Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8358813

JPasswordField identifies spaces in password via delete shortcuts

XMLWordPrintable

    • b10
    • generic
    • os_x

        ADDITIONAL SYSTEM INFORMATION :
        Observed using Aqua L&F on Mac, using JDK25

        A DESCRIPTION OF THE PROBLEM :
        Other tickets (such as 8354646, 6191897) point out that users should not be able to identify where spaces are in a JPasswordField.

        On Mac I'm still able to identify some information about whitespace with keyboard shortcuts like ALT + BACKSPACE.

        (I haven't tested this on other L&Fs yet.)

        I think (?) resolving this may involve updating getPasswordFieldInputMap()

        STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
        Run the attached source code. If it identifies KeyStrokes: try using those in the JPasswordField to identify where spaces are in the in password.

        EXPECTED VERSUS ACTUAL BEHAVIOR :
        EXPECTED -
        No keystrokes should help you identify where spaces are in the password. (This test should probably not even output KeyStrokes to the console.)
        ACTUAL -
        The test writes this to the console, and each keyboard shortcuts identifies word boundaries:

        ```
        delete-previous-word (alt pressed BACK_SPACE)
        delete-previous-word (ctrl pressed W)
        delete-next-word (alt pressed DELETE)


        Try using the above KeyStrokes to identify the boundary of words in the JPasswordField
        ```

        ---------- BEGIN SOURCE ----------

        import javax.swing.*;
        import javax.swing.text.DefaultEditorKit;
        import java.awt.event.ActionEvent;

        public class PasswordSelectionWordTest {
            public static void main(String[] args) throws Exception {
                SwingUtilities.invokeAndWait(() -> {
                    String str = "one two three";
                    JPasswordField field = new JPasswordField(str);

                    boolean foundSuspiciousInputs = false;
                    for (int condition : new int[] {
                            JComponent.WHEN_IN_FOCUSED_WINDOW,
                            JComponent.WHEN_FOCUSED,
                            JComponent.WHEN_ANCESTOR_OF_FOCUSED_COMPONENT
                    }) {
                        InputMap inputMap = field.getInputMap(condition);
                        if (inputMap.allKeys() == null)
                            continue;
                        for (KeyStroke keyStroke : inputMap.allKeys()) {
                            Object actionBinding = inputMap.get(keyStroke);
                            if (String.valueOf(actionBinding).contains("word")) {
                                System.out.println(inputMap.get(keyStroke) + " (" + keyStroke + ")");
                                foundSuspiciousInputs = true;
                            }
                        }
                    }

                    if (!foundSuspiciousInputs) {
                        System.out.println("No suspicious KeyStrokes detected; this test passes.");
                        System.exit(0);
                    }
                    System.out.println("\n\nTry using the above KeyStrokes to identify the boundary of words in the JPasswordField");


                    JFrame f = new JFrame();
                    f.getContentPane().add(field);
                    f.pack();
                    f.setVisible(true);
                });
            }
        }

        ---------- END SOURCE ----------

              jwood Jeremy Wood
              webbuggrp Webbug Group
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: