Prevent passwords from being recorded during text conversion

* doc/lispref/commands.texi (Misc Events): Document new value of
text-conversion-style.

* java/org/gnu/emacs/EmacsService.java (EmacsService)
<IC_MODE_PASSWORD>: New constant.

* java/org/gnu/emacs/EmacsView.java (onCreateInputConnection):
Set TYPE_TEXT_VARIATION_PASSWORD and IME_FLAG_FORCE_ASII if mode
is IC_MODE_PASSWORD.

* lisp/subr.el (read-passwd): Set text-conversion-style to
`password'.

* src/androidgui.h (enum android_ic_mode): New value
ANDROID_IC_MODE_PASSWORD.

* src/androidterm.c (android_reset_conversion): Handle
`password'.

* src/buffer.c (syms_of_buffer)
<&BVAR (current_buffer, text_conversion_style)>: Update doc
string.

* src/textconv.c (syms_of_textconv) <Qpassword>: New DEFSYM.
<Vtext_conversion_edits>: Fix typos in doc string.

doc/lispref/commands.texi

@@ -2464,7 +2464,7 @@ buffer-local variable @code{text-conversion-style}, which determines
 how an input method that wishes to make edits to buffer contents will
 behave.
 
-This variable can have one of three values:
+This variable can have one of four values:
 
 @table @code
 @item nil
@@ -2475,6 +2475,13 @@ events will be sent instead of text conversion events.
 This means that the input method will be enabled, but @key{RET} will
 be sent whenever the input method wants to insert a new line.
 
+@item password
+This is largely identical to @code{action}, but also requests an input
+method capable of inserting ASCII characters and instructs it not to
+save input in locations from whence it might be subsequently retrieved
+by features of the input method unfit to handle sensitive information,
+such as text suggestions.
+
 @item t
 This, or any other value, means that the input method will be enabled
 and make edits followed by @code{text-conversion} events.

java/org/gnu/emacs/EmacsService.java

@@ -114,9 +114,10 @@ public final class EmacsService extends Service
   private ContentResolver resolver;
 
   /* Keep this in synch with androidgui.h.  */
-  public static final int IC_MODE_NULL   = 0;
-  public static final int IC_MODE_ACTION = 1;
-  public static final int IC_MODE_TEXT   = 2;
+  public static final int IC_MODE_NULL     = 0;
+  public static final int IC_MODE_ACTION   = 1;
+  public static final int IC_MODE_TEXT     = 2;
+  public static final int IC_MODE_PASSWORD = 3;
 
   /* Display metrics used by font backends.  */
   public DisplayMetrics metrics;

java/org/gnu/emacs/EmacsView.java

@@ -838,9 +838,16 @@ else if (child.getVisibility () != GONE)
 	EmacsNative.requestSelectionUpdate (window.handle);
       }
 
-    if (mode == EmacsService.IC_MODE_ACTION)
+    if (mode == EmacsService.IC_MODE_ACTION
+	|| mode == EmacsService.IC_MODE_PASSWORD)
       info.imeOptions |= EditorInfo.IME_ACTION_DONE;
 
+    if (mode == EmacsService.IC_MODE_PASSWORD)
+      {
+	info.imeOptions |= EditorInfo.IME_FLAG_FORCE_ASCII;
+	info.inputType  |= InputType.TYPE_TEXT_VARIATION_PASSWORD;
+      }
+
     /* Set the initial selection fields.  */
     info.initialSelStart = selection[0];
     info.initialSelEnd = selection[1];

lisp/subr.el

@@ -3405,6 +3405,10 @@ with Emacs.  Do not call it directly in your own packages."
        (+ i beg) (+ 1 i beg)
        'help-echo "C-u: Clear password\nTAB: Toggle password visibility"))))
 
