Views::Textfield: Prevent revealing password text.

ui/views/controls/textfield/textfield_model.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/views/controls/textfield/textfield_model.h"
 
 #include <algorithm>
 
 #include "base/logging.h"
 #include "base/macros.h"
@@ skipping 326 matching lines @@
     ConfirmCompositionText();
   size_t save = GetCursorPosition();
   MoveCursor(gfx::LINE_BREAK, render_text_->GetVisualDirectionOfLogicalEnd(),
              gfx::SELECTION_NONE);
   InsertText(new_text);
   render_text_->SetCursorPosition(save);
   ClearSelection();
 }
 
 bool TextfieldModel::Delete(bool add_to_kill_buffer) {
+  // |add_to_kill_buffer| should never be true for an obscured textfield.
+  DCHECK(!add_to_kill_buffer || !render_text_->obscured());
+
   if (HasCompositionText()) {
     // No undo/redo for composition text.
     CancelCompositionText();
     return true;
   }
+
   if (HasSelection()) {
     if (add_to_kill_buffer)
       SetKillBuffer(GetSelectedText());
     DeleteSelection();
     return true;
   }
   if (text().length() > GetCursorPosition()) {
     size_t cursor_position = GetCursorPosition();
     size_t next_grapheme_index = render_text_->IndexOfAdjacentGrapheme(
         cursor_position, gfx::CURSOR_FORWARD);
     gfx::Range range_to_delete(cursor_position, next_grapheme_index);
     if (add_to_kill_buffer)
       SetKillBuffer(GetTextFromRange(range_to_delete));
     ExecuteAndRecordDelete(range_to_delete, true);
     return true;
   }
   return false;
 }
 
 bool TextfieldModel::Backspace(bool add_to_kill_buffer) {
+  // |add_to_kill_buffer| should never be true for an obscured textfield.
+  DCHECK(!add_to_kill_buffer || !render_text_->obscured());
+
   if (HasCompositionText()) {
     // No undo/redo for composition text.
     CancelCompositionText();
     return true;
   }
+
   if (HasSelection()) {
     if (add_to_kill_buffer)
       SetKillBuffer(GetSelectedText());
     DeleteSelection();
     return true;
   }
   size_t cursor_position = GetCursorPosition();
   if (cursor_position > 0) {
     // Delete one code point, which may be two UTF-16 words.
     size_t previous_grapheme_index =
@@ skipping 36 matching lines @@
 bool TextfieldModel::MoveCursorTo(const gfx::Point& point, bool select) {
   if (HasCompositionText())
     ConfirmCompositionText();
   gfx::SelectionModel cursor = render_text_->FindCursorPosition(point);
   if (select)
     cursor.set_selection_start(render_text_->selection().start());
   return render_text_->MoveCursorTo(cursor);
 }
 
 base::string16 TextfieldModel::GetSelectedText() const {
-  return text().substr(render_text_->selection().GetMin(),
-                       render_text_->selection().length());
+  return GetTextFromRange(render_text_->selection());
 }
 
 void TextfieldModel::SelectRange(const gfx::Range& range) {
   if (HasCompositionText())
     ConfirmCompositionText();
   render_text_->SelectRange(range);
 }
 
 void TextfieldModel::SelectSelectionModel(const gfx::SelectionModel& sel) {
   if (HasCompositionText())
@@ skipping 401 matching lines @@
   render_text_->SetCursorPosition(new_cursor_pos);
   // TODO(oshima): Select text that was just undone, like Mac (but not GTK).
 }
 
 // static
 void TextfieldModel::ClearKillBuffer() {
   SetKillBuffer(base::string16());
 }
 
 }  // namespace views