Bug 248470 – [GTK] Should be possible to block resource preload

• Status: NEW
• Component: WebKitGTK

[Milan Crha]

Created attachment 463787 [details]
test message

The attached file contains a message, which can be imported into the Evolution, or you can simply remove mail headers from the top and use it as a bare HTML page. It corresponds to this page https://www.michaelgeist.ca/2022/11/law-bytes-podcast-episode-148/?utm_source=rss&utm_medium=rss&utm_campaign=law-bytes-podcast-episode-148 

I do not like several things about it:

a) there is a set of warnings on the console:

> CONSOLE OTHER WARN The resource https://www.michaelgeist.ca/wp-content/plugins/social-icons-widget-by-wpzoom/assets/font/socicon.woff?v=4.2.6
> was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it wasn't preloaded for nothing.

   1) how can WebKitGTK preload anything, when the evolution controls what is loaded and what not through WebKitWebPage::send-request? See also bug #248390, but this one is different, from my point of view

   2) what am I supposed to do with this warning, when I've absolutely no control on the HTML content? The page is generated by a 3rd party. Maybe you've enabled these warnings only in some developer mode, then it would be okay.

b) Evolution has set:
		"auto-load-images", TRUE,
		"enable-dns-prefetching", FALSE,
This page contains a lot of tags about prefetching and preloading and what not. I hope all of these are consulted with the WebKitWebPage::send-request, or if there's any other mechanism to make sure the 3rd-party page doesn't touch internet on its own, only through the controlled way by the application, then I'll be happy to be pointed to the right direction. Otherwise my understanding was that the WebKitWebPage::send-request is one way to influence what is downloaded and how. I'm aware of the WebKitWebView::decide-policy, it is used internally, though only for WEBKIT_NAVIGATION_TYPE_LINK_CLICKED:

```

	if (type != WEBKIT_POLICY_DECISION_TYPE_NAVIGATION_ACTION &&
	    type != WEBKIT_POLICY_DECISION_TYPE_NEW_WINDOW_ACTION)
		return FALSE;

	navigation_decision = WEBKIT_NAVIGATION_POLICY_DECISION (decision);
	navigation_action = webkit_navigation_policy_decision_get_navigation_action (navigation_decision);
	navigation_type = webkit_navigation_action_get_navigation_type (navigation_action);

	if (navigation_type != WEBKIT_NAVIGATION_TYPE_LINK_CLICKED)
		return FALSE;
```
This signal doesn't seem to cover "redirect" as the WebKitWebPage::send-request allows.

[Milan Crha]

I forgot to add, this is with webkit2gtk4.1-2.38.0-3.fc37.x86_64

[Milan Crha]

Does that with 2.40.0 as well.

[Michael Catanzaro]

Perhaps I'm misunderstanding something, but the problem is a web console warning caused by the web content in the email that you're displaying, yes?

> 2) what am I supposed to do with this warning, when I've absolutely no control on the HTML content? The page is generated by a 3rd party. Maybe you've enabled these warnings only in some developer mode, then it would be okay.

You're not supposed to do anything with this warning. It's a warning for whoever developed the HTML used in that email. Preloading content in emails just doesn't make sense, right? You should not attempt to "fix" web console warnings because those can only be fixed by the web content developers, not by the developers of applications that use WebKit.

[Milan Crha]

(In reply to Michael Catanzaro from comment #3)
> Perhaps I'm misunderstanding something, but the problem is a web console
> warning caused by the web content in the email that you're displaying, yes?

Yes and no. One problem is that I cannot (and shouldn't, as you said) do anything about the warning. If it's only for the page developer, then show it to the page developer, not to everybody else, whom cannot influence it by any means.

The other problem is that it claims the resource *had been preloaded*. I trusted that message, but trying it here, I do not see any sign of the resource download in the access logs of my server, thus maybe the warning lies and nothing was preload at all. Being there anything preloaded, I'd consider it a security problem, because any attacker/spammer could have such preloads in the document to verify the address is functional and anybody reads the message, despite Evolution controlling the internet traffic by the WebKitGTK API.

Interestingly, referencing an https:// address in the "preload" <link>, which uses an invalid certificate, shows an error message in the console about the invalid certificate, thus maybe it tries to download something with http://, but doesn't finish it? I do not know how these things work under the hood.

[Michael Catanzaro]

> The other problem is that it claims the resource *had been preloaded*. I trusted that message, but trying it here, I do not see any sign of the resource download in the access logs of my server, thus maybe the warning lies and nothing was preload at all.

Huh, that sounds like a bug indeed. I would trust your server logs.

> Being there anything preloaded, I'd consider it a security problem, because any attacker/spammer could have such preloads in the document to verify the address is functional and anybody reads the message, despite Evolution controlling the internet traffic by the WebKitGTK API.

I guess we need some way to block preloads. It's expected that web content can preload whatever it wants, and I don't think we have any way to prevent that. But an email client is indeed expected to not allow that.