Make Android Clipboard Keep Track of Last Modified Time

ui/android/java/src/org/chromium/ui/base/Clipboard.java

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 package org.chromium.ui.base;
 
 import android.content.ClipData;
 import android.content.ClipboardManager;
 import android.content.Context;
 
+import org.chromium.base.Log;
 import org.chromium.base.annotations.CalledByNative;
 import org.chromium.base.annotations.JNINamespace;
 import org.chromium.base.annotations.SuppressFBWarnings;
+import org.chromium.base.metrics.RecordHistogram;
+import org.chromium.base.metrics.RecordUserAction;
 import org.chromium.ui.R;
 import org.chromium.ui.widget.Toast;
 
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.Arrays;
+
 /**
  * Simple proxy that provides C++ code with an access pathway to the Android
  * clipboard.
  */
 @JNINamespace("ui")
-public class Clipboard {
+public class Clipboard implements ClipboardManager.OnPrimaryClipChangedListener {
+    private static final String TAG = "Clipboard";
+
     // Necessary for coercing clipboard contents to text if they require
     // access to network resources, etceteras (e.g., URI in clipboard)
     private final Context mContext;
 
     private final ClipboardManager mClipboardManager;
 
+    // A message hasher that's used to hash clipboard contents so we can tell
+    // when a clipboard changes without storing the full contents.
+    private MessageDigest mMd5Hasher;
+    // The hash of the current clipboard.
+    private byte[] mClipboardMd5;
+    // The time when the clipboard was last updated.  Set to 0 if unknown.
+    private long mClipboardChangeTime;
+
     /**
      * Use the factory constructor instead.
      *
      * @param context for accessing the clipboard
      */
     public Clipboard(final Context context) {
         mContext = context;
         mClipboardManager = (ClipboardManager)
                 context.getSystemService(Context.CLIPBOARD_SERVICE);
+        mClipboardManager.addPrimaryClipChangedListener(this);
+        try {
+            mMd5Hasher = MessageDigest.getInstance("MD5");
+            mClipboardMd5 = weakMd5Hash();
+        } catch (NoSuchAlgorithmException e) {
+            Log.e(TAG,
+                    "Unable to construct MD5 MessageDigest: %s; assume "
+                            + "clipboard last update time is start of epoch.",
+                    e);
+            mMd5Hasher = null;
+            mClipboardMd5 = new byte[] {};
+        }
+        RecordHistogram.recordBooleanHistogram("Clipboard.ConstructedHasher", mMd5Hasher != null);
+        mClipboardChangeTime = 0;
     }
 
     /**
      * Returns a new Clipboard object bound to the specified context.
      *
      * @param context for accessing the clipboard
      * @return the new object
      */
     @CalledByNative
     private static Clipboard create(final Context context) {
@@ skipping 42 matching lines @@
         // getPrimaryClip() has been observed to throw unexpected exceptions for some devices (see
         // crbug/654802 and b/31501780)
         try {
             return mClipboardManager.getPrimaryClip().getItemAt(0).getHtmlText();
         } catch (Exception e) {
             return null;
         }
     }
 
     /**
+     * Gets the time the clipboard content last changed.
+     *
+     * This is calculated according to the device's clock.  E.g., it continues

[Ted C, 2017/03/23 20:59:31]

Although this file isn't consistent, we wrap at 100 chars for javadocs normally

[Mark P, 2017/03/23 23:40:32]

Yeah, I actually had this file originally at 100 chars, then noticed the
majority of the comments here wrapped at 80 and decided to go with local
consistency.

Let me know if you want me to reformat everything...?

