- Dillo-dev - lists.mailman3.com

an experiment regarding cross site request forgery

by corvid＠lavabit.com

Justus wrote: > Johannes Hofmann wrote: > > Perhaps we should be more careful when to send out a cookie. > > What about not sending cookies with image requests, if the host of > > the image url is different from the one in the main page? > > What do other browser do about this? > > Yes, I think this is the way to go. One need to decide when to send out > authentication credentials (legitimate session) and when to strip them > (CSRF attempt). Martin Johns and I developed a firefox extension [0] > that does exactly this. Please see [1] pages 29 - 37 or [2] for more > information. [1] is also a pretty good introduction to CSRF. Please note > that the browser independent proxy solution is deprecated (but should > work unless the twisted framework changed its api too much) and the > firefox extension is somewhat unmaintained at the moment... Having done some reading now: So for an HTTP redirect or an image request, A->B, I gather up the cookies that I would send when asking for B and discard those that I would not send if I were asking for A?

Oct. 1, 2008

what crashes remain?

by Johannes.Hofmann＠gmx.de

On Wed, Oct 01, 2008 at 03:01:19PM -0400, Jorge Arellano Cid wrote: > On Wed, Oct 01, 2008 at 06:14:47PM +0200, Johannes Hofmann wrote: > > On Wed, Oct 01, 2008 at 11:45:53AM -0400, Jorge Arellano Cid wrote: > > > On Wed, Oct 01, 2008 at 04:47:05PM +0200, Johannes Hofmann wrote: > > > > Hi, > > > > > > > > On Wed, Oct 01, 2008 at 10:33:20AM -0400, Jorge Arellano Cid wrote: > > > > > Hi, > > > > > > > > > > On Sat, Sep 27, 2008 at 05:38:03PM -0400, Jorge Arellano Cid wrote: > > > > > > On Sat, Sep 27, 2008 at 05:29:28PM +0000, corvid wrote: > > > > > > > It's still possible to crash dillo if you click on a remote link and > > > > > > > quickly click on some images to load them. Doesn't crash every time, > > > > > > > but typically within four tries or so. I had assumed it was the same > > > > > > > thing as whatever was wrong with the menu crash, so I'd ignored it. > > > > > > > > > > > > > > If I stick > > > > > > > a_Bw_stop_clients(bw, BW_Img); > > > > > > > in the DilloHtml destructor, I can no longer get it to crash, but > > > > > > > I randomly got a "Cache_process_queue Caught busy!!!" while browsing > > > > > > > earlier today, so there's something wrong with just doing that. > > > > > > > (Assuming it's related; I'm not in the habit of getting that MSG.) > > > > > > > > > > > > That message means big trouble: the event loop stepped over itself... > > > > > > > > > > > > I've tried several different ways but can't get to crash it. > > > > > > > > > > > > Does the attached patch help? > > > > > > > > > > > > -- > > > > > > Cheers > > > > > > Jorge.- > > > > > > > > > > > diff -pru dillo2/src/html.cc dillo2-cur/src/html.cc > > > > > > --- dillo2/src/html.cc 2008-09-27 15:11:08.000000000 -0400 > > > > > > +++ dillo2-cur/src/html.cc 2008-09-27 17:34:21.000000000 -0400 > > > > > > @@ -711,6 +711,8 @@ bool_t DilloHtml::unloadedImages() > > > > > > */ > > > > > > void DilloHtml::loadImages (const DilloUrl *pattern) > > > > > > { > > > > > > + dReturn_if_fail (bw->nav_expecting == FALSE); > > > > > > + > > > > > > for (int i = 0; i < images->size(); i++) { > > > > > > if (images->get(i)->image) { > > > > > > if ((!pattern) || (!a_Url_cmp(images->get(i)->url, pattern))) { > > > > > > > > > > Can you still crash dillo this way, with the latest CVS? > > > > > (i.e. without the above patch). > > > > > > > > I'm currently seeing all sorts of crashes and I suspect that they > > > > are related to xpmImage from fltk. > > > > Could someone with a linux machine please check current dillo with > > > > valgrind especially when the new mini_bug_xpm is shown? > > > > > > > > Also changing mini_bug_xpm to 15x15 seems to fix things for me. > > > > I don't understand all that completely, but other crashes might be > > > > related to this. > > > > > > OK, I'll check with valgrind... > > > Does changing mini_ok_xpm to 16x16 fix it too? > > > > No it doesn't, that's what I thought first too :-) > > > > But it really only happens when fltk was compiled with > > --disable-xft > > I did that and FLTK's tests don't use xft, but my > dillo-fltk still uses them! > Did you call ./configure for dillo again? > > > BTW, does a: > > - new_w = strlen(str)*8 + 20; > + new_w = strlen(str)*8 + 40; > > in ui.cc solve the problem for you? No, it doesn't. I think it's a fltk problem. Cheers, Johannes

