May 2026 - Dillo-dev - lists.mailman3.com

Re: [PATCH] Add user-controllable Sec-GPC header

by a1ex＠dismail.de

Hi, <a1ex(a)dismail.de> wrote: > Hi, > > The attached patch adds a Sec-GPC header to Dillo. It defaults to ON, > and is controllable through a dillorc setting of 'http_sec_gpc'. > > Also, I changed DNT to be user-controllable with a dillorc setting of > 'http_dnt', also defaults to ON. > > I know that this is too late to get in for the 3.3.0 release, but I'm > sending it for review now, and if there are any issues it should allow > plenty of time to fix. > > Regards, > Alex > Friendly post-release ping! I've been running with this patch for a while now and it seems to be working fine. Here are some tests demonstrating how it works (showing HTTP headers using the new 'trace_http' feature): Default settings (http_dnt=YES, http_sec_gpc=YES): GET / HTTP/1.1\x0D Host: dillo-browser.org\x0D User-Agent: Dillo/3.3.0\x0D Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\x0D Accept-Encoding: gzip, deflate, br\x0D Referer: https://dillo-browser.org/\x0D Connection: keep-alive\x0D DNT: 1\x0D Sec-GPC: 1\x0D \x0D Only DNT on (http_dnt=YES, http_sec_gpc=NO): GET / HTTP/1.1\x0D Host: dillo-browser.org\x0D User-Agent: Dillo/3.3.0\x0D Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\x0D Accept-Encoding: gzip, deflate, br\x0D Referer: https://dillo-browser.org/\x0D Connection: keep-alive\x0D DNT: 1\x0D \x0D Only Sec-GPC on (http_dnt=NO, http_sec_gpc=YES): GET / HTTP/1.1\x0D Host: dillo-browser.org\x0D User-Agent: Dillo/3.3.0\x0D Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\x0D Accept-Encoding: gzip, deflate, br\x0D Referer: https://dillo-browser.org/\x0D Connection: keep-alive\x0D Sec-GPC: 1\x0D \x0D Both off (http_dnt=NO, http_sec_gpc=NO): GET / HTTP/1.1\x0D Host: dillo-browser.org\x0D User-Agent: Dillo/3.3.0\x0D Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\x0D Accept-Encoding: gzip, deflate, br\x0D Referer: https://dillo-browser.org/\x0D Connection: keep-alive\x0D \x0D If my implementation is less than ideal and you'd rather do it differently, or if this feature simply isn't worth bothering with, that's fine too. Regards, Alex

May 2, 2026

Re: [Issue]: Parsing empty domain attributes in cookies

by Julian Jørgensen

Hi Rodrigo, På Fri, 1 May 2026 23:04:07 +0200 Rodrigo Arias <rodarima(a)gmail.com> skrev: > >Maybe you need a hand with other issues? > > Sure!, here are some issues that would need a bit of work, but I > haven't had much time: > > Recently I saw that Wikipedia images were starting to fail with a 429 > HTTP code, likely because they consider Dillo a bot. I reached out to > them, but didn't got any reply. Perhaps there is something we could > do in our side to avoid this problem. > > https://bug.dillo-browser.org/523/ > > Another one is to add a limit to the maximum memory we will accept in > the decoder so we protect the user from compression bombs: > > https://bug.dillo-browser.org/422/ > > Another problem is that Dillo always caches the page, even if they > come with a no cache header. It would be nice to add some support for > this: > > https://bug.dillo-browser.org/293/ > https://bug.dillo-browser.org/77/ > > There are also many areas of improvement in the rendering side as > well, but I think it would be easier to work on the network/cache > first. Thanks, I will look at the page no-caching issue/feature :-). > Keep in mind that we have a strict ban against AI/LLM generated code. +1 Best regards, Julian Jørgensen

May 1, 2026

Re: [Issue]: Parsing empty domain attributes in cookies

by Rodrigo Arias

Hi Julian, On Fri, May 01, 2026 at 10:16:49PM +0200, Julian Jørgensen wrote: >Hmm, I think I misphased my email. What I was trying to say was: I had >fun debugging and creating the patch, and would like to work a bit more >on dillo :-). I'm glad :) >Maybe you need a hand with other issues? Sure!, here are some issues that would need a bit of work, but I haven't had much time: Recently I saw that Wikipedia images were starting to fail with a 429 HTTP code, likely because they consider Dillo a bot. I reached out to them, but didn't got any reply. Perhaps there is something we could do in our side to avoid this problem. https://bug.dillo-browser.org/523/ Another one is to add a limit to the maximum memory we will accept in the decoder so we protect the user from compression bombs: https://bug.dillo-browser.org/422/ Another problem is that Dillo always caches the page, even if they come with a no cache header. It would be nice to add some support for this: https://bug.dillo-browser.org/293/ https://bug.dillo-browser.org/77/ There are also many areas of improvement in the rendering side as well, but I think it would be easier to work on the network/cache first. Keep in mind that we have a strict ban against AI/LLM generated code. Best, Rodrigo.

May 1, 2026

Re: [Issue]: Parsing empty domain attributes in cookies

by Julian Jørgensen

Hi Rodrigo, På Fri, 1 May 2026 21:33:40 +0200 Rodrigo Arias <rodarima(a)gmail.com> skrev: > On Fri, May 01, 2026 at 08:01:45PM +0200, Julian Jørgensen wrote: > >I'm glad that my patch and report turned out to be usefull. I found > >the codebase pretty nice to navigate, so if you want to, I can give > >fixing the test a try. > > No worries, I already know what is causing the problem. It should not > take me long to fix it :) Hmm, I think I misphased my email. What I was trying to say was: I had fun debugging and creating the patch, and would like to work a bit more on dillo :-). Maybe you need a hand with other issues? Best regards, Julian Jørgensen

May 1, 2026

Re: [Issue]: Parsing empty domain attributes in cookies

by Rodrigo Arias

Hi Julian, On Fri, May 01, 2026 at 08:01:45PM +0200, Julian Jørgensen wrote: >I'm glad that my patch and report turned out to be usefull. I found the >codebase pretty nice to navigate, so if you want to, I can give fixing >the test a try. No worries, I already know what is causing the problem. It should not take me long to fix it :) Best, Rodrigo.

May 1, 2026

Re: [Issue]: Parsing empty domain attributes in cookies

by Julian Jørgensen

Hi Rodrigo, På Wed, 29 Apr 2026 21:52:40 +0200 Rodrigo Arias <rodarima(a)gmail.com> skrev: > Thanks for the patch, it seems to work as intended. I also think that > ignoring the key/value is the right interpretation from: > > https://www.rfc-editor.org/rfc/rfc6265#section-5.2.3 > > > If the attribute-value is empty, the behavior is undefined. > > However, the user agent SHOULD ignore the cookie-av entirely. > > I will merge it after fixing the cookies unit test, so I can add > extra cases for empty domains. I'm glad that my patch and report turned out to be usefull. I found the codebase pretty nice to navigate, so if you want to, I can give fixing the test a try. Best regards, Julian Jørgensen

May 1, 2026