Reintroduce password support to NativeTextfieldViews

ui/gfx/render_text.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/gfx/render_text.h"
 
 #include <algorithm>
 
 #include "base/i18n/break_iterator.h"
 #include "base/logging.h"
 #include "base/stl_util.h"
 #include "ui/gfx/canvas.h"
 #include "ui/gfx/canvas_skia.h"
 #include "unicode/uchar.h"
 
 namespace {
 
+// All chars are replaced by this char when the password style is set.
+// TODO(benrg): GTK uses the first of U+25CF, U+2022, U+2731, U+273A, '*'
+// that's available in the font (find_invisible_char() in gtkentry.c).
+const char16 kPasswordReplacementChar = '*';
+
+// Color settings for text, backgrounds and cursor.
+// These are tentative, and should be derived from theme, system
+// settings and current settings.
+// TODO(oshima): Change this to match the standard chrome
+// before dogfooding textfield views.
+const SkColor kSelectedTextColor = SK_ColorWHITE;
+const SkColor kFocusedSelectionColor = SkColorSetRGB(30, 144, 255);
+const SkColor kUnfocusedSelectionColor = SK_ColorLTGRAY;
+const SkColor kCursorColor = SK_ColorBLACK;
+
 #ifndef NDEBUG
 // Check StyleRanges invariant conditions: sorted and non-overlapping ranges.
 void CheckStyleRanges(const gfx::StyleRanges& style_ranges, size_t length) {
   if (length == 0) {
     DCHECK(style_ranges.empty()) << "Style ranges exist for empty text.";
     return;
   }
   for (gfx::StyleRanges::size_type i = 0; i < style_ranges.size() - 1; i++) {
     const ui::Range& former = style_ranges[i].range;
     const ui::Range& latter = style_ranges[i + 1].range;
@@ skipping 92 matching lines @@
 #endif
   cached_bounds_and_offset_valid_ = false;
 
   // Reset selection model. SetText should always followed by SetSelectionModel
   // or SetCursorPosition in upper layer.
   SetSelectionModel(SelectionModel(0, 0, SelectionModel::LEADING));
 
   UpdateLayout();
 }
 
+string16 RenderText::GetObscuredText() const {
+  string16 txt = text();
+  if (obscured_) {
+    // TODO(benrg): There should probably be one bullet/asterisk per
+    // cursorable character, not one per UTF-16 word. However, I'm not sure
+    // it's worth the effort. GTK appears to use one per code point. Do people
+    // use non-BMP code points and combining diacritics in their passwords?

[xji, 2011/12/22 01:11:20]

Ben and I just talked about how to map obscured text and the underline text so
that the backspace/delete works on the  underline text on grapheme boundary.

Think it again. I think that is wrong.
For example, if the underline text is "abcd", while "ab" are 2 characters but
one grapheme. The obscured text is "****", when cursor is at "**|**", if moving
cursor left, we should not move cursor to "|****", which implies the first 2
"**" is one grapheme, it is probably against the security rule. The only one
thing obscured text tells about password should be how many characters in the
password, nothing more.

Maybe that is the reason why windows, gtk etc. all move cursor from "**|**" to
"*|***", and press "backspace" delete 'a' leaving the underline text as invalid.

I think we should do the same, instead of fancy stuff that works on underline
text grapheme boundary.

Just talked to an Arabic-speaking co-worker, and he consented.

But one thing he thinks is that we should show replacement characters on each
Unicode character, not on each UTF16 code point. 

[benrg, 2011/12/22 02:14:21]

xji wrote:
What I was thinking is that the obscured characters would be ***, the cursor
would initially be at *|** (equivalent to ab|cd in the underlying text), and
moving left would take it to |*** (equivalent to |abcd).

On the other hand, if you do it that way and you don't want to leak the number
of code points in the grapheme, then backspacing from *|** (ab|cd) has to take
you to |** (|cd), even though backspacing from ab|cd takes you to a|cd.

On the other other hand, displaying more than one asterisk per grapheme leaks
information too. Either way, you're leaking a length, and probably neither kind
of length is more sensitive than the other. I think that a strong password would
not be significantly weakened by disclosure of any of this information.

As we also discussed, both Windows and GTK do it the easy (to implement) way,
which may be enough justification for doing it that way ourselves. Presumably,
if anyone actually cared, Windows and/or GTK would have been "fixed" by now.