+     * increasing when the device is suspended.  Likewise, it can be in the
+     * future if the user's clock updated after this information was recorded.
+     *
+     * @return a Java long recording the last changed time in milliseconds since
+     * epoch, or 0 if the time could not be determined.
+     */
+    @CalledByNative
+    public long getClipboardContentChangeTimeInMillis() {
+        return mClipboardChangeTime;
+    }
+
+    /**
      * Emulates the behavior of the now-deprecated
      * {@link android.text.ClipboardManager#setText(CharSequence)}, setting the
      * clipboard's current primary clip to a plain-text clip that consists of
      * the specified string.
      * @param text  will become the content of the clipboard's primary clip
      */
     @SuppressFBWarnings("UPM_UNCALLED_PRIVATE_METHOD")
     @CalledByNative
     public void setText(final String text) {
         setPrimaryClipNoException(ClipData.newPlainText("text", text));
@@ skipping 24 matching lines @@
 
     private void setPrimaryClipNoException(ClipData clip) {
         try {
             mClipboardManager.setPrimaryClip(clip);
         } catch (Exception ex) {
             // Ignore any exceptions here as certain devices have bugs and will fail.
             String text = mContext.getString(R.string.copy_to_clipboard_failure_message);
             Toast.makeText(mContext, text, Toast.LENGTH_SHORT).show();
         }
     }
+
+    /**
+     * Updates mClipboardMd5 and mClipboardChangeTime when the clipboard updates.
+     *
+     * Implements OnPrimaryClipChangedListener to listen for clipboard updates.
+     */
+    @Override
+    public void onPrimaryClipChanged() {
+        if (mMd5Hasher == null) {

[Ted C, 2017/03/23 20:59:31]

in javaland, you can put the statement and conditional all on a single line if
it fits and reads ok (although I don't recall if git cl format complains these
days...which I should file a bug for).

[Mark P, 2017/03/23 23:40:32]

Done.

+            return;
+        }
+        RecordUserAction.record("MobileOmniboxClipboardChanged");
+        mClipboardMd5 = weakMd5Hash();
+        // Always update the clipboard change time even if the clipboard
+        // content hasn't changed.  This is because if the user put something
+        // in the clipboard recently (even if it was not necessary because it
+        // was already there), that content should be considered recent.
+        mClipboardChangeTime = System.currentTimeMillis();

[Ted C, 2017/03/23 20:59:31]

Are we persisting this across cold starts?  If not, I would recommend
https://developer.android.com/reference/android/os/SystemClock.html#uptimeMil...

or

https://developer.android.com/reference/android/os/SystemClock.html#elapsedRe...

which are monotonically increasing and avoids time travel backwards.  But that
only works if you use this same value for comparison but it looks like we are
passing the time to native and it is likely comparing against a similar behavior
as System.currentTimeMillis (where we could use these clocks, but we'd need to
be reporting clipboard age instead of time)

[Mark P, 2017/03/23 23:40:32]

Yes, that's the intention.  It's not there at the moment.  I'll add it in
another changelist, per this changelist description.

+    }
+
+    /**
+     * Returns a weak hash of getCoercedText().
+     *
+     * @return a Java byte[] with the weak hash.
+     */
+    private byte[] weakMd5Hash() {
+        if (getCoercedText() == null) {
+            return new byte[] {};
+        }
+        // Compute a hash consisting of the first 4 bytes of the MD5 hash of
+        // getCoercedText().  This value is used to detect clipboard content
+        // change. Keeping only 4 bytes is a privacy requirement to introduce
+        // collision and allow deniability of having copied a given string.
+        return Arrays.copyOfRange(mMd5Hasher.digest(getCoercedText().getBytes()), 0, 4);

[Ted C, 2017/03/23 20:59:31]

We want to use MD5 here because it gives a consistent/unpredictability compared
to something like Object#hashCode from java?

[Mark P, 2017/03/23 23:40:32]

I didn't think through this at all.  This comment and reasoning comes from the
iOS implementation of this same feature.  I suppose I can open the question with
legal about whether they think the Java's hash function is good enough.  If you
push me, I will, though obviously I'd rather not jump through that hoop.

+    }
 }