- Dillo-dev - lists.mailman3.com

Hardening Dillo with unveil and pledge
by a1ex＠dismail.de 25 Jul '24

25 Jul '24

Hi list, I have been experimenting with unveil[1] and pledge[2] on Dillo to reduce possible attack surface. Right now these system calls are exclusive to OpenBSD, but there are projects[3] working to bring them to Linux and other systems. Basically, unveil restricts which areas of the filesystem a program can access, and pledge restricts which system calls the program is allowed to make. [1] https://man.openbsd.org/unveil.2 [2] https://man.openbsd.org/pledge.2 [3] https://justine.lol/pledge/ Initial testing indicates that both of these features are working correctly with Dillo. I am including a patch which provides some basic filesystem protection, and limits Dillo to the minimum amount of syscalls possible. If anyone has questions or comments, they are welcome. Regards, Alex --- a/src/dillo.cc Fri Jun 14 22:27:18 2024 +++ b/src/dillo.cc Sat Jul 20 15:16:42 2024 @@ -24,6 +24,7 @@ #include <stdio.h> #include <unistd.h> +#include <err.h> #include <stdlib.h> #include <time.h> #include <sys/types.h> @@ -397,6 +398,24 @@ int main(int argc, char **argv) FILE *fp; srand((uint_t)(time(0) ^ getpid())); + + // Unveil and Pledge + if (unveil("/usr", "rx") == -1) { + err(1, "unveil failed"); + } + if (unveil("/tmp", "rwc") == -1) { + err(1, "unveil failed"); + } + if (unveil("/etc", "r") == -1) { + err(1, "unveil failed"); + } + if (unveil("/home", "rwc") == -1) { + err(1, "unveil failed"); + } + if (pledge("stdio rpath wpath cpath inet unix dns tty proc prot_exec", + NULL) == -1) { + err(1, "pledge failed"); + } // Some OSes exit dillo without this (not GNU/Linux). signal(SIGPIPE, SIG_IGN);

2 5

[SCRIPT] Run Dillo with a random user agent
by a1ex＠dismail.de 14 Jul '24

14 Jul '24

Hi list, Here is a simple script which runs Dillo with a random user agent on each run. I've been using it for a long time with no issues. It would be interesting to have similar functionality built-in to Dillo at some point, at least for me. $ cat rundillo.sh #!/bin/sh # runs dillo with a random user agent, from a list in agents.txt # the ua must be the last line of dillorc, this deletes it: echo -e '$d\nw\nq'| ed ~/.dillo/dillorc # put a random ua line from agents.txt into the last line of dillorc # each line in agents.txt must include http_user_agent='...' cat ~/.dillo/agents.txt | sort -R | head -1 >> ~/.dillo/dillorc # run dillo: dillo ------------------------------- Here is an example 'agents.txt': http_user_agent='Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0' http_user_agent='Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0' http_user_agent='Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0' http_user_agent='Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0' http_user_agent='Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0' http_user_agent='Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5; rv:123.0) Gecko/20100101 Firefox/123.0' http_user_agent='Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5; rv:124.0) Gecko/20100101 Firefox/124.0' http_user_agent='Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5; rv:125.0) Gecko/20100101 Firefox/125.0' http_user_agent='Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5; rv:126.0) Gecko/20100101 Firefox/126.0' http_user_agent='Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5; rv:127.0) Gecko/20100101 Firefox/127.0' ------------------------------ Just make sure there are no blank lines or comments in agents.txt Anyway, hopefully this will be useful to someone. Enjoy :) -Alex

