen, so it might be unrelated.

The problem seems to occur faster if more requests are made, for example listening to Spotify's Web client, which only downloads small chunks of audio per request, ususally triggers the problem within 1h tops.

For example, in this page: Baidu Tongji, click the "登录" on the top right

then, the login form is displayed as a modal dialog, but the dialog to select my user is not at the top

Set the "z-index" for #KeeAddonPanelMatchedLogins to a large number, it works well

Needs to be re-implemented since old technology that enabled this feature is no longer available in Firefox.

Hello,

When 2 windows sessions are running in the same time, the windows showing the authorization code to be entered is showing on the 1st session which has been opened.
I don't know if it is Keepass or Keefox related but in the doubt, here is the information.
Nice app by the way ... this is the very first time i'm having troubles with it :)

Windows 10
Firefox 54.0.1
Keepass 2.36

Antoine

Create a separate helper application for Kee to communicate with, instead of direct WebSocket communication with the KeePassRPC server.

This will allow KeePass to be launched from the browser and potentially allow concurrent KeePass instances to be supported without the need for manual TCP port configuration at both ends.

• Must not prevent existing WebSockets KPRPC client from functioning.
• Will be launched by the browser and follow the lifecycle of the WebExtension in the browser.
• More than one may be running at the same time.
• Needs to be able to:
  • Launch KeePass if it's not running
  • Connect to KeePassRPC server
  • Ideally, detect presence or not of the KeePassRPC plugin (e.g. by determining that a KeePass process is active but KeePassRPC is not listening)
  • Proxy all KPRPC requests between Kee and the KeePassRPC server.
• Could adjust usage of the agreed communications port to just initial handshaking and then hand off later communication to a different port in order to better support multiple instances and multiple user sessions running KeePass concurrently?
• Will likely require changes at both ends of the existing KeePassRPC connection to ensure that connection status can be correctly reported to the user.

I have no plans to implement this at the moment but welcome either "reaction" feedback on this issue or offers to implement it from other people. For me, just using the built-in "Run KeePass at Windows startup" option will likely be good enough but I'm happy to advise and review implementations of a native application if anyone else feels strongly about the need for any features that this native application will enable.

username and pwd field are not in any form

thanks

Needs to be re-implemented since old technology that enabled this feature is no longer available in Firefox.

Also all screenshots and most instructions will need to be replaced.

From #29 :

Not working at all for me on 57.0b1. I get a toolbar icon, and clicking it just shows "Loading...".

Please can anyone experiencing this issue supply some more information about environment, steps to reproduce and browser console log debug output. I've not seen such behaviour myself so can't start looking into the issue without more to go on.

Saving of HTTP Auth and proxy credentials may be possible too - intercept every HTTP request, look for Authorisation header, base64 decode the value and then send it to the same or similar code to that which saves normal forms.

Possibly just add it to the same persistent data attached to the relevant tab and update the save password code to understand realms and missing form data?

//deleted//

When I installed the browser extension and KeepassRPC, I got an infinite number of authorization windows appearing, without any of them actually having anything inside.

Works fine in Chrome.

Possibly because https://bugzilla.mozilla.org/show_bug.cgi?id=1342207 only addressed the case where Firefox is already running and a new window opens but a session restoration at startup seems to not trigger browser.tabs.onActivated

I'm investigating if there is a way to workaround this problem.

I think Basic Auth was supported in an earlier version of the Web Extensions version but now it's gone. Any reason why?

Just installed this alpha on firefox nightly. i also added the new keepassrpc as well. keefox says that it is off and i am not logged in. i am on win10 (Insider build) x64

IMO, even if no suitable submit button is found, but Username and Password Fields are, the Autofill should succeed instead of aborting the whole matching process ("No submission possibility found in this form")

Per the Milestones schedule on this repository, the bulk of all efforts until the release of version 2.0 will be on ensuring that we can get something vaguely resembling KeeFox 1.6 to run in Firefox 57+ (and Google Chrome, etc.)

That means re-writing the add-on to use WebExtensions.

