From b61c04b28012069607ebd71a2b6449f4f83877ba Mon Sep 17 00:00:00 2001 From: Hojun-Cho Date: Tue, 18 Aug 2026 04:18:41 +0900 Subject: [PATCH] gtk: an entry hidden the older way is private too MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit isprivate() reads the GTK input purpose and nothing else, but the purpose is not the only way an application marks a password field, and it is not the older one. GTK 3.24.52, measured: gtk_entry_set_visibility(entry, FALSE) purpose stays FREE_FORM gtk_entry_set_input_purpose(PASSWORD) purpose PASSWORD so an entry hidden the first way looks like ordinary text to the module. This machine runs one. /usr/libexec/xfce-polkit, the XFCE authentication dialog, is up right now under GTK_IM_MODULE=strans, and its binary calls gtk_entry_set_visibility and never gtk_entry_set_input_purpose, so every password typed into it goes through the engine. Against the real daemon, in Korean mode: typed hunter2 stored ㅗㅕ숟ㄱ2 typed correcthorse stored 책ㄱㄷㅊ쇅ㄴㄷ typed P4ssw0rd stored ㅔ4ㄴㄵ0ㄱㅇ The field draws bullets, so nothing on screen says why the authentication failed -- except the pending syllable, which is drawn as itself: three keys into such an entry the old module leaves 한 on screen where the field should read ●●●. With this it reads ●●●, and the entry holds gks. set_visibility sends the input context no signal, so the question cannot be answered where the purpose is, in init and notify::input-purpose. It has to be asked at the key, of the client window, which is the entry's own: gdk_window_get_user_data on it returns the GtkEntry. fcitx5-gtk asks it the same way in all three of its GTK versions -- gtk3/fcitximcontext .cpp:1155-1162, under the comment "seems visibility != PASSWORD hint". It costs one field read and one type check per key, on a path that then does a socket round trip anyway. It does not cover XIM: that protocol has no attribute for this, and no fcitx5 frontend answers it either -- only its GTK and Qt client modules do -- so an X client reached over XIM still composes in its password field. Nor does it notice a "show password" box switched off in the middle of a composition: there is no signal for visibility, so the pending text stays in the daemon until the next focus change. Noticing that needs a signal connection on a widget the module does not own, which is a bigger thing than the hole is. The test is a live one and it earns its line: with the fix removed it says gtk_live_test: hidden-entry key reached daemon or did not commit Both guards were checked by removing them. Without GTK_IS_ENTRY the run takes a Gtk-CRITICAL and fails; without the im->win test it exits 139, on the stalled-peer context, which never gets a client window. An ishidden that always answers yes fails earlier still, at the initial protocol frames. Breaking the test's own helper so it hands back the toplevel's window instead of the entry's fails too, which is what says the assertion watches the right window rather than merely counting no events. That count is the one thing that had to be made deterministic. A new client window invalidates the caret, and the fake daemon records that frame on its own thread, so sampling the event count straight after set_client_window raced it: 2 failures in 8 runs. The block now waits for that frame and names it, and there were 0 in 20 after. 90 unit, check-live, check-stress and valgrind clean. Co-Authored-By: Claude Opus 5 (1M context) --- gtk/main.c | 14 +++++++++++- tests/gtk_live_test.c | 51 +++++++++++++++++++++++++++++++++++++++++-- 2 files changed, 62 insertions(+), 3 deletions(-) diff --git a/gtk/main.c b/gtk/main.c index 78dd8b1..c6819ff 100644 --- a/gtk/main.c +++ b/gtk/main.c @@ -243,6 +243,18 @@ sendreset(Im *im) g_signal_emit_by_name(im, "commit", commit); } +/* A password entry hidden the older way sets no purpose and signals nothing. */ +static int +ishidden(Im *im) +{ + GtkWidget *w; + + if(im->win == NULL) + return 0; + gdk_window_get_user_data(im->win, (gpointer*)&w); + return GTK_IS_ENTRY(w) && !gtk_entry_get_visibility(GTK_ENTRY(w)); +} + static gboolean kpress(GtkIMContext *ctx, GdkEventKey *ev) { @@ -264,7 +276,7 @@ kpress(GtkIMContext *ctx, GdkEventKey *ev) return simplefilter(ctx, ev, 0); key = ipckeysym(ev->keyval, gdk_keyval_to_unicode(ev->keyval)); mod = ipcmod(ev->state); - if(im->private || key == 0){ + if(im->private || ishidden(im) || key == 0){ r = simplefilter(ctx, ev, 0); /* A dead key starts a compose: pending text was typed first. */ if(im->simpleactive) diff --git a/tests/gtk_live_test.c b/tests/gtk_live_test.c index b49134a..873d54c 100644 --- a/tests/gtk_live_test.c +++ b/tests/gtk_live_test.c @@ -570,6 +570,25 @@ newwindow(int x, int y) return w; } +/* A GtkEntry gives its context a window of its own, under the toplevel's. */ +static GdkWindow* +entrywindow(GtkWidget *entry) +{ + GdkWindow *w; + GList *kids, *l; + gpointer u; + + w = NULL; + kids = gdk_window_get_children(gtk_widget_get_window(entry)); + for(l = kids; l != NULL; l = l->next){ + gdk_window_get_user_data(l->data, &u); + if(u == entry) + w = l->data; + } + g_list_free(kids); + return w; +} + #define Check(c, ...) do{ if(!(c)){ fail(__VA_ARGS__); goto out; } }while(0) int @@ -578,8 +597,8 @@ main(int argc, char **argv) Server srv; Siglog log; GtkIMContext *ctx, *oldctx, *badctx; - GtkWidget *top; - GdkWindow *win; + GtkWidget *top, *entry; + GdkWindow *win, *entrywin; GdkRectangle rect; Event e; static const GtkInputPurpose purposes[] = { @@ -757,6 +776,34 @@ main(int argc, char **argv) } g_object_set(ctx, "input-purpose", GTK_INPUT_PURPOSE_FREE_FORM, NULL); + + /* An entry hidden the older way is private too, purpose or no purpose. */ + entry = gtk_entry_new(); + gtk_container_add(GTK_CONTAINER(top), entry); + gtk_widget_show(entry); + pump(); + entrywin = entrywindow(entry); + Check(entrywin != NULL, "the test GtkEntry has no window of its own"); + first = eventcount(&srv); + gtk_im_context_set_client_window(ctx, entrywin); + /* The caret the new window invalidates must land before keys are counted. */ + Check(waitcount(&srv, first + 1) && getevent(&srv, first).type == Ecaret, + "the entry window did not renegotiate the caret"); + setpre(&srv, ""); + gtk_entry_set_visibility(GTK_ENTRY(entry), FALSE); + clearlog(&log); + first = eventcount(&srv); + Check(key(ctx, entrywin, GDK_KEY_y), "hidden-entry fallback did not commit"); + Check(eventcount(&srv) == first && strcmp(log.commit, "y") == 0, + "hidden-entry key reached daemon or did not commit"); + gtk_entry_set_visibility(GTK_ENTRY(entry), TRUE); + clearlog(&log); + first = eventcount(&srv); + Check(key(ctx, entrywin, GDK_KEY_y), "visible-entry key was not eaten"); + Check(waitcount(&srv, first + 1) && log.commit[0] == '\0', + "visible-entry key did not reach the daemon"); + gtk_im_context_set_client_window(ctx, win); + setpre(&srv, "reset"); clearlog(&log); Check(key(ctx, win, GDK_KEY_e), "reset setup key was not eaten");