June 2026 - Dillo-dev - lists.mailman3.com

[PATCH] Fix header parsing bug with malicious header fields

by 256＠256-32.com

In cache.c, Cache_parse_multiple_fields() doesn't properly skip to the end of the line after finding a match, meaning you can trick it into thinking a single field is actually multiple fields. You can test it by running this command, assuming you have netcat installed: printf $'HTTP/1.0 200\r\nWarning: .Warning: x\r\n\r\n' | nc -Nl 8080 You can then direct Dillo to <http://localhost:8080/>. Dillo's output is then: HTTP warning: .Warning: x HTTP warning: x With this patch, the second line is not produced. (I also fixed a comment that uses the wrong name for a variable; I hope you don't mind.) Sorry the patch isn't in the usual .patch format, I'm new to git. diff --git a/src/cache.c b/src/cache.c index 154bef5c..5bd8a5dc 100644 --- a/src/cache.c +++ b/src/cache.c @@ -287,7 +287,7 @@ static int Cache_bufsize(CacheEntry_t *e) * Inject full page content directly into the cache. * Used for "about:splash". May be used for "about:cache" too. * - * The @param data_ds buffer is copied into the entry buffer, so it is + * @param buf is copied into the entry buffer, so it is the * responsibility of the caller to free it. */ void a_Cache_entry_inject(const DilloUrl *Url, @@ -765,9 +765,8 @@ static Dlist *Cache_parse_multiple_fields(const char *header, j--; field = dStrndup(header + i, j); dList_append(fields, field); - } else { - while (header[i] != '\n') i++; } + while (header[i] != '\n') i++; } if (dList_length(fields) == 0) {

June 14, 2026

Re: [Issue]: Parsing empty domain attributes in cookies

by Rodrigo Arias

Hi, On Wed, Apr 29, 2026 at 09:52:40PM +0200, Rodrigo Arias wrote: >I will merge it after fixing the cookies unit test, so I can add extra >cases for empty domains. Sorry for the delay, merged here: https://git.dillo-browser.org/dillo/commit/?id=9489bacfa2d051e52f6b9b43a246… Also added a couple of test cases. Best, Rodrigo.

June 6, 2026

Re: "Buggy" bugtracker doesn't copy or symlink additional files

by E. C. Masloch

On at 2026-06-04 19:11:55 +0200, Rodrigo Arias <rodarima(a)gmail.com> wrote: >Hi, > >> However, it appears that the "out" subdirectories of the program named buggy do not receive symlinks nor copies of the "extra attachments" files. > >Yeah, I'm aware. I have some fixes but I don't like any of them yet. I'll fix it eventually. I went and fixed this in my fork. The exact changeset is available on our hgweb [1]. Regards, ecm [1]: https://hg.pushbx.org/ecm/buggy/rev/71903036f451

June 5, 2026

Re: "Buggy" bugtracker doesn't copy or symlink additional files

by Rodrigo Arias

Hi, >However, it appears that the "out" subdirectories of the program named >buggy do not receive symlinks nor copies of the "extra attachments" >files. Yeah, I'm aware. I have some fixes but I don't like any of them yet. I'll fix it eventually. Best, Rodrigo.

June 4, 2026

"Buggy" bugtracker doesn't copy or symlink additional files

by E. C. Masloch

Hello! In the bugtracker sources [1] it states: > This repository contains the issues for the Dillo web browser. Each issue is contained in a directory named with the issue number. The text of the issue is stored in the index.md markdown file and any extra attachments are placed inside the issue directory. However, it appears that the "out" subdirectories of the program named buggy do not receive symlinks nor copies of the "extra attachments" files. Here's how to find attachment files in the repo named bugtracker: ~/proj/buggy/bugtracker/git$ find -mindepth 2 -a \! -iname index.md | grep -E '^\.\/[0-9]+\/' ./521/repro.sh ./429/meta ./520/log.txt Example is in ticket 520 [2]. The link titled "Full trace log" leads to a 404 page [3]. Regards, ecm [1]: https://git.dillo-browser.org/bugtracker/tree/README.md?id=0239b970b60b6ea6… [2]: https://bug.dillo-browser.org/520/ [3]: https://bug.dillo-browser.org/520/log.txt

June 4, 2026