Florian Bruhin
43e58ac865
CVE-2018-10895: Fix CSRF issues with qute://settings/set URL
...
In ffc29ee043
(part of v1.0.0), a
qute://settings/set URL was added to change settings.
Contrary to what I apparently believed at the time, it *is* possible for
websites to access `qute://*` URLs (i.e., neither QtWebKit nor QtWebEngine
prohibit such requests, other than the usual cross-origin rules).
In other words, this means a website can e.g. have an `<img>` tag which loads a
`qute://settings/set` URL, which then sets `editor.command` to a bash script.
The result of that is arbitrary code execution.
Fixes #4060
See #2332
2018-07-11 17:05:23 +02:00
Olmo Kramer
9f5f52360c
Add test cases for url-patterns
2018-07-04 23:52:28 +02:00
Olmo Kramer
332cbf811b
Add test for custom hint group
2018-07-04 22:56:47 +02:00
Olmo Kramer
7aa5db29b5
Add tests for invalid hint group & js click handler
2018-07-04 22:56:47 +02:00
Florian Bruhin
a0f36c5cbf
Skip JS test which is too flaky
2018-07-03 14:15:08 +02:00
Florian Bruhin
26d6cf8ef6
Stabilize URL escaping test
2018-07-03 10:29:28 +02:00
Florian Bruhin
f6f713bbfe
Skip key forwarding tests on Qt 5.11.1
...
See #4036
2018-07-02 23:19:57 +02:00
Florian Bruhin
6ca11ed95b
Adjust SSL test for Qt 5.11
2018-07-02 23:15:04 +02:00
Florian Bruhin
9a14574c9f
Skip invalid links on any Qt 5.11 version
...
See #3661
2018-07-02 22:32:59 +02:00
Florian Bruhin
3312c221c4
Stabilize ssl_strict test
2018-06-26 10:26:17 +02:00
Florian Bruhin
85a9f6a08a
Fix lint
2018-06-26 10:23:48 +02:00
Florian Bruhin
1bc3d444b6
Stabilize escaping URLs test
2018-06-25 23:02:50 +02:00
Florian Bruhin
87778277e0
Fix SSL error page tests
2018-06-25 22:51:48 +02:00
Florian Bruhin
a02c25dfb1
Don't escape URLs for qute://history
...
We only use the URL to set a 'href' attribute, which does not need escaping.
See #4011
Fixes #4012
2018-06-23 14:27:07 +02:00
Florian Bruhin
5a7869f2fe
Fix XSS issue on qute://history
...
Fixes #4011
2018-06-21 21:20:19 +02:00
Jay Kamat
0e7bbccd71
Fix stacking tabs setting with new_tab prev
2018-06-19 12:10:21 -04:00
Jay Kamat
1919029858
Add setting for controlling stacking of new tabs
2018-06-18 18:09:13 -04:00
Florian Bruhin
b1b06fcb43
Fix restore test
2018-06-14 17:42:33 +02:00
Florian Bruhin
11fce30ed0
Stabilize mode_on_change tests
2018-06-14 15:56:48 +02:00
Florian Bruhin
1335fccba1
Merge remote-tracking branch 'origin/pr/3590' into tab-mode
2018-06-14 15:40:58 +02:00
Florian Bruhin
cec63ea449
Merge remote-tracking branch 'origin/pr/3906'
2018-06-14 14:49:30 +02:00
Florian Bruhin
b7c1d7fe37
Fix broken tests
2018-06-11 18:38:22 +02:00
Florian Bruhin
263d298449
Remove the content.developer_extras setting
2018-06-11 18:09:24 +02:00
Florian Bruhin
98c82859b5
Skip "History with view-source URL" on QtWebKit
2018-06-11 15:36:48 +02:00
Florian Bruhin
7f69920158
Merge remote-tracking branch 'origin/pr/3947'
2018-06-11 11:29:14 +02:00
Florian Bruhin
1ba2e3e24b
Implement Qt 5.11 devtools support
...
