GNU bug report logs - #57796
29.0.50; textsec-link-suspicious-p is unaware of eww-url-transformers

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 57796 in the body.
You can then email your comments to 57796 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Visuwesh <visuweshm <at> gmail.com>
To: bug-gnu-emacs <at> gnu.org
Subject: 29.0.50; textsec-link-suspicious-p is unaware of eww-url-transformers
Date: Wed, 14 Sep 2022 13:11:21 +0530

I use eww-url-transformers to redirect URLs to libre front-ends of
certain websites like YouTube, Imgur, etc. however,
textsec-link-suspicious-p is blissfully unaware of this transformation
and reports false positives in certain cases.  A simple reproducer is
the following,

    1. emacs -Q
    2. Eval the following lisp code
          (defun vz/eww-url-transformer (url)
            (if (string-prefix-p "https://youtube.com/watch?v=" url)
                (concat "https://yewtu.be/watch?v"
                    (substring url (string-search "=" url)))
              url))

          (setq eww-url-transformers '(vz/eww-url-transformer))
    3. Say M-s M-w https://youtube.com/watch?v=nMqBCkxfRMk RET
    4. Scroll up to the description and see textsec highlight links to
       YouTube in red colour since now they are redirected to yewtu.be

I don't think anything can be meaningful can be done here though,
perhaps it might suffice to document this in the docstring of
eww-url-transformers.

P.S. Can we make the :foreground attribute of textsec-suspicious face to
     be white?  It is very hard to read what the link is in this case.


In GNU Emacs 29.0.50 (build 11, x86_64-pc-linux-gnu, X toolkit, cairo
 version 1.16.0, Xaw scroll bars) of 2022-09-11 built on astatine
Repository revision: 9219e83b3c0ef53df02caf4c8ba38f482937ab50
Repository branch: master
Windowing system distributor 'The X.Org Foundation', version 11.0.12101004
System Description: Debian GNU/Linux bookworm/sid

Configured using:
 'configure --with-sound=alsa --with-x-toolkit=lucid --with-json
 --without-xaw3d --without-gconf --without-libsystemd'
Configured features:
ACL CAIRO DBUS FREETYPE GIF GLIB GMP GNUTLS GPM GSETTINGS HARFBUZZ JPEG
JSON LIBOTF LIBSELINUX LIBXML2 MODULES NOTIFY INOTIFY PDUMPER PNG RSVG
SECCOMP SOUND SQLITE3 THREADS TIFF TOOLKIT_SCROLL_BARS WEBP X11 XDBE XIM
XINPUT2 XPM LUCID ZLIB
Important settings:
  value of $LC_MONETARY: ta_IN.UTF-8
  value of $LC_NUMERIC: ta_IN.UTF-8
  value of $LANG: en_GB.UTF-8
  locale-coding-system: utf-8-unix

Major mode: ELisp/l

Minor modes in effect:
  bug-reference-prog-mode: t
  recentf-mode: t
  shell-dirtrack-mode: t
  paredit-mode: t
  eros-mode: t
  flymake-mode: t
  pdf-occur-global-minor-mode: t
  minibuffer-depth-indicate-mode: t
  repeat-mode: t
  display-time-mode: t
  display-battery-mode: t
  winner-mode: t
  acme-tag-minor-mode: t
  delete-selection-mode: t
  xterm-mouse-mode: t
  straight-use-package-mode: t
  straight-package-neutering-mode: t
  tooltip-mode: t
  global-eldoc-mode: t
  eldoc-mode: t
  show-paren-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  use-hard-newlines: t
  tab-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  undelete-frame-mode: t
  transient-mark-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  abbrev-mode: t

Load-path shadows:
/home/viz/lib/emacs/straight/build/faceup/faceup hides /home/viz/lib/ports/emacs/lisp/emacs-lisp/faceup

