Bug 79491

Summary: "Untrusted page links to local filesystem" check crashes Konqueror
Product: [Applications] konqueror Reporter: Malte S. Stretz <mss>
Component: generalAssignee: Konqueror Bugs <konqueror-bugs-null>
Status: RESOLVED FIXED    
Severity: crash CC: drjamph
Priority: NOR    
Version First Reported In: 3.2.1   
Target Milestone: ---   
Platform: unspecified   
OS: Linux   
Latest Commit: Version Fixed/Implemented In:
Sentry Crash Report:

Description Malte S. Stretz 2004-04-12 14:35:53 UTC 
Version:           3.2.1 (using KDE 3.2.1, Gentoo)
Compiler:          gcc version 3.3.2 20031218 (Gentoo Linux 3.3.2-r5, propolice-3.3-7)
OS:          Linux (i686) release 2.4.20-gentoo-r8

Going to the following link makes Konqi go boom. First the dialog 
| This untrusted page contains a link
| file:/E%3A/Backstage7/seitenpromo1.swf
| to your local file system.
will appear. As soon as you click "OK", it will crash.

The URL:
http://www.backstage7.de/cd/single04/mia/mia.htm

The backtrace:
Using host libthread_db library "/lib/libthread_db.so.1".
[Thread debugging using libthread_db enabled]
[New Thread 16384 (LWP 27372)]
0x4126a3e8 in waitpid () from /lib/libpthread.so.0
#0  0x4126a3e8 in waitpid () from /lib/libpthread.so.0
#1  0x40868274 in __JCR_LIST__ () from /usr/kde/cvs/lib/libkdecore.so.4
#2  0x407adc30 in KCrash::defaultCrashHandler(int) (sig=6) at kcrash.cpp:246
#3  0x412691b3 in __pthread_sighandler () from /lib/libpthread.so.0
#4  <signal handler called>
#5  0x413dc421 in kill () from /lib/libc.so.6
#6  0x41266743 in pthread_kill () from /lib/libpthread.so.0
#7  0x41266adb in raise () from /lib/libpthread.so.0
#8  0x413dc1d2 in raise () from /lib/libc.so.6
#9  0x413dd6ec in abort () from /lib/libc.so.6
#10 0x413d5a79 in __assert_fail () from /lib/libc.so.6
#11 0x41a8c009 in khtml::RenderReplaced::calcMinMaxWidth() (this=0x8b7bc9c)
    at render_replaced.cpp:78
#12 0x41a2a30c in khtml::KHTMLParser::insertNode(DOM::NodeImpl*, bool) (
    this=0x8c40c60, n=0x8cdc508, flat=true) at htmlparser.cpp:342
#13 0x41a2a026 in khtml::KHTMLParser::parseToken(khtml::Token*) (
    this=0x8c40c60, t=0x8c40b5c) at htmlparser.cpp:279
#14 0x41a30b0e in khtml::HTMLTokenizer::processToken() (this=0x8c40b28)
    at htmltokenizer.cpp:1577
#15 0x41a2f836 in khtml::HTMLTokenizer::parseTag(khtml::DOMStringIt&) (
    this=0x8c40b28, src=@0x8c40c3c) at htmltokenizer.cpp:1090
#16 0x41a30255 in khtml::HTMLTokenizer::write(QString const&, bool) (
    this=0x8c40b28, str=@0xbfffc9a0, appendData=false)
    at htmltokenizer.cpp:1345
#17 0x419cba69 in KHTMLPart::write(char const*, int) (this=0x8ae7c88, 
    str=0x8c9e818 "ung\r\n\r\n/ Single</font></b></p>\r\n\r\n<div align=\"center\">\r\n\r\n  <table border=\"0\" width=\"600\">\r\n\r\n      <center>\r\n\r\n      <tr>\r\n\r\n        <td width=\"50%\" align=\"center\"><img border=\"0\" src=\"hungriges_herz"..., len=4007) at khtml_part.cpp:1721
#18 0x419c9a64 in KHTMLPart::slotData(KIO::Job*, QMemArray<char> const&) (
    this=0x8ae7c88, kio_job=0x8b24198, data=@0xbfffcfc0) at khtml_part.cpp:1409
#19 0x419e185f in KHTMLPart::qt_invoke(int, QUObject*) (this=0x8ae7c88, 
    _id=1090467112, _o=0xbfffcc30) at khtml_part.moc:470
#20 0x40b8ed4c in QObject::activate_signal(QConnectionList*, QUObject*) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#21 0x401d3370 in KIO::TransferJob::data(KIO::Job*, QMemArray<char> const&) (
    this=0x8b24198, t0=0x0, t1=@0x0) at jobclasses.moc:722
#22 0x401c2ee5 in KIO::TransferJob::slotData(QMemArray<char> const&) (
