- Dillo-dev - lists.mailman3.com

Re: a vulnerability in dillo

by Ivan Popov

Hello Jorge, thanks for your answer! On Wed, 5 Mar 2003, Jorge Arellano Cid wrote: > Probably (soon) socket file descriptors will reside in > /tmp/dillo and use temporary filenames, or something akin (this My first reaction is - who would be responsible for creating that /tmp/dillo? The first user? probably not. root at host startup? not a good idea to rely on the host admin to be able to run a program. May be something like /tmp/dillo-<truly-random-chars>/ per dillo instance, then you are rather safe against tampering but you have to make your bookmark server aware of possible parallel server accessing the same bookmarks. I would suggest not to rely on a common name all dillo instances of the same user would share. Then it would be 1. widely known and open to tampering 2. not working across different hosts anyway, as you need a server process per host, while bookmarks file may be shared between hosts. Just in case - I am glad you do not try to put sockets in/under homedirs. 1. the underlying filesystems may not support that 2. there is a hardcoded (in the specification) limit on the path name length of a unix socket - it breaks on some setups with homedirs deep in the filetree I mention it as it is a fairly often mistake of different software with unix sockets, to put sockets under the user's homedir. Best regards and thanks for dillo! -- Ivan

March 5, 2003

Re: [Dillo-dev] Re: hidden fields in forms broken?

by John Bradford

> > I've come across an apparent form anomaly when using dillo to test a > > separate application. > > > > If I create a html form, the data submitted differs depending on whether > > I use "text" or "hidden" input types -- specifically, the "hidden" type > > is not parsed for html entities. This causes breakage when I want to set > > the value to the four-character string x"'y, for example. > > > > The code for this is in html.c, around line 3077 (version 1.132), where > > just using the same "init_str = (value) ? value : NULL;" as most other > > types would work. > > > > >From the comment, it was clearly a deliberate decision to > > leave out entity-parsing for DILLO_HTML_INPUT_HIDDEN (and > > DILLO_HTML_INPUT_PASSWORD, around line 3049). The change appears to have > > been made between revisions 1.5 and 1.6, where the "submit" (and others) > > type explicitly had Html_parse_entities() called but the "hidden" type > > didn't. > > > > I don't see any dispensation in the HTML DTD which makes "hidden" and > > "password" immune to the entity rules. Is the exception in dillo an > > oversight that just hasn't been spotted yet? Or is there some reasoning > > that I'm missing behind the way things are? > > > > For reference, other web browsers I tried took the html fragment > > > > <form> > > <input type=text name=plain value="x"x"> > > <input type=hidden name=hide value="x"x"> > > <input type=submit> > > </form> > > > > and on submission, the URL had the same value for "plain" and "hide". > > In dillo, the query string is plain=x%22x&hide=x%26quot%3Bx > > This is quite an interesting issue! > > I digged through the historical releases and the root of the > problem is very far (before 0.3.2!). > > As I currently see it, the SGML type for those INPUT attribute > values is CDATA, so entities SHOULD/MUST be parsed!!! > > Does anyone know otherwise? I noticed problems with this when I was developing a web based regular expression editor, and thought it was a problem with my code, but checking with another browser, it seemed to be a Dillo bug. Also, note that Dillo breaks on code like this: <input type="hidden" name="foo" value="<b>bar</b>"> displaying "> when it shouldn't do. John.

March 5, 2003

Re: hidden fields in forms broken?

by Jorge Arellano Cid

Francis, > I've come across an apparent form anomaly when using dillo to test a > separate application. > > If I create a html form, the data submitted differs depending on whether > I use "text" or "hidden" input types -- specifically, the "hidden" type > is not parsed for html entities. This causes breakage when I want to set > the value to the four-character string x"'y, for example. > > The code for this is in html.c, around line 3077 (version 1.132), where > just using the same "init_str = (value) ? value : NULL;" as most other > types would work. > > >From the comment, it was clearly a deliberate decision to > leave out entity-parsing for DILLO_HTML_INPUT_HIDDEN (and > DILLO_HTML_INPUT_PASSWORD, around line 3049). The change appears to have > been made between revisions 1.5 and 1.6, where the "submit" (and others) > type explicitly had Html_parse_entities() called but the "hidden" type > didn't. > > I don't see any dispensation in the HTML DTD which makes "hidden" and > "password" immune to the entity rules. Is the exception in dillo an > oversight that just hasn't been spotted yet? Or is there some reasoning > that I'm missing behind the way things are? > > For reference, other web browsers I tried took the html fragment > > <form> > <input type=text name=plain value="x"x"> > <input type=hidden name=hide value="x"x"> > <input type=submit> > </form> > > and on submission, the URL had the same value for "plain" and "hide". > In dillo, the query string is plain=x%22x&hide=x%26quot%3Bx This is quite an interesting issue! I digged through the historical releases and the root of the problem is very far (before 0.3.2!). As I currently see it, the SGML type for those INPUT attribute values is CDATA, so entities SHOULD/MUST be parsed!!! Does anyone know otherwise? Cheers Jorge.-

