[Edbrowse-dev] js circumvented

[Edbrowse-dev] js circumvented

[Karl Dahlke]

Q. How can you read local files on your computer,
that aren't in html, and still run out of js memory?

a. If those files are very large, and in a format like pdf or some such
that is turned into html and rendered, then you may have megabytes of html,
all turned into js nodes, even the individual words turned into text nodes.
And yet there is no javascript in the generated html,
and it's all a waste, even slows down performance
even if you did have memory for it.

I think I should write a routine to detect the lack of js
ahead of time and disable it for this session.
Honestly it's easy to do.
loop over tags, if there is no <script>,
and if none of the tags have onclick onchange onload etc attributes,
and I already set flags based on these attributes,
so if none of these flags are set, then js is never going to run,
so just turn it off.
I'll probably go ahead with this, as people are already requesting it,
unless other people think it is a bad idea.

Karl Dahlke

Re: [Edbrowse-dev] js circumvented

[Adam Thompson]

[-- Attachment #1: Type: text/plain, Size: 1553 bytes --]

On Thu, Oct 01, 2015 at 06:24:10AM -0400, Karl Dahlke wrote:
> Q. How can you read local files on your computer,
> that aren't in html, and still run out of js memory?
> 
> a. If those files are very large, and in a format like pdf or some such
> that is turned into html and rendered, then you may have megabytes of html,
> all turned into js nodes, even the individual words turned into text nodes.
> And yet there is no javascript in the generated html,
> and it's all a waste, even slows down performance
> even if you did have memory for it.

Yixe.

> I think I should write a routine to detect the lack of js
> ahead of time and disable it for this session.
> Honestly it's easy to do.
> loop over tags, if there is no <script>,
> and if none of the tags have onclick onchange onload etc attributes,
> and I already set flags based on these attributes,
> so if none of these flags are set, then js is never going to run,
> so just turn it off.
> I'll probably go ahead with this, as people are already requesting it,
> unless other people think it is a bad idea.

Definitely, please make this happen, with the change that it should be per page not per session I think.
For example, I may look at a huge pdf,
and then browse to a URL within afore mentioned pdf from the same session.
If js is auto-disabled by the pdf for that session then it would stay disabled
for the web page which is probably not what I want,
whereas if the check is done per page then it'd re-enable itself when I change page.

Cheers,
Adam.

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 473 bytes --]

[Edbrowse-dev] js circumvented

[Karl Dahlke]

> For example, I may look at a huge pdf,
> and then browse to a URL within afore mentioned pdf from the same session.
> If js is auto-disabled by the pdf for that session then it would stay disabled

No it becomes active again, technically it's a new window on the stack.
You can even M2 (capital M) and that web page still has js,
while the original pdf does not.
It works as you would want it to.

Karl Dahlke

Re: [Edbrowse-dev] js circumvented

[Adam Thompson]

[-- Attachment #1: Type: text/plain, Size: 557 bytes --]

On Fri, Oct 02, 2015 at 03:21:35AM -0400, Karl Dahlke wrote:
> > For example, I may look at a huge pdf,
> > and then browse to a URL within afore mentioned pdf from the same session.
> > If js is auto-disabled by the pdf for that session then it would stay disabled
> 
> No it becomes active again, technically it's a new window on the stack.
> You can even M2 (capital M) and that web page still has js,
> while the original pdf does not.
> It works as you would want it to.

That's ok then, I was thinking session == buffer but apparently not.

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 473 bytes --]