[bug#30329] [PATCH] gnu: emacs: Build with xwidgets support.

[bug#30329] [PATCH] gnu: emacs: Build with xwidgets support.

[Alex Vong]

[-- Attachment #1: Type: text/plain, Size: 382 bytes --]

Hi,

This patch adds xwidgets support to Emcas. So Emacs can now display GTK
widgets. In particular, it can display webpages using webkitgtk.

Also, I use webkitgtk-2.4 instead of webkitgtk, because xwidgets
requires libwebkitgtk-3.0 instead of libwebkitgtk-4.0 to
build.

Moroever, the size of the closure of Emacs increases from 880.2 MiB -->
1232.4 MiB after adding the inputs.


[-- Attachment #2: 0001-gnu-emacs-Build-with-xwidgets-support.patch --]
[-- Type: text/x-diff, Size: 2415 bytes --]

From ae89b2e42689d2ae54d5785238daa5800ad94241 Mon Sep 17 00:00:00 2001
From: Alex Vong <alexvong1995@gmail.com>
Date: Sat, 3 Feb 2018 05:05:17 +0800
Subject: [PATCH] gnu: emacs: Build with xwidgets support.

* gnu/packages/emacs.scm (emacs) [arguments]: Add '--with-xwidgets'
to #:configure-flags.
[inputs]: Add glib-networking, gsettings-desktop-schemas, libxcomposite,
webkitgtk-2.4.
---
 gnu/packages/emacs.scm | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/emacs.scm b/gnu/packages/emacs.scm
index 9be92edc1..a56aec440 100644
--- a/gnu/packages/emacs.scm
+++ b/gnu/packages/emacs.scm
@@ -15,7 +15,7 @@
 ;;; Copyright © 2016, 2017 ng0 <ng0@infotropique.org>
 ;;; Copyright © 2016 Alex Griffin <a@ajgrf.com>
 ;;; Copyright © 2016, 2017 Nicolas Goaziou <mail@nicolasgoaziou.fr>
-;;; Copyright © 2016, 2017 Alex Vong <alexvong1995@gmail.com>
+;;; Copyright © 2016, 2017, 2018 Alex Vong <alexvong1995@gmail.com>
 ;;; Copyright © 2016, 2017, 2018 Arun Isaac <arunisaac@systemreboot.net>
 ;;; Copyright © 2017 Christopher Baines <mail@cbaines.net>
 ;;; Copyright © 2017 Mathieu Othacehe <m.othacehe@gmail.com>
@@ -81,6 +81,7 @@
   #:use-module (gnu packages version-control)
   #:use-module (gnu packages imagemagick)
   #:use-module (gnu packages w3m)
+  #:use-module (gnu packages webkit)
   #:use-module (gnu packages wget)
   #:use-module (gnu packages autotools)
   #:use-module (gnu packages base)
@@ -151,7 +152,9 @@
                      " ")))))))
     (build-system glib-or-gtk-build-system)
     (arguments
-     `(#:phases
+     `(#:configure-flags
+       '("--with-xwidgets")
+       #:phases
        (modify-phases %standard-phases
          (add-before 'configure 'fix-/bin/pwd
            (lambda _
@@ -204,7 +207,13 @@
 
        ;; multilingualization support
        ("libotf" ,libotf)
-       ("m17n-lib" ,m17n-lib)))
+       ("m17n-lib" ,m17n-lib)
+
+       ;; xwidgets support
+       ("glib-networking" ,glib-networking) ; required for browsing https pages
+       ("gsettings-desktop-schemas" ,gsettings-desktop-schemas)
+       ("libxcomposite" ,libxcomposite)
+       ("webkitgtk" ,webkitgtk-2.4))) ; libwebkitgtk-3.0 is required
     (native-inputs
      `(("guix-emacs.el" ,(search-auxiliary-file "emacs/guix-emacs.el"))
        ("pkg-config" ,pkg-config)
-- 
2.16.1


[-- Attachment #3: Type: text/plain, Size: 14 bytes --]


Cheers,
Alex

[bug#30329] [PATCH] gnu: emacs: Build with xwidgets support.

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 898 bytes --]

On Sat, Feb 03, 2018 at 05:48:12AM +0800, Alex Vong wrote:
> Hi,
> 
> This patch adds xwidgets support to Emcas. So Emacs can now display GTK
> widgets. In particular, it can display webpages using webkitgtk.
> 
> Also, I use webkitgtk-2.4 instead of webkitgtk, because xwidgets
> requires libwebkitgtk-3.0 instead of libwebkitgtk-4.0 to
> build.

Webkitgtk is very actively researched and exploited for security
problems. If this use of webkitgtk-2.4 would ever handle untrusted
input, it's not very safe. I don't use Emacs so I'm not sure what the
use case is for webkitgtk.

For examples, you can check the security advisories published by the
Webkitgtk team:

https://webkitgtk.org/news.html

They publish an advisory after every release, and there are always
several fixed bugs allowing code execution by whoever supplies the input
(typically from a remote web server).

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[bug#30329] [PATCH] gnu: emacs: Build with xwidgets support.

[Ludovic Courtès]

Hello,

Leo Famulari <leo@famulari.name> skribis:

> On Sat, Feb 03, 2018 at 05:48:12AM +0800, Alex Vong wrote:
>> Hi,
>> 
>> This patch adds xwidgets support to Emcas. So Emacs can now display GTK
>> widgets. In particular, it can display webpages using webkitgtk.
>> 
>> Also, I use webkitgtk-2.4 instead of webkitgtk, because xwidgets
>> requires libwebkitgtk-3.0 instead of libwebkitgtk-4.0 to
>> build.
>
> Webkitgtk is very actively researched and exploited for security
> problems. If this use of webkitgtk-2.4 would ever handle untrusted
> input, it's not very safe. I don't use Emacs so I'm not sure what the
> use case is for webkitgtk.
>
> For examples, you can check the security advisories published by the
> Webkitgtk team:
>
> https://webkitgtk.org/news.html
>
> They publish an advisory after every release, and there are always
> several fixed bugs allowing code execution by whoever supplies the input
> (typically from a remote web server).

