Issue #1348 - Part 3: Set IS_PRIVATE input scope in private browsing.

Microsoft IME on Windows 10 20H1 (build 19025+) supports IME private
mode by input scope. Although previous Windows versions use an
undocumented API for Edge and IE only, the next Windows 10 release will
use a public API for it.
We pre-empt this potential privacy concern by setting the IS_PRIVATE
flag when in PB mode.

4 files changed, 28 insertions, 9 deletions

diff --git a/widget/windows/TSFTextStore.cpp b/widget/windows/TSFTextStore.cpp
index c80de831c9..12b8cd0c11 100644
--- a/widget/windows/TSFTextStore.cpp
+++ b/widget/windows/TSFTextStore.cpp
@@ -1355,7 +1355,9 @@ TSFTextStore::Init(nsWindowBase* aWidget,
     return false;
   }
 
-  SetInputScope(aContext.mHTMLInputType, aContext.mHTMLInputInputmode);
+  SetInputScope(aContext.mHTMLInputType,
+                aContext.mHTMLInputInputmode,
+                aContext.mInPrivateBrowsing);
 
   // Create document manager
   RefPtr<ITfThreadMgr> threadMgr = sThreadMgr;
@@ -3205,9 +3207,15 @@ TSFTextStore::InsertEmbedded(DWORD dwFlags,
 
 void
 TSFTextStore::SetInputScope(const nsString& aHTMLInputType,
-                            const nsString& aHTMLInputInputMode)
+                            const nsString& aHTMLInputInputMode,
+                            bool aInPrivateBrowsing)
 {
   mInputScopes.Clear();
+  
+  if (aInPrivateBrowsing) {
+    mInputScopes.AppendElement(IS_PRIVATE);
+  }
+  
   if (aHTMLInputType.IsEmpty() || aHTMLInputType.EqualsLiteral("text")) {
     if (aHTMLInputInputMode.EqualsLiteral("url")) {
       mInputScopes.AppendElement(IS_URL);
@@ -5688,7 +5696,8 @@ TSFTextStore::SetInputContext(nsWindowBase* aWidget,
     if (sEnabledTextStore) {
       RefPtr<TSFTextStore> textStore(sEnabledTextStore);
       textStore->SetInputScope(aContext.mHTMLInputType,
-                               aContext.mHTMLInputInputmode);
+                               aContext.mHTMLInputInputmode,
+                               aContext.mInPrivateBrowsing);
     }
     return;
   }
diff --git a/widget/windows/TSFTextStore.h b/widget/windows/TSFTextStore.h
index 9596510d51..d1431e95d6 100644
--- a/widget/windows/TSFTextStore.h
+++ b/widget/windows/TSFTextStore.h
@@ -355,7 +355,8 @@ protected:
                               ULONG aFilterCount,
                               const TS_ATTRID* aFilterAttrs);
   void     SetInputScope(const nsString& aHTMLInputType,
-                         const nsString& aHTMLInputInputmode);
+                         const nsString& aHTMLInputInputmode,
+                         bool aInPrivateBrowsing);
 
   // Creates native caret over our caret.  This method only works on desktop
   // application.  Otherwise, this does nothing.
diff --git a/widget/windows/WinIMEHandler.cpp b/widget/windows/WinIMEHandler.cpp
index 99f0fb1363..9debaa2dda 100644
--- a/widget/windows/WinIMEHandler.cpp
+++ b/widget/windows/WinIMEHandler.cpp
@@ -409,7 +409,7 @@ IMEHandler::OnDestroyWindow(nsWindow* aWindow)
   if (!sIsInTSFMode) {
     // MSDN says we need to set IS_DEFAULT to avoid memory leak when we use
     // SetInputScopes API. Use an empty string to do this.
-    SetInputScopeForIMM32(aWindow, EmptyString(), EmptyString());
+    SetInputScopeForIMM32(aWindow, EmptyString(), EmptyString(), false);
   }
 #endif // #ifdef NS_ENABLE_TSF
   AssociateIMEContext(aWindow, true);
@@ -481,8 +481,10 @@ IMEHandler::SetInputContext(nsWindow* aWindow,
     }
   } else {
     // Set at least InputScope even when TextStore is not available.
-    SetInputScopeForIMM32(aWindow, aInputContext.mHTMLInputType,
-                          aInputContext.mHTMLInputInputmode);
+    SetInputScopeForIMM32(aWindow,
+                          aInputContext.mHTMLInputType,
+                          aInputContext.mHTMLInputInputmode,
+                          aInputContext.mInPrivateBrowsing);
   }
 #endif // #ifdef NS_ENABLE_TSF
 
@@ -583,12 +585,18 @@ IMEHandler::OnKeyboardLayoutChanged()
 void
 IMEHandler::SetInputScopeForIMM32(nsWindow* aWindow,
                                   const nsAString& aHTMLInputType,
-                                  const nsAString& aHTMLInputInputmode)
+                                  const nsAString& aHTMLInputInputmode,
+                                  bool aInPrivateBrowsing)
 {
   if (sIsInTSFMode || !sSetInputScopes || aWindow->Destroyed()) {
     return;
   }
   AutoTArray<InputScope, 3> scopes;
+
+  if (aInPrivateBrowsing) {
+    scopes.AppendElement(IS_PRIVATE);
+  }
+
   // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-input-element.html
   if (aHTMLInputType.IsEmpty() || aHTMLInputType.EqualsLiteral("text")) {
     if (aHTMLInputInputmode.EqualsLiteral("url")) {
diff --git a/widget/windows/WinIMEHandler.h b/widget/windows/WinIMEHandler.h
index c18a4437e8..c836e86269 100644
--- a/widget/windows/WinIMEHandler.h
+++ b/widget/windows/WinIMEHandler.h
@@ -144,7 +144,8 @@ private:
   static decltype(SetInputScopes)* sSetInputScopes;
   static void SetInputScopeForIMM32(nsWindow* aWindow,
                                     const nsAString& aHTMLInputType,
-                                    const nsAString& aHTMLInputInputmode);
+                                    const nsAString& aHTMLInputInputmode,
+                                    bool aInPrivateBrowsing);
   static bool sIsInTSFMode;
   // If sIMMEnabled is false, any IME messages are not handled in TSF mode.
   // Additionally, IME context is always disassociated from focused window.