September 2008 - Dillo-dev - lists.mailman3.com

an experiment regarding cross site request forgery

by Johannes.Hofmann＠gmx.de

Hi, On Tue, Sep 30, 2008 at 12:56:05PM +0000, corvid wrote: > Cross site request forgery is the one where the bad person sticks > an image tag or some javascript or whatever on a page, > and your privileges are used to do something. Sounds interesting. Just read the corresponding wikipedia entry. > > So my latest little experiment: out of the image urls your browser > sees that have queries (the '?a=b&c=d&e=f'), how many are > - just advertisement trash anyway > - things you want where the request would work just as well with the query > removed (e.g. forum software that likes to stick session ids on everything) > - things that wouldn't still work but don't really matter (e.g. user icons) > - things you need > > Here's a little bit of code that tries rejecting them. > (If dillo had an option for such a thing someday, I imagine it would have a > form more like "don't automatically load, and make it easier to know what the > URL is before you load it manually") To me the cross site request forgery issue looks more like an issue of the cookie system. Perhaps we should be more careful when to send out a cookie. What about not sending cookies with image requests, if the host of the image url is different from the one in the main page? What do other browser do about this? Cheers, Johannes

Sept. 30, 2008

an experiment regarding cross site request forgery

by joerg.sonnenberger＠web.de

On Tue, Sep 30, 2008 at 12:56:05PM +0000, corvid wrote: > So my latest little experiment: out of the image urls your browser > sees that have queries (the '?a=b&c=d&e=f'), how many are There's nothing wrong with that. Such an image URL is a simple GET request. Any web application doing a modification is broken by design and there are good reasons for allowing such URLs. The problem is allowing POST actions to a different site than the one issuing it. If you want to prevent CSRF, consider adding a warning for that (e.g. form action and current URL are not under the same second level domain). Joerg

Sept. 30, 2008

Window close dialog

by jcid＠dillo.org

On Mon, Sep 29, 2008 at 08:46:10PM +0200, Johannes Hofmann wrote: > On Mon, Sep 29, 2008 at 11:12:39AM -0400, Jorge Arellano Cid wrote: > > On Mon, Sep 29, 2008 at 04:03:55PM +0200, Johannes Hofmann wrote: > > > Hi, > > > > > > On Mon, Sep 29, 2008 at 09:48:58AM -0400, Jorge Arellano Cid wrote: > > > > Hi, > > > > > > > > Can somebody please make the dialog for closing a window > > > > with tabs open? > > > > > > "Close Window" only closes the current tab anyway. > > > > Yes. > > > > > "Exit Dillo" closes all windows including tabs. > > > So, do you think about a dialog in the "Exit Dillo" case when > > > there is more than one tab or more than one window or both? > > > > Both, plus the window manager's "close window" if there're open Tabs. > > > > > Do we have the number of open windows somewhere? > > > > In bw.cc's num_bws. > > > > Ok, please check attached patch. > It relies on the current browser window to be stored in a window's > user_data. > We may want to reconsider this, but certainly not before the > release. Committed. -- Cheers Jorge.-

Sept. 30, 2008

patch: changeLinkColor

by jcid＠dillo.org

On Mon, Sep 29, 2008 at 08:50:18PM +0200, Johannes Hofmann wrote: > On Sun, Sep 28, 2008 at 04:40:53PM -0400, Jorge Arellano Cid wrote: > > On Sun, Sep 28, 2008 at 09:20:17PM +0200, Johannes Hofmann wrote: > > > On Sun, Sep 28, 2008 at 02:54:56PM -0400, Jorge Arellano Cid wrote: > > > > On Sun, Sep 28, 2008 at 05:55:10PM +0000, corvid wrote: > > > > > Encouraged by the idea that I am going in the right direction, I have > > > > > made a new one with spaceStyle: > > > > > > > > Funny how we were working on the same patch a the same time! > > > > > > > > I had an ancient version, and gave it a review. > > > > The link search is linear inside textblock. A linux gazette page > > > > showed more than 33000 words to color a link. On bigger pages it may be worst. > > > > It depends on the structure. For instance our bookmarks uses tables > > > > and the link is usually found in less than 10 words. > > > > > > > > The patch in CVS reduce the 35000 steps to 1500 or so (the > > > > sorted link list is sparse, so there's a penalty for looking > > > > for an actual link to compare to). > > > > > > > > > > Not sure I understand this optimization. > > > It is assuming that link numbers are always increasing, right? > > > > Right. > > > > > Can we assume this in dw/*? > > > > I checked html.cc and x_link is crescent. Not sure about the rest. > > > > > src/html.cc seems to be implemented currently in way that this is > > > true. But perhaps we could/should reuse link numbers for equal > > > destination urls in the future? > > > > In that case it'd need a revision. > > > > > Or someone might just choose hashes of the url string as link > > > number. > > > > > > BTW. with both implementations I now see issues with this example: > > > > > > <html> > > > <body> > > > <a href="http://www.dillo.org">dillo</a> > > > <a href="http://slashdot.org">slashdot</a> > > > <a href="http://www.dillo.org">dillo</a> > > > </body> > > > </html> > > > > > > When opening the first link in a new window, it doesn't change color > > > in the original one. > > > When opening it in a tab, the first one changes color. After a > > > reload also the second one changes color. > > > Am I missing something? > > > > Yes, the link color change is meant as a visual cue for the user > > to know the click is being processed. We could leave the link alone > > and change the mouse cursor instead. > > > > The link not changing color when openning it with the menu > > is IMO a bug, I'm looking for... > > > > BTW, the linear search patch is much simpler and as link > > clicking is not a performance critical task it could be left > > implemented in O(n). > > I prefer linear search. Once it really becomes a performance problem > we can look for an optimization. Committed corvid's version. -- Cheers Jorge.-

