1549394 - (CVE-2019-17018) Potential privacy leak from Win10 keyboard autocomplete of data entered in Private Browsing

Status: RESOLVED FIXED

(Core :: Widget: Win32, defect, P3)

Description

[Randell Jesup [:jesup] (needinfo me)]

Chrome is expected to fix a privacy leak from Incognito mode to normal browsing via the keyboard learning autocomplete data and exposing it in the normal browsing context. See https://hothardware.com/news/micrsoft-chromium-fixes (latter part).

Basically, we should be using IS_PRIVATE as the input scope in Private Browsing on windows to avoid the Win10 keyboard from learning from input and offering as corrections or autocomplete data when we're not in Private Browsing.

See https://docs.microsoft.com/en-us/windows/desktop/api/inputscope/ne-inputscope-inputscope

Comment 1

[:Gijs (he/him)]

AFAICT this would need to live in WinIMEHandler.cpp and TSFTextStore.cpp, and would be relatively straightforward to do once we figure out how to go from the window/widget ref to "is this window in private browsing".

Comment 2

[Daniel Veditz [:dveditz]]

We should also use it for password fields in NON-private browsing (unless we're using IS_PASSWORD and that does the same, although it's deprecated now).

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:jimm, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 4

[Makoto Kato [:m_kato]]

3 years ago, although I investigated IS_PRIVATE flag support for MS-IME, IME didn't see this flag and IME called LCIEIsCurrentProcessInPrivate to detect whether IE/Edge is private mode. If MS-IME supports IS_PRIVATE, we should support it.

When I test Chrome Canary 80 with Windows 10 Build 1903, incognito mode on Chrome won't change to IME private mode. And this is same result even if using Insider build 18990.

Comment 5

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Makoto-san, currently, MS-IME is being redesigned as you know. How about to request it via Feedback Hub? If you file it, I'll tell the feedback URL to the engineers.

Comment 6

[Makoto Kato [:m_kato]]

(In reply to Masayuki Nakano [:masayuki] (he/him)(JST, +0900) from comment #5)

Makoto-san, currently, MS-IME is being redesigned as you know. How about to request it via Feedback Hub? If you file it, I'll tell the feedback URL to the engineers.

https://aka.ms/AA6eu0q

When I talked with Yukawa-san when he came to Japan, he said, "Although I approved this patch, I didn't know whether MS-IME supported private mode by IS_PRIVATE really."

Comment 8

[Makoto Kato [:m_kato]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=d7df176b91caf8ef1f7a59bccd1cad647b699855

Comment 9

[Makoto Kato [:m_kato]]

Attachment: Bug 1549394 - Part 1. Clean up input scope support for IMM32.

Use AutoTArray to set input scope.

Comment 10

[Makoto Kato [:m_kato]]

Attachment: Bug 1549394 - Part 2. Set IS_PRIVATE input scope in private browsing.

Microsoft IME on Windows 10 20H1 (build 19025+) supports IME private mode by
input scope. Although previous Windows version uses undocumented API for
Edge and IE only, next Windows will use public API for it.

So let's use IS_PRIVATE input scope in private browsing mode.

Depends on D53917

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/fb2f4ca36af4
Part 1. Clean up input scope support for IMM32. r=masayuki
https://hg.mozilla.org/integration/autoland/rev/5da3dcd12b69
Part 2. Set IS_PRIVATE input scope in private browsing. r=masayuki

Comment 12

[Cristian Brindusan [:cbrindusan]]

Backed out 2 changesets (bug 1549394) for MinGW bustages at TSFTextStore.cpp.

Push with failures: https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=pending%2Crunning%2Csuccess%2Ctestfailed%2Cbusted%2Cexception&revision=5da3dcd12b69775a4479f3589a886aaebdbdb41a&selectedJob=277327480

Failure log: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=277327480&repo=autoland&lineNumber=73741

Comment 13

[Tom Ritter [:tjr]]

Sorry for the mingw failure. We had a similar one of these recently, you can follow that pattern to fix it.

File a bug like Bug 1597739 blocking mingw-clang
Stick in a mingw hack-around: https://hg.mozilla.org/mozilla-central/rev/ba86d1b7d2a5

Comment 14

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/85e1dc70361e
Backed out 2 changesets for MinGW bustages at TSFTextStore.cpp. CLOSED TREE

Comment 15

[Makoto Kato [:m_kato]]

MinGW doesn't have IS_PRIVATE (Why?). So re-landed this using MINGW32

Comment 16

[Makoto Kato [:m_kato]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=d425733b85e8369f9543a34e6b8d3b143064eeb3

Comment 17

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4cbaf7e27c2e
Part 1. Clean up input scope support for IMM32. r=masayuki
https://hg.mozilla.org/integration/autoland/rev/f081bea8c605
Part 2. Set IS_PRIVATE input scope in private browsing. r=masayuki

Comment 18

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/4cbaf7e27c2e
https://hg.mozilla.org/mozilla-central/rev/f081bea8c605

Comment 19

[Tom Ritter [:tjr]]

Attachment: advisory.txt

Comment 20

[Tom Ritter [:tjr]]

Attachment: advisory.txt