GNU bug report logs - #30329
[PATCH] gnu: emacs: Build with xwidgets support.

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 30329 in the body.
You can then email your comments to 30329 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Alex Vong <alexvong1995 <at> gmail.com>
To: guix-patches <at> gnu.org
Subject: [PATCH] gnu: emacs: Build with xwidgets support.
Date: Sat, 03 Feb 2018 05:48:12 +0800

[Message part 1 (text/plain, inline)]

Hi,

This patch adds xwidgets support to Emcas. So Emacs can now display GTK
widgets. In particular, it can display webpages using webkitgtk.

Also, I use webkitgtk-2.4 instead of webkitgtk, because xwidgets
requires libwebkitgtk-3.0 instead of libwebkitgtk-4.0 to
build.

Moroever, the size of the closure of Emacs increases from 880.2 MiB -->
1232.4 MiB after adding the inputs.

[0001-gnu-emacs-Build-with-xwidgets-support.patch (text/x-diff, inline)]

From ae89b2e42689d2ae54d5785238daa5800ad94241 Mon Sep 17 00:00:00 2001
From: Alex Vong <alexvong1995 <at> gmail.com>
Date: Sat, 3 Feb 2018 05:05:17 +0800
Subject: [PATCH] gnu: emacs: Build with xwidgets support.

* gnu/packages/emacs.scm (emacs) [arguments]: Add '--with-xwidgets'
to #:configure-flags.
[inputs]: Add glib-networking, gsettings-desktop-schemas, libxcomposite,
webkitgtk-2.4.
---
 gnu/packages/emacs.scm | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/emacs.scm b/gnu/packages/emacs.scm
index 9be92edc1..a56aec440 100644
--- a/gnu/packages/emacs.scm
+++ b/gnu/packages/emacs.scm
@@ -15,7 +15,7 @@
 ;;; Copyright © 2016, 2017 ng0 <ng0 <at> infotropique.org>
 ;;; Copyright © 2016 Alex Griffin <a <at> ajgrf.com>
 ;;; Copyright © 2016, 2017 Nicolas Goaziou <mail <at> nicolasgoaziou.fr>
-;;; Copyright © 2016, 2017 Alex Vong <alexvong1995 <at> gmail.com>
+;;; Copyright © 2016, 2017, 2018 Alex Vong <alexvong1995 <at> gmail.com>
 ;;; Copyright © 2016, 2017, 2018 Arun Isaac <arunisaac <at> systemreboot.net>
 ;;; Copyright © 2017 Christopher Baines <mail <at> cbaines.net>
 ;;; Copyright © 2017 Mathieu Othacehe <m.othacehe <at> gmail.com>
@@ -81,6 +81,7 @@
   #:use-module (gnu packages version-control)
   #:use-module (gnu packages imagemagick)
   #:use-module (gnu packages w3m)
+  #:use-module (gnu packages webkit)
   #:use-module (gnu packages wget)
   #:use-module (gnu packages autotools)
   #:use-module (gnu packages base)
@@ -151,7 +152,9 @@
                      " ")))))))
     (build-system glib-or-gtk-build-system)
     (arguments
-     `(#:phases
+     `(#:configure-flags
+       '("--with-xwidgets")
+       #:phases
        (modify-phases %standard-phases
          (add-before 'configure 'fix-/bin/pwd
            (lambda _
@@ -204,7 +207,13 @@
 
        ;; multilingualization support
        ("libotf" ,libotf)
-       ("m17n-lib" ,m17n-lib)))
+       ("m17n-lib" ,m17n-lib)
+
+       ;; xwidgets support
+       ("glib-networking" ,glib-networking) ; required for browsing https pages
+       ("gsettings-desktop-schemas" ,gsettings-desktop-schemas)
+       ("libxcomposite" ,libxcomposite)
+       ("webkitgtk" ,webkitgtk-2.4))) ; libwebkitgtk-3.0 is required
     (native-inputs
      `(("guix-emacs.el" ,(search-auxiliary-file "emacs/guix-emacs.el"))
        ("pkg-config" ,pkg-config)
-- 
2.16.1

[Message part 3 (text/plain, inline)]

Cheers,
Alex

Message #8 received at 30329 <at> debbugs.gnu.org (full text, mbox):

From: Leo Famulari <leo <at> famulari.name>
To: Alex Vong <alexvong1995 <at> gmail.com>
Cc: 30329 <at> debbugs.gnu.org
Subject: Re: [bug#30329] [PATCH] gnu: emacs: Build with xwidgets support.
Date: Mon, 5 Feb 2018 16:58:39 -0500

[Message part 1 (text/plain, inline)]

On Sat, Feb 03, 2018 at 05:48:12AM +0800, Alex Vong wrote:
> Hi,
> 
> This patch adds xwidgets support to Emcas. So Emacs can now display GTK
> widgets. In particular, it can display webpages using webkitgtk.
> 
> Also, I use webkitgtk-2.4 instead of webkitgtk, because xwidgets
> requires libwebkitgtk-3.0 instead of libwebkitgtk-4.0 to
> build.