March 5, 2003

Re: a vulnerability in dillo

by Jorge Arellano Cid

On Sun, 2 Mar 2003, Ivan Popov wrote: > Hello, > > having read the statement about dillo being a secure browser, It tries to be! > I want to draw your attention to the exploitable in different ways > bookmarks plugin interface. > > I submitted it as a bug and mentioned denial-of-service only, but creating > predictably named sockets in /tmp opens to other possible attacks > (e.g. spoofing your bookmarks) as well. > > I realize dillo and the plugins are evolving at fast rate, but this issue > can (and should?) be fixed even on the early stages of development. Probably (soon) socket file descriptors will reside in /tmp/dillo and use temporary filenames, or something akin (this also solves the problem of a pre-existent file with the same name). > Thanks for the great software! > I appreciate dillo - it is small, fast and functional. Thanks for your nice comments too. Cheers Jorge.-

March 5, 2003

Re: [Dillo-dev] freezing of dillo.0.7.0

by Jorge Arellano Cid

On Thu, 27 Feb 2003, robert w hall wrote: > Is the description of the 'freezing' of dillo given in the README an > uptodate description of the problem. This implies that it is a kernel > version effect... Yes, the Linux kernel had a bug and it was fixed. Linux >= 2.4.9 => No problem. > I originally compiled dillo0.6.6 against slack 7, kernel 2.4.5 (IIRC, or > even 2.2.18) with no problems. However dillo0.7.0 does freeze, even when > compiled against the headers for, and run under, kernel 2.4.19. BUT it > compiles and runs ok when compiled under slack8.1, with the same headers > and kernel. > Is this a gcc problem? (I'm using 2.91.66 with slack 7). It may be another kind of freeze! Please get the latest CVS and test it (dillo 0.7.0 freezes on Solaris because of another bug, but it's fixed on the CVS). I've used Slackware since 3.5 aprox. and never had problems with the default gcc. > (The suggested patch poll-fix-fast of course does not run in cleanly > against 0.7.0., and though the source compiles the executable still > freezes). Yes, it's quite a burden to maintain such patches, and the right fix is to upgrade the kernel. > Sorry if I've missed something on this. HTH, and as I said, it was probably another thing... Cheers Jorge.-

March 5, 2003

Re: [Dillo-dev] float implementation

by John Bradford

> I just want to announce the availability of my code to > fix bug #233 which concernes the rendering of > align=left and align=right tables. The patches and > screen shots are at > > http://home.earthlink.net/~crayne2 > > Feedback would be appreciated. :) It seems to have broken something - have a look at http://grabjohn.com The lists no longer have bullets. Also, at: http://kde.org If you use a small Dillo window, the links on the left can overlap the text to their right. For some reason, using FVWM2, maximising the Dillo window no longer makes it redraw with your patches. Having said all that, it does make some pages look a lot better. John.

March 5, 2003

float implementation

by Joe Crayne

I just want to announce the availability of my code to fix bug #233 which concernes the rendering of align=left and align=right tables. The patches and screen shots are at http://home.earthlink.net/~crayne2 Feedback would be appreciated. :)

March 5, 2003

Re: [Dillo-dev] More bugfixes

by Thorben Thuermer

On Tue, 4 Mar 2003 18:22:27 -0300 (CLST) Jorge Arellano Cid <jcid(a)softhome.net> wrote: > Sebastian: Please review BUG#424, Keith says it's a trivial fix. for reference: BUG#: 424 Impact: soft error At: run time Type: memory leak Comments: Version 0.7.0 pixmap leak on resize. Dw_gtk_viewport_paint calls gdk_pixmap_ref instead of gdk_pixmap_unref. Fix is trivial. HTReproduce: Resize dillo repeatedly and note X server memory size increase WorkedBy: keithp(a)keithp.com this looks interesting. i noticed problems with *excessive* X resource leaks (=growth of the server's memory usage), and this might be a possible fix, i'm going to test that. diff -r1.22 dw_gtk_viewport.c 263c263 < gdk_pixmap_ref (viewport->back_pixmap); --- > gdk_pixmap_unref (viewport->back_pixmap); > Ah, can anyone reproduce/not_reproduce bug 406? i could never reproduce that... maybe you should ask people to at least include a gdb backtrace for crashes? Greetings, Thorben Thuermer

March 5, 2003

Re: [Dillo-dev] Question about dpi interface ...

by Thorben Thuermer

On Wed, 05 Mar 2003 10:07:59 +0100 Lars Segerlund <lars.segerlund(a)comsys.se> wrote: > > If I have dillo 0.7.0 with the bookmarks working through dpi, how can > I add dpi functionality ? > > Can I make a dpi server without modyfying the dillo binary ? you might want to read http://dillo.auriga.wearlab.de/dpi1.html for information on the dpi system. > / rgards, Lars Segerlund. Greetings, Thorben Thuermer

March 5, 2003

Question about dpi interface ...

by Lars Segerlund

If I have dillo 0.7.0 with the bookmarks working through dpi, how can I add dpi functionality ? Can I make a dpi server without modyfying the dillo binary ? / rgards, Lars Segerlund.

March 5, 2003