WebDialog.set_html fails under Safari 5.0.6

thomthom

@thomthom said:

Similar, expect that I made it work with file:// - now that seems to have been closed down as well.

I think a load or reload button may be required or a least help debug, sort of got Fredo's working now.

driven

sorry, it was late and I didn't explain anything...

Fredo made some tweeks and I was doing the mac testing.

when either fredo's LibFredo6 settings dialog or Cleanup3 dialog are first opened they show in WebInpector Resources as (about:blank)
initial load of either

(about:blank) pages can't be reloaded using normal right-click reload, however with fredo's if you make a selection that forces a content reload like changing the parramaters, (about:blank) is replaced by the proper page, the errors disappear and everything works.

after changing checkbox selection

with Cleanup3 there is nothing to click that will force a change, to see if it would then reload properly.

sorry if my logic is flawed, but hopefully this explains what I mean.

john

thomthom

I split of the discussion for this particular issue as it's a problem with the WebDialog class itself and not the plugin in itself.

Dan Rathbun

Didn't John do some testing awhile back where he had to use " file://localhost/" or similar ?

What if the resources were in the user's path.. " **~**/Library/Application Support/...etc."

thomthom

@dan rathbun said:

Didn't John do some testing awhile back where he had to use " file://localhost/" or similar ?

Yes, but now even that fails.

Dan Rathbun

@thomthom said:

Making a cleanup operation from Ruby won't be so easy I think...

Don't overlook the Standard Library... " tmpdir.rb" and " tempfile.rb"

Dan Rathbun

Been having similar problems trying to run a local copy of firebug... looks like it's time to set up a simple server. I think Dan Berger has one in the win32-api package.

fredo6

@thomthom said:

I split of the discussion for this particular issue as it's a problem with the WebDialog class itself and not the plugin in itself.

I agree, and before we engage in workarounds and other approximate fixing, we really need to understand where the issue comes from and why it does materialized differently in two versions of Safari which should not be so different (5.03 and 5.06, correct?).

In any case, we need to hear from the SU team, because they must have an idea of how the web dialogs are integrated with Safari on Mac and clarify why security is handled differently by a set_html and a set_file.

Fredo

TIG

Isn't it that there are three different BUT 'related' .set_ methods?

**WebDialog.set_file** Used to set a *local* HTML file to display in the webdialog. Arguments: filename = The filename for the webdialog file (HTML file). path = (optional) A path to which the filename is relative. Returns: nil Usage: dialog.set_file("C:\\Temp\\mypage.html")

OR
**WebDialog.set_html** Used to load a string of *HTML code* into the webdialog. Arguments: html_string = A string of valid html to display in your webdialog. Returns: nil Usage: dialog.set_html("Hello world!")

OR
**WebDialog.set_url** Used to load a specific *URL* into the webdialog, i.e. it loads a *web-site* into the webdialog. Arguments: url = The URL for a specific web site. Returns: nil Usage: dialog.set_url("http://www.google.com")

They are not meant to be interchangeable

thomthom

TIG: The problem is that when you use .set_html you do not get access to local resources any more under OSX Safari 5.0.6+.

Dan Rathbun

Ok.. now, both Safari and Chrome use Webkit.

IF (assumption) both implement security polices in a similar way (on Mac via a manifest plist file inside the bundle,) you might compare the settings pre and post Safari 5.0.6.

On Chrome the settings are in file "com.google.Chrome.manifest", so (hoping,) that for Safari, the file would be something like "com.apple.Safari.manifest".

I'm going by the Chrome policy list when I suggest looking for policy "DisabledSchemes", or "SafeBrowsingEnabled", "ImagesBlockedForUrls", "JavaScriptAllowedForUrls", etc. (see the list... or find the list explicitly for Safari.)