+    std::fill(txt.begin(), txt.end(), kPasswordReplacementChar);
+  }
+  return txt;
+}
+
 void RenderText::ToggleInsertMode() {
   insert_mode_ = !insert_mode_;
   cached_bounds_and_offset_valid_ = false;
 }
 
+void RenderText::SetObscured(bool obscured) {
+  obscured_ = obscured;
+  cached_bounds_and_offset_valid_ = false;
+  UpdateLayout();
+}
+
 void RenderText::SetDisplayRect(const Rect& r) {
   display_rect_ = r;
   cached_bounds_and_offset_valid_ = false;
   UpdateLayout();
 }
 
 size_t RenderText::GetCursorPosition() const {
   return selection_model_.selection_end();
 }
 
@@ skipping 121 matching lines @@
 
 void RenderText::SelectAll() {
   SelectionModel sel(RightEndSelectionModel());
   sel.set_selection_start(LeftEndSelectionModel().selection_start());
   SetSelectionModel(sel);
 }
 
 void RenderText::SelectWord() {
   size_t cursor_position = GetCursorPosition();
 
-  base::i18n::BreakIterator iter(text(), base::i18n::BreakIterator::BREAK_WORD);
+  string16 txt = GetObscuredText();
+  base::i18n::BreakIterator iter(txt, base::i18n::BreakIterator::BREAK_WORD);
   bool success = iter.Init();
   DCHECK(success);
   if (!success)
     return;
 
   size_t selection_start = cursor_position;
   for (; selection_start != 0; --selection_start) {
     if (iter.IsStartOfWord(selection_start) ||
         iter.IsEndOfWord(selection_start))
       break;
   }
 
   if (selection_start == cursor_position)
     ++cursor_position;
 
-  for (; cursor_position < text().length(); ++cursor_position) {
+  for (; cursor_position < txt.length(); ++cursor_position) {
     if (iter.IsEndOfWord(cursor_position) ||
         iter.IsStartOfWord(cursor_position))
       break;
   }
 
   MoveCursorTo(selection_start, false);
   MoveCursorTo(cursor_position, true);
 }
 
 const ui::Range& RenderText::GetCompositionRange() const {
@@ skipping 31 matching lines @@
   cached_bounds_and_offset_valid_ = false;
   UpdateLayout();
 }
 
 base::i18n::TextDirection RenderText::GetTextDirection() {
   if (base::i18n::IsRTL())
     return base::i18n::RIGHT_TO_LEFT;
   return base::i18n::LEFT_TO_RIGHT;
 }
 
-int RenderText::GetStringWidth() {
-  return default_style_.font.GetStringWidth(text());
-}
-
 void RenderText::Draw(Canvas* canvas) {
   EnsureLayout();
 
   if (!text().empty()) {
     DrawSelection(canvas);
     DrawVisualText(canvas);
   }
   DrawCursor(canvas);
 }
 
-SelectionModel RenderText::FindCursorPosition(const Point& point) {
-  const Font& font = default_style_.font;
-  int left = 0;
-  int left_pos = 0;
-  int right = font.GetStringWidth(text());
-  int right_pos = text().length();
-
-  int x = point.x() - (display_rect_.x() + GetUpdatedDisplayOffset().x());
-  if (x <= left) return SelectionModel(left_pos);
-  if (x >= right) return SelectionModel(right_pos);
-  // binary searching the cursor position.
-  // TODO(oshima): use the center of character instead of edge.
-  // Binary search may not work for language like Arabic.
-  while (std::abs(static_cast<long>(right_pos - left_pos)) > 1) {
-    int pivot_pos = left_pos + (right_pos - left_pos) / 2;
-    int pivot = font.GetStringWidth(text().substr(0, pivot_pos));
-    if (pivot < x) {
-      left = pivot;
-      left_pos = pivot_pos;
-    } else if (pivot == x) {
-      return SelectionModel(pivot_pos);
-    } else {
-      right = pivot;
-      right_pos = pivot_pos;
-    }
-  }
-  return SelectionModel(left_pos);
-}
-
 const Rect& RenderText::GetUpdatedCursorBounds() {
   UpdateCachedBoundsAndOffset();
   return cursor_bounds_;
 }
 
 size_t RenderText::GetIndexOfNextGrapheme(size_t position) {
   return IndexOfAdjacentGrapheme(position, true);
 }
 
 SelectionModel RenderText::GetSelectionModelForSelectionStart() {
@@ skipping 12 matching lines @@
 