Features:
(shadow sort ecomplete mail-extr emacsbug descr-text find-dired files-x
grep dired-aux shr-color textsec uni-scripts idna-mapping ucs-normalize
uni-confusable textsec-check network-stream url-http url-gw nsm
url-cache url-auth pdf-sync pdf-outline pdf-links pdf-history
org-capture doct ob-R ob-awk ob-calc calc-store calc-trail calc-ext calc
calc-loaddefs rect calc-macs ob-clojure ob-css ob-dot ob-eshell eshell
esh-cmd esh-ext esh-opt esh-proc esh-io esh-arg esh-module esh-groups
esh-util ob-forth ob-fortran ob-gnuplot ob-groovy ob-haskell ob-java
ob-js ob-julia ob-latex ob-lilypond ob-lisp ob-lua ob-makefile ob-maxima
ob-ocaml ob-octave ob-org ob-perl ob-processing ob-python python compat
ob-ruby ob-sass ob-scheme ob-screen ob-sed ob-sqlite ob-sql doctor
cal-islam holidays holiday-loaddefs mule-util cal-move ob-ditaa
ob-plantuml org-colview org-crypt org-habit org-plot org-archive
cus-start dabbrev vc-hg vc-bzr vc-src vc-sccs vc-svn vc-cvs vc-rcs
smerge-mode log-edit add-log executable notifications bug-reference xref
shortdoc help-fns radix-tree cl-print pulse color avy misearch
multi-isearch reveal recentf tree-widget vc-backup log-view pcvs-util vc
diff vc-git diff-mode vc-dispatcher org-clock org-duration cal-iso
writegood-mode flyspell ispell org-pdftools pdf-annot facemenu org-noter
org-element avl-tree generator org-agenda ob-C cc-mode cc-fonts cc-guess
cc-menus cc-cmds cc-styles cc-align cc-engine cc-vars cc-defs ob-shell
shell ob-racket async ob-async cdlatex texmathp org-attach ol-eww eww
xdg url-queue mm-url ol-rmail ol-mhe ol-irc ol-info ol-gnus nnselect
gnus-art mm-uu mml2015 mm-view mml-smime smime gnutls dig gnus-sum shr
pixel-fill kinsoku url-file svg gnus-group gnus-undo gnus-start
gnus-dbus gnus-cloud nnimap nnmail mail-source utf7 nnoo parse-time
gnus-spec gnus-int gnus-range message sendmail yank-media puny rfc822
mml mml-sec epa epg rfc6068 epg-config mm-decode mm-bodies mm-encode
mail-parse rfc2231 rfc2047 rfc2045 ietf-drums mailabbrev gmm-utils
mailheader gnus-win gnus nnheader gnus-util mail-utils range mm-util
mail-prsvr ol-docview doc-view ol-bibtex ol-bbdb ol-w3m ol-doi
org-link-doi org-tempo tempo org-id org-refile ol-man org ob ob-tangle
ob-ref ob-lob ob-table ob-exp org-macro org-footnote org-src ob-comint
org-pcomplete pcomplete org-list org-faces org-entities noutline outline
org-version ob-emacs-lisp ob-core ob-eval org-table oc-basic bibtex
iso8601 org-keys oc org-loaddefs ol org-compat org-macs cursor-sensor
icomplete face-remap server paredit edmacro kmacro eros time-date
checkdoc lisp-mnt flymake-proc flymake project warnings wordel-autoloads
sokoban-autoloads ement-autoloads svg-lib-autoloads
taxy-magit-section-autoloads magit-section-autoloads dash-autoloads
taxy-autoloads plz-autoloads nov-autoloads esxml-autoloads kv-autoloads
transmission-autoloads lua-mode-autoloads nix-mode-autoloads
gnuplot-autoloads racket-mode-autoloads pos-tip-autoloads
faceup-autoloads eros-autoloads flymake-shellcheck-autoloads