Sept. 30, 2008

an experiment regarding cross site request forgery

by corvid＠lavabit.com

Cross site request forgery is the one where the bad person sticks an image tag or some javascript or whatever on a page, and your privileges are used to do something. So my latest little experiment: out of the image urls your browser sees that have queries (the '?a=b&c=d&e=f'), how many are - just advertisement trash anyway - things you want where the request would work just as well with the query removed (e.g. forum software that likes to stick session ids on everything) - things that wouldn't still work but don't really matter (e.g. user icons) - things you need Here's a little bit of code that tries rejecting them. (If dillo had an option for such a thing someday, I imagine it would have a form more like "don't automatically load, and make it easier to know what the URL is before you load it manually")

Sept. 30, 2008

what crashes remain?

by corvid＠lavabit.com

I wrote: > Jorge wrote: > > On Mon, Sep 29, 2008 at 05:49:44PM +0000, corvid wrote: > > > Jorge wrote: > > > > On Mon, Sep 29, 2008 at 02:09:36PM +0000, corvid wrote: > > > > > Jorge wrote: > > > > > > On Sun, Sep 28, 2008 at 12:52:47AM +0000, corvid wrote: > > > > > > > Playing with the file menu, I see that Alt-W, Alt-E, Alt-X, Alt-C > > > > > > > all segfault. I thought somebody said something (that I didn't pay > > > > > > > attention to) about the file menu since tabs were added, but if so, > > > > > > > I can't find that mail. > > > > > > > > > > > > Please check the patch in CVS. > > > > > > > > > > > > FLTK2 has a bug in that it regards the first menu item letter as > > > > > > a shortcut. > > > > > > > > > > > > Note: I tried with invisible shortcuts doing nothing, > > > > > > removing shortcuts and all that stuff, until I found this way > > > > > > to workaround the problem. > > > > > > > > > > > > Note2: Alt-W and Alt-X are accelerators, so they're OK. > > > > > > > > > > > > AFAIS there's no more segfault here. > > > > > > > > > > Alt-W and Alt-X still segfault for me. > > > > Does anybody else see this bug? > > Here's the backtrace that I get: > > #0 0x080c9df0 in fltk::Widget::any_of (this=0x70, f=4864) > at ../fltk/Widget.h:143 > #1 0x080c9e3c in fltk::Widget::takesevents (this=0x70) at ../fltk/Widget.h:168 > #2 0x080e43c4 in fltk::Widget::take_focus (this=0x70) at run.cxx:152 > #3 0x080d6bc5 in fltk::MenuBar::handle (this=0x816a5a0, event=12) > at MenuBar.cxx:94 [snip] MenuBar.cxx:93 went as follows: #0 a_UIcmd_close_bw (vbw=0x81b1958) at uicmd.cc:232 #1 0x08055bc9 in a_UIcmd_close_all_bw () at uicmd.cc:259 #2 0x08051c58 in menubar_cb (wid=0x8166288, data=0x810df5d) at ui.cc:477 #3 0x080d643a in fltk::Menu::popup () at Widget.cxx:49 #4 0x080d6cb9 in fltk::MenuBar::handle (this=0x816a440, event=12) at MenuBar.cxx:93 so MenuBar and its lastfocus_ are dead by line 94. There seems to be a pattern emerging lately :)

Sept. 30, 2008

what crashes remain?