I've made a good start by pulling over some code snippets from KeeFox 1.6 and piecing them together in a way that has resulted in the current "pre-alpha" version having the following broadly working:

• Basic add-on architecture (build, default config, logging to console)
• Connection from add-on to the existing KeePassRPC plugin version
• Rendering state of connection on a browser button/icon on the browser toolbar
• Detection of forms on web pages
• Sending request to find matching logins and receiving list of logins in the web page

The lists below will be expanded as we delve into more detail and see how the WebExtensions API evolves over the next 6 months. With some luck we might be able to implement some items from the "uncertain" list although it's also likely other features will be added to the two lists.

Functionality we are unable to retain

• Assisted KeePass installation and configuration (prohibited by WebExtensions)
• Some customised keyboard shortcut keys (it should be possible for each user to manually re-configure them though)
• Logging to files (prohibited by WebExtensions)
• Protecting the KeePassRPC authentication token with the Firefox master password (prohibited by WebExtensions)

Functionality we are unlikely to retain (either too much work or uncertain technical viability)

• Some customised keyboard shortcut keys (we probably won't migrate the current settings but some keyboard shortcuts that relate to specific web pages can be supported if we have time)
• Launching KeePass from within Firefox (launching executables is banned although if a user were to install a hypothetical "KeeFox helper" executable we might be able to get something to work but it is unlikely that will exist on most user's systems so this work goes to the bottom of the priority list)
• Multi-page logins (the code that will deal with filling and saving passwords gets created and destroyed on every page load, making this a technically difficult problem to solve)
• Some assistive UI (e.g. new user advice, tips, security warnings). Things like "Save/update password?" should be possible in some form but may suffer from reduced usability
• Usage metrics (this is useful for planning how to improve KeeFox but with limited control over the changes we are making for version 2.0, a reduction in the number of platforms running version 2.0 and a lack of time to analyse and act on the limited data we could collect, it's not worthwhile initially)
• HTTP Auth/Proxy/Windows Auth dialog box filling and saving (not possible to modify the dialog box, other more-limited approaches could work if we have time though)

Please feel free to comment or ask questions below. I'll try to reply regularly but hope you'll understand that my priority is developing the code rather than answering questions that have already been answered multiple times. If you can help answer anyone else's questions or get involved in other discussion threads that would be great.

Try to generate a password when your active tab is a non-web page such a browser settings or a new tab.

This fails because Kee tries to add an iframe to the web page to act as a host for the password generator but this is not possible on these types of pages.

Same behaviour for the matched logins panel, although that can only ever be created on web page so the impact is pretty limited.

Might be worth converting the password generator to a separate dialog window, although I am wary of the poor window management offered by that solution considering the transient life span of this panel.

Alternatively could maybe open a new tab containing only the password manager panel?

Given the typical use cases of the password generator I don't intend to address this soon but welcome discussion and contributions.

Needs to be re-implemented since old technology that enabled this feature is no longer available in Firefox.

I have a pinned tab and the site needs http auth. When firefox (latest nightly) starts I get the http auth prompt but nothing from keefox. I noticed that keefox l has the "off" image overlaid on the toobar. I suspect this is an issue where firefox initialized the addin before it opens the pinned tab.

Since the conversion to a WebExtension is such a major rewrite, perhaps it is appropriate to revisit the question of supporting KeePassHTTP. For me, the advantage woulld be that I could switch to running KeePassXC instead of the terrible .NET client. I have not looked into the protocols at all, so I have no idea what advantages KeePassRPC has over KeePassHTTP, but seeing these two APIs unified I believe would be a huge step in the right direction, but for this extension and any others.

hello thanks for all you wok on webext to keefox.

i have a client with a internationalized domain name and keefox not propose login & password
https://en.wikipedia.org/wiki/Internationalized_domain_name

i don't know if it a problem with keepass or the browser ext who can i provide you more information ?

Firefox's "Remember logins and passwords for websites" option is cleared every time browser is started.

I understand the addon clears this checkbox, as the previous version did, however I use Firefox to store (some) passwords and I want to re-check it.

With the old version installing the add-on cleared the "Remember passwords" checkbox, and then re-checking it would leave it on. With this version, the box is cleared every time the browser starts.