See #3010
2018-06-11 11:07:14 +02:00
Florian Bruhin
c4add62301
Merge remote-tracking branch 'origin/pr/3825'
2018-06-10 17:30:44 +02:00
Florian Bruhin
50fa7743ba
Only use OS-specific line separator for hints
2018-06-10 17:21:31 +02:00
Jay Kamat
de127497a2
Press enter to follow links instead of using js
...
This codepath may trigger a crash which was fixed by
0e75f3272d
.
However, this commit does not make it more likely to happen, and this
patch was backported into arch (at least).
In the future, we may be able to use <enter> on qtwebkit with js,
without triggering this crash
2018-06-09 15:42:44 -07:00
Florian Bruhin
8bf7cb539a
Mark modal window test as flaky
2018-06-07 22:57:16 +02:00
Florian Bruhin
999513d5d8
Skip invalid link tests on Qt 5.11
...
Qt 5.11 just loads about:blank and doesn't let us catch this in
acceptNavigationRequest, but the same happens in Chromium as well.
See #3661
2018-06-07 13:49:28 +02:00
Florian Bruhin
8cc3804119
Don't run test with failed download on Qt 5.11
...
Looks like we can't use an <a> tag with download-attribute to trigger a failed
download in the test on Qt 5.11...
See #2298 , #3661
2018-06-06 21:12:23 +02:00
Jay Kamat
c33a887b2d
Add support for following tab selected elements to :follow-selected
2018-05-25 12:39:36 -07:00
Jay Kamat
71d55e9213
Refocus command prompt after a new tab is opened when in command mode
2018-05-11 08:49:13 -07:00
Jay Kamat
95093b82c9
Refocus webview after spawning a background tab
2018-05-10 10:15:01 -07:00
Jay Kamat
bc9f178a08
Add test for tab-bg focus
2018-05-09 15:34:01 -07:00
Florian Bruhin
8531f89ca3
Merge remote-tracking branch 'origin/pr/3789'
2018-05-08 11:45:20 +02:00
Florian Bruhin
49bdcd5a97
Merge remote-tracking branch 'origin/pr/3796'
2018-05-03 13:58:26 +02:00
rr-
537aa22d64
Change clipboard mocking
2018-04-18 11:00:05 +02:00
rr-
30d3612a17
Add test for rapid yanking
2018-04-18 10:59:54 +02:00
Jay Kamat
cbb246fd0b
Update tests for new implementation
2018-04-16 23:28:32 -04:00
Florian Bruhin
4a78519b63
Mark opening/closing window via JS test as flaky
2018-04-16 17:14:47 +02:00
Slackhead
62aa9bdbb3
Added debug() logging for next/prev-tab and test scenarios
2018-04-09 02:03:02 +01:00
Slackhead
fac546e9b4
Remove test scenarios for last/first tab when wrap is off
2018-04-08 18:56:16 +01:00
Jay Kamat
76dbfa7305
Allow searching for double semicolons
...
Possibly breaks scripts using :search with ;; to split commands. A
workaround is to put the :search command at the end.
2018-04-05 17:20:50 -04:00
Jay Kamat
9ad6cef369
Add a test for leading arguments
2018-04-01 21:00:02 -04:00
Jay Kamat
cb8a75577e
Add tests for hinting with --first
2018-03-30 15:03:08 -04:00
Florian Bruhin
005fa8b675
Fix newline
2018-03-28 09:14:26 +02:00
Florian Bruhin
c7e5033eaa
Set MainWindow as parent of TabbedBrowser
...
If we close the MainWindow (and it gets deleted), we need to make sure to delete
the TabbedBrowser as well.
Fixes #3781
2018-03-28 08:58:07 +02:00
Florian Bruhin
d4ea1df232
Improve window_open.html tests
2018-03-25 19:56:48 +02:00
Florian Bruhin
f1789effdc
Stabilize navigate.feature on Qt 5.11
...