by corvid＠lavabit.com

Jorge wrote: > On Mon, Sep 29, 2008 at 05:49:44PM +0000, corvid wrote: > > Jorge wrote: > > > On Mon, Sep 29, 2008 at 02:09:36PM +0000, corvid wrote: > > > > Jorge wrote: > > > > > On Sun, Sep 28, 2008 at 12:52:47AM +0000, corvid wrote: > > > > > > Playing with the file menu, I see that Alt-W, Alt-E, Alt-X, Alt-C > > > > > > all segfault. I thought somebody said something (that I didn't pay > > > > > > attention to) about the file menu since tabs were added, but if so, > > > > > > I can't find that mail. > > > > > > > > > > Please check the patch in CVS. > > > > > > > > > > FLTK2 has a bug in that it regards the first menu item letter as > > > > > a shortcut. > > > > > > > > > > Note: I tried with invisible shortcuts doing nothing, > > > > > removing shortcuts and all that stuff, until I found this way > > > > > to workaround the problem. > > > > > > > > > > Note2: Alt-W and Alt-X are accelerators, so they're OK. > > > > > > > > > > AFAIS there's no more segfault here. > > > > > > > > Alt-W and Alt-X still segfault for me. > > Does anybody else see this bug? Here's the backtrace that I get: #0 0x080c9df0 in fltk::Widget::any_of (this=0x70, f=4864) at ../fltk/Widget.h:143 #1 0x080c9e3c in fltk::Widget::takesevents (this=0x70) at ../fltk/Widget.h:168 #2 0x080e43c4 in fltk::Widget::take_focus (this=0x70) at run.cxx:152 #3 0x080d6bc5 in fltk::MenuBar::handle (this=0x816a5a0, event=12) at MenuBar.cxx:94 #4 0x080ff1c3 in fltk::Widget::send (this=0x816a5a0, event=12) at Widget.cxx:804 #5 0x080c96d6 in fltk::Group::handle (this=0x816aa58, event=12) at Group.cxx:416 #6 0x080ff1c3 in fltk::Widget::send (this=0x816aa58, event=12) at Widget.cxx:804 #7 0x080c9691 in fltk::Group::handle (this=0x816a818, event=12) at Group.cxx:413 #8 0x080ff1c3 in fltk::Widget::send (this=0x816a818, event=12) at Widget.cxx:804 #9 0x080c9691 in fltk::Group::handle (this=0x815abb0, event=12) at Group.cxx:413 #10 0x080503e8 in UI::handle (this=0x815abb0, event=12) at ui.cc:809 #11 0x080ff1c3 in fltk::Widget::send (this=0x815abb0, event=12) at Widget.cxx:804 #12 0x080ef2ce in fltk::TabGroup::handle (this=0x815ab28, event=12) at TabGroup.cxx:239 #13 0x080567bf in CustTabGroup::handle (this=0x815ab28, e=12) at uicmd.cc:79 #14 0x080ff1c3 in fltk::Widget::send (this=0x815ab28, event=12) at Widget.cxx:804 #15 0x080c9691 in fltk::Group::handle (this=0x815a6a0, event=12) at Group.cxx:413 #16 0x0810160c in fltk::Window::handle () #17 0x080ff1c3 in fltk::Widget::send (this=0x815a6a0, event=12) at Widget.cxx:804 #18 0x080dfd11 in fltk::handle (event=12, window=0x815a6a0) at run.cxx:1319 #19 0x080dfdb9 in fltk::try_shortcut () at run.cxx:1195 #20 0x080d1167 in fltk::Input::handle_key () at Widget.cxx:49 #21 0x080d15d5 in fltk::Input::handle () at Widget.cxx:49 #22 0x080d18f1 in fltk::Input::handle () at Widget.cxx:49 #23 0x0805431c in CustInput::handle (this=0x81657f0, e=8) at ui.cc:82 #24 0x080ff1f2 in fltk::Widget::send (this=0x81657f0, event=8) at Widget.cxx:808 #25 0x080dfc4d in fltk::handle (event=8, window=0x815a6a0) at run.cxx:1293 #26 0x080e62a8 in fltk::handle () at x11/run.cxx:1961 #27 0x080e62f0 in do_queued_events () at x11/run.cxx:399 #28 0x080e661c in fl_wait (time_to_wait=1.00000002e+20) at x11/run.cxx:459 #29 0x080e66b7 in fltk::wait (time_to_wait=1.00000002e+20) at run.cxx:463 #30 0x080e67ce in fltk::run () at run.cxx:399 #31 0x0804efab in main (argc=1, argv=0xbffffb44) at dillo.cc:127

