October 2010 - Dillo-dev - lists.mailman3.com

Dillo confused by embedded NULL characters

by corvid＠lavabit.com

Jeremy wrote: > On Sat, Oct 23, 2010 at 09:19:45PM +0000, corvid wrote: > > Jeremy wrote: > > > On Sat, Oct 23, 2010 at 08:02:04PM +0000, corvid wrote: > > > > Jeremy wrote: > > > > > http://makespace.org/ has some NULL characters in its header, > > > > > which causes it to disappear in Dillo. Firefox and links have > > > > > no problems. What's the fix? > > > > > > > > It seems to be showing up fine for me. > > > > > > So it is! It's my local patches that are trying to parse quoted > > > attributes like Firefox that are doing it. > > I have yet to look at it in detail, but I think the problem is that > strcspn() assumes that there are no NULLs in its argument apart from > the terminating NULL so it may give the wrong result when there are > embedded NULLs. The current logic assumes that the return value will > be the index of one of the terminating characters or the index of the > terminating NULL. But here it might be the index of an embedded NULL > which is a case that the current code does not handle. I *suspect* > that Dillo does the right thing more by accident than design. > > > I think the SGML declaration in section 20.1 of the 4.01 spec means > > that NULLs are not legal. > > So we have a choice: do we treat embedded NULLs as undefined > behaviour? If we decide "No, Dillo must handle embedded NULLs in the > 'right' way" then we have to rewrite Html_write_raw() (and possibly > a_Html_parse_entities() and Html_get_javascript_link() too) to not use > strcspn(). Ouch! This seems to be a pretty rare case so maybe it is > not worth the effort? I personally lean toward not handling it if it's illegal in particular because it's so rarely encountered that I imagine we'll forget about it at some point and accidentally make it stop working. PS Speaking of embedded NULLs, we still need to make HTTPS queries with embedded NULLs work properly at some point. (Submit a form with a file input.) a_Dpip_build_cmd() is not built to handle that case.

Oct. 26, 2010

Https remote certificate cannot be verified

by corvid＠lavabit.com

Dennis wrote: > The "The remote certificate cannot be verified (code 20)" dialog popup > window, that presumably pops up when accessing an unverifiable https > site, often pops up many times while loading a page -- probably a > separate instance for each image? Can it not pop up only once? (per > unverifiable https domain?) I think everyone wants that, and we just need someone to put in the work. > (And perhaps the current window title "Choice5" could be a bit more > informative? And maybe there should be an option to save such > certificates to avoid future warnings?) IIRC, adding an option to save certificates would be easy. I was sort of thinking about it once, but my concern was that not too many users would quite understand that they were now trusting something in perpetuity that they shouldn't necessarily. (Maybe making sure that the warning is alarming enough would suffice, though.)

Oct. 26, 2010

Dillo confused by embedded NULL characters

by onepoint＠starurchin.org

On Sat, Oct 23, 2010 at 09:19:45PM +0000, corvid wrote: > Jeremy wrote: > > On Sat, Oct 23, 2010 at 08:02:04PM +0000, corvid wrote: > > > Jeremy wrote: > > > > http://makespace.org/ has some NULL characters in its header, > > > > which causes it to disappear in Dillo. Firefox and links have > > > > no problems. What's the fix? > > > > > > It seems to be showing up fine for me. > > > > So it is! It's my local patches that are trying to parse quoted > > attributes like Firefox that are doing it. I have yet to look at it in detail, but I think the problem is that strcspn() assumes that there are no NULLs in its argument apart from the terminating NULL so it may give the wrong result when there are embedded NULLs. The current logic assumes that the return value will be the index of one of the terminating characters or the index of the terminating NULL. But here it might be the index of an embedded NULL which is a case that the current code does not handle. I *suspect* that Dillo does the right thing more by accident than design. > I think the SGML declaration in section 20.1 of the 4.01 spec means > that NULLs are not legal. So we have a choice: do we treat embedded NULLs as undefined behaviour? If we decide "No, Dillo must handle embedded NULLs in the 'right' way" then we have to rewrite Html_write_raw() (and possibly a_Html_parse_entities() and Html_get_javascript_link() too) to not use strcspn(). Ouch! This seems to be a pretty rare case so maybe it is not worth the effort? Regards, Jeremy Henty