writegood-mode-autoloads siege-mode-autoloads paredit-autoloads
puni-autoloads expand-region-autoloads filladapt-autoloads compose
scroll-other-window org-pdftools-autoloads org-noter-autoloads
change-env-autoloads math-delimiters-autoloads doct-autoloads
ob-async-autoloads async-autoloads emacs-ob-racket-autoloads
valign-autoloads cdlatex-autoloads auctex-autoloads tex-site pdf-occur
ibuf-ext ibuffer ibuffer-loaddefs tablist advice tablist-filter
semantic/wisent/comp semantic/wisent semantic/wisent/wisent
semantic/util-modes semantic/util semantic semantic/tag semantic/lex
semantic/fw mode-local cedet pdf-isearch let-alist pdf-misc imenu
pdf-tools package browse-url url url-proxy url-privacy url-expand
url-methods url-history url-cookie generate-lisp-file url-domsuf
url-util mailcap url-handlers url-parse auth-source eieio eieio-core
json map byte-opt url-vars compile comint ansi-color cus-edit edebug
debug backtrace find-func icons wid-edit pdf-view password-cache
jka-compr pdf-cache pdf-info tq pdf-util pdf-macs image-mode dired-x
dired dired-loaddefs exif pdf-tools-autoloads tablist-autoloads mb-depth
repeat visual-fill-autoloads olivetti-autoloads time format-spec battery
dbus filenotify xml dom tamil99 quail disp-table lacarte-autoloads
winner ring acme-tag shell-command+ thingatpt acme-tag-autoloads
shell-command-plus-autoloads delsel easy-mmode xt-mouse cus-load
avy-autoloads finder-inf vc-backup-autoloads compat-autoloads icalendar
diary-lib diary-loaddefs cal-menu calendar cal-loaddefs rx filecache
imenu-xref-autoloads derived chemtable-autoloads molar-mass-autoloads
saveplace-pdf-view saveplace bookmark text-property-search pp
saveplace-pdf-view-autoloads pcase inspector-autoloads xr-autoloads
straight-autoloads cl-seq info cl-extra help-mode straight subr-x
cl-macs gv cl-loaddefs cl-lib bytecomp byte-compile cconv vz-nh-theme
vz-options-theme rmc iso-transl tooltip eldoc paren electric uniquify
ediff-hook vc-hooks lisp-float-type elisp-mode mwheel term/x-win x-win
term/common-win x-dnd tool-bar dnd fontset image regexp-opt fringe
tabulated-list replace newcomment text-mode lisp-mode prog-mode register
page tab-bar menu-bar rfn-eshadow isearch easymenu timer select
scroll-bar mouse jit-lock font-lock syntax font-core term/tty-colors
frame minibuffer nadvice seq simple cl-generic indonesian philippine
cham georgian utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao
korean japanese eucjp-ms cp51932 hebrew greek romanian slovak czech
european ethiopic indian cyrillic chinese composite emoji-zwj charscript
charprop case-table epa-hook jka-cmpr-hook help abbrev obarray oclosure
cl-preloaded button loaddefs faces cus-face macroexp files window
text-properties overlay sha1 md5 base64 format env code-pages mule
custom widget keymap hashtable-print-readable backquote threads dbusbind
inotify dynamic-setting system-font-setting font-render-setting cairo
x-toolkit xinput2 x multi-tty make-network-process emacs)

