March 2003 - Dillo-dev - lists.mailman3.com

Alternative toolbar icons
by Jorge Arellano Cid 05 Mar '03

05 Mar '03

Hi there! I just updated the Icons page (the toolbar alternatives) (BUG#410). Go give it a look! Cheers Jorge.-

1 0

Re: a vulnerability in dillo
by Jorge Arellano Cid 05 Mar '03

05 Mar '03

On Sun, 2 Mar 2003, Ivan Popov wrote: > Hello, > > having read the statement about dillo being a secure browser, It tries to be! > I want to draw your attention to the exploitable in different ways > bookmarks plugin interface. > > I submitted it as a bug and mentioned denial-of-service only, but creating > predictably named sockets in /tmp opens to other possible attacks > (e.g. spoofing your bookmarks) as well. > > I realize dillo and the plugins are evolving at fast rate, but this issue > can (and should?) be fixed even on the early stages of development. Probably (soon) socket file descriptors will reside in /tmp/dillo and use temporary filenames, or something akin (this also solves the problem of a pre-existent file with the same name). > Thanks for the great software! > I appreciate dillo - it is small, fast and functional. Thanks for your nice comments too. Cheers Jorge.-

2 1

Re: hidden fields in forms broken?
by Jorge Arellano Cid 05 Mar '03

05 Mar '03

Francis, > I've come across an apparent form anomaly when using dillo to test a > separate application. > > If I create a html form, the data submitted differs depending on whether > I use "text" or "hidden" input types -- specifically, the "hidden" type > is not parsed for html entities. This causes breakage when I want to set > the value to the four-character string x"'y, for example. > > The code for this is in html.c, around line 3077 (version 1.132), where > just using the same "init_str = (value) ? value : NULL;" as most other > types would work. > > >From the comment, it was clearly a deliberate decision to > leave out entity-parsing for DILLO_HTML_INPUT_HIDDEN (and > DILLO_HTML_INPUT_PASSWORD, around line 3049). The change appears to have > been made between revisions 1.5 and 1.6, where the "submit" (and others) > type explicitly had Html_parse_entities() called but the "hidden" type > didn't. > > I don't see any dispensation in the HTML DTD which makes "hidden" and > "password" immune to the entity rules. Is the exception in dillo an > oversight that just hasn't been spotted yet? Or is there some reasoning > that I'm missing behind the way things are? > > For reference, other web browsers I tried took the html fragment > > <form> > <input type=text name=plain value="x"x"> > <input type=hidden name=hide value="x"x"> > <input type=submit> > </form> > > and on submission, the URL had the same value for "plain" and "hide". > In dillo, the query string is plain=x%22x&hide=x%26quot%3Bx This is quite an interesting issue! I digged through the historical releases and the root of the problem is very far (before 0.3.2!). As I currently see it, the SGML type for those INPUT attribute values is CDATA, so entities SHOULD/MUST be parsed!!! Does anyone know otherwise? Cheers Jorge.-

2 1

Question about dpi interface ...
by Lars Segerlund 05 Mar '03

05 Mar '03

If I have dillo 0.7.0 with the bookmarks working through dpi, how can I add dpi functionality ? Can I make a dpi server without modyfying the dillo binary ? / rgards, Lars Segerlund.

2 1

Loosing bookmarks
by John Bradford 02 Mar '03

02 Mar '03

Since I started using using 7.0, my bookmarks have been lost on four occasions, but I haven't been able to reproduce the bug at will - has anybody else noticed this? John.

9 9

BUGFIX set close_on_exec (FD_CLOEXEC)
by Raphael Barabas 02 Mar '03

02 Mar '03

hello, in my neverending search for the perfect browser i stumbled across dillo. it looks great and quite usable, altough it's still alpha. unfortunately dillo 0.7.0 won't run on solaris8 (ultra30), so i wrote a fix. turns out every other os is affected by this bug, too. solaris just seems to be less forgiving in this matter :) to compile on solaris you may also need some workarounds, take a look at bugreports 402, 413 and 415. problem: solaris: see bugreport 416, dillo enters endless loop on startup, repeating "IO_write: Changing io->Buf (0)" linux: no immediate effect, although some filedescriptors are in state "open" for too long. i've not really looked into it but this should have negative effects in the long run. reason: in IO.c, function IO_submit, filedescriptor-flag close_on_exec is not set the right way (not at all). on solaris, as a direct result, non-blocking io will accidentally be handled via O_NDELAY instead of O_NONBLOCKING, resulting in an endless loop. patch: *** IO.c.org Sat Mar 1 21:56:13 2003 --- IO.c Sat Mar 1 21:56:54 2003 *************** *** 530,536 **** /* Set FD to background and to close on exec. */ fcntl(r_io->FD, F_SETFL, ! O_NONBLOCK | FD_CLOEXEC | fcntl(r_io->FD, F_GETFL)); if ( r_io->Op == IORead ) { g_io_add_watch(r_io->GioCh, G_IO_IN | G_IO_ERR | G_IO_HUP, --- 530,538 ---- /* Set FD to background and to close on exec. */ fcntl(r_io->FD, F_SETFL, ! O_NONBLOCK | fcntl(r_io->FD, F_GETFL)); ! fcntl(r_io->FD, F_SETFD, ! FD_CLOEXEC | fcntl(r_io->FD, F_GETFD)); if ( r_io->Op == IORead ) { g_io_add_watch(r_io->GioCh, G_IO_IN | G_IO_ERR | G_IO_HUP, disclaimer: this bugfix has been tested briefly on debian gnu/linux 2.4.20 and solaris 8. please review my code for correctness. also note that bugreport 417 has been proven wrong by this. regards, raphael

