Skip to content

Fix secure TextInput leaking through the cached spannable on Android - #59472

Open
lazerg wants to merge 1 commit into
react:mainfrom
lazerg:fix/issue-59469-secure-textinput-leak
Open

lazerg wants to merge 1 commit into
react:mainfrom
lazerg:fix/issue-59469-secure-textinput-leak

Conversation

@lazerg

@lazerg lazerg commented Oct 26, 2026

Copy link
Copy Markdown
Contributor

Summary:

On Android (Fabric), a secureTextEntry TextInput that got input is never released after it unmounts. updateCachedSpannable() copies the text with all its spans into TextLayoutManager's cache, and that includes PasswordTransformationMethod.Visible, which holds the view's Editable and through it the view and its Activity. The cache entry is only removed in finalize(), which can't run while the cache keeps the view alive.

The cached copy is only used for measurement, so it now drops every span that isn't a CharacterStyle, ParagraphStyle or ReactSpan right after copying the text, as suggested in the issue.

Fixes #59469

Changelog:

[ANDROID] [FIXED] - Fix secureTextEntry TextInput staying in memory after unmount

Test Plan:

Added ReactEditTextCachedSpannableTest, which types into a password field with "show password" on and checks the cached spannable has no PasswordTransformationMethod spans. It fails on main and passes with this change.

./gradlew :packages:react-native:ReactAndroid:testDebugUnitTest --tests "com.facebook.react.views.textinput.*" --tests "com.facebook.react.views.text.*"

All views.text and views.textinput tests pass.

@meta-cla meta-cla Bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Oct 26, 2026
@facebook-github-tools facebook-github-tools Bot added the Shared with Meta Applied via automation to indicate that an Issue or Pull Request has been shared with the team. label Oct 26, 2026
@github-actions

Copy link
Copy Markdown

Visual regression

No visual differences at f1628af6b15b.

ios: no capture

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. Shared with Meta Applied via automation to indicate that an Issue or Pull Request has been shared with the team.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Android] Unmounted TextInput with secureTextEntry is never released: TextLayoutManager's spannable cache keeps it (and its Activity) alive

1 participant