- Dillo-dev - lists.mailman3.com

web bug save?

by bblochl＠arcor.de

*On http://www.dillo.org/ I found the item News and a remark: 03-Jul-2009 Dillo-2.1.1 has been released to provide a security fix for malicious images. I am not shure what is meant with **malicious images? Are this so called Web bugs? If yes - how is the blocking done? I think there are some strategies possible to prevent a browser from a Web Bug attack: 1. Dont allow to load gifs or pngs from another URL as the actual page comes from. (I think to remember that firefox **originally **had such an option - not available in the actual version.) 2. I think one might prepare HTML/CSS not to load such gifs or pngs smaller than say about 5x5. Do you think such a measure is feasible in Dillo and could that really stop Web Bugs? But I think that there should not be a problem to make Web Bugs larger than 1x1pixel as long as they are transparent - may be I am wrong, I am just a simple minded user, not a web professional. So such a limit might be useless? Are there other ideas? I am highly interested in that Web Bug problem. Seasons greetings bblochl ** *

Dec. 25, 2009

[oph-villedieu@orange.fr: dillo_2.1.1]

by corvid＠lavabit.com

Johannes wrote: > I think we never supported valign=top | middle | bottom > in dillo-fltk. > We probabely need to implement it in Textblock::sizeAllocateImpl(). I realized that my current solution, already known to be awfully inefficient, wouldn't let me implement baseline alignment. So, back to Table::sizeAllocateImpl(). When I had tried modifying y and descent here the other day, it put things in roughly the right place, but my problem was that the box drawn around the cell wouldn't reach to the top anymore. I imagine modifying the top padding value might help. Would that be an improper way to go about it?

Dec. 24, 2009

valign table cells (Re: [Dillo-dev] dpi program names)

by corvid＠lavabit.com

Johannes wrote: > On Wed, Dec 23, 2009 at 07:28:40PM +0000, corvid wrote: > > Something...somewhere...gets confused sometimes, though. > > Maybe I'll puzzle it out, but we'll see. I hope it's not somewhere in > > the redraw optimizations or something. > > If that's the case, i.e. it get's fixed by dragging another window > over the dillo window, then I will try to fix that. Let's not hold > off features because of this optimization thing. Luckily it turned out to be a bug in my code. I was using getContentHeight() when I needed to determine this manually from the passed allocation instead.

Dec. 24, 2009

dpi program names

by Johannes.Hofmann＠gmx.de

On Wed, Dec 23, 2009 at 07:28:40PM +0000, corvid wrote: > When talking with the submitter for bug#930, I found that he used > --prefix, which meant that dpid couldn't be found when > the directory wasn't in his path. > --program-suffix, which meant that dillo wasn't going to find dpid > anyway. (Apparently the dpis also had the suffix, which is probably > not handled by anything, either.) > > To what degree do you think it would be reasonable to handle this? > > Teaching dillo to try the --prefix when searching for dpid is pretty > easy, but when it comes to --program-suffix...well, I'm not sure > whether that's hard to extract from autoconf or not, but there's also > "--program-transform-name" which takes a sed program that transforms > names into who-knows-what, and the prospect of teaching src/IO/dpi.c to > know what happened over in dpid/ makes me want to write something > in the FAQ about leaving the filenames themselves alone. We could do something about --prefix, but for the rest I would just add a note in the FAQ or improve error messages if necessary. > > > PS I discovered that I could get vertical-align and table cells to > pretty much work by making a TableCell::lineYOffsetWidgetAllocation > (so much for having the Textblock version inline!). Nice! > Something...somewhere...gets confused sometimes, though. > Maybe I'll puzzle it out, but we'll see. I hope it's not somewhere in > the redraw optimizations or something. If that's the case, i.e. it get's fixed by dragging another window over the dillo window, then I will try to fix that. Let's not hold off features because of this optimization thing. Cheers, Johannes