Sept. 30, 2008

Window close dialog

by jcid＠dillo.org

On Mon, Sep 29, 2008 at 07:46:52PM +0200, Johannes Hofmann wrote: > Hi Jorge, > > On Mon, Sep 29, 2008 at 11:12:39AM -0400, Jorge Arellano Cid wrote: > > On Mon, Sep 29, 2008 at 04:03:55PM +0200, Johannes Hofmann wrote: > > > Hi, > > > > > > On Mon, Sep 29, 2008 at 09:48:58AM -0400, Jorge Arellano Cid wrote: > > > > Hi, > > > > > > > > Can somebody please make the dialog for closing a window > > > > with tabs open? > > > > > > "Close Window" only closes the current tab anyway. > > > > Yes. > > > > > "Exit Dillo" closes all windows including tabs. > > > So, do you think about a dialog in the "Exit Dillo" case when > > > there is more than one tab or more than one window or both? > > > > Both, plus the window manager's "close window" if there're open Tabs. > > > > > Do we have the number of open windows somewhere? > > > > In bw.cc's num_bws. > > > > just tried to implement that by creating a callback for the > fltk::Window. But then I noticed that user_data() of the windows is > already beeing used in ui.cc. > I don't understand why this is necessary. UI also contains a pointer > to the BrowserWindow (Bw). It helps the child widgets find their bw. e.g. search button, panel buttons, etc. They are nested in different ways depending on the panel shape choice so AFAIS there's no easy way to navigate up to the UI. One way solve it is to store the bw in the window's user_data(), thus a simple wid->window()->user_data() does the trick. Giving it some more thought, the danger of some function not belonging to the current UI geting the wrong bw is real, and it may end sending commands to the wrong bw. IOW: there's only one window for several tabs. When Tabs switch focus, the window()->user_data() is updated accordingly. If a background Tab requests its bw using window()->user_data() it will get the wrong one! (this may cause problems as the one reported by corvid.) If we can find an alternative method to get to a widget's bw (storing it in the CustTabGroup for instance), it'd be much better. -- Cheers Jorge.-

Sept. 30, 2008

what crashes remain?

by jcid＠dillo.org

On Mon, Sep 29, 2008 at 05:49:44PM +0000, corvid wrote: > Jorge wrote: > > On Mon, Sep 29, 2008 at 02:09:36PM +0000, corvid wrote: > > > Jorge wrote: > > > > On Sun, Sep 28, 2008 at 12:52:47AM +0000, corvid wrote: > > > > > Playing with the file menu, I see that Alt-W, Alt-E, Alt-X, Alt-C > > > > > all segfault. I thought somebody said something (that I didn't pay > > > > > attention to) about the file menu since tabs were added, but if so, > > > > > I can't find that mail. > > > > > > > > Please check the patch in CVS. > > > > > > > > FLTK2 has a bug in that it regards the first menu item letter as > > > > a shortcut. > > > > > > > > Note: I tried with invisible shortcuts doing nothing, > > > > removing shortcuts and all that stuff, until I found this way > > > > to workaround the problem. > > > > > > > > Note2: Alt-W and Alt-X are accelerators, so they're OK. > > > > > > > > AFAIS there's no more segfault here. > > > > > > Alt-W and Alt-X still segfault for me. Does anybody else see this bug? > > > > Hmm... > > > > What fltk version are you using? > > > > Anyway, as a workaround, try removing the ampersand in the > > labels for "Close Window" and "Exit Dillo", in UI::make_menubar(). > > The latest snapshot, 6305. Same here... > Removing the ampersands == no more segfaults for me. Good, at least we have a workaround. -- Cheers Jorge.-

Sept. 29, 2008

segfault -- callback + closed window?

by Johannes.Hofmann＠gmx.de

Hi, On Mon, Sep 29, 2008 at 07:38:20PM +0000, corvid wrote: > I hit ',' a few times, going back past a page with a > big progressive jpeg webcomic, and hit ^Q to close the window > while dillo was thinking its way past that image. > I can reproduce a segfault with or without my close dialog patch. > Got: > > Program received signal SIGSEGV, Segmentation fault. > [Switching to Thread 16384 (LWP 2782)] > 0x080fc708 in fltk::Widget::redraw (this=0x81cb680, flags=8 '\b') > at Widget.cxx:575 > 575 widget->damage_ |= DAMAGE_CHILD; > (gdb) bt > #0 0x080fc708 in fltk::Widget::redraw (this=0x81cb680, flags=8 '\b') > at Widget.cxx:575 > #1 0x0804f679 in UI::button_set_sens (this=0x82ce9d8, btn=UI_STOP, sens=0) > at ui.cc:1109 > #2 0x08054c59 in a_UIcmd_set_buttons_sens_cb (vbw=0x81ad858) at uicmd.cc:835 > #3 0x080e47f9 in fltk::wait () at TabGroup.cxx:116 > #4 0x080e489d in fltk::run () at TabGroup.cxx:116 > #5 0x0804efab in main (argc=1, argv=0xbffffb44) at dillo.cc:127 > > > Maybe that's just a part of life with callbacks... > Life is hard with callbacks, but I think it's just a bug :-) Cheers, Johannes

Sept. 29, 2008