Oct. 26, 2010

Https remote certificate cannot be verified

by dennisn＠dennisn.dyndns.org

The "The remote certificate cannot be verified (code 20)" dialog popup window, that presumably pops up when accessing an unverifiable https site, often pops up many times while loading a page -- probably a separate instance for each image? Can it not pop up only once? (per unverifiable https domain?) (And perhaps the current window title "Choice5" could be a bit more informative? And maybe there should be an option to save such certificates to avoid future warnings?)

Oct. 24, 2010

Dillo confused by embedded NULL characters

by corvid＠lavabit.com

Jeremy wrote: > On Sat, Oct 23, 2010 at 08:02:04PM +0000, corvid wrote: > > Jeremy wrote: > > > http://makespace.org/ has some NULL characters in its header, which > > > causes it to disappear in Dillo. Firefox and links have no problems. > > > What's the fix? > > > > It seems to be showing up fine for me. > > So it is! It's my local patches that are trying to parse quoted > attributes like Firefox that are doing it. Very strange! However, if > you go to http://makespace.org/ and then view the page source, the > result is truncated, even in vanilla Dillo. I think the SGML declaration in section 20.1 of the 4.01 spec means that NULLs are not legal.

Oct. 23, 2010

Dillo confused by embedded NULL characters

by onepoint＠starurchin.org

On Sat, Oct 23, 2010 at 08:02:04PM +0000, corvid wrote: > Jeremy wrote: > > http://makespace.org/ has some NULL characters in its header, which > > causes it to disappear in Dillo. Firefox and links have no problems. > > What's the fix? > > It seems to be showing up fine for me. So it is! It's my local patches that are trying to parse quoted attributes like Firefox that are doing it. Very strange! However, if you go to http://makespace.org/ and then view the page source, the result is truncated, even in vanilla Dillo. Regards, Jeremy Henty

Oct. 23, 2010

Dillo confused by embedded NULL characters

by corvid＠lavabit.com

Jeremy wrote: > http://makespace.org/ has some NULL characters in its header, which > causes it to disappear in Dillo. Firefox and links have no problems. > What's the fix? It seems to be showing up fine for me.

Oct. 23, 2010

Dillo confused by embedded NULL characters

by onepoint＠starurchin.org

http://makespace.org/ has some NULL characters in its header, which causes it to disappear in Dillo. Firefox and links have no problems. What's the fix? Regards, Jeremy Henty