Oct. 1, 2008

what crashes remain?

by jcid＠dillo.org

On Sat, Sep 27, 2008 at 11:15:42PM +0000, corvid wrote: > Jorge wrote: > > On Sat, Sep 27, 2008 at 05:29:28PM +0000, corvid wrote: > > > It's still possible to crash dillo if you click on a remote link and > > > quickly click on some images to load them. Doesn't crash every time, > > > but typically within four tries or so. I had assumed it was the same > > > thing as whatever was wrong with the menu crash, so I'd ignored it. > > > > > > If I stick > > > a_Bw_stop_clients(bw, BW_Img); > > > in the DilloHtml destructor, I can no longer get it to crash, but > > > I randomly got a "Cache_process_queue Caught busy!!!" while browsing > > > earlier today, so there's something wrong with just doing that. > > > (Assuming it's related; I'm not in the habit of getting that MSG.) > > > > That message means big trouble: the event loop stepped over itself... > > > > I've tried several different ways but can't get to crash it. > > > > Does the attached patch help? > > Seems to be working well so far. > Is there any danger in adding something like > a_Nav_cancel_expect to a_UIcmd_stop()? It looks safe to do. It even looks like the right thing to do. Just committed: - Disallowed loading images when expecting is set. - Added a cancel_expect call to the Stop button. -- Cheers Jorge.-

Oct. 1, 2008

[patch] share button images between UIs

by Johannes.Hofmann＠gmx.de

On Wed, Oct 01, 2008 at 04:38:42PM -0400, Jorge Arellano Cid wrote: > On Wed, Oct 01, 2008 at 02:58:44PM -0400, Jorge Arellano Cid wrote: > > On Wed, Oct 01, 2008 at 07:36:54PM +0200, Johannes Hofmann wrote: > > > Hi, > > > > > > this is independent from the recent crashes. > > > This patch shares the images between multiple UIs. > > > > > > What do you think? > > > > Committed! > > > > Except that "img on/off" doesn't switch the icon. > > Please send me a patch for this. > > Don't worry, it's fixed in CVS now. > Ah thanks. A similar fix is necessary for small icons. Patch attached. Cheers, Johannes

Oct. 1, 2008

what crashes remain?

by jcid＠dillo.org

On Wed, Oct 01, 2008 at 02:48:10PM +0000, corvid wrote: > Jorge wrote: > > On Sat, Sep 27, 2008 at 05:38:03PM -0400, Jorge Arellano Cid wrote: > > > On Sat, Sep 27, 2008 at 05:29:28PM +0000, corvid wrote: > > > > It's still possible to crash dillo if you click on a remote link and > > > > quickly click on some images to load them. Doesn't crash every time, > > > > but typically within four tries or so. I had assumed it was the same > > > > thing as whatever was wrong with the menu crash, so I'd ignored it. > > > > > > > > If I stick > > > > a_Bw_stop_clients(bw, BW_Img); > > > > in the DilloHtml destructor, I can no longer get it to crash, but > > > > I randomly got a "Cache_process_queue Caught busy!!!" while browsing > > > > earlier today, so there's something wrong with just doing that. > > > > (Assuming it's related; I'm not in the habit of getting that MSG.) > > > > > > That message means big trouble: the event loop stepped over itself... > > > > > > I've tried several different ways but can't get to crash it. > > > > > > Does the attached patch help? > > > > > > -- > > > Cheers > > > Jorge.- > > > > > diff -pru dillo2/src/html.cc dillo2-cur/src/html.cc > > > --- dillo2/src/html.cc 2008-09-27 15:11:08.000000000 -0400 > > > +++ dillo2-cur/src/html.cc 2008-09-27 17:34:21.000000000 -0400 > > > @@ -711,6 +711,8 @@ bool_t DilloHtml::unloadedImages() > > > */ > > > void DilloHtml::loadImages (const DilloUrl *pattern) > > > { > > > + dReturn_if_fail (bw->nav_expecting == FALSE); > > > + > > > for (int i = 0; i < images->size(); i++) { > > > if (images->get(i)->image) { > > > if ((!pattern) || (!a_Url_cmp(images->get(i)->url, pattern))) { > > > > Can you still crash dillo this way, with the latest CVS? > > (i.e. without the above patch). > > Yes. > > Also, I found out why loading was sometimes randomly disabled (as mentioned > yesterday). You know how leaving the window sometimes causes an extra > Nav_open_url()? No, I don't know. How is it triggered? -- Cheers Jorge.-