1 1

patch for POSIX file lock
by yangguilong 02 Mar '03

02 Mar '03

I'm compiling dillo on Cygwin, which lacks of flock/lockf, but has support for POSIX file lock (fcntl()). To enable the cookies support, I write a patch for it. In hope that it will be useful for other platform having similar situation. diff -Nurp dillo-0.6.6/src/cookies.c dillo-0.6.6-cygwin/src/cookies.c --- dillo-0.6.6/src/cookies.c 2002-05-28 04:47:50.000000000 +0800 +++ dillo-0.6.6-cygwin/src/cookies.c 2003-03-01 10:23:56.000000000 +0800 @@ -130,6 +130,9 @@ void a_Cookies_init() GList *domain_cookies; char *filename; char line[LINE_MAXLEN]; +#ifndef HAVE_LOCKF + struct flock lck; +#endif Cookie_control_init(); @@ -145,7 +148,16 @@ void a_Cookies_init() } /* Try to get a lock from the file descriptor */ +#ifdef HAVE_LOCKF disabled = (lockf(fileno(file_stream), F_TLOCK, 0) == -1); +#else /* POSIX lock */ + lck.l_start = 0; /* start at beginning of file */ + lck.l_len = 0; /* lock entire file */ + lck.l_type = F_WRLCK; + lck.l_whence = SEEK_SET; /* absolute offset */ + + disabled = (fcntl(fileno(file_stream), F_SETLK, &lck) == -1); +#endif if (disabled) { DEBUG_MSG(10, "The cookies file has a file lock:\n" " disabling cookies in this dillo!\n"); @@ -278,6 +290,9 @@ static gboolean Cookies_freeall_cb(gpoin void a_Cookies_freeall() { int fd; +#ifndef HAVE_LOCKF + struct flock lck; +#endif if (disabled) return; @@ -288,7 +303,16 @@ void a_Cookies_freeall() g_hash_table_foreach_remove(cookies, Cookies_freeall_cb, NULL); +#ifdef HAVE_LOCKF lockf(fd, F_ULOCK, 0); +#else /* POSIX file lock */ + lck.l_start = 0; /* start at beginning of file */ + lck.l_len = 0; /* lock entire file */ + lck.l_type = F_UNLCK; + lck.l_whence = SEEK_SET; /* absolute offset */ + + fcntl(fileno(file_stream), F_SETLKW, &lck); +#endif fclose(file_stream); } --------------------------------------------- »¶Ó¹âÁÙ http://www.cmmail.com

1 0

Great work on Dillo! (fwd)
by Jorge Arellano Cid 01 Mar '03

01 Mar '03

---------- Forwarded message ---------- Date: Wed, 26 Feb 2003 10:02:07 -0500 From: Alwyn Kerr <alkerr(a)yifan.net> To: jcid(a)softhome.net Subject: Great work on Dillo! Hi there, I'm writing to express how happy I am with Dillo. I'm a HUGE fan of software that is light-weight and Dillo would have to be the smallest, functional browser I've ever used. I find that it is especially useful for browsing documentation that's saved as a stack of HTML pages on disk. I mostly use it for reading the GTK API docs. when developing GTK applications. Anyway, before I'm done I was just wondering if future versions of Dillo might make tabs available for multiple pages? Once again, keep up the good work and please extend my happiness to the rest of the development team. Owen Klan ----------------------------------------------------- http://eo.yifan.net Free POP3/Web Email, File Manager, Calendar and Address Book

1 0

Bookmarks no longer work
by Albert Wagner 01 Mar '03

01 Mar '03

I had some trouble with my system and had to manually kill several processes. Ever since then Dillo bookmarks no longer work. I get the following: Nav_open_url: Url=>dpi:/bm/< [connect]: Connection refused Not implemented How can I fix this?

3 5