Webkitgtk is very actively researched and exploited for security
problems. If this use of webkitgtk-2.4 would ever handle untrusted
input, it's not very safe. I don't use Emacs so I'm not sure what the
use case is for webkitgtk.

For examples, you can check the security advisories published by the
Webkitgtk team:

https://webkitgtk.org/news.html

They publish an advisory after every release, and there are always
several fixed bugs allowing code execution by whoever supplies the input
(typically from a remote web server).

[signature.asc (application/pgp-signature, inline)]

Message #11 received at 30329 <at> debbugs.gnu.org (full text, mbox):

From: ludo <at> gnu.org (Ludovic Courtès)
To: Leo Famulari <leo <at> famulari.name>
Cc: 30329 <at> debbugs.gnu.org, Alex Vong <alexvong1995 <at> gmail.com>
Subject: Re: [bug#30329] [PATCH] gnu: emacs: Build with xwidgets support.
Date: Tue, 06 Feb 2018 16:28:59 +0100

Hello,

Leo Famulari <leo <at> famulari.name> skribis:

> On Sat, Feb 03, 2018 at 05:48:12AM +0800, Alex Vong wrote:
>> Hi,
>> 
>> This patch adds xwidgets support to Emcas. So Emacs can now display GTK
>> widgets. In particular, it can display webpages using webkitgtk.
>> 
>> Also, I use webkitgtk-2.4 instead of webkitgtk, because xwidgets
>> requires libwebkitgtk-3.0 instead of libwebkitgtk-4.0 to
>> build.
>
> Webkitgtk is very actively researched and exploited for security
> problems. If this use of webkitgtk-2.4 would ever handle untrusted
> input, it's not very safe. I don't use Emacs so I'm not sure what the
> use case is for webkitgtk.
>
> For examples, you can check the security advisories published by the
> Webkitgtk team:
>
> https://webkitgtk.org/news.html
>
> They publish an advisory after every release, and there are always
> several fixed bugs allowing code execution by whoever supplies the input
> (typically from a remote web server).

That’s indeed a bit of a problem.  Would be nice if it could use the
latest webkitgtk series.

Given that and the increase in closure size, I would prefer making it a
separate “emacs-xwidgets” package.

WDYT?

Thanks,
Ludo’.

Message #14 received at 30329 <at> debbugs.gnu.org (full text, mbox):

From: Alex Vong <alexvong1995 <at> gmail.com>
To: ludo <at> gnu.org (Ludovic Courtès)
Cc: 30329 <at> debbugs.gnu.org, Leo Famulari <leo <at> famulari.name>
Subject: Re: [bug#30329] [PATCH] gnu: emacs: Build with xwidgets support.
Date: Thu, 08 Feb 2018 09:04:35 +0800

ludo <at> gnu.org (Ludovic Courtès) writes:

> Hello,
>
> Leo Famulari <leo <at> famulari.name> skribis:
>
>> On Sat, Feb 03, 2018 at 05:48:12AM +0800, Alex Vong wrote:
>>> Hi,
>>> 
>>> This patch adds xwidgets support to Emcas. So Emacs can now display GTK
>>> widgets. In particular, it can display webpages using webkitgtk.
>>> 
>>> Also, I use webkitgtk-2.4 instead of webkitgtk, because xwidgets
>>> requires libwebkitgtk-3.0 instead of libwebkitgtk-4.0 to
>>> build.
>>
>> Webkitgtk is very actively researched and exploited for security
>> problems. If this use of webkitgtk-2.4 would ever handle untrusted
>> input, it's not very safe. I don't use Emacs so I'm not sure what the
>> use case is for webkitgtk.
>>
>> For examples, you can check the security advisories published by the
>> Webkitgtk team:
>>
>> https://webkitgtk.org/news.html
>>
>> They publish an advisory after every release, and there are always
>> several fixed bugs allowing code execution by whoever supplies the input
>> (typically from a remote web server).
>
> That’s indeed a bit of a problem.  Would be nice if it could use the
> latest webkitgtk series.
>
> Given that and the increase in closure size, I would prefer making it a
> separate “emacs-xwidgets” package.
>
> WDYT?
>
I agree with what Leo thought. Since it is up to emacs package authors
to make sure untrusted input are never sent to webkitgtk, and it is hard
to garantee that every package does the right thing.

So I will send another patch after emacs switch to libwebkitgtk-4.0 (in
a separate package).