Looks like we get qute://help as URL from the previous test otherwise?
See #3661
2018-03-23 10:29:25 +01:00
Florian Bruhin
e43f0a61b9
Move all QWebEngineScript related code out of webenginesettings
...
It looks like there's some issue with QWebEngineScript in a profile, at least
with older Qt versions...
See #3497 , #3377
2018-03-19 17:33:02 +01:00
Marc Jauvin
b7159d780a
Merge 'origin/master' into tab-input-mode
2018-03-16 14:28:36 -04:00
Florian Bruhin
c0fdf19756
Merge remote-tracking branch 'origin/pr/3704'
2018-03-14 08:06:24 +01:00
Marc Jauvin
c9f6cd507b
address requested changes
...
- add INPUT_MODES & PROMPT_MODES constants in modeman
- use those in tabbedbrowser and modeman
- fix debug logs format to be more human readable
- fix associated tests for new debug logs
2018-03-13 23:31:48 -04:00
Jay Kamat
35beff98a9
Add test for #3711
2018-03-13 19:18:42 -04:00
Ryan Roden-Corrent
38bb3673db
Preserve a backup if editor callback fails.
...
Currently the editor deletes its temp file whenever editing is finished.
With this patch, the file will not be deleted if the editor callback
encounters an exception.
One example is if the tab containing the edited element is closed. The
editor errors with "Edited element vanished", but with this patch it
will also print "Backup at ..." so the user does not lose their work.
Resolves #1596 .
Supersedes #3641 , using the cleaner approach started in #1677 .
2018-03-12 08:34:50 -04:00
Florian Bruhin
f0a649e101
Mark another GreaseMonkey test as flaky
...
See #3238
2018-03-11 14:29:54 +01:00
Florian Bruhin
06bccfeb78
Improve error message for QtWebEngine inspector
2018-03-06 12:57:38 +01:00
Florian Bruhin
69a58c9597
Remove Qt 5.8 support and tests
...
With QtWebKit it's probably okay to still use it (*cough* Hyperbola
GNU/Linux-libre^tm *cough*), and only blacklisting it with QtWebEngine would be
quite some effort.
Fixes #3608
2018-03-06 11:04:59 +01:00
Florian Bruhin
0e2a39da2a
Fix tests for keyboard parsing change
2018-03-06 07:39:41 +01:00
Florian Bruhin
155a1901c0
Merge branch 'keys'
2018-03-04 22:50:41 +01:00
Florian Bruhin
7fd0b52360
Add missing newline
...
[ci skip]
2018-02-28 08:11:23 +01:00
Florian Bruhin
f3aaa1084a
Migrate spell tests to unittests
2018-02-28 08:08:23 +01:00
Florian Bruhin
d9ae3fd5aa
Fix more hinting issues
2018-02-26 20:49:02 +01:00
Florian Bruhin
8bce2ba8e8
Fix expected message
2018-02-26 20:03:21 +01:00
Florian Bruhin
f1b20f6dc4
Fix forward_unbound_keys test
2018-02-26 20:02:43 +01:00
Florian Bruhin
1444634abb
Fix :fake-key test
2018-02-26 14:26:12 +01:00
Florian Bruhin
353753c03c
Merge remote-tracking branch 'origin/pr/3620'
2018-02-26 07:26:24 +01:00
Florian Bruhin
de0aa32c11
Merge remote-tracking branch 'origin/pr/3626'
2018-02-26 07:20:34 +01:00
Jay Kamat
76bf35cbdd
Add qtbug60673 markers to relevant tests
2018-02-25 19:00:15 -05:00
Jay Kamat
7a8fa5f46e
Implement deduplication of searches on webkit
2018-02-25 18:40:16 -05:00
Florian Bruhin
54713f57e5
Merge remote-tracking branch 'origin/pr/3624'