2 6

[PATCH] Toolbar button to control zoom level
by a1ex＠dismail.de 13 Jul '24

13 Jul '24

Hi, Here is an updated patch with a better icon and fixed tooltip. Hopefully somebody finds it useful :) diff -u ./pixmaps.h mod/pixmaps.h --- ./pixmaps.h Sat Jul 6 18:03:43 2024 +++ mod/pixmaps.h Sat Jul 6 18:23:27 2024 @@ -1410,6 +1410,28 @@ }; /* XPM */ +static const char *const zoom_xpm[] = { +"16 16 2 1", +" c None", +"@ c gray70", +" ", +" @@@@@@ ", +" @ @ ", +" @ @ ", +" @ @@ @ ", +" @ @@ @ ", +" @ @@ @ ", +" @ @@@@@@@@ @ ", +" @ @@@@@@@@ @ ", +" @ @@ @ ", +" @ @@ @ ", +" @ @@ @ ", +" @ @@@@ ", +" @@@@@@ @@@", +" @@", +" "}; + +/* XPM */ static const char *const new_s_xpm[] = { "11 11 35 1", " c None", diff -u ./ui.cc mod/ui.cc --- ./ui.cc Sat Jul 6 18:26:52 2024 +++ mod/ui.cc Sat Jul 6 18:03:57 2024 @@ -38,7 +38,7 @@ struct iconset { Fl_Image *ImgMeterOK, *ImgMeterBug, - *ImgHome, *ImgReload, *ImgSave, *ImgBook, *ImgTools, + *ImgHome, *ImgReload, *ImgSave, *ImgBook, *ImgTools, *ImgZoom, *ImgClear,*ImgSearch, *ImgHelp, *ImgLeft, *ImgLeftIn, *ImgRight, *ImgRightIn, *ImgStop, *ImgStopIn; }; @@ -51,6 +51,7 @@ new Fl_Pixmap(save_xpm), new Fl_Pixmap(bm_xpm), new Fl_Pixmap(tools_xpm), + new Fl_Pixmap(zoom_xpm), new Fl_Pixmap(new_s_xpm), new Fl_Pixmap(search_xpm), new Fl_Pixmap(help_xpm), @@ -70,6 +71,7 @@ new Fl_Pixmap(save_s_xpm), new Fl_Pixmap(bm_s_xpm), new Fl_Pixmap(tools_s_xpm), + new Fl_Pixmap(zoom_xpm), new Fl_Pixmap(new_s_xpm), standard_icons.ImgSearch, standard_icons.ImgHelp, @@ -356,6 +358,13 @@ wid->y() + wid->h()); } break; + case UI_ZOOM: + if (b == FL_LEFT_MOUSE) { + a_UIcmd_zoom_in(a_UIcmd_get_bw_by_widget(wid)); + } else if (b == FL_RIGHT_MOUSE) { + a_UIcmd_zoom_out(a_UIcmd_get_bw_by_widget(wid)); + } + break; default: break; } @@ -433,6 +442,7 @@ Stop = make_button("Stop", icons->ImgStop, icons->ImgStopIn, UI_STOP); Bookmarks = make_button("Book", icons->ImgBook, NULL, UI_BOOK); Tools = make_button("Tools", icons->ImgTools, NULL, UI_TOOLS); + Zoom = make_button("Zoom", icons->ImgZoom, NULL, UI_ZOOM); Back->set_tooltip("Previous page"); Forw->set_tooltip("Next page"); @@ -442,6 +452,7 @@ Stop->set_tooltip("Stop loading"); Bookmarks->set_tooltip("View bookmarks"); Tools->set_tooltip("Settings"); + Zoom->set_tooltip("Zoom in: left-click, Zoom out: right-click"); } /** diff -u ./ui.hh mod/ui.hh --- ./ui.hh Sat Jul 6 18:03:43 2024 +++ mod/ui.hh Sat Jul 6 18:03:57 2024 @@ -23,6 +23,7 @@ UI_STOP, UI_BOOK, UI_TOOLS, + UI_ZOOM, UI_CLEAR, UI_SEARCH } UIButton; @@ -125,7 +126,7 @@ CustGroupVertical *TopGroup; CustButton *Back, *Forw, *Home, *Reload, *Save, *Stop, *Bookmarks, - *Tools, *Clear, *Search, *Help, *BugMeter, *FileButton; + *Tools, *Zoom, *Clear, *Search, *Help, *BugMeter, *FileButton; CustGroupHorizontal *LocBar, *NavBar, *StatusBar; Fl_Input *Location; CustProgressBox *PProg, *IProg; -Alex

