Browser integration: KeePassXC icon/auto-populate appears in all fields in webapp (Synology)

[LbqpdL]

Overview

Hello,
I'm using KeepassXC browser integration to log into the web interface of my Synology NAS.
Once logged, KeepassXC icons will appear on all kinds of fields and propose to populate the field, even if it's not a login/password field.

Steps to Reproduce

1. Setup KeepassXC with Web integration
2. Autorise auth information to be inserted in the page
3. The auth information are pushed to all fields

Expected Behavior

Only propose auth information at login page and / or on login/password fields

Actual Behavior

The auth information are pushed to all fields

Context

This mostly applies within a specific web application (admin portal of Synology NAS)

In the following screenshot:

KeepassXC browser integration tries to populate the first field (the field is for an IP address)
The icon appears in the "repertoire" field and auto-populates it with a login (the field is for a text entry, a directory)

KeePassXC - Version 2.7.9
Révision : 8f6dd13

KeePassXC - Version 2.7.9
Révision : 8f6dd13

Qt 5.15.11
Le mode débogage est désactivé.

OS : Windows 11 Version 2009
Architecture : x86_64
Kernel : winnt 10.0.22631

Extensions activées :

• Saisie automatique
• Intégration aux navigateurs
• Clés d'accès
• Agent SSH
• KeeShare
• YubiKey
• Déverrouillage rapide

Bibliothèques cryptographiques :

• Botan 3.1.1

[varjolintu]

Is there a demo page or a public instance where this can be tried? There's two more open issues where Synology is mentioned.
At least it would be helpful to get the HTML code of those fields that are incorrectly detected.

[droidmonkey]

I have a synology NAS and didn't notice any errant KeePassXC icons anywhere in the dialogs. I think I have a different software than the OP though.

[LbqpdL]

Is there a demo page or a public instance where this can be tried? There's two more open issues where Synology is mentioned. At least it would be helpful to get the HTML code of those fields that are incorrectly detected.

You can create a demo environment via https://demo.synology.com

[droidmonkey]

What is the exact portion of the admin console that shows this problem? Your screenshot was not specific and I don't understand the language.

Edit: looks like the backup screen

[varjolintu]

And how do I get to the backup screen without any prompts or activations?

[LbqpdL]

Sorry for the language.

You can spin up a demo in english at https://demo.synology.com/en-uk

You can dismiss the first screen (2FA auth) by clicking any link in black/underlined ("Non merci" in this screenshot)

You can dismiss the second screen by doing the same then OK.

You can then select the displayed language in the top right corner by clicking on "personnal"

And then select "english" as displayed language

You can then open the "control panel"

Within control panel, select "shared folder"

Then dropdown menu "Create > create", this will launch the creation of a shared folder

Shared folder creation wizard : Screenshot from the Demo instance

Shared folder creation wizard : Screenshot from my personnal instance (with keepassxc browser integration activated)
When clicking in the first field, the auto-complete is proposed :

Same for the second field

This also happens in unrelated fields, such as a "filter" field

Screenshot from demo instance

Screenshot from personnal instance

This is how the entry is configured within the keepassxc database

[LbqpdL]

To further help the debugging, I tested from another browser (Chromium)

Keepass integration activated, not yet configured:

If I connect manually (without connecting the extention to the database), I have the following:

After connecting the extension, the password entry is recognised

I de-log, and relaunch the login page. I then need to activate the "add option of Username only for the site"

The login field is recognised (icon appears), I can log into the system

This works as intended

In the next screen, the password is then proposed for autologin

Once logged-in, the issue appears

[varjolintu]

Thanks for providing the instructions. I tested this and it seems the culprit is the Username-only Detection. It cannot distinquish the single input fields from fields like name, which is one reason we keep the option disabled by default. It can give too much false positives.

My suggestion is:

• Disable the Username-only Detection for the site.
• When you are on the login screen, choose Custom Login Fields from the popup and select the username field as such.
• Do the same on the next screen for the password field.

In this way you can get the login dialog working without needing to enable the Username-only Detection that seems to have negative effects.