    this=0x8b24198, _data=@0x0) at job.cpp:784
#23 0x401d38c6 in KIO::TransferJob::qt_invoke(int, QUObject*) (this=0x8b24198, 
    _id=18, _o=0xbfffcd50) at jobclasses.moc:801
#24 0x40b8ed4c in QObject::activate_signal(QConnectionList*, QUObject*) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#25 0x401b316d in KIO::SlaveInterface::data(QMemArray<char> const&) (
    this=0x8ac9fa0, t0=@0x0) at slaveinterface.moc:194
#26 0x401b1ba4 in KIO::SlaveInterface::dispatch(int, QMemArray<char> const&) (
    this=0x8ac9fa0, _cmd=100, rawdata=@0xbfffcfc0) at slaveinterface.cpp:246
#27 0x401b192b in KIO::SlaveInterface::dispatch() (this=0x8ac9fa0)
    at slaveinterface.cpp:191
#28 0x401af62d in KIO::Slave::gotInput() (this=0x8ac9fa0) at slave.cpp:294
#29 0x401b0eeb in KIO::Slave::qt_invoke(int, QUObject*) (this=0x8ac9fa0, 
    _id=4, _o=0xbfffd100) at slave.moc:113
#30 0x40b8ed4c in QObject::activate_signal(QConnectionList*, QUObject*) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#31 0x40b8eead in QObject::activate_signal(int, int) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#32 0x40ebf052 in QSocketNotifier::activated(int) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#33 0x40baaf70 in QSocketNotifier::event(QEvent*) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#34 0x40b33b0f in QApplication::internalNotify(QObject*, QEvent*) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#35 0x40b32edb in QApplication::notify(QObject*, QEvent*) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#36 0x40726ece in KApplication::notify(QObject*, QEvent*) (this=0xbffff0d0, 
    receiver=0x8ac9b80, event=0xbfffd4d0) at kapplication.cpp:506
#37 0x40b235ba in QEventLoop::activateSocketNotifiers() ()
   from /usr/qt/3/lib/libqt-mt.so.3
#38 0x40adf2e1 in QEventLoop::processEvents(unsigned) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#39 0x40b45b28 in QEventLoop::enterLoop() () from /usr/qt/3/lib/libqt-mt.so.3
#40 0x40b33dc1 in QApplication::enter_loop() ()
   from /usr/qt/3/lib/libqt-mt.so.3
#41 0x40c94219 in QPopupMenu::exec(QPoint const&, int) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#42 0x4161f07d in KonqMainWindow::slotPopupMenu(KXMLGUIClient*, QPoint const&, QPtrList<KFileItem> const&, KParts::URLArgs const&, unsigned, bool) (
    this=0x8100838, client=0x8c46d28, _global=@0x4126dbf8, _items=@0xbfffd9a0, 
    _args=@0x0, itemFlags=12, showProperties=false) at konq_mainwindow.cc:4064
#43 0x4161e96a in KonqMainWindow::slotPopupMenu(KXMLGUIClient*, QPoint const&, KURL const&, KParts::URLArgs const&, unsigned, unsigned) (this=0x0, client=0x0, 
    _global=@0x0, url=@0x0, _args=@0xbfffdca0, f=0, _mode=0)
    at konq_mainwindow.cc:3894
#44 0x416250e6 in KonqMainWindow::qt_invoke(int, QUObject*) (this=0x8100838, 
    _id=1090467112, _o=0xbfffdb90) at konq_mainwindow.moc:537
#45 0x40b8ed4c in QObject::activate_signal(QConnectionList*, QUObject*) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#46 0x400508f6 in KParts::BrowserExtension::popupMenu(KXMLGUIClient*, QPoint const&, KURL const&, KParts::URLArgs const&, unsigned, unsigned) (this=0x893ddb0, 
    t0=0x0, t1=@0x0, t2=@0x0, t3=@0x0, t4=12, t5=32768)
    at browserextension.moc:459
#47 0x419d907e in KHTMLPart::popupMenu(QString const&) (this=0x88e8af0, 
    linkUrl=@0x893c934) at khtml_part.cpp:4248
#48 0x419dca47 in KHTMLPart::khtmlMousePressEvent(khtml::MousePressEvent*) (
    this=0x88e8af0, event=0xbfffe220) at khtml_part.cpp:5169
#49 0x419dc7bb in KHTMLPart::customEvent(QCustomEvent*) (this=0x88e8af0, 