Oct. 23, 2010

major commit upcoming

by jcid＠dillo.org

On Thu, Oct 21, 2010 at 09:47:46PM +0200, Johannes Hofmann wrote: > On Thu, Oct 21, 2010 at 08:48:19AM -0300, Jorge Arellano Cid wrote: > > On Wed, Oct 20, 2010 at 10:05:28PM +0200, Johannes Hofmann wrote: > > > On Wed, Oct 20, 2010 at 12:39:37PM -0300, Jorge Arellano Cid wrote: > > > > On Tue, Oct 19, 2010 at 09:11:41PM +0200, Johannes Hofmann wrote: > > > > > Hi, > > > > > > > > > > just a headsup, that I plan to commit some changes for the CSS on > > > > > <HTML> element issue that involve quite a few files. > > > > > Basically it is a minor API change for StyleEngine, but as > > > > > StyleEngine is called from quite a few places, the patch is rather > > > > > big. > > > > > Please let me know in case this is inconvenient atm. > > > > > > > > On my part, go ahead. > > > > I'm still working on the collapsing border code. > > > > > > Ok then - here you go.... > > > > > > Basically the changes are to fix the problem that CSS for the <HTML> > > > element was not evaluated (reported by Jeremy). > > > But the changes in StyleEngine will also help to implement dynamic > > > style changes in the future (as needed for :visited :hover :focus > > > etc). > > > > > > As always please report any regressions... > > > > It looks like it will help me! (inherit nonCSS stuff) > > > > --- > > > > BTW, I had a hard time with border collapsing, because after > > adapting dillo to render my test cases as Firefox, other tests > > showed big differences. It was after digging into cell_props, > > resetValues, {pre, post}processAttrs, parser, etc... that I found > > the problem: dillo is not discarding CSS with syntax errors: > > > > http://www.dillo.org/test/discard-syntax-errors.html > > > > Note1: I tried pushing to hg css_compat, but it didn't work. My > > local repo behaved as the push was successful but no changes were > > made in the remote one (setting hofmann as trusted in my local > > hgrc didn't help either). > > > > Note2: index.html has 644 permissions > > Can you please retry - I hope it's fixed now. I can pull and push to the hg repo, but the web page is not updated. There's still this message: <cite> remote: Not trusting file /sfhome/groups/dillo/htdocs/css_compat/.hg/hgrc from untrusted user hofmann, group dillo remote: Not trusting file /auriga/sfhome/groups/dillo/htdocs/css_compat/.hg/hgrc from untrusted user hofmann, group dillo </cite> I have: [paths] default = ssh://dillo.org//sfhome/groups/dillo/htdocs/css_compat [trusted] users = hofmann as local .hg/hgrc -- Cheers Jorge.-

Oct. 22, 2010

major commit upcoming

by Johannes.Hofmann＠gmx.de

On Thu, Oct 21, 2010 at 02:49:00PM +0200, Johannes Hofmann wrote: > -----Urspr?ngliche Nachricht----- > Von: Jorge Arellano Cid <jcid(a)dillo.org> > Gesendet: Do 21.10.2010 13:49 > An: dillo-dev(a)dillo.org; > Betreff: Re: [Dillo-dev] major commit upcoming > > > On Wed, Oct 20, 2010 at 10:05:28PM +0200, Johannes Hofmann wrote: > > > On Wed, Oct 20, 2010 at 12:39:37PM -0300, Jorge Arellano Cid wrote: > > > > On Tue, Oct 19, 2010 at 09:11:41PM +0200, Johannes Hofmann wrote: > > > > > Hi, > > > > > > > > > > just a headsup, that I plan to commit some changes for the CSS on > > > > > <HTML> element issue that involve quite a few files. > > > > > Basically it is a minor API change for StyleEngine, but as > > > > > StyleEngine is called from quite a few places, the patch is rather > > > > > big. > > > > > Please let me know in case this is inconvenient atm. > > > > > > > > On my part, go ahead. > > > > I'm still working on the collapsing border code. > > > > > > Ok then - here you go.... > > > > > > Basically the changes are to fix the problem that CSS for the <HTML> > > > element was not evaluated (reported by Jeremy). > > > But the changes in StyleEngine will also help to implement dynamic > > > style changes in the future (as needed for :visited :hover :focus > > > etc). > > > > > > As always please report any regressions... > > > > It looks like it will help me! (inherit nonCSS stuff) > > Right, I moved this functionality from html.cc / table.cc into styleengine.cc. > > > > > --- > > > > BTW, I had a hard time with border collapsing, because after > > adapting dillo to render my test cases as Firefox, other tests > > showed big differences. It was after digging into cell_props, > > resetValues, {pre, post}processAttrs, parser, etc... that I found > > the problem: dillo is not discarding CSS with syntax errors: > > > > http://www.dillo.org/test/discard-syntax-errors.html > > > > Generally dillo should discard CSS with errors, but there are some cases > where it doesn't. I will look at your test case when I'm at home. Ah now I see what you mean... Declaration dropping does not work with shortcuts like margin:, border: and so on. It should work for single properties like border-bottom-style: and so on. I will look into it. Cheers, Johannes

Oct. 21, 2010