Version: 1.4.3 (using KDE 3.0.4) Installed from: (testing/unstable) Compiler: gcc version 2.95.4 20011002 (Debian prerelease) OS: Linux (i686) release 2.4.19 If a message subject contains HTML code that represents an image, the tooltip that pops up above it apparently tries to render the image. If it actually loads the image, this is a security/privacy risk and if not, a visual nuisance.
Created attachment 648 [details] Screenshot of the bug The cursor is not visible in the screenshot since ksnapshot doesn't capture it. It should be above the hilighted title of the message.
i'm confirming this "funny" bug. even just "<img>" is in the subject it renders a "black box" image in the tooltip!
Subject: Re: Tooltip popup renders image URLs in message subject KMail doesn't try to download the files the URLs point to. So this isn't a privacy risk but just a visual nuisance.
anyway at least e.g. this code in the message subject causes kmail to completely freeze on mouse over for tooltip: <img name="veeeeeeeery_large_image" width="30000" height="15000" />
This seems to be mainly a QT problem, actually. QListView has an option to automatically show a tool tip for text items that don't fit in their cells. Unlike tool tip renderer, however, the cell renderer doesn't interpret text as "rich text". 'QStyleSheet::escape(...)' in 'text(int)' would thus fix the bug for tool tips but introduce a new one for the list view (e.g. '<' would be displayed as '<').
The following is what the Trolls had to say about this: ===== Since it is not possible to just turn off the rich text handling for QToolTips in this listview, this leaves us with two ways to resolve this issue. One being to just turn off the showToolTips() functionality for this listview by using: http://doc.trolltech.com/3.1/qlistview.html#setShowToolTips The alternative is to handle the tooltips yourself, this way you can parse the text and then escape the <>'s so that it shows them as ordinary <>'s instead of trying to show it as an image. For more information about QToolTip see: http://doc.trolltech.com/3.1/qtooltip.html Other than that there is nothing much you can do I am afraid. ===== So we can now decide whether we want to go for the easy or for the hard solution. I'll downgrade the bug to a wish since this isn't a bug in KMail but (IMO) a misbehavior of QToolTip.
Created attachment 2163 [details] implements the custom tooltip scheme This patch implements the custom tooltip scheme and seems to work fine BUT I have slight doubts about the following chunk: @@ -90,13 +92,15 @@ public: int mMsgId; QString mKey; + bool mTruncated; // WARNING: Do not add new member variables to the class ;) Does anyone know why the warning is there? Kmail works fine with the added member and the class definition is in a .cpp file so it doesn't look like a binary backwards compatibility issue.
Ping. (There's an 8 months old patch fixing this issues, but nobody's apparently reviewed it yet.)
Created attachment 5788 [details] tooltip with pre tag being rendered This is a screenshot of the <pre> tag also being rendered in a tooltip. Are all html tags rendered in QToolTips?
I just noticed this behaviour in kMail and just wondered if something like the <applet>-tag might work inside a subject? That'd be really bad but from the comments above I got the impression that only a subset of tags with visual effects are interpreted/rendered? What about the patch proposed by elonen@iki.fi?
Saw this strange behavior myself. Retested #4 - it does not freeze anymore, but the complete screen flashes in a strange way... Ingo, I would say that this is a bug in the kmail application (it does not matter that the problem really is in the library used...). But it is not a serious bug either - I set it to minor. The easiest solution might be to filter the string before setting the tool tip?
*** Bug 111038 has been marked as a duplicate of this bug. ***
*** Bug 148872 has been marked as a duplicate of this bug. ***
In kmail 1.10 (kde 4.1) * the <img> tag is not rendered in the tooltip * the big <img> of comment #4 does not makes it to freeze neither to flash, and * the <pre> tag is not rendered as such in the tooltip
I can still reproduce part of this bug: If I send myself a message containing "<img name="veeeeeeeery_large_image" width="30000" height="15000" />" in its subject and getting the tooltip, kmail starts leaking memory (I killed it at around 1.5 GiB).
(KDE 4.2.2) You can reproduce this behaviour also by putting & into the subject header - the tooltip shows a plain '&' rather than the text that is actually in the subject type. Is it possible to escape the subject header before rendering it into a html tooltip?
SVN commit 1005635 by mkoller: BUG: 52223 escape subject text when generating the tooltip to avoid using/executing HTML code existing in the subject text M +2 -1 view.cpp WebSVN link: http://websvn.kde.org/?view=rev&revision=1005635
SVN commit 1007467 by tmcguire: Backport r1005635 by mkoller from trunk to the 4.3 branch: CCBUG: 52223 escape subject text when generating the tooltip to avoid using/executing HTML code existing in the subject text M +2 -1 view.cpp WebSVN link: http://websvn.kde.org/?view=rev&revision=1007467