    event=0xbfffe220) at khtml_part.cpp:5067
#50 0x40b8c55c in QObject::event(QEvent*) () from /usr/qt/3/lib/libqt-mt.so.3
#51 0x40b33b0f in QApplication::internalNotify(QObject*, QEvent*) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#52 0x40b32edb in QApplication::notify(QObject*, QEvent*) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#53 0x40726ece in KApplication::notify(QObject*, QEvent*) (this=0xbffff0d0, 
    receiver=0x88e8af0, event=0xbfffe220) at kapplication.cpp:506
#54 0x4004a14d in QApplication::sendEvent(QObject*, QEvent*) (receiver=0x0, 
    event=0x6) at qapplication.h:491
#55 0x419b1b3f in KHTMLView::viewportMousePressEvent(QMouseEvent*) (
    this=0x88f85c0, _mouse=0xbfffe8e0) at khtmlview.cpp:712
#56 0x40c9f053 in QScrollView::eventFilter(QObject*, QEvent*) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#57 0x419b382e in KHTMLView::eventFilter(QObject*, QEvent*) (this=0x88f85c0, 
    o=0x893ba38, e=0xbfffe8e0) at khtmlview.cpp:1412
#58 0x40b8c67e in QObject::activate_filters(QEvent*) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#59 0x40b8c5ac in QObject::event(QEvent*) () from /usr/qt/3/lib/libqt-mt.so.3
#60 0x40bc439f in QWidget::event(QEvent*) () from /usr/qt/3/lib/libqt-mt.so.3
#61 0x40b33b0f in QApplication::internalNotify(QObject*, QEvent*) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#62 0x40b32fd0 in QApplication::notify(QObject*, QEvent*) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#63 0x40726ece in KApplication::notify(QObject*, QEvent*) (this=0xbffff0d0, 
    receiver=0x893ba38, event=0xbfffe8e0) at kapplication.cpp:506
#64 0x40acacd0 in QETWidget::translateMouseEvent(_XEvent const*) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#65 0x40ac8960 in QApplication::x11ProcessEvent(_XEvent*) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#66 0x40adf861 in QEventLoop::processEvents(unsigned) ()
   from /usr/qt/3/lib/libqt-mt.so.3
#67 0x40b45b28 in QEventLoop::enterLoop() () from /usr/qt/3/lib/libqt-mt.so.3
#68 0x40b459d8 in QEventLoop::exec() () from /usr/qt/3/lib/libqt-mt.so.3
#69 0x40b33d61 in QApplication::exec() () from /usr/qt/3/lib/libqt-mt.so.3
#70 0x415ca527 in kdemain (argc=0, argv=0x0) at konq_main.cc:184
#71 0x408ac996 in kdeinitmain (argc=0, argv=0x0) at konqueror_dummy.cc:2
#72 0x0804dbec in launch (argc=4, _name=0x806303c "konqueror", 
    args=0x806308e "/home/mss", cwd=0x806308e "/home/mss", envc=53, 
    envs=0x80638b6 "", reset_env=true, tty=0x0, avoid_loops=false, 
    startup_id_str=0x0) at kinit.cpp:604
#73 0x0804f079 in handle_launcher_request (sock=4) at kinit.cpp:1167
#74 0x0804f68d in handle_requests (waitForPid=0) at kinit.cpp:1350
#75 0x08050617 in main (argc=3, argv=0xbffff7b4, envp=0x0) at kinit.cpp:1797
Comment 1 Tommi Tervo 2004-09-07 12:59:32 UTC 
*** Bug 88551 has been marked as a duplicate of this bug. ***
Comment 2 Maksim Orlovich 2005-11-14 00:30:23 UTC 
seems to be gone/page changed?
Comment 3 Malte S. Stretz 2005-11-14 11:37:56 UTC 
Nope, the HTML is still there:
        <p align="center"><font face="Verdana" size="2"><embed width="280" height="40" src="file:///E:/Backstage7/seitenpromo1.swf" align="middle"><noembed>Leider haben Sie noch kein Plug In für Flash installiert was nötig wäre um alles zu sehen;-)</noembed></font></td>

But Konqi 3.5.0-beta2 no longer shows the warning... I tried to put together a testcase here [1] which doesnt work either.  I assume it is fixed in 3.5...

[1] http://msquadrat.de/tmp/kde-bug79491.html