- Dillo-dev - lists.mailman3.com

Re: [Dillo-dev] Re: hidden fields in forms broken?

by John Bradford

> > I've come across an apparent form anomaly when using dillo to test a > > separate application. > > > > If I create a html form, the data submitted differs depending on whether > > I use "text" or "hidden" input types -- specifically, the "hidden" type > > is not parsed for html entities. This causes breakage when I want to set > > the value to the four-character string x"'y, for example. > > > > The code for this is in html.c, around line 3077 (version 1.132), where > > just using the same "init_str = (value) ? value : NULL;" as most other > > types would work. > > > > >From the comment, it was clearly a deliberate decision to > > leave out entity-parsing for DILLO_HTML_INPUT_HIDDEN (and > > DILLO_HTML_INPUT_PASSWORD, around line 3049). The change appears to have > > been made between revisions 1.5 and 1.6, where the "submit" (and others) > > type explicitly had Html_parse_entities() called but the "hidden" type > > didn't. > > > > I don't see any dispensation in the HTML DTD which makes "hidden" and > > "password" immune to the entity rules. Is the exception in dillo an > > oversight that just hasn't been spotted yet? Or is there some reasoning > > that I'm missing behind the way things are? > > > > For reference, other web browsers I tried took the html fragment > > > > <form> > > <input type=text name=plain value="x"x"> > > <input type=hidden name=hide value="x"x"> > > <input type=submit> > > </form> > > > > and on submission, the URL had the same value for "plain" and "hide". > > In dillo, the query string is plain=x%22x&hide=x%26quot%3Bx > > This is quite an interesting issue! > > I digged through the historical releases and the root of the > problem is very far (before 0.3.2!). > > As I currently see it, the SGML type for those INPUT attribute > values is CDATA, so entities SHOULD/MUST be parsed!!! > > Does anyone know otherwise? I noticed problems with this when I was developing a web based regular expression editor, and thought it was a problem with my code, but checking with another browser, it seemed to be a Dillo bug. Also, note that Dillo breaks on code like this: <input type="hidden" name="foo" value="<b>bar</b>"> displaying "> when it shouldn't do. John.

March 5, 2003

Re: hidden fields in forms broken?

by Jorge Arellano Cid

Francis, > I've come across an apparent form anomaly when using dillo to test a > separate application. > > If I create a html form, the data submitted differs depending on whether > I use "text" or "hidden" input types -- specifically, the "hidden" type > is not parsed for html entities. This causes breakage when I want to set > the value to the four-character string x"'y, for example. > > The code for this is in html.c, around line 3077 (version 1.132), where > just using the same "init_str = (value) ? value : NULL;" as most other > types would work. > > >From the comment, it was clearly a deliberate decision to > leave out entity-parsing for DILLO_HTML_INPUT_HIDDEN (and > DILLO_HTML_INPUT_PASSWORD, around line 3049). The change appears to have > been made between revisions 1.5 and 1.6, where the "submit" (and others) > type explicitly had Html_parse_entities() called but the "hidden" type > didn't. > > I don't see any dispensation in the HTML DTD which makes "hidden" and > "password" immune to the entity rules. Is the exception in dillo an > oversight that just hasn't been spotted yet? Or is there some reasoning > that I'm missing behind the way things are? > > For reference, other web browsers I tried took the html fragment > > <form> > <input type=text name=plain value="x"x"> > <input type=hidden name=hide value="x"x"> > <input type=submit> > </form> > > and on submission, the URL had the same value for "plain" and "hide". > In dillo, the query string is plain=x%22x&hide=x%26quot%3Bx This is quite an interesting issue! I digged through the historical releases and the root of the problem is very far (before 0.3.2!). As I currently see it, the SGML type for those INPUT attribute values is CDATA, so entities SHOULD/MUST be parsed!!! Does anyone know otherwise? Cheers Jorge.-

March 5, 2003

Re: a vulnerability in dillo

by Jorge Arellano Cid

On Sun, 2 Mar 2003, Ivan Popov wrote: > Hello, > > having read the statement about dillo being a secure browser, It tries to be! > I want to draw your attention to the exploitable in different ways > bookmarks plugin interface. > > I submitted it as a bug and mentioned denial-of-service only, but creating > predictably named sockets in /tmp opens to other possible attacks > (e.g. spoofing your bookmarks) as well. > > I realize dillo and the plugins are evolving at fast rate, but this issue > can (and should?) be fixed even on the early stages of development. Probably (soon) socket file descriptors will reside in /tmp/dillo and use temporary filenames, or something akin (this also solves the problem of a pre-existent file with the same name). > Thanks for the great software! > I appreciate dillo - it is small, fast and functional. Thanks for your nice comments too. Cheers Jorge.-