> Thanks,
> Ludo’.

Message #17 received at 30329 <at> debbugs.gnu.org (full text, mbox):

From: Leo Famulari <leo <at> famulari.name>
To: Alex Vong <alexvong1995 <at> gmail.com>
Cc: 30329 <at> debbugs.gnu.org, Ludovic Courtès <ludo <at> gnu.org>
Subject: Re: [bug#30329] [PATCH] gnu: emacs: Build with xwidgets support.
Date: Wed, 7 Feb 2018 21:32:53 -0500

[Message part 1 (text/plain, inline)]

On Thu, Feb 08, 2018 at 09:04:35AM +0800, Alex Vong wrote:
> I agree with what Leo thought. Since it is up to emacs package authors
> to make sure untrusted input are never sent to webkitgtk, and it is hard
> to garantee that every package does the right thing.

I'd like to clarify myself a bit.

I believe that with some time and effort, someone could find exploitable
bugs in every complex piece of software in Guix.

We shouldn't let this hold us back from enjoying the features of the
software.

However, in cases where the bugs were publicized long ago (webkitgtk
2.4.0 is almost 4 years old; 2.4.11 almost 2 years old) and the bugs are
easily accessible to attackers (webkitgtk renders content from web
pages) we should be more careful.

GnuCash is now the only thing in our tree using this old webkitgtk, and
the GnuCash developers are actively working to make GnuCash use a more
recent version. Other distros have even removed GnuCash or are preparing
to remove it due to this issue, but I think we can wait for a bit
longer.

BTW, there is a bug to discuss related issues at
<https://bugs.gnu.org/26176>.

[signature.asc (application/pgp-signature, inline)]

Message #20 received at 30329 <at> debbugs.gnu.org (full text, mbox):

From: Chris Marusich <cmmarusich <at> gmail.com>
To: Alex Vong <alexvong1995 <at> gmail.com>
Cc: 30329 <at> debbugs.gnu.org, Ludovic Courtès <ludo <at> gnu.org>,
 Leo Famulari <leo <at> famulari.name>
Subject: Re: [bug#30329] [PATCH] gnu: emacs: Build with xwidgets support.
Date: Fri, 08 Jun 2018 22:25:34 -0700

[Message part 1 (text/plain, inline)]

Hi,

Alex Vong <alexvong1995 <at> gmail.com> writes:

> This patch adds xwidgets support to Emcas. So Emacs can now display GTK
> widgets. In particular, it can display webpages using webkitgtk.
>
> Also, I use webkitgtk-2.4 instead of webkitgtk, because xwidgets
> requires libwebkitgtk-3.0 instead of libwebkitgtk-4.0 to
> build.

This patch will no longer work, since webkitgtk <at> 2.4 has been removed.
How shall we proceed?  Is something like it still needed, or can we
close this report?

-- 
Chris

[signature.asc (application/pgp-signature, inline)]

Message #25 received at 30329-done <at> debbugs.gnu.org (full text, mbox):

From: Ricardo Wurmus <rekado <at> elephly.net>
To: Chris Marusich <cmmarusich <at> gmail.com>
Cc: 30329-done <at> debbugs.gnu.org, Ludovic Courtès <ludo <at> gnu.org>,
 Alex Vong <alexvong1995 <at> gmail.com>, Leo Famulari <leo <at> famulari.name>
Subject: Re: [bug#30329] [PATCH] gnu: emacs: Build with xwidgets support.
Date: Thu, 21 Jun 2018 14:05:36 +0200

Chris Marusich <cmmarusich <at> gmail.com> writes:

> Alex Vong <alexvong1995 <at> gmail.com> writes:
>
>> This patch adds xwidgets support to Emcas. So Emacs can now display GTK
>> widgets. In particular, it can display webpages using webkitgtk.
>>
>> Also, I use webkitgtk-2.4 instead of webkitgtk, because xwidgets
>> requires libwebkitgtk-3.0 instead of libwebkitgtk-4.0 to
>> build.
>
> This patch will no longer work, since webkitgtk <at> 2.4 has been removed.
> How shall we proceed?  Is something like it still needed, or can we
> close this report?

Some time ago I updated the Emacs xwidget feature to use the latest
webkit, so we shouldn’t be using the old one here.

I would suggest not to add this package, because the xwidgets feature
currently isn’t all that useful.  There is very little communication
between Emacs and the widget.  Work was underway (and has since stalled)
to use gobject introspection to expose the webkit API to Elisp.

I’d suggest to wait until this feature is more useful.

Alex, I’m closing this bug now, but you’re welcome to submit another
patch that adds a separate emacs-with-xwidgets package and I won’t
reject it despite my opinion of current state of the feature.

Thanks!

--
Ricardo

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.