Re: [Evolution] Security implications of WebKit migration



On Thursday 20 of September 2012 11:56:01 Jose Dapena Paz wrote:
El jue, 20-09-2012 a las 11:39 +0200, Dan Vratil escribiÃ:
The only unfortunate thing we haven't "fixed" yet are plugins. We have to
have plugins enabled in order to be able to inject GtkWidgets (like
attachment bar) into WebKit. This also means that Flash or Java content
in enabled and that they WILL be displayed and executed (assuming you
have necessary plugins installed) in the mail preview. We are aware of
this and I have already discussed with Milan a possible solution -
writing our own "ad-block" extension and force replace all <object> and
<applet> tags by a placeholder.
A possibility would be avoiding embeding gtk at all, even for the
attachment bar, and implement it completely on html. Is this something
considered, or is the work to implement this is out of scope now?

It has been considered of course, but the amount of work needed to achieve the
same functionality is inadequate and we now totally lack manpower to do so.

Attachments are added to the attachment bar asynchronously, the attachment bar
is in fact a view for a model with attachments. Implementing this all using
just DOM bindings provided by WebKit would be....well, out of scope (note that
you can't use JavaScript to do this on the "client"-side). Also supporting
accessibility would be a problem here.

I've managed to do this for the itip-formatter, which used to be a Gtk widget,
now it's all handled through the DOM and I'm not sure I want to do it again :)

Dan

--
dvratil redhat com | Associate Software Engineer / BaseOS / KDE, Qt
GPG Key: 0xC59D614F6F4AE348
Fingerprint: 4EC1 86E3 C54E 0B39 5FDD B5FB C59D 614F 6F4A E348

Attachment: signature.asc
Description: This is a digitally signed message part.



[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]