2018-02-25 21:09:56 +01:00
Florian Bruhin
52b5492c6a
Merge branch 'per-url'
2018-02-25 19:44:51 +01:00
Florian Bruhin
ba88fc43e0
Stabilize error page test
2018-02-25 19:40:38 +01:00
Florian Bruhin
4c147b77c1
Add a test for the error page workaround
2018-02-25 16:35:02 +01:00
Jay Kamat
4602afe770
Add a webengine duplicate search test
2018-02-23 18:13:20 -05:00
Jay Kamat
820ffed07f
Remove test blacklists for 5.10
2018-02-23 18:06:57 -05:00
Florian Bruhin
98b2b67b8b
Add tests for per-URL JavaScript settings
2018-02-23 15:08:07 +01:00
Jay Kamat
cb8d62866c
Blacklist qt versions 5.8.0 through 5.9.4 for caret tests
2018-02-22 18:34:15 -05:00
Jay Kamat
c16c625feb
Add basic tests for searching and caret mode
2018-02-22 10:28:35 -05:00
Florian Bruhin
ecfd4a77a0
Merge remote-tracking branch 'origin/pr/3562'
2018-02-21 10:11:40 +01:00
Florian Bruhin
7c1fb1d215
Refactor acceptNavigationRequest handling to use signals
2018-02-19 22:07:53 +01:00
Marc Jauvin
620a966d1e
add debug logs and adjust tests to use them
2018-02-14 09:58:23 -05:00
Marc Jauvin
9b8a182a78
history-clear does nothing to help here
2018-02-13 17:03:01 -05:00
Marc Jauvin
f94e12008a
fix the tests by clearing history
2018-02-13 16:23:56 -05:00
Marc Jauvin
e38df261cb
skip this test for qt>=5.10 until the log problem gets resolved
2018-02-13 13:00:44 -05:00
Marc Jauvin
6214c38d7e
add input_mode tests for tabs.mode_on_change
2018-02-12 18:11:32 -05:00
Florian Bruhin
47451aa495
Open qute://tabs with :buffer
2018-02-12 23:00:26 +01:00
George Edward Bulmer
2f4910f1f2
Add test for escaping {{url}}
2018-02-11 14:17:28 +00:00
Florian Bruhin
52d7ff79fc
Skip another scroll test with Qt 5.10 and Travis
2018-02-10 20:15:17 +01:00
Florian Bruhin
0b5ba828db
Add missing test
2018-02-09 22:23:07 +01:00
Florian Bruhin
e0dd7970d8
Skip fragment test
...
Looks like this now XPASSes with Qt 5.10 on Windows
2018-02-08 20:23:34 +01:00
Florian Bruhin
ea80ded8d5
Try to stabilize editor end2end test
...
Let's also wait until we're sure the mtime changed here.
2018-02-08 20:21:25 +01:00
Florian Bruhin
53e7d13c2d
Skip failing scrolling tests on Qt 5.10 on Travis
...
See #3572
2018-02-08 10:42:55 +01:00
Florian Bruhin
3306247ae5
Merge branch 'editor-watch'
2018-02-07 22:31:49 +01:00
Florian Bruhin
01ccbc679d
Fix lint
2018-02-07 22:26:32 +01:00
Florian Bruhin
aa3970c83e
Merge branch 'pr/3371'
2018-02-07 18:26:19 +01:00
Florian Bruhin
1c662ae94c
Revive iframe test as flaky
...
See #1525
2018-02-07 18:25:25 +01:00
Florian Bruhin
0bdee1e292
Stabilize the flaky iframe test
...
The test above this one loads hello.txt, but we don't wait for the "load
finished" message, so it can arrive after the previous test already finished and
make this test not wait properly.
However, we also can't easily wait for the load finished message in the
previous test as it only appears with QtWebEngine, not QtWebKit.
As a workaround, we simply load another file in that test, to circumvent this
kind of cross-interaction.
2018-02-07 18:16:03 +01:00