+;; Actually in textconv.c.
+(defvar overriding-text-conversion-style)
+(declare-function set-text-conversion-style "textconv.c")
+
 (defun read-passwd (prompt &optional confirm default)
   "Read a password, prompting with PROMPT, and return it.
 If optional CONFIRM is non-nil, read the password twice to make sure.
@@ -3445,7 +3449,8 @@ by doing (clear-string STRING)."
             (add-hook 'post-command-hook #'read-passwd--hide-password nil t))
         (unwind-protect
             (let ((enable-recursive-minibuffers t)
-		  (read-hide-char (or read-hide-char ?*)))
+		  (read-hide-char (or read-hide-char ?*))
+                  (overriding-text-conversion-style 'password))
               (read-string prompt nil t default)) ; t = "no history"
           (when (buffer-live-p minibuf)
             (with-current-buffer minibuf
@@ -3457,7 +3462,10 @@ by doing (clear-string STRING)."
                            #'read-passwd--hide-password 'local)
               (kill-local-variable 'post-self-insert-hook)
               ;; And of course, don't keep the sensitive data around.
-              (erase-buffer))))))))
+              (erase-buffer)
+              ;; Then restore the previous text conversion style.
+              (when (fboundp 'set-text-conversion-style)
+                (set-text-conversion-style text-conversion-style)))))))))
 
 (defvar read-number-history nil
   "The default history for the `read-number' function.")
@@ -3867,10 +3875,6 @@ confusing to some users.")
                from--tty-menu-p)            ; invoked via TTY menu
            use-dialog-box)))
 
-;; Actually in textconv.c.
-(defvar overriding-text-conversion-style)
-(declare-function set-text-conversion-style "textconv.c")
-
 (defun y-or-n-p (prompt)
   "Ask user a \"y or n\" question.
 Return t if answer is \"y\" and nil if it is \"n\".

src/androidgui.h

@@ -618,9 +618,10 @@ enum android_lookup_status
 
 enum android_ic_mode
   {
-    ANDROID_IC_MODE_NULL   = 0,
-    ANDROID_IC_MODE_ACTION = 1,
-    ANDROID_IC_MODE_TEXT   = 2,
+    ANDROID_IC_MODE_NULL     = 0,
+    ANDROID_IC_MODE_ACTION   = 1,
+    ANDROID_IC_MODE_TEXT     = 2,
+    ANDROID_IC_MODE_PASSWORD = 3,
   };
 
 enum android_stack_mode

src/androidterm.c

@@ -6276,6 +6276,8 @@ android_reset_conversion (struct frame *f)
 
   if (NILP (style) || conversion_disabled_p ())
     mode = ANDROID_IC_MODE_NULL;
+  else if (EQ (style, Qpassword))
+    mode = ANDROID_IC_MODE_PASSWORD;
   else if (EQ (style, Qaction) || EQ (f->selected_window,
 				      f->minibuffer_window))
     mode = ANDROID_IC_MODE_ACTION;

src/buffer.c

@@ -5900,12 +5900,19 @@ Use Custom to set this variable and update the display.  */);
 						     text_conversion_style),
 		     Qnil,
     doc: /* How the on screen keyboard's input method should insert in this buffer.
+
 When nil, the input method will be disabled and an ordinary keyboard
 will be displayed in its place.
+
 When the symbol `action', the input method will insert text directly, but
 will send `return' key events instead of inserting new line characters.
 Any other value means that the input method will insert text directly.
 
+When the symbol `password', an input method capable of ASCII input will
+be enabled, and will not save entered text where it will be retrieved
+for text suggestions or other features not suited to handling sensitive
+information, in addition to reporting `return' as when `action'.
+
 If you need to make non-buffer local changes to this variable, use
 `overriding-text-conversion-style', which see.
 

src/textconv.c

@@ -2318,6 +2318,7 @@ void
 syms_of_textconv (void)
 {
   DEFSYM (Qaction, "action");
+  DEFSYM (Qpassword, "password");
   DEFSYM (Qtext_conversion, "text-conversion");
   DEFSYM (Qpush_mark, "push-mark");
   DEFSYM (Qunderline, "underline");
@@ -2325,7 +2326,7 @@ syms_of_textconv (void)
 	  "overriding-text-conversion-style");
 
   DEFVAR_LISP ("text-conversion-edits", Vtext_conversion_edits,
-    doc: /* List of buffers that were last edited as result of text conversion.
+    doc: /* List of buffers last edited as a result of text conversion.
 
 This list can be used while handling a `text-conversion' event to
 determine which changes have taken place.