- Dillo-dev - lists.mailman3.com

[PATCH] Fix header parsing bug with malicious header fields
by 256＠256-32.com June 21, 2026

June 21, 2026

In cache.c, Cache_parse_multiple_fields() doesn't properly skip to the end of the line after finding a match, meaning you can trick it into thinking a single field is actually multiple fields. You can test it by running this command, assuming you have netcat installed: printf $'HTTP/1.0 200\r\nWarning: .Warning: x\r\n\r\n' | nc -Nl 8080 You can then direct Dillo to <http://localhost:8080/>. Dillo's output is then: HTTP warning: .Warning: x HTTP warning: x With this patch, the second line is not produced. (I also fixed a comment that uses the wrong name for a variable; I hope you don't mind.) Sorry the patch isn't in the usual .patch format, I'm new to git. diff --git a/src/cache.c b/src/cache.c index 154bef5c..5bd8a5dc 100644 --- a/src/cache.c +++ b/src/cache.c @@ -287,7 +287,7 @@ static int Cache_bufsize(CacheEntry_t *e) * Inject full page content directly into the cache. * Used for "about:splash". May be used for "about:cache" too. * - * The @param data_ds buffer is copied into the entry buffer, so it is + * @param buf is copied into the entry buffer, so it is the * responsibility of the caller to free it. */ void a_Cache_entry_inject(const DilloUrl *Url, @@ -765,9 +765,8 @@ static Dlist *Cache_parse_multiple_fields(const char *header, j--; field = dStrndup(header + i, j); dList_append(fields, field); - } else { - while (header[i] != '\n') i++; } + while (header[i] != '\n') i++; } if (dList_length(fields) == 0) {

2 1

Nordstjernen web browser
by Andreas Røsdal June 16, 2026

June 16, 2026

Hi, I am making the Nordstjernen web browser. Implemented in C. It's like Dillo, small and simple. https://nordstjernen.org/ https://github.com/nordstjernen-web/nordstjernen I hope it's interesting for you, the internet needs more small independent web browsers. Andreas

5 4

caniuse for Dillo?
by Artyom Bologov June 15, 2026

June 15, 2026

Hi y’all, I want to make sure my site opens in Dillo in perpetuity, so I’m interested in what features of HTML and CSS Dillo does or does not support. Is there any information on that? Can it be made accessible on the Web somehow? Should it be relegated to caniuse or MDN? Best of luck, -- Artyom Bologov https://aartaka.me

2 1

dpi problem
by Teddi Vazquez June 15, 2026

June 15, 2026

Hello, I'm trying to add the plugins for gopher and gemini, when i run the "make install" the next message appears in both: echo 'proto.gopher=gopher/gopher.filter.dpi' >> /root/.dillo/dpidrc dpidc stop || true ** ERROR **: [Dpi_read_comm_keys] No such file or directory ** ERROR **: main: Can't read dpid's port number mkdir -p ~/.dillo/dpi/gopher cp -f gopher.filter.dpi ~/.dillo/dpi/gopher I read the docs and thought maybe it was because the "dpi_dir" option wasn't added: "dpi_dir=~/.dillo/dpi/" but when I run dillo on the terminal this appears: prefs: {dpi_dir} is not a recognized token. paths: Cannot open file '/home/tmv/.dillo/keysrc': No such file or directory paths: Using /usr/local/etc/dillo/keysrc paths: Cannot open file '/home/tmv/.dillo/domainrc': No such file or directory paths: Using /usr/local/etc/dillo/domainrc I'm sorry if this obvious error, if possible I would like to receive some help, thanks. -- -----BEGIN GEEK CODE BLOCK----- Version: 3.12 GC/CS/H/IT/L/M/P/S/SS/O d- s+: a? C++++ UL++++ P+ L+++ E+ W+++ N+ o- K++ w O-- M V- PS+++ PE++ Y+ PGP++ t+ 5+ X+ R tv b++++ DI--- D+ G++ e* h! r- x* ------END GEEK CODE BLOCK------ GPG: 37219EA0D04C8D3C Keybase: tmv

2 1

[Issue]: Parsing empty domain attributes in cookies
by Julian Jørgensen June 6, 2026

