Aug 26 - Update password detect against off field 2

tests/js/test_field_heuristics.js

@@ -112,6 +112,64 @@ check('click fallback registered', /addEventListener\(\s*"click"/.test(SRC), tru
 check('keydown fallback registered', /addEventListener\(\s*"keydown"/.test(SRC), true);
 check('submit listener retained', /addEventListener\(\s*"submit"/.test(SRC), true);
 
+// ── _isTrustworthyOrigin: where credentials may be filled ──────────────────
+// Extracted from the real source and evaluated against a stubbed `location`,
+// so this exercises the shipped function rather than a copy of its rules.
+{
+  const fnSrc = SRC.match(
+    /function _isTrustworthyOrigin\(\) \{[\s\S]*?\n  \}/,
+  );
+  if (!fnSrc) {
+    failures++;
+    console.log('FAIL  could not extract _isTrustworthyOrigin from content.js');
+  } else {
+    const make = new Function(
+      'location',
+      `${fnSrc[0]}; return _isTrustworthyOrigin();`,
+    );
+    const at = (protocol, hostname) => make({ protocol, hostname });
+
+    // HTTPS is always fine.
+    check('https is trustworthy', at('https:', 'example.com'), true);
+
+    // Local devices over plain HTTP — routers, NAS, printers. Dropping
+    // http://*/* entirely would break exactly these.
+    for (const host of ['localhost', '127.0.0.1', '::1', 'router.local',
+                        '10.0.0.1', '192.168.1.1', '172.16.5.4', '172.31.0.1',
+                        '169.254.1.1', 'nas.lan', 'box.home']) {
+      check(`http://${host} is treated as local`, at('http:', host), true);
+    }
+
+    // Plaintext on the public internet must warn.
+    for (const host of ['example.com', 'bank.co.uk', '8.8.8.8',
+                        '172.15.0.1', '172.32.0.1', '11.0.0.1',
+                        '192.169.1.1', 'evil-localhost.com',
+                        'localhost.evil.com', '127.0.0.1.evil.com']) {
+      check(`http://${host} is NOT trusted`, at('http:', host), false);
+    }
+  }
+}
+
+// ── Autologin must not click a control that discards the login ────────────
+{
+  const m = SRC.match(/var _NEGATIVE_CONTROL = (\/[^\n]+\/[a-z]*);/);
+  if (!m) {
+    failures++;
+    console.log('FAIL  could not find _NEGATIVE_CONTROL in content.js');
+  } else {
+    // eslint-disable-next-line no-eval
+    const NEG = eval(m[1]);
+    for (const label of ['Cancel', 'Reset', 'Go back', 'Forgot password?',
+                         'Register', 'Sign up', 'Create account']) {
+      check(`autologin skips "${label}"`, NEG.test(label), true);
+    }
+    for (const label of ['Sign In', 'Log in', 'Submit', 'Continue', 'OK']) {
+      check(`autologin allows "${label}"`, NEG.test(label), false);
+    }
+  }
+}
+
+// ── Summary (must stay last so every block above is counted) ───────────────
 if (failures) {
   console.log(`\n${failures} failure(s)`);
   process.exit(1);