March 5, 2003

Re: [Dillo-dev] freezing of dillo.0.7.0

by Jorge Arellano Cid

On Thu, 27 Feb 2003, robert w hall wrote: > Is the description of the 'freezing' of dillo given in the README an > uptodate description of the problem. This implies that it is a kernel > version effect... Yes, the Linux kernel had a bug and it was fixed. Linux >= 2.4.9 => No problem. > I originally compiled dillo0.6.6 against slack 7, kernel 2.4.5 (IIRC, or > even 2.2.18) with no problems. However dillo0.7.0 does freeze, even when > compiled against the headers for, and run under, kernel 2.4.19. BUT it > compiles and runs ok when compiled under slack8.1, with the same headers > and kernel. > Is this a gcc problem? (I'm using 2.91.66 with slack 7). It may be another kind of freeze! Please get the latest CVS and test it (dillo 0.7.0 freezes on Solaris because of another bug, but it's fixed on the CVS). I've used Slackware since 3.5 aprox. and never had problems with the default gcc. > (The suggested patch poll-fix-fast of course does not run in cleanly > against 0.7.0., and though the source compiles the executable still > freezes). Yes, it's quite a burden to maintain such patches, and the right fix is to upgrade the kernel. > Sorry if I've missed something on this. HTH, and as I said, it was probably another thing... Cheers Jorge.-

March 5, 2003

Re: [Dillo-dev] float implementation

by John Bradford

> I just want to announce the availability of my code to > fix bug #233 which concernes the rendering of > align=left and align=right tables. The patches and > screen shots are at > > http://home.earthlink.net/~crayne2 > > Feedback would be appreciated. :) It seems to have broken something - have a look at http://grabjohn.com The lists no longer have bullets. Also, at: http://kde.org If you use a small Dillo window, the links on the left can overlap the text to their right. For some reason, using FVWM2, maximising the Dillo window no longer makes it redraw with your patches. Having said all that, it does make some pages look a lot better. John.

March 5, 2003

float implementation

by Joe Crayne

I just want to announce the availability of my code to fix bug #233 which concernes the rendering of align=left and align=right tables. The patches and screen shots are at http://home.earthlink.net/~crayne2 Feedback would be appreciated. :)

March 5, 2003

Re: [Dillo-dev] More bugfixes

by Thorben Thuermer

On Tue, 4 Mar 2003 18:22:27 -0300 (CLST) Jorge Arellano Cid <jcid(a)softhome.net> wrote: > Sebastian: Please review BUG#424, Keith says it's a trivial fix. for reference: BUG#: 424 Impact: soft error At: run time Type: memory leak Comments: Version 0.7.0 pixmap leak on resize. Dw_gtk_viewport_paint calls gdk_pixmap_ref instead of gdk_pixmap_unref. Fix is trivial. HTReproduce: Resize dillo repeatedly and note X server memory size increase WorkedBy: keithp(a)keithp.com this looks interesting. i noticed problems with *excessive* X resource leaks (=growth of the server's memory usage), and this might be a possible fix, i'm going to test that. diff -r1.22 dw_gtk_viewport.c 263c263 < gdk_pixmap_ref (viewport->back_pixmap); --- > gdk_pixmap_unref (viewport->back_pixmap); > Ah, can anyone reproduce/not_reproduce bug 406? i could never reproduce that... maybe you should ask people to at least include a gdb backtrace for crashes? Greetings, Thorben Thuermer

March 5, 2003

Re: [Dillo-dev] Question about dpi interface ...

by Thorben Thuermer

On Wed, 05 Mar 2003 10:07:59 +0100 Lars Segerlund <lars.segerlund(a)comsys.se> wrote: > > If I have dillo 0.7.0 with the bookmarks working through dpi, how can > I add dpi functionality ? > > Can I make a dpi server without modyfying the dillo binary ? you might want to read http://dillo.auriga.wearlab.de/dpi1.html for information on the dpi system. > / rgards, Lars Segerlund. Greetings, Thorben Thuermer

March 5, 2003

Question about dpi interface ...

by Lars Segerlund

If I have dillo 0.7.0 with the bookmarks working through dpi, how can I add dpi functionality ? Can I make a dpi server without modyfying the dillo binary ? / rgards, Lars Segerlund.

March 5, 2003

More bugfixes

by Jorge Arellano Cid

Hi there! I've been reviewing the bugtrack and receiving a lot of emails with regard to problems with solaris. There were several issues, some solved in CVS and others that escape our scope (Solaris is so inconsistent that some versions require certain libraries that others not, some fail, some work...) If someone has the patience to tweak configure.in to detect the different subversions of Solaris and add the magical options, I'd put it in. Just read the ChangeLog for a brief of the fixes. --------------------------------------------------- NOTE: There're lots of fixes, not just for Solaris. --------------------------------------------------- Please send me feedback about how it went. Sadly I just received _one_ mail report. Andreas: Please test the flock patch. It should work with *BSD as it defines flock(). Sebastian: Please review BUG#424, Keith says it's a trivial fix. Ah, can anyone reproduce/not_reproduce bug 406? Has anyone with a 64bit machine had NO trouble at all? :-) Cheers Jorge.-

March 4, 2003