June 6, 2026

Hi Dillo devs, Thanks for a great browser :-). I'm having great fun using it for accessing smaller sites. However, I might have found a minor issue with the way it handles cookies. I'm not very familiar with browser, so the problem is most likely on the site I'm trying to access. I use this pretty popular search engine called kagi.com. They have a html mode, which I enjoy testing in browsers like Dillo. The problem is that their session cookie is saved with an empty domain like so: `Domain=;`. As far as I can understand from [1], it seems that this should result in Dillo (the user agent?) ignoring this key/value pair. However, Dillo will parse the domain as "", which will fail the domain/host verification later in the program. I have attached a git formatted patch to demonstrate the issue. After applying this change, the kagi.com page works like I would expect. Best regards, Julian Jørgensen [1]: https://www.rfc-editor.org/rfc/rfc6265#section-5.2.3

2 7

"Buggy" bugtracker doesn't copy or symlink additional files
by E. C. Masloch June 5, 2026

June 5, 2026

Hello! In the bugtracker sources [1] it states: > This repository contains the issues for the Dillo web browser. Each issue is contained in a directory named with the issue number. The text of the issue is stored in the index.md markdown file and any extra attachments are placed inside the issue directory. However, it appears that the "out" subdirectories of the program named buggy do not receive symlinks nor copies of the "extra attachments" files. Here's how to find attachment files in the repo named bugtracker: ~/proj/buggy/bugtracker/git$ find -mindepth 2 -a \! -iname index.md | grep -E '^\.\/[0-9]+\/' ./521/repro.sh ./429/meta ./520/log.txt Example is in ticket 520 [2]. The link titled "Full trace log" leads to a 404 page [3]. Regards, ecm [1]: https://git.dillo-browser.org/bugtracker/tree/README.md?id=0239b970b60b6ea6… [2]: https://bug.dillo-browser.org/520/ [3]: https://bug.dillo-browser.org/520/log.txt

2 2

dillo displays corrupted data using gopher protocol
by Ben Collver May 28, 2026

May 28, 2026

Greetings, I am usuing dillo 3.3.0 on Slackware64 15.0. When i open the following document, dillo corrupts the content 100% of the time. <gopher://tilde.pink/1/~bencollver/log/ 2026-01-04-m1-macro-processor-retreat/readme.map> See example screenshots linked below. <gopher://tilde.pink/I/~bencollver/files/dillo-1.png> <gopher://tilde.pink/I/~bencollver/files/dillo-2.png> Details noticed about this corruption: * It never happens in lynx. * It only happens for type 1 gopher items. * It always begins on the line of text at offset 1500, which happens to be the MTU for both the server and the client. Any suggestions for troubleshooting this further? Thanks! -Ben

2 4

Save link as... silent failure on gopher protocol
by Ben Collver May 25, 2026

May 25, 2026

Good day, I am using dillo 3.3.0 on Slackware64 15.0. If I open a gopher directory, right-click on an item, and click Save link as..., this opens a file save dialog. If i click OK, it dismisses the dialog. I expected it to save something, but it creates no new files. Gopher URI: gopher://gopher.pglaf.org/1/4/0/2/8/40282/ Top item: 40282-0 I found the following workaround: * Left click 40282-0 * Click Save button in browser toolbar This creates a new file as expected. Best regards, -Ben

2 1

Dillo reporting UTF-8 bytes in URLs as bugs
by 256＠256-32.com May 11, 2026

May 11, 2026

On my personal website <https://256-32.com/>, Dillo reports the following bug in a link that uses special characters: HTML warning: line 64, URL has 8 illegal bytes in {00-1F, 7F-FF} range ('/computers/důvěřivý'). However, the HTTP response sent by my server specifies charset=utf-8 in the content type. These UTF-8 links work properly in Dillo, despite the bug message, and I believe my site is not in error here. <validator.w3.org> says my site is fine, so it seems there's nothing wrong with special characters in URLs. It doesn't report the same bytes outside of a link href as being bad. The error message seems to originate from src/html.cc:196.

2 2

[PATCH] Add user-controllable Sec-GPC header
by a1ex＠dismail.de May 2, 2026

May 2, 2026

Hi, The attached patch adds a Sec-GPC header to Dillo. It defaults to ON, and is controllable through a dillorc setting of 'http_sec_gpc'. Also, I changed DNT to be user-controllable with a dillorc setting of 'http_dnt', also defaults to ON. I know that this is too late to get in for the 3.3.0 release, but I'm sending it for review now, and if there are any issues it should allow plenty of time to fix. Regards, Alex

1 1