P.S. : I wonder if Mac Sketchup changes any of these Safari security policies when it installs, to enable correct use of WebDialogs, ... and by upgrading to a newer Safari version, the policy file is overwritten. (So a comparison of the Safari manifest file, both pre and post Sketchup install, may also be in order.)

driven

@thomthom said:

TIG: The problem is that when you use .set_html you do not get access to local resources any more under OSX Safari 5.0.6+.

have you got an example of .set_html that works on older Safari, I've been going through all my old bits and I can't find an example that ever worked, heres some variations of .set_url and .set_file that all (bar one) work under Safari 5.0.6, I'm not including the files, unless you want them, it's more about the syntax, which is slightly different from 5.0.3 if you use .set_file("file:///...) Safari adds an additional file:/ to the url and reports an error

dlg1 = UI;;WebDialog.new("BoilerPlate1", true, "BP1", 200, 200, 110, 0, true);
dlg1.set_url("file;///Library/Application%20Support/Google%20SketchUp%208/SketchUp/plugins/WD_BoilerPlate_cln/demo/tests.html")
dlg1.set_background_color("#fff")
dlg1.show_modal 
#works

dlg2 = UI;;WebDialog.new("BoilerPlate2", true, "BP2", 200, 200, 310, 0, true);
dlg2.set_file("/Volumes/Macintosh HD/Library/Application Support/Google SketchUp 8/SketchUp/plugins/WD_BoilerPlate_cln/demo/elements.html")
dlg2.set_background_color("#fff")
dlg2.show_modal 
#works, BUT an external ajax call for js fails, local backup js loads instead

dlg3 = UI;;WebDialog.new("BoilerPlate3", true, "BP3", 200, 200, 510, 0, true);
dlg3.set_file("/Library/Application Support/Google SketchUp 8/SketchUp/plugins/WD_BoilerPlate_cln/test/index.html")
dlg3.set_background_color("pink")
dlg3.show_modal 
#works

dlg4 = UI;;WebDialog.new("BoilerPlate4", true, "BP4", 200, 200, 710, 0, true);
dlg4.set_url("file;///volumes/Macintosh%20HD/Library/Application%20Support/Google%20SketchUp%208/SketchUp/plugins/WD_BoilerPlate_cln/test/index.html")
dlg4.set_background_color("grey")
dlg4.show_modal 
#works

dlg5 = UI;;WebDialog.new("BoilerPlate5", true, "BP5", 200, 200, 910, 0, true);
dlg5.set_url("file;//localhost/Library/Application%20Support/Google%20SketchUp%208/SketchUp/plugins/WD_BoilerPlate_cln/404.html")
dlg5.set_background_color("#fff")
dlg5.show_modal   
#works

dlg6 = UI;;WebDialog.new("BoilerPlate6", true, "BP6", 200, 200, 1110, 0, true);
dlg6.set_file("/Library/Application Support/Google SketchUp 8/SketchUp/plugins/_LaptopLearnig/Ch1/TextBook.pdf")
dlg6.set_background_color("#fff")
dlg6.show_modal  
#works

dlg7 = UI;;WebDialog.new("BoilerPlate7", true, "BP7", 200, 200, 1310, 0, true);
dlg7.set_url("file;///volumes/Macintosh%20HD/Library/Application%20Support/Google%20SketchUp%208/SketchUp/plugins/_LaptopLearnig/Ch1/TextBook.pdf")
dlg7.set_background_color("#fff")
dlg7.show_modal 
#works

dlg8 = UI;;WebDialog.new("BoilerPlate8", true, "BP8", 200, 200, 1510, 0, true);
dlg8.set_url("file;//localhost/Library/Application%20Support/Google%20SketchUp%208/SketchUp/plugins/_LaptopLearnig/Ch1/TextBook.pdf")
dlg8.set_background_color("#fff")
dlg8.show_modal  
#works

dlg9 = UI;;WebDialog.new("BoilerPlate9", true, "BP9", 200, 200, 1710, 0, true);
dlg9.set_url("http://localhost/Library/Application%20Support/Google%20SketchUp%208/SketchUp/plugins/_LaptopLearnig/Ch1/TextBook.pdf")
dlg9.set_background_color("#fff")
dlg9.show_modal  
# DOSEN'T work[it is a pdf afterall]... but do I get a Not Found message
#The requested URL /Library/Application Support/Google SketchUp 8/SketchUp/plugins/_LaptopLearnig/Ch1/TextBook.pdf was not found on this server.

