bugGNU Octave - Bugs: bug #49709, Potential privacy breach related...

 
 

bug #49709: Potential privacy breach related to SF logo

Submitted by:  Rafael Laboissiere <rlaboiss>
Submitted on:  Sat 26 Nov 2016 06:33:59 PM UTC  
 
Category: Octave FunctionSeverity: 3 - Normal
Priority: 5 - NormalItem Group: Other
Status: FixedAssigned to: Mike Miller <mtmiller>
Originator Name: Open/Closed: Closed
Release: 4.2.0Operating System: Any

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 10 Jan 2017 02:14:38 AM UTC, comment #5:

Fixed on stable (as well as another small bug found along the way) and merged to default:

http://hg.savannah.gnu.org/hgweb/octave/rev/fdf9f98c3b72
http://hg.savannah.gnu.org/hgweb/octave/rev/f2456a17490c
http://hg.savannah.gnu.org/hgweb/octave/rev/8ba865cd4703

The resulting HTML is now valid HTML 5 (tested at https://validator.w3.org/) and contains no external references and embeds no external images or scripts.

For future reference, if others come across this bug, it would be better to either embed the output of this function as an iframe in another page, use some kind of static site templating system, or post-process it using some kind of tool, if it's needed to add navigation, style sheets, or headers and footers to integrate it into a site such as Octave Forge.

Mike Miller <mtmiller>
Project AdministratorIn charge of this item.
Mon 09 Jan 2017 11:30:01 PM UTC, comment #4:

I am working on fixing this today. Given no feedback since November, I am going to go ahead with simplifying the HTML template, removing all references to Octave Forge external assets, and fixing the HTML output to use correct HTML 5 syntax.

Since this is a private function that is only used by those who know how to use it, and are running it to post or contribute a plot comparison somewhere on the web, I think it is extremely safe to push my changes to stable for 4.2.1.

Mike Miller <mtmiller>
Project AdministratorIn charge of this item.
Sun 27 Nov 2016 06:02:37 PM UTC, comment #3:

I think it doesn't hurt to patch the HTML template to be whatever it needs to be to satisfy downstream requirements.

I think it's worth keeping this open to improve the HTML template that is distributed with Octave so it doesn't contain implicit references to the Octave Forge web site.

Mike Miller <mtmiller>
Project AdministratorIn charge of this item.
Sat 26 Nov 2016 10:08:39 PM UTC, comment #2:

Thanks for the thorough explanation, Mike. Would it hurt if we drop that <div> element from the html_plot_demos_template.html file in the Debian package?

Rafael Laboissiere <rlaboiss>
Sat 26 Nov 2016 07:11:47 PM UTC, comment #1:

These files are not actually used in any part of Octave or its build system. The functions are intended to be used by an end user of Octave who wants to generate this web page:

http://octave.sourceforge.net/compare_plots/

and as you can see there, the page is intended to fit into the Octave Forge web layout, which is why the header and footer are the way they are.

To make use of these files, a user would be told to do this

which would produce the HTML file that could be shared or posted on a web site, and is designed to be hosted on the sourceforge project page.

If we want to keep Octave itself "pure" of any Forge URL knowledge, there could be some post-process step done to add the Octave Forge header and footer, rather than including them in the original file built by these functions.

Mike Miller <mtmiller>
Project AdministratorIn charge of this item.
Sat 26 Nov 2016 06:33:59 PM UTC, original submission:

I am not sure this is a bug or not but it is, at least, preventing version 4.2.0 of integrating Debian.

The Lintian checker is complaining about the URL for the SF logo that is included in file scripts/testfun/private/html_plot_demos_template.html. Lintian issues a privacy-breach-logo error [1].

The URL appears inside a <div> element at the bottom of the html file:

Is that <div> element really necessary for Octave?

Thanks,

Rafael

[1] https://lintian.debian.org/tags/privacy-breach-logo.html

Rafael Laboissiere <rlaboiss>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by mtmiller (Posted a comment)
  • -unavailable- added by rlaboiss (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only project members can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 10 Jan 2017 02:14:38 AM UTCmtmillerStatusIn Progress=>Fixed
      Open/ClosedOpen=>Closed
    Mon 09 Jan 2017 11:30:01 PM UTCmtmillerStatusConfirmed=>In Progress
      Assigned toNone=>mtmiller
    Sun 27 Nov 2016 06:02:37 PM UTCmtmillerCategoryNone=>Octave Function
      StatusNone=>Confirmed

    Back to the top


    Powered by Savane 3.1-cleanup1