Re: [Edbrowse-dev] frames and security

2017-08-09 Thread Dominique Martinet
Karl Dahlke wrote on Wed, Aug 09, 2017: > So if I had an email server in China that spewed out millions of phishing > emails each day, I could have those emails direct the user to a false site > that was a blank window with a frame inside and that frame brings up Bank of > America.com. > This is

Re: [Edbrowse-dev] showscripts()

2017-09-20 Thread Dominique Martinet
Hi Geoff, Geoff McLane wrote on Thu, Sep 21, 2017: > But then when I type showscipts(), I just get a ? > > Likewise typing dumptree() gets me another ? > > Obviously missing something here... sorry for being such a klutz... > any help appreciated... I think these are js function, so you should

Re: [Edbrowse-dev] Signing into my Amazon account

2018-01-05 Thread Dominique Martinet
Hi Chuck, Happy new year everyone. Chuck Hallenbeck wrote on Fri, Jan 05, 2018: > #1. No matter what, I always get the "Please enable > cookies to continue" message at the top of the sign-in page. This is likely a js problem, some variable/field must not be set somewhere so the text is displaye

Re: [Edbrowse-dev] Signing into my Amazon account

2018-01-06 Thread Dominique Martinet
Hi Chuck, Chuck Hallenbeck wrote on Sat, Jan 06, 2018: > The file containing the failed signin is only about 3K, and can be > fount here: > > www.panix.com/~chuxroom/signing-in.txt I'm not going to be very helpful regarding the js errors themselves, but if your password is six numbers followed b

Re: [Edbrowse-dev] amazon and its JS

2018-01-13 Thread Dominique Martinet
Hi all, On my end I cannot log in either, using duktape's master, but I've been playing a bit with duktape's debugging. One thing I find odd is that the loading time for www.amazon.com (not the sign in page) seems to vary greatly from one run to another. Sometimes it loads in tens of seconds (slo

Re: [Edbrowse-dev] amazon and its JS

2018-01-13 Thread Dominique Martinet
Dominique Martinet wrote on Sat, Jan 13, 2018: > I have only walked through the very first of these : > querySelectorAll seems to be invoked from document > (e.g. document.querySelectorAll()) modulo tons of obfuscation. > I thought this would be easy to fix by just addi

Re: [Edbrowse-dev] Directory Sort

2018-01-13 Thread Dominique Martinet
I don't really use edbrowse for files, but a couple of remarks as I do use ls sorting a lot. Karl Dahlke wrote on Sat, Jan 13, 2018: > dsrt=t sort by time. Files have three (or sometimes four now) times, the time you're referring to is probably mtime (modification time), but I think it might be

Re: [Edbrowse-dev] Error Object

2018-01-19 Thread Dominique Martinet
Hi Karl, thanks for this mail, Karl Dahlke wrote on Fri, Jan 19, 2018: > Re: x.foobar, the base value is unfortunately not available after > error creation. Both expressions like 'v = x.foobar' and 'v = > x.foobar()' do have access to 'x' when the internal call site creates > and throws the error.

Re: [Edbrowse-dev] Curl library error

2018-01-29 Thread Dominique Martinet
Chuck Hallenbeck wrote on Mon, Jan 29, 2018: > If I decide to backtrack, it makes sense to do so stepping backward a > day at a time until I can once more access that site. But what would > that tell us? If you're up for it, git has a 'bisect' command where it goes halfway in history everytime a

Re: [Edbrowse-dev] version

2018-02-18 Thread Dominique Martinet
Karl Dahlke wrote on Sun, Feb 18, 2018: > And it won't be easy because a lot of those tests are in try catch and don't > cause any errors that we can see. > Can we somehow see errors that are hidden inside try catch? I'd need to remove some of the dust but my duktape debugger test did log errors

Re: [Edbrowse-dev] version

2018-02-18 Thread Dominique Martinet
Dominique Martinet wrote on Sun, Feb 18, 2018: > Definitely not something we want integrated before a release but could > help in a separate branch just to test, will send a mail with some > instructions once I got it to move again So, as a prerequisite, ou need a debugger-enabled du

Re: [Edbrowse-dev] zip and security

2018-03-05 Thread Dominique Martinet
Karl Dahlke wrote on Mon, Mar 05, 2018: > He writes a web page with javascript that does an xhr request to > zipxd://foo.zip@:@top I think it's a matter of priority, but now we have javascript working a bit better we might soon find time to make it more restricted somehow. I still think allowing

Re: [Edbrowse-dev] XHR same-domain restriction

2018-03-12 Thread Dominique Martinet
Karl Dahlke wrote on Mon, Mar 12, 2018: > I doubt there are restrictions on xhr domains in other browsers. If > there were such restrictions, one could get around them easily. Hm, I don't know how it works, but firefox did not do any network request to pizza.com when loading Kevin's page. > var

Re: [Edbrowse-dev] XHR same-domain restriction

2018-03-12 Thread Dominique Martinet
Hi, No worry, I agree this isn't easy. We/you've been working hard to make more sites work so I don't want to break these either, let's take the time needed to research first. Adding to that that I'm a little bit paranoid and like to disable as much as I can get with, but we'll need to come up wi