Unfortunately that makes it impossible to use Firefox's password saving feature.

Edit: See below for a sort of solution thanks to @noiro777 :

This issue was a show stopper for me so I found a relatively simple work-around for it. You just have to have lock that preference so that it can't be updated by the extension. Unfortunately, the procedure to do this is less than obvious, but it does seem to work well (at least for the Windows version)

1. Create new or add to the file **_[Install Directory]\mozillla.cfg_**  ( e.g. **_C:\Program Files (x86)\Mozilla Firefox\mozilla.cfg_** )  exactly like the following (**including** the **//** on the 1st line):
   //
   lockPref("signon.rememberSignons", true);

2. Create new or add to the file **[Install Directory]\defaults\pref\local-setting.js**  as follows:
   //
   pref("general.config.filename", "mozilla.cfg");
   pref("general.config.obscure_value", 0);

Again, it's critical that the 1st line of both files is just: //

3. Completely restart Firefox.

If all goes well, the setting will be greyed-out and selected and should be remain that way until the preference is unlocked.

Now that there is a web extension version can you create an edge version? I use firefox but have business need to use edge on many occasions and hate not having keefox

Looks like there are cross-browser differences regarding initial add-on installation experience. Needs investigation and improvement.

By clicking or typing into a panel the user implicitly indicates that they are controlling the state of the panel so we shouldn't take automatic action once that has happened.

I'm trying Alpha 5 since a week ago. I can't get it working. Normally the icon was detecting KeePass but it didn't detect any form in any page. If I click it i get this: https://i.imgur.com/2LUThR6.png

Today the icon was showing an OFF tooltip until I restarted Firefox, now the icon is good but it does nothing like before.

Please close this issue if all these are the expected results for this alpha. If not I can do some debugging/testing if you need it.

Thx for the work

Hello,

The login and password of .htpassword accesses do not work. The authentication window is empty and can not be filled by keefox because of a hang.

Please fix the bug

Thank you

Greetings

Sorry I use an online translator French / English

So, this will probably only affect a few sites, but I've found one where it does (Intranet though).

The problem is that when using Autosubmit,
Alpha 17 (and 18) don't submit the value of the <input type="submit"> tag.

Example:

<form method="POST">
  <input type="text" name="email" />
  <input type="password" name="password" />
  <input type="submit" name="login" value="Log in" />
</form>

When manually submitting or Pre-Alpha 17, the login Key/Value Pair is correctly sent in the request payload:

  email: [email protected]
  password: example
  login: Log in

But Alpha 17+ leave out the submit value:

  email: [email protected]
  password: example

Apparently, this fails this particular website's input sanitation checks.

Sorry if it isn't a issue, I didn't know where to post it.

The toolbar button popup are always showing this:

Is this the expected behavior? When logged to the database is always showing this, no functionality and no styled text.

2.0 Beta 3

Needs more detailed use cases and specification.

When logging in using forms with some basic captcha functionality or other fields that change with every login operation, Kee will consider the login entry as different to any others already stored in the database and hence, unless disabled by configuration, will ask the user to save the new password.

Could come up with a blacklist/whitelist system? With pre-populated magic names? (what? "captcha"? etc.)

Also worth thinking about context - e.g. "ignore this field" option?

Needs to be re-implemented since old technology that enabled this feature is no longer available in Firefox.

Initial plan is to require user to explicitly select a page number when updating a form login (initial saved entry will always be page 1 and in a change to current UX, user will be required to save after the initial page submission rather than continuing to the end of the process).

Will probably not permit auto-submission across pages. So the feature becomes more of a way to correctly record and fill multiple pages interactively rather than a fully automated one-click login behaviour.

• Kee Version: 2.0.0.5
• KeePass Version: 2.36
• KeePassRPC Version: 1.7.2.0
• Firefox Nightly Linux x64

Kee freezes Firefox completely on Tab change or when I open a new Tab. It doesn't matter how long I wait, Firefox does not come back to live. I need to hard kill Firefox.