Memory information:
((conses 16 873008 103092) (symbols ?0 54900 3) (strings 32 281437 10459) (string-bytes 1 17412302) (vectors 16
                                                                                                             110864)
 (
  vector-slots 8 2509054 178881) (floats 8 997 840) (intervals ?8 25313 2962) (buffers 1000 ?J))

Message #8 received at 57796 <at> debbugs.gnu.org (full text, mbox):

From: Visuwesh <visuweshm <at> gmail.com>
To: 57796 <at> debbugs.gnu.org
Subject: Re: bug#57796: 29.0.50; textsec-link-suspicious-p is unaware of
 eww-url-transformers
Date: Wed, 14 Sep 2022 13:35:40 +0530

Upon digging this issue further, I see the problem is with shr-tag-a not
textsec-link-suspicious-p.  Sorry for the misleading bug title---I'm not
sure what the right way to rename the title is.

Message #11 received at 57796 <at> debbugs.gnu.org (full text, mbox):

From: Visuwesh <visuweshm <at> gmail.com>
To: 57796 <at> debbugs.gnu.org
Subject: Re: bug#57796: 29.0.50; textsec-link-suspicious-p is unaware of
 eww-url-transformers
Date: Wed, 14 Sep 2022 13:35:59 +0530

Upon digging this issue further, I see the problem is with shr-tag-a,
not textsec-link-suspicious-p.  Sorry for the misleading bug title---I'm
not sure what the right way to rename the title is.

Message #14 received at 57796 <at> debbugs.gnu.org (full text, mbox):

From: Lars Ingebrigtsen <larsi <at> gnus.org>
To: Visuwesh <visuweshm <at> gmail.com>
Cc: 57796 <at> debbugs.gnu.org
Subject: Re: bug#57796: 29.0.50; textsec-link-suspicious-p is unaware of
 eww-url-transformers
Date: Wed, 14 Sep 2022 15:17:44 +0200

Visuwesh <visuweshm <at> gmail.com> writes:

> I don't think anything can be meaningful can be done here though,
> perhaps it might suffice to document this in the docstring of
> eww-url-transformers.

I've now made shr use the transformers (in eww buffers).

> P.S. Can we make the :foreground attribute of textsec-suspicious face to
>      be white?  It is very hard to read what the link is in this case.

Done.

Message #19 received at 57796 <at> debbugs.gnu.org (full text, mbox):

From: Visuwesh <visuweshm <at> gmail.com>
To: 57796 <at> debbugs.gnu.org
Subject: Re: bug#57796: 29.0.50; textsec-link-suspicious-p is unaware of
 eww-url-transformers
Date: Wed, 14 Sep 2022 19:18:51 +0530

[புதன் செப்டம்பர் 14, 2022] Visuwesh wrote:

> Upon digging this issue further, I see the problem is with shr-tag-a,
> not textsec-link-suspicious-p.  Sorry for the misleading bug title---I'm
> not sure what the right way to rename the title is.

Looks like eww uses a custom tag function for <a></a>.  I tried the
following patch but I cannot figure out how to turn `href' into a full
URL.

diff --git a/lisp/net/eww.el b/lisp/net/eww.el
index 6ed0719eca..de4a06dc47 100644
--- a/lisp/net/eww.el
+++ b/lisp/net/eww.el
@@ -781,9 +781,13 @@ eww-tag-link
 
 (defun eww-tag-a (dom)
   (eww-handle-link dom)
-  (let ((start (point)))
+  (let ((start (point))
+        (href (dom-attr dom 'href)))
+    (when href
+      (setq href (eww--transform-url (shr-expand-url href)))
+      (dom-set-attribute dom 'href href))
     (shr-tag-a dom)
-    (if (dom-attr dom 'href)
+    (if href
         (put-text-property start (point)
                            'keymap
                            (if (mm-images-in-region-p start (point))

Message #22 received at 57796 <at> debbugs.gnu.org (full text, mbox):

From: Visuwesh <visuweshm <at> gmail.com>
To: Lars Ingebrigtsen <larsi <at> gnus.org>
Cc: 57796 <at> debbugs.gnu.org
Subject: Re: bug#57796: 29.0.50; textsec-link-suspicious-p is unaware of
 eww-url-transformers
Date: Wed, 14 Sep 2022 20:10:51 +0530

[புதன் செப்டம்பர் 14, 2022] Lars Ingebrigtsen wrote:

> Visuwesh <visuweshm <at> gmail.com> writes:
>
>> I don't think anything can be meaningful can be done here though,
>> perhaps it might suffice to document this in the docstring of
>> eww-url-transformers.
>
> I've now made shr use the transformers (in eww buffers).

Thanks!

>> P.S. Can we make the :foreground attribute of textsec-suspicious face to
>>      be white?  It is very hard to read what the link is in this case.
>
> Done.

Thanks again.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.