bugGNU Octave - Bugs: bug #49709, Potential privacy breach related...

 
 

bug #49709: Potential privacy breach related to SF logo

Submitter:  Rafael Laboissière <rlaboiss>
Submitted:  Sat 26 Nov 2016 06:33:59 PM UTC
   
 
Category:  Octave Function Severity:  3 - Normal
Priority:  5 - Normal Item Group:  Other
Status:  Fixed Assigned to:  mtmiller
Originator Name:  Open/Closed:  * Closed
Release:  * 4.2.0 Operating System:  * Any
Fixed Release:  None Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 10 Jan 2017 02:14:38 AM UTC, comment #5: 

Fixed on stable (as well as another small bug found along the way) and merged to default:

http://hg.savannah.gnu.org/hgweb/octave/rev/fdf9f98c3b72
http://hg.savannah.gnu.org/hgweb/octave/rev/f2456a17490c
http://hg.savannah.gnu.org/hgweb/octave/rev/8ba865cd4703

The resulting HTML is now valid HTML 5 (tested at https://validator.w3.org/) and contains no external references and embeds no external images or scripts.

For future reference, if others come across this bug, it would be better to either embed the output of this function as an iframe in another page, use some kind of static site templating system, or post-process it using some kind of tool, if it's needed to add navigation, style sheets, or headers and footers to integrate it into a site such as Octave Forge.

Mike Miller <mtmiller>
Group Member
Mon 09 Jan 2017 11:30:01 PM UTC, comment #4: 

I am working on fixing this today. Given no feedback since November, I am going to go ahead with simplifying the HTML template, removing all references to Octave Forge external assets, and fixing the HTML output to use correct HTML 5 syntax.

Since this is a private function that is only used by those who know how to use it, and are running it to post or contribute a plot comparison somewhere on the web, I think it is extremely safe to push my changes to stable for 4.2.1.

Mike Miller <mtmiller>
Group Member
Sun 27 Nov 2016 06:02:37 PM UTC, comment #3: 

I think it doesn't hurt to patch the HTML template to be whatever it needs to be to satisfy downstream requirements.

I think it's worth keeping this open to improve the HTML template that is distributed with Octave so it doesn't contain implicit references to the Octave Forge web site.

Mike Miller <mtmiller>
Group Member
Sat 26 Nov 2016 10:08:39 PM UTC, comment #2: 

Thanks for the thorough explanation, Mike. Would it hurt if we drop that <div> element from the html_plot_demos_template.html file in the Debian package?

Rafael Laboissière <rlaboiss>
Sat 26 Nov 2016 07:11:47 PM UTC, comment #1: 

These files are not actually used in any part of Octave or its build system. The functions are intended to be used by an end user of Octave who wants to generate this web page:

http://octave.sourceforge.net/compare_plots/

and as you can see there, the page is intended to fit into the Octave Forge web layout, which is why the header and footer are the way they are.

To make use of these files, a user would be told to do this


>> addpath (fullfile (__octave_config_info__ ("fcnfiledir"), "testfun", "private"))
>> compare_plot_demos


which would produce the HTML file that could be shared or posted on a web site, and is designed to be hosted on the sourceforge project page.

If we want to keep Octave itself "pure" of any Forge URL knowledge, there could be some post-process step done to add the Octave Forge header and footer, rather than including them in the original file built by these functions.

Mike Miller <mtmiller>
Group Member
Sat 26 Nov 2016 06:33:59 PM UTC, original submission:  

I am not sure this is a bug or not but it is, at least, preventing version 4.2.0 of integrating Debian.

The Lintian checker is complaining about the URL for the SF logo that is included in file scripts/testfun/private/html_plot_demos_template.html. Lintian issues a privacy-breach-logo error [1].

The URL appears inside a <div> element at the bottom of the html file:


<div id="sf_logo">
  <a href="http://sourceforge.net"><img src="http://sourceforge.net/sflogo.php?group_id=2888&amp;type=1"
     width="88" height="31" style="border: 0;" alt="SourceForge.net Logo"/></a>
</div>


Is that <div> element really necessary for Octave?

Thanks,

Rafael

[1] https://lintian.debian.org/tags/privacy-breach-logo.html

Rafael Laboissière <rlaboiss>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by mtmiller (Posted a comment)
  • -email is unavailable- added by rlaboiss (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-01-10 mtmiller StatusIn Progress Fixed
        Open/ClosedOpen Closed
    2017-01-09 mtmiller StatusConfirmed In Progress
        Assigned toNone mtmiller
    2016-11-27 mtmiller CategoryNone Octave Function
        StatusNone Confirmed

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code