When I disable Kee there is not a single freeze of Firefox at all. I still need to find out if this is related to using Kee to fill out forms or if it just happens when it's finding compatible forms. But I can say that it doesn't happen all the time I'm using Kee, which doesn't make it easy to reproduce.

edit
I think I can say it's unrelated to using Kee actively. But when it freezes, it is on Tab change/close/new Tab when the last used page has a form.

It would make this perfect if you could support the submition of TOTP passwords if one is enabled for the entry being used.

Since the plugin now needs to be downloaded separately, it would be good to provide PGP signed downloads with checksums.

Should be able to click on the text to disable auto-close

Just installed keefox from github releases + keepassplugin from github too.
The 'Authorize a new connection' window is blank. Mouse change in some location of the window.

Debian 8 x64.
Firefox Nightly 58.0a1.

No idea where to find logs.
Could it be related to #22 ?

Don't think I finished implementing this but hopefully it's a small job to complete it.

Hopefully I'm not missing some documentation somewhere explaining this.

Using Firefox 57, Kee, and KeePassRPC, it seems like the URLs in my KeePass entries have to be very specific - www.domain.com instead of just domain.com.

Reading what documentation I did find, it seems like there's a domain|hostname option, but I must be missing it in both places. Where should I look for this, or is this expected functionality?

Using alpha 4 and keepassrpc 1.7.2: when i get an http auth popup there are no icons to allow me to look up the username/password. I don't have the "finds only one" box checked, but it also didn't work with the box checked.

Think it'll be a bit less distracting up there.

Since the rebranding to Kee, the migration of old KeeFox configuration has not been working.

Will need to look for old config names too.

I have tried kee versions from alpha 5 and nothing has worked yet. With alpha 8, it keeps asking me for authorization and once I enter the code, it instantly locks up my Firefox. I have no option but to force quit FF. At the next start, same thing happens again, starting with authorization window popping up again.
I am on fedora 26, Firefox 58.0a1 (2017-10-01) (64-bit)

In #27 two different issues were discussed. This issue is about Firefox simetimes not loading pages anymore.

The UI is still responsive and there is no high CPU usage, but web pages just aren't loaded anymore. Opening the dev tools shows that no requests aren't even made.

After restarting Firefox everything is back to normal.

I'm on Windows 10 64 bit. For me, this bug regularely happens right after booting up the PC and starting FF for the first time. After a couple of minutes, pages stop loading. After restarting FF, it usually works until I reboot the PC.

Currently, only input type submit or image are found without an additional role attribute. Type=button should be regarded as a possible submission possibility as well.

With Firefox 57.0b7, I get lots of freezes when Kee alpha 13-14 is enabled. During a freeze, the CPU usage of Firefox skyrockets. This maybe happen when loading a tab, but I am really not sure.

Note that when there is no freeze, I managed to use Kee successfully.

When I use the shortcut ctrl+shift+2 to insert the login data and there are several possible login data entries I can't use the arrow keys to navigagte between those entries. I had to use the Mouse instead. This is a little annoying because it would be faster with the arrow keys.

The settings select/option control in Firefox and update password group/DB select/option control in multiple browsers (but especially Chrome) look poor enough to be unusable by non-technical users. The conversion from XUL to HTML has just not really worked properly.

Probably need to replace with something similar to technique used in settings dropdown: #siteChooserSearchResults

Would be nice to get this done before the beta but it's not quite a showstopper for that demographic so let's see how we go.

Should be possible to rework the connection behaviour to reset it whenever the port is changed so that a browser restart is no longer required.

Probably want to debounce the changes to a maximum of one per second though.

Filling via https://developer.mozilla.org/en-US/Add-ons/WebExtensions/API/WebRequest/onAuthRequired
Saving may be possible too - intercept every HTTP request, look for Authorisation header, base64 decode the value and then send it to the same or similar code to that which saves normal forms.

can the new addon be written with other ports of keepass in mind?
like keepassxc?
right now in linux the addon uses wine and mono just to run keepassx and it has no other use for that specific program(keepass original) other than keepassRPC. the wine verison it not integrated nicely in linux.
please make it so that the addon will not depend on the application it communicates with but only on existence of keepassRPC.
thank you.