That’s indeed a bit of a problem.  Would be nice if it could use the
latest webkitgtk series.

Given that and the increase in closure size, I would prefer making it a
separate “emacs-xwidgets” package.

WDYT?

Thanks,
Ludo’.

[bug#30329] [PATCH] gnu: emacs: Build with xwidgets support.

[Alex Vong]

ludo@gnu.org (Ludovic Courtès) writes:

> Hello,
>
> Leo Famulari <leo@famulari.name> skribis:
>
>> On Sat, Feb 03, 2018 at 05:48:12AM +0800, Alex Vong wrote:
>>> Hi,
>>> 
>>> This patch adds xwidgets support to Emcas. So Emacs can now display GTK
>>> widgets. In particular, it can display webpages using webkitgtk.
>>> 
>>> Also, I use webkitgtk-2.4 instead of webkitgtk, because xwidgets
>>> requires libwebkitgtk-3.0 instead of libwebkitgtk-4.0 to
>>> build.
>>
>> Webkitgtk is very actively researched and exploited for security
>> problems. If this use of webkitgtk-2.4 would ever handle untrusted
>> input, it's not very safe. I don't use Emacs so I'm not sure what the
>> use case is for webkitgtk.
>>
>> For examples, you can check the security advisories published by the
>> Webkitgtk team:
>>
>> https://webkitgtk.org/news.html
>>
>> They publish an advisory after every release, and there are always
>> several fixed bugs allowing code execution by whoever supplies the input
>> (typically from a remote web server).
>
> That’s indeed a bit of a problem.  Would be nice if it could use the
> latest webkitgtk series.
>
> Given that and the increase in closure size, I would prefer making it a
> separate “emacs-xwidgets” package.
>
> WDYT?
>
I agree with what Leo thought. Since it is up to emacs package authors
to make sure untrusted input are never sent to webkitgtk, and it is hard
to garantee that every package does the right thing.

So I will send another patch after emacs switch to libwebkitgtk-4.0 (in
a separate package).

> Thanks,
> Ludo’.

[bug#30329] [PATCH] gnu: emacs: Build with xwidgets support.

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 1115 bytes --]

On Thu, Feb 08, 2018 at 09:04:35AM +0800, Alex Vong wrote:
> I agree with what Leo thought. Since it is up to emacs package authors
> to make sure untrusted input are never sent to webkitgtk, and it is hard
> to garantee that every package does the right thing.

I'd like to clarify myself a bit.

I believe that with some time and effort, someone could find exploitable
bugs in every complex piece of software in Guix.

We shouldn't let this hold us back from enjoying the features of the
software.

However, in cases where the bugs were publicized long ago (webkitgtk
2.4.0 is almost 4 years old; 2.4.11 almost 2 years old) and the bugs are
easily accessible to attackers (webkitgtk renders content from web
pages) we should be more careful.

GnuCash is now the only thing in our tree using this old webkitgtk, and
the GnuCash developers are actively working to make GnuCash use a more
recent version. Other distros have even removed GnuCash or are preparing
to remove it due to this issue, but I think we can wait for a bit
longer.

BTW, there is a bug to discuss related issues at
<https://bugs.gnu.org/26176>.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[bug#30329] [PATCH] gnu: emacs: Build with xwidgets support.

[Chris Marusich]

[-- Attachment #1: Type: text/plain, Size: 513 bytes --]

Hi,

Alex Vong <alexvong1995@gmail.com> writes:

> This patch adds xwidgets support to Emcas. So Emacs can now display GTK
> widgets. In particular, it can display webpages using webkitgtk.
>
> Also, I use webkitgtk-2.4 instead of webkitgtk, because xwidgets
> requires libwebkitgtk-3.0 instead of libwebkitgtk-4.0 to
> build.

This patch will no longer work, since webkitgtk@2.4 has been removed.
How shall we proceed?  Is something like it still needed, or can we
close this report?

-- 
Chris

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

bug#30329: [PATCH] gnu: emacs: Build with xwidgets support.

[Ricardo Wurmus]

Chris Marusich <cmmarusich@gmail.com> writes:

> Alex Vong <alexvong1995@gmail.com> writes:
>
>> This patch adds xwidgets support to Emcas. So Emacs can now display GTK
>> widgets. In particular, it can display webpages using webkitgtk.
>>
>> Also, I use webkitgtk-2.4 instead of webkitgtk, because xwidgets
>> requires libwebkitgtk-3.0 instead of libwebkitgtk-4.0 to
>> build.
>
> This patch will no longer work, since webkitgtk@2.4 has been removed.
> How shall we proceed?  Is something like it still needed, or can we
> close this report?

Some time ago I updated the Emacs xwidget feature to use the latest
webkit, so we shouldn’t be using the old one here.

I would suggest not to add this package, because the xwidgets feature
currently isn’t all that useful.  There is very little communication
between Emacs and the widget.  Work was underway (and has since stalled)
to use gobject introspection to expose the webkit API to Elisp.

I’d suggest to wait until this feature is more useful.

Alex, I’m closing this bug now, but you’re welcome to submit another
patch that adds a separate emacs-with-xwidgets package and I won’t
reject it despite my opinion of current state of the feature.

Thanks!

--
Ricardo