IssueTracker

Android Studio 4.0 Canary 1
Build #AI-192.6817.14.36.5959023, built on October 22, 2019
Runtime version: 1.8.0_212-release-1586-b4-5784211 amd64
VM: OpenJDK 64-Bit Server VM by JetBrains s.r.o
Linux 5.0.0-32-generic
GC: ParNew, ConcurrentMarkSweep
Memory: 1981M
Cores: 8
Registry: ide.new.welcome.screen.force=true, debugger.watches.in.variables=false
Non-Bundled Plugins: CheckStyle-IDEA

Version of Gradle Plugin: 4.0.0-alpha01
Version of Gradle: 5.6.1
Version of Kotlin: 1.3.60-eap-25
OS: Ubuntu 19.04

-----------

Steps to Reproduce:
1. UnZIP the attached project and import it into Android Studio
2. Run the app
3. Start recording a screencast (e.g., from Android Studio)
4. Tap the "Show Popup" button to show an empty Popup
5. Wait a moment
6. Tap the "Show Popup" button again to dismiss that Popup
7. Stop recording the screencast
8. Look at the screencast

Expected Results: The screencast to be completely empty, as we are recording the functionality of an activity that has FLAG_SECURE set

Actual Results: The Popup appears in the screencast when that "Show Popup" button was clicked, and vanishes from the screencast when that "Show Popup" button was clicked again

The attached MP4 is a screencast taken of this app, using a Pixel 4 running Android 10.

----

If you are going to create a Window with WindowManager, you need to see whether we are in a secure window now and propagate that secure status. Otherwise, we wind up in the same situation that we have with the View-based UI framework, where FLAG_SECURE misses lots of content (menus, Spinner, dialogs, toasts, etc.), because we do not control those windows and cannot set FLAG_SECURE on them. See https://github.com/commonsguy/cwac-security/blob/master/docs/FLAGSECURE.md and https://issuetracker.google.com/issues/37100029 for historical context.

PopupLayout has access to composeView. If that View is owned by an activity, you can find the activity's window, see if it has FLAG_SECURE set upon it, and if so put FLAG_SECURE on the window created by the PopupLayout. This is not ideal, as it will not handle some edge cases (e.g., composeView is not owned by an activity) but AFAIK there is no way for a View to get its Window (or that window's flags) in all cases.

A more flexible possibility is to have a WindowSecurityPolicy enum, with values like:

- NORMAL for an insecure window
- SECURE for a secure window
- INHERIT to use the aforementioned "see what the current window uses" approach

Then, have Popup() take a WindowSecurityPolicy parameter, defaulted to INHERIT. This would allow developers that are directly calling Popup() to positively specify a policy if desired. If the policy is SECURE, or it is INHERIT and the current window has FLAG_SECURE set, apply FLAG_SECURE to the window created by the Popup.

My concern with Popup in particular is that it might get used elsewhere within the Compose libraries. If Popup (and DropdownPopup) were only ever going to be used directly by outside developers, you could say that it is up to us to implement SecurePopup and SecureDropdownPopup. However, my guess is that Compose will use Popup internally, which exacerbates the problem if Popup cannot handle FLAG_SECURE itself. For example, if a Frobozz composable supplied by Compose uses Popup internally, now you are asking the community to maintain a SecureFrobozz that uses a SecurePopup. We wind up having community-maintained parallel composables to those in Compose itself, just to address security issues.

Thanks for considering this!