3 4

Option to define external link handler
by a1ex＠dismail.de 13 Jul '24

13 Jul '24

Hi Rodrigo and list, Thanks for all the recent improvements! I have one more feature which I would like to propose, or hopefully at least get some guidance with. An option to open a link with an external program. This could be a custom downloader, or whatever else the user wants. Ideally it would be a setting in dillorc, something like: external_downloader="/usr/bin/some_command -x -y -z" And in the right-click Link menu there would be an option to open the link with the external program, something like "Open link with external app". I can envision various workflows, especially repetitive ones, in which this would be a real time-saver. There is nothing really wrong with the built-in downloader, but it's not always ideal. Obviously it's possible to copy the link and use it in whatever program, but that results in extra clicks / key-presses. Is there any interest in a feature like this? I've been looking at the source, but am not really seeing a way to easily replace the current download program (or even where it is defined). If anyone has hints on how to do this, I'd appreciate the help. Or, even better, someone more talented could step up and implement the feature :) Regards, Alex

4 23

zoom needs scrolling to maintain center
by pastebin＠gmx.com 12 Jul '24

12 Jul '24

Hi with left mouse click on zoom button -> screen get bigger and screen slides down - so when leaves the viewport it needs a scroll up so center remains and zoom is userfull with right mouse click on zoom button -> screen get smaller and screen slides down - so when viewport is off the physical screena scroll down - do nothing when viewport is <= the physical screen ---

3 3

dillo css
by pastebin＠gmx.com 11 Jul '24

11 Jul '24

Hi the attached html with css that does dropdown box renders fine with seamonkey with the ~/.dillo/style.css or tools/use embedded css it partially succeeds but the drop down fails i have an old dillo css html help file (looks like from 2005) titled Dillo Web Browser :: Cascading Style Sheets and what the current dillo user manual (generated for version 3.1.1) has in it for css any further 3.1.1 css info/help pages? these are quite complicated coding dillo-3.1.1/src/cssparser.cc dillo-3.1.1/src/css.cc

1 0

adding magnifying glass to zoom button
by pastebin＠gmx.com 10 Jul '24

10 Jul '24

Hi I was able to add a 'magnifying' glass to the zoom button by in src/ui.cc line 54 by the following new Fl_Pixmap(search_xpm), // new Fl_Pixmap(zoom_xpm), i am working on how to do make a 'patch' but it still needs some work

1 0

view source - close button
by pastebin＠gmx.com 10 Jul '24

10 Jul '24

Hi didn't there use to be a close button on the bottom of the 'right mouse click/view page source' page like there is on the 'bug display page'? the zoom controls aren't the cause of it not being there

2 3

dillo mouse cursor
by pastebin＠gmx.com 07 Jul '24

07 Jul '24

Hi anyone have any interesting mouse cursor pointers? i'm using a left arrow pointer - then over a link becomes left pointing hand xsetroot -cursor_name left_ptr

2 6

RFC repository
by Rodrigo Arias 07 Jul '24

07 Jul '24

Hi, I've decided to open a RFC-like repository for Dillo here: https://github.com/dillo-browser/rfc So we can have a centralized place to propose and discuss non-arbitrary changes or other topics regarding Dillo. For now they are just Markdown files so they are easy to read and write from any editor and we don't rely much on GitHub. This also allows contributions by sending patches via email. I'll be collecting more thoughts about the rule-based mechanism I was talking about in other threads in the RFC-002: Rule-based content manipulation, here: https://github.com/dillo-browser/rfc/blob/rfc-002/rfc-002-rule-based-conten… I may also add the PEC proposal I did the other day to classify how broken are pages when you disable JS, although it not very Dillo specific: https://dillo-browser.github.io/pec/ Best, Rodrigo.

2 2