Views::Textfield: Prevent revealing password text.

ui/views/controls/textfield/textfield_model.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/views/controls/textfield/textfield_model.h"
 
 #include <algorithm>
 
 #include "base/logging.h"
 #include "base/macros.h"
@@ skipping 331 matching lines @@
   render_text_->SetCursorPosition(save);
   ClearSelection();
 }
 
 bool TextfieldModel::Delete(bool add_to_kill_buffer) {
   if (HasCompositionText()) {
     // No undo/redo for composition text.
     CancelCompositionText();
     return true;
   }
+  // |add_to_kill_buffer| should never be true for an obscured textfield.

[Peter Kasting, 2016/09/20 17:29:30]

Nit: Why not DCHECK this atop the function instead of below the first block? 
Does that block sometimes violate this invariant?

Newline between this block and surrounding code (in this case, above)

[karandeepb, 2016/09/21 03:36:12]

Done.

+  DCHECK(!(add_to_kill_buffer && render_text_->obscured()));

[Peter Kasting, 2016/09/20 17:29:30]

Nit: Distribute "!" through and eliminate parens

[karandeepb, 2016/09/21 03:36:12]

Done.

+
   if (HasSelection()) {
     if (add_to_kill_buffer)
       SetKillBuffer(GetSelectedText());
     DeleteSelection();
     return true;
   }
   if (text().length() > GetCursorPosition()) {
     size_t cursor_position = GetCursorPosition();
     size_t next_grapheme_index = render_text_->IndexOfAdjacentGrapheme(
         cursor_position, gfx::CURSOR_FORWARD);
     gfx::Range range_to_delete(cursor_position, next_grapheme_index);
     if (add_to_kill_buffer)
       SetKillBuffer(GetTextFromRange(range_to_delete));
     ExecuteAndRecordDelete(range_to_delete, true);
     return true;
   }
   return false;
 }
 
 bool TextfieldModel::Backspace(bool add_to_kill_buffer) {
   if (HasCompositionText()) {
     // No undo/redo for composition text.
     CancelCompositionText();
     return true;
   }
+  // |add_to_kill_buffer| should never be true for an obscured textfield.
+  DCHECK(!(add_to_kill_buffer && render_text_->obscured()));

[Peter Kasting, 2016/09/20 17:29:30]

Same comments

[karandeepb, 2016/09/21 03:36:12]

Done.

+
   if (HasSelection()) {
     if (add_to_kill_buffer)
       SetKillBuffer(GetSelectedText());
     DeleteSelection();
     return true;
   }
   size_t cursor_position = GetCursorPosition();
   if (cursor_position > 0) {
     // Delete one code point, which may be two UTF-16 words.
     size_t previous_grapheme_index =
@@ skipping 36 matching lines @@
 bool TextfieldModel::MoveCursorTo(const gfx::Point& point, bool select) {
   if (HasCompositionText())
     ConfirmCompositionText();
   gfx::SelectionModel cursor = render_text_->FindCursorPosition(point);
   if (select)
     cursor.set_selection_start(render_text_->selection().start());
   return render_text_->MoveCursorTo(cursor);
 }
 
 base::string16 TextfieldModel::GetSelectedText() const {
-  return text().substr(render_text_->selection().GetMin(),
-                       render_text_->selection().length());
+  return GetTextFromRange(render_text_->selection());
 }
 
 void TextfieldModel::SelectRange(const gfx::Range& range) {
   if (HasCompositionText())
     ConfirmCompositionText();
   render_text_->SelectRange(range);
 }
 
 void TextfieldModel::SelectSelectionModel(const gfx::SelectionModel& sel) {
   if (HasCompositionText())
@@ skipping 401 matching lines @@
   render_text_->SetCursorPosition(new_cursor_pos);
   // TODO(oshima): Select text that was just undone, like Mac (but not GTK).
 }
 
 // static
 void TextfieldModel::ClearKillBuffer() {
   SetKillBuffer(base::string16());
 }
 
 }  // namespace views