Re: [edbrowse-dev] fastmail

2018-07-20 Thread Dominique Martinet
Chuck Hallenbeck wrote on Fri, Jul 20, 2018: > My daughter with her Windows laptop created an account for me on > fastmail.com successfully. The kapcha took a form I have never seen > before. Instead of an image to copy to an input field, it took the > form of a series of statements to click on,

[edbrowse-dev] Missing duktape features

2019-06-25 Thread Dominique Martinet
Hi, First - thanks for snapshot(), that makes things so much easier! Now, I am using a website which uses new javascript features which are not implemented yet in duktape. Unfortunately that website is a private interface to my internet provider so I cannot share it, but basically I have three

Re: [edbrowse-dev] building on ubuntu

2019-09-02 Thread Dominique Martinet
Karl Dahlke wrote on Mon, Sep 02, 2019: > > I do not exactly understand your 'gnutls' vs 'openssl'... > > Guess what, neither do I. > We convinced ourselves a year ago that was the problem, but ldd clearly shows > my curl linking to openssl, and > curl https://weloveanimals.me > fails on my machi

[Edbrowse-dev] Disabling local echo for password fields

2017-07-02 Thread Dominique Martinet
ill useful to keep disabled by default or not. Thank you for reading, -- Dominique Martinet | Asmadeus ___ Edbrowse-dev mailing list Edbrowse-dev@lists.the-brannons.com http://lists.the-brannons.com/mailman/listinfo/edbrowse-dev

Re: [Edbrowse-dev] Disabling local echo for password fields

2017-07-07 Thread Dominique Martinet
Chris Brannon wrote on Fri, Jul 07, 2017: > Karl Dahlke writes: > > > But, in the interest of a windows implementation some day, > > I'd prefer a function in stringfile.c that turns echo on and off, > *SNIP* > > 4. Finally, call this function, on and off, when grabbing the password for > > http

Re: [Edbrowse-dev] Disabling local echo for password fields

2017-07-09 Thread Dominique Martinet
Karl Dahlke wrote on Mon, Jul 03, 2017: > 4. Finally, call this function, on and off, when grabbing the password > for http 401 authentication - piece of cake. Up to here was easy, done and pushed again on github ( https://github.com/CMB/edbrowse/pull/29 should probably update ) > 5. [...] > Line

Re: [Edbrowse-dev] Disabling local echo for password fields

2017-07-09 Thread Dominique Martinet
Karl Dahlke wrote on Sun, Jul 09, 2017: > I got the patch out of github, it will take a while to look through, > not a lot of code but a lot of little changes all over the place. Thank you; I was not sure on where to add code first so the code itself was done quickly/is not polished. If the place/

Re: [Edbrowse-dev] Disabling local echo for password fields

2017-07-11 Thread Dominique Martinet
Chris Brannon wrote on Mon, Jul 10, 2017: > The inp_types list in decorate.c is also duplicated in html.c, and you > missed that one in the patch to add the new minor type. > Couldn't we just get rid of the inp_types from html.c and make inp_types > from decorate.c global? I have done just that: r

Re: [Edbrowse-dev] Disabling local echo for password fields

2017-07-12 Thread Dominique Martinet
Chris Brannon wrote on Wed, Jul 12, 2017: > I think the itype_minor idea is a good one, because all these minor > types are just text for the purposes of edbrowse. We can add new > ones if we ever need to do that; they'll still be handled as text. > The thing I'm a little concerned about is the lo

Re: [Edbrowse-dev] Disabling local echo for password fields

2017-07-12 Thread Dominique Martinet
Chris Brannon wrote on Wed, Jul 12, 2017: > Also, when the type was not found in inp_types nor inp_others, > itype_minor should probably be set to INP_DEFAULTMINOR (or whatever you > care to call it). I'd say just keep 0 (as the field is init to 0) for that, so it both does not matter if text does

Re: [Edbrowse-dev] Disabling local echo for password fields

2017-07-15 Thread Dominique Martinet
Karl Dahlke wrote on Wed, Jul 12, 2017: > The mask bit would get around this. > > bool masked:1; I have done that, you can find a new version in the pull request: https://github.com/CMB/edbrowse/pull/29 > if(t->masked || t->inp_minor == INP_PW) { put in stars } I preferred setting the masked f

Re: [Edbrowse-dev] Disabling local echo for password fields

2017-07-17 Thread Dominique Martinet
Chris Brannon wrote on Mon, Jul 17, 2017: > Your curl auth patch is merged. Sorry for the long wait; I really > wanted to get some clarification on that, and now I have it. Don't worry about it. I did not see any clarification anywhere, did you get it in private? (I'm mainly curious if the on/of

Re: [Edbrowse-dev] Object identifiers

2017-07-23 Thread Dominique Martinet
Hi, Karl Dahlke wrote on Sun, Jul 23, 2017: > I really don't have a better alternative right now. What do you think? I'm not quite sure it will help, if the problem is a desynchronisation between what we think is still linked and what duktape thinks is still linked then even with an indirect mapp

Re: [Edbrowse-dev] Object identifiers

2017-07-24 Thread Dominique Martinet
Karl Dahlke wrote on Mon, Jul 24, 2017: > Well if we call upon an object with id 17, and there is no such > object, for any reason, we get back eb$idl[17] which will not crash > the process, and is probably the null object, which is what we want. Ok, so you do use duktape to hold the array, in tha