New issue
Advanced search Search tips

Issue 873816 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Aug 17
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug



Sign in to add a comment

We shouldn't allow line breaks in the middle of obfuscated credit card numbers

Project Member Reported by ftirelo@chromium.org, Aug 13

Issue description

Chrome Version: 70.0.3519.0+
OS: All

What steps will reproduce the problem?
(1) Enable credit cards autofill in chrome://settings/payments and credit cards sync'ing in chrome://settings/syncSetup.
(2) Add one *expired* credit card to Google Pay; double check that a copy is not saved in chrome (you can check and remove the local copy in chrome://settings/payments).
(3) Navigate to https://dump-truck.appspot.com/usecase-address_and_cc_on_same_page/address_and_cc.html
(4) Click on the "Name on card" field and accept the Google Pay expired credit card suggestion - a prompt to update expiration date and enter the CVC will show up.

What is the expected result?

Obfuscated credit card number (e.g. ****1234) should be in a single line - see screenshot.

What happens instead?

There is a line break inside the  (e.g. ****1234) should be in a single line.

 
CVC dialog current.PNG
77.6 KB View Download
Screenshot for https://chromium-review.googlesource.com/c/chromium/src/+/1173338
CVC dialog with NNBSP.PNG
77.6 KB View Download
Labels: Target-70 FoundIn-70
Final screenshots for comparison:
 - without WORD-JOINER: what we had before crrev.com/c/1173338
 - with WORD-JOINER: what we have with crrev.com/c/1173338

Final diff - with WORD-JOINER.PNG
36.5 KB View Download
Final diff - without WORD-JOINER.PNG
36.5 KB View Download
Project Member

Comment 4 by bugdroid1@chromium.org, Aug 17

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/826358715d4fb9623b5fcc825423fe6c0b68a5f4

commit 826358715d4fb9623b5fcc825423fe6c0b68a5f4
Author: Fabio Tirelo <ftirelo@chromium.org>
Date: Fri Aug 17 15:41:54 2018

[Card unmask dialog] Use non-breakable space for number obfuscation

This is a PE fix for the CVC dialog.

The current credit card number obfuscation approach uses U+2006
(SIX-PER-EM SPACE) to add a small space between bullets and between
the last bullet and the first unobfuscated digit. However, that
character works as a simple space and allows line breaks inside the
obfuscated number on multiline dialog titles.

This CL adds U+2060 (WORD-JOINER) characters between bullets and
spaces in the obfuscated strings, so they can't be broken into
separate lines. A previous version tried to use U+202F (NARROW
NO-BREAK SPACE), but unfortunately the result looked too spacey on
Android. The new character is invisible, so the only visual change
is that now obfuscated numbers can't be broken.

Screenshots in the bug.

Bug:  873816 
Change-Id: I927be848d2f63a5a76486668baebe64e7eb304f6
Reviewed-on: https://chromium-review.googlesource.com/1173338
Reviewed-by: Rouslan Solomakhin <rouslan@chromium.org>
Reviewed-by: Roger McFarlane <rogerm@chromium.org>
Commit-Queue: Fabio Tirelo <ftirelo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#584084}
[modify] https://crrev.com/826358715d4fb9623b5fcc825423fe6c0b68a5f4/chrome/android/javatests/src/org/chromium/chrome/browser/autofill/PersonalDataManagerTest.java
[modify] https://crrev.com/826358715d4fb9623b5fcc825423fe6c0b68a5f4/chrome/android/javatests/src/org/chromium/chrome/browser/payments/PaymentRequestPaymentAppAndCardsTest.java
[modify] https://crrev.com/826358715d4fb9623b5fcc825423fe6c0b68a5f4/chrome/android/javatests/src/org/chromium/chrome/browser/payments/PaymentRequestPaymentAppsSortingTest.java
[modify] https://crrev.com/826358715d4fb9623b5fcc825423fe6c0b68a5f4/components/autofill/core/browser/credit_card.cc

Status: Fixed (was: Assigned)

Sign in to add a comment