[FormAnalyzer] scoring password hints

src/Form/FormAnalyzer.js

@@ -40,9 +40,6 @@ class FormAnalyzer {
          */
         this.signals = [];
 
-        // Analyse the input that was passed. This is pretty arbitrary, but historically it's been working nicely.
-        this.evaluateElAttributes(input, 1, true);
-
         // If we have a meaningful container (a form), check that, otherwise check the whole page
         if (form !== input) {
             this.evaluateForm();
@@ -53,15 +50,18 @@ class FormAnalyzer {
         return this;
     }
 
+    areLoginOrSignupSignalsWeak() {
+        return Math.abs(this.autofillSignal) < 10;
+    }
+
     /**
      * Hybrid forms can be used for both login and signup
      * @returns {boolean}
      */
     get isHybrid() {
         // When marking for hybrid we also want to ensure other signals are weak
-        const areOtherSignalsWeak = Math.abs(this.autofillSignal) < 10;
 
-        return this.hybridSignal > 0 && areOtherSignalsWeak;
+        return this.hybridSignal > 0 && this.areLoginOrSignupSignalsWeak();
     }
 
     get isLogin() {
@@ -146,7 +146,7 @@ class FormAnalyzer {
         }
 
         const signupRegexToUse = this.matching.getDDGMatcherRegex(shouldBeConservative ? 'conservativeSignupRegex' : 'signupRegex');
-        const matchesSignup = safeRegexTest(/new.?password/i, string) || safeRegexTest(signupRegexToUse, string);
+        const matchesSignup = safeRegexTest(/new.?(password|username)/i, string) || safeRegexTest(signupRegexToUse, string);
 
         // In some cases a login match means the login is somewhere else, i.e. when a link points outside
         if (shouldFlip) {
@@ -230,6 +230,16 @@ class FormAnalyzer {
         });
     }
 
+    evaluatePasswordHints() {
+        const textContent = this.form.textContent?.replace(/\s+/g, ' ');
+        if (textContent) {
+            const hasPasswordHints = safeRegexTest(this.matching.getDDGMatcherRegex('passwordHintsRegex'), textContent, 500);
+            if (hasPasswordHints) {
+                this.increaseSignalBy(5, 'Password hints');
+            }
+        }
+    }
+
     /**
      * Function that checks if the element is an external link or a custom web element that
      * encapsulates a link.
@@ -313,6 +323,11 @@ class FormAnalyzer {
         // Check page title
         this.evaluatePageTitle();
 
+        // Evaluate attributes of form's input elements
+        this.form.querySelectorAll(this.matching.cssSelector('formInputsSelector')).forEach((input) => {
+            this.evaluateElAttributes(input, 1, true);
+        });
+
         // Check form attributes
         this.evaluateElAttributes(this.form);
 
@@ -332,11 +347,16 @@ class FormAnalyzer {
         }
 
         // A form with many fields is unlikely to be a login form
-        const relevantFields = this.form.querySelectorAll(this.matching.cssSelector('genericTextField'));
+        const relevantFields = this.form.querySelectorAll(this.matching.cssSelector('genericTextInputField'));
         if (relevantFields.length >= 4) {
             this.increaseSignalBy(relevantFields.length * 1.5, 'many fields: it is probably not a login');
         }
 
+        // If we can't decide at this point, try reading password hints
+        if (this.areLoginOrSignupSignalsWeak()) {
+            this.evaluatePasswordHints();
+        }
+
         // If we can't decide at this point, try reading page headings
         if (this.autofillSignal === 0) {
             this.evaluatePageHeadings();