 RenderText::RenderText()
     : text_(),
       selection_model_(),
       cursor_bounds_(),
       cursor_visible_(false),
       insert_mode_(true),
       composition_range_(ui::Range::InvalidRange()),
       style_ranges_(),
       default_style_(),
+      obscured_(false),
       display_rect_(),
       display_offset_(),
       cached_bounds_and_offset_valid_(false) {
 }
 
 const Point& RenderText::GetUpdatedDisplayOffset() {
   UpdateCachedBoundsAndOffset();
   return display_offset_;
 }
 
-SelectionModel RenderText::GetLeftSelectionModel(const SelectionModel& current,
-                                                 BreakType break_type) {
-  if (break_type == LINE_BREAK)
-    return LeftEndSelectionModel();
-  size_t pos = std::max(static_cast<long>(current.selection_end() - 1),
-                        static_cast<long>(0));
-  if (break_type == CHARACTER_BREAK)
-    return SelectionModel(pos, pos, SelectionModel::LEADING);
-
-  // Notes: We always iterate words from the beginning.
-  // This is probably fast enough for our usage, but we may
-  // want to modify WordIterator so that it can start from the
-  // middle of string and advance backwards.
-  base::i18n::BreakIterator iter(text(), base::i18n::BreakIterator::BREAK_WORD);
-  bool success = iter.Init();
-  DCHECK(success);
-  if (!success)
-    return current;
-  while (iter.Advance()) {
-    if (iter.IsWord()) {
-      size_t begin = iter.pos() - iter.GetString().length();
-      if (begin == current.selection_end()) {
-        // The cursor is at the beginning of a word.
-        // Move to previous word.
-        break;
-      } else if (iter.pos() >= current.selection_end()) {
-        // The cursor is in the middle or at the end of a word.
-        // Move to the top of current word.
-        pos = begin;
-        break;
-      } else {
-        pos = iter.pos() - iter.GetString().length();
-      }
-    }
-  }
-
-  return SelectionModel(pos, pos, SelectionModel::LEADING);
-}
-
-SelectionModel RenderText::GetRightSelectionModel(const SelectionModel& current,
-                                                  BreakType break_type) {
-  if (text_.empty())
-    return SelectionModel(0, 0, SelectionModel::LEADING);
-  if (break_type == LINE_BREAK)
-    return RightEndSelectionModel();
-  size_t pos = std::min(current.selection_end() + 1, text().length());
-  if (break_type == CHARACTER_BREAK)
-    return SelectionModel(pos, pos, SelectionModel::LEADING);
-
-  base::i18n::BreakIterator iter(text(), base::i18n::BreakIterator::BREAK_WORD);
-  bool success = iter.Init();
-  DCHECK(success);
-  if (!success)
-    return current;
-  while (iter.Advance()) {
-    pos = iter.pos();
-    if (iter.IsWord() && pos > current.selection_end())
-      break;
-  }
-  return SelectionModel(pos, pos, SelectionModel::LEADING);
-}
-
-SelectionModel RenderText::LeftEndSelectionModel() {
-  return SelectionModel(0, 0, SelectionModel::LEADING);
-}
-
-SelectionModel RenderText::RightEndSelectionModel() {
-  size_t cursor = text().length();
-  size_t caret_pos = GetIndexOfPreviousGrapheme(cursor);
-  SelectionModel::CaretPlacement placement = (caret_pos == cursor) ?
-      SelectionModel::LEADING : SelectionModel::TRAILING;
-  return SelectionModel(cursor, caret_pos, placement);
-}
-
 void RenderText::SetSelectionModel(const SelectionModel& model) {
   DCHECK_LE(model.selection_start(), text().length());
   selection_model_.set_selection_start(model.selection_start());
   DCHECK_LE(model.selection_end(), text().length());
   selection_model_.set_selection_end(model.selection_end());
   DCHECK_LT(model.caret_pos(),
             std::max(text().length(), static_cast<size_t>(1)));
   selection_model_.set_caret_pos(model.caret_pos());
   selection_model_.set_caret_placement(model.caret_placement());
 
@@ skipping 99 matching lines @@
 void RenderText::DrawCursor(Canvas* canvas) {
   // Paint cursor. Replace cursor is drawn as rectangle for now.
   // TODO(msw): Draw a better cursor with a better indication of association.
   if (cursor_visible() && focused()) {
     Rect r(GetUpdatedCursorBounds());
     canvas->DrawRectInt(kCursorColor, r.x(), r.y(), r.width(), r.height());
   }
 }
 
 }  // namespace gfx