Oct. 1, 2008

[patch] share button images between UIs

by jcid＠dillo.org

On Wed, Oct 01, 2008 at 02:58:44PM -0400, Jorge Arellano Cid wrote: > On Wed, Oct 01, 2008 at 07:36:54PM +0200, Johannes Hofmann wrote: > > Hi, > > > > this is independent from the recent crashes. > > This patch shares the images between multiple UIs. > > > > What do you think? > > Committed! > > Except that "img on/off" doesn't switch the icon. > Please send me a patch for this. Don't worry, it's fixed in CVS now. -- Cheers Jorge.-

Oct. 1, 2008

what crashes remain?

by jcid＠dillo.org

On Wed, Oct 01, 2008 at 06:14:47PM +0200, Johannes Hofmann wrote: > On Wed, Oct 01, 2008 at 11:45:53AM -0400, Jorge Arellano Cid wrote: > > On Wed, Oct 01, 2008 at 04:47:05PM +0200, Johannes Hofmann wrote: > > > Hi, > > > > > > On Wed, Oct 01, 2008 at 10:33:20AM -0400, Jorge Arellano Cid wrote: > > > > Hi, > > > > > > > > On Sat, Sep 27, 2008 at 05:38:03PM -0400, Jorge Arellano Cid wrote: > > > > > On Sat, Sep 27, 2008 at 05:29:28PM +0000, corvid wrote: > > > > > > It's still possible to crash dillo if you click on a remote link and > > > > > > quickly click on some images to load them. Doesn't crash every time, > > > > > > but typically within four tries or so. I had assumed it was the same > > > > > > thing as whatever was wrong with the menu crash, so I'd ignored it. > > > > > > > > > > > > If I stick > > > > > > a_Bw_stop_clients(bw, BW_Img); > > > > > > in the DilloHtml destructor, I can no longer get it to crash, but > > > > > > I randomly got a "Cache_process_queue Caught busy!!!" while browsing > > > > > > earlier today, so there's something wrong with just doing that. > > > > > > (Assuming it's related; I'm not in the habit of getting that MSG.) > > > > > > > > > > That message means big trouble: the event loop stepped over itself... > > > > > > > > > > I've tried several different ways but can't get to crash it. > > > > > > > > > > Does the attached patch help? > > > > > > > > > > -- > > > > > Cheers > > > > > Jorge.- > > > > > > > > > diff -pru dillo2/src/html.cc dillo2-cur/src/html.cc > > > > > --- dillo2/src/html.cc 2008-09-27 15:11:08.000000000 -0400 > > > > > +++ dillo2-cur/src/html.cc 2008-09-27 17:34:21.000000000 -0400 > > > > > @@ -711,6 +711,8 @@ bool_t DilloHtml::unloadedImages() > > > > > */ > > > > > void DilloHtml::loadImages (const DilloUrl *pattern) > > > > > { > > > > > + dReturn_if_fail (bw->nav_expecting == FALSE); > > > > > + > > > > > for (int i = 0; i < images->size(); i++) { > > > > > if (images->get(i)->image) { > > > > > if ((!pattern) || (!a_Url_cmp(images->get(i)->url, pattern))) { > > > > > > > > Can you still crash dillo this way, with the latest CVS? > > > > (i.e. without the above patch). > > > > > > I'm currently seeing all sorts of crashes and I suspect that they > > > are related to xpmImage from fltk. > > > Could someone with a linux machine please check current dillo with > > > valgrind especially when the new mini_bug_xpm is shown? > > > > > > Also changing mini_bug_xpm to 15x15 seems to fix things for me. > > > I don't understand all that completely, but other crashes might be > > > related to this. > > > > OK, I'll check with valgrind... > > Does changing mini_ok_xpm to 16x16 fix it too? > > No it doesn't, that's what I thought first too :-) > > But it really only happens when fltk was compiled with > --disable-xft I did that and FLTK's tests don't use xft, but my dillo-fltk still uses them! BTW, does a: - new_w = strlen(str)*8 + 20; + new_w = strlen(str)*8 + 40; in ui.cc solve the problem for you? If true, I can make a patch using measure(). -- Cheers Jorge.-

Oct. 1, 2008

[patch] share button images between UIs

by jcid＠dillo.org

On Wed, Oct 01, 2008 at 07:36:54PM +0200, Johannes Hofmann wrote: > Hi, > > this is independent from the recent crashes. > This patch shares the images between multiple UIs. > > What do you think? Committed! Except that "img on/off" doesn't switch the icon. Please send me a patch for this. -- Cheers Jorge.-

Oct. 1, 2008

[patch] share button images between UIs

by corvid＠lavabit.com

Johannes wrote: > this is independent from the recent crashes. > This patch shares the images between multiple UIs. > > What do you think? Good!

Oct. 1, 2008

[patch] share button images between UIs

by Johannes.Hofmann＠gmx.de

Hi, this is independent from the recent crashes. This patch shares the images between multiple UIs. What do you think? Cheers, Johannes

Oct. 1, 2008