dlg10 = UI;;WebDialog.new("aceSUedit", false,"ace", 900, 600, 50, 350, false);
dlg10.set_url("http://upstairs.lan/cloud9/cloud9/support/ace/ModalWindow.html")
dlg10.show_modal 
#works and is an extremely complex html with lots of dynamic content

I'll set these all up on Safari 5.0.3 tomorrow and see how they fair.
john

Dan Rathbun

@driven said:

... if you use .set_file("file:///...) Safari adds an additional file:/ to the url and reports an error...

I'm purty sure that it's the Sketchup API UI::WebDialog code that prepends all set_file() arguments with "file://", happens on Windows as well.

I tried set_file("file://localhost/path/to/local/file.html")
and got that Sketchup error dialog (I believe it had the Sketchup icon in the upper left of the caption bar,) saying:
' %(#8000BF)[Could not find file: "file://file://localhost/path/to/local/file.html"]'

I would say that method should check to see if the substring is already there before prepending it.

Dan Rathbun

Here's a bug report at Webkit Bugzilla on local file:// handling broken.
Webkit bug #10777
It was reported in 2006 !

The 'reporter' also filed a bug at apple: #4809075
.. because he was unsure if it was Safari, or Webkit; but never got back to his original report and said what happened.
So the status remains: UNCONFIRMED

I tried to log into the apple bug reporter to check on #4809075, but got a login error.

TIG

@unknownuser said:

...if you use .set_file("file:///...) Safari adds an additional file:/ to the url and reports an error...
BUT surely that's not really an 'error' ? It's just a logical application of some rules.
The .set_file() method is expecting a file path - like 'C:/temp/myfile.txt'.
The .set_url() method is expecting a url like 'http://www.forums.sketchucation.com' OR 'file:///C:/temp/myfile.txt' if it's a local file path.
The .set_file() method takes its argument and it prepends a hard-coded initial 'file:///' to make it into suitable 'url' friendly code, from the bald file path: this is just like what happens when you try to open a local file with UI.openURL(), which requires that you have added the initial 'file:///' to any local file path etc.

The .set_**html**() method is expecting a some 'html code as text' and this is a more serious issue, to this side one.

thomthom

@driven said:

have you got an example of .set_html that works on older Safari,

webdialog.set_html( 'Hello World<hr><img src="file:///Users/thomas/Desktop/helloworld.jpg" alt="image should be here"><hr>Bye World' )
Very crude example, invalid HTML, but it's the bare bones. The image would load in older Safari.

@dan rathbun said:

P.S. : I wonder if Mac Sketchup changes any of these Safari security policies when it installs, to enable correct use of WebDialogs, ... and by upgrading to a newer Safari version, the policy file is overwritten. (So a comparison of the Safari manifest file, both pre and post Sketchup install, may also be in order.)

Never been a problem before... Something must have changed at 5.0.6.

thomthom

.set_file and .set_url isn't really the problem here. They both work the same as pre-5.0.6 as far as I can tell.

.set_html is the core of the problems.

Dan Rathbun

@thomthom said:

@dan rathbun said:

P.S. : I wonder if Mac Sketchup changes any of these Safari security policies when it installs, ...

Never been a problem before... Something must have changed at 5.0.6.

Meaning, you have upgraded Safari a number of times in the past, without causing adverse effects on Sketchup WebDialogs ??

Dan Rathbun

And can someone check the Apple Bug site.. to see if anyone else has filed a local resource regression bug for 5.0.6 ??

TIG

Could this be the 'security update' that's messing it up?
@unknownuser said:

WebKit in Apple Safari before 5.0.6 has improper libxslt security settings, which allows remote attackers to create arbitrary files, and consequently execute arbitrary code, via a crafted web site. NOTE: this may overlap CVE-2011-1425.
http://www.cvedetails.com/cve/CVE-2011-1774/ http://support.apple.com/kb/ht4808