Dec. 23, 2009

dpi program names

by corvid＠lavabit.com

When talking with the submitter for bug#930, I found that he used --prefix, which meant that dpid couldn't be found when the directory wasn't in his path. --program-suffix, which meant that dillo wasn't going to find dpid anyway. (Apparently the dpis also had the suffix, which is probably not handled by anything, either.) To what degree do you think it would be reasonable to handle this? Teaching dillo to try the --prefix when searching for dpid is pretty easy, but when it comes to --program-suffix...well, I'm not sure whether that's hard to extract from autoconf or not, but there's also "--program-transform-name" which takes a sed program that transforms names into who-knows-what, and the prospect of teaching src/IO/dpi.c to know what happened over in dpid/ makes me want to write something in the FAQ about leaving the filenames themselves alone. PS I discovered that I could get vertical-align and table cells to pretty much work by making a TableCell::lineYOffsetWidgetAllocation (so much for having the Textblock version inline!). Something...somewhere...gets confused sometimes, though. Maybe I'll puzzle it out, but we'll see. I hope it's not somewhere in the redraw optimizations or something.

Dec. 23, 2009

patch: no size 0 images

by corvid＠lavabit.com

Just a little toy to ignore images of size 0. I also tried checking for display:none, but this made css very unhappy when it reached the noncss hints code later in the function. I didn't bother to try to fit it in with the neighboring code yet, since I don't know how well this will go over. So far, a bit of browsing has mostly shown me that there is a company at scorecardresearch.com that has infected a nontrivial portion of the web. (Of course we could still dig up the same-domain code and do something with that instead.)

Dec. 22, 2009

patch: vertical-align

by corvid＠lavabit.com

I just put up a new version. I had introduced a bug while cleaning up the code yesterday. I would've expected it to have broken everything quickly and horribly, but somehow I managed to run happily for hours before triggering the bug.

Dec. 22, 2009

patch: vertical-align

by corvid＠lavabit.com

http://www.dillo.org/test/vertical-align.patch - this won't do anything for table cells - it sometimes won't do the right thing because it doesn't know what is yet to come later in the line - it calculates Y offsets for words when drawing them. It may be better to add a field to Word

Dec. 21, 2009

[oph-villedieu@orange.fr: dillo_2.1.1]

by corvid＠lavabit.com

Johannes wrote: > On Sun, Dec 20, 2009 at 11:28:15AM -0300, Jorge Arellano Cid wrote: > > Hi, > > > > I just received this email. The attached example shows the bug. > > Does anybody remember what we did with valign? ;) > > > > > > I'm afraid I found a bug in this release (?) : > > > it does not understand the html tag <td valign="bottom"> > > > it reads instead <td valign="top"> > I think we never supported valign=top | middle | bottom > in dillo-fltk. > We probabely need to implement it in Textblock::sizeAllocateImpl(). The vertical-align code I have around doesn't do anything for table cells. I guess I have increased incentive to clean up what I already have, at least.

Dec. 20, 2009

[oph-villedieu@orange.fr: dillo_2.1.1]

by Johannes.Hofmann＠gmx.de

Hi, On Sun, Dec 20, 2009 at 11:28:15AM -0300, Jorge Arellano Cid wrote: > Hi, > > I just received this email. The attached example shows the bug. > Does anybody remember what we did with valign? ;) > > > > I'm afraid I found a bug in this release (?) : > > it does not understand the html tag <td valign="bottom"> > > it reads instead <td valign="top"> > > #:-(( > > hoping it helps, > > best whishes for Christmas and New year, > > > > Edouard BENOIS (France) > > > > http://pagesperso-orange.fr/edouard.benois/photos.htm > > Ouch, that doesn't look good :-) > > > > > <html> > <body> > <table border='1'> > <tr> > <td>1<br>2<br>3 > <td valign=top>* > <td valign=middle>* > <td valign=bottom>* > </table> > </body> > </html> I think we never supported valign=top | middle | bottom in dillo-fltk. We probabely need to implement it in Textblock::sizeAllocateImpl(). Cheers, Johannes

Dec. 20, 2009