October 2005 - Inkscape Devel

Plain SVG as default ?
by John Taber 18 Oct '05

18 Oct '05

I've just noticed that Inkscape's SVG format doesn't work in cairo for the few drawings we tried - when we save as Plain SVG, they appear correctly. Not sure this is a universal problem but with the advent of Firefox SVG based on Cairo and the soon to be popularity of Cairo and XML in general, it might begin to confuse users that Inkscape's SVG is not Plain SVG and their svg drawings might not show correctly. We're already confused with whether a *.svg drawing is in Inkscape mode or Plain mode - obviously we can parse the xml code but just is more work. Also not sure how this plays out in Safari, Konqueror, or Opera. I would assume this might also affect Inkscape submissions to Open Clip Art which I would assume is standardized on the Plain SVG ? I would like to suggest: 1) make the Plain SVG as the default 2) rename the Inkscape SVG as something like *.svgi

9 14

Native look 'n feel win32
by Hal Lorenz 18 Oct '05

18 Oct '05

Hi there, I don't mind the Inkscape UI on Windows, but was wondering if it is being considered to give Inkscape a native-ish look on Windows, or even if there are any means to doing so? Also are there any docs on the Inkscape site that pertain to compiling it for Win32 w/ gtkmm? Either by x-compiling on Linux or using cygwin/mingw, I'm interested in how you guys do it. Kind regards, Hal

4 3

Hyphenation for text-justify
by Stefan de Konink 18 Oct '05

18 Oct '05

Hello, >From the Jabber conversation, bryyyce pointed me to the dev mailinglist. For our local Radio/TV-broadcasting foundation I made some software that makes a cable-text-program from SVG documents. Basically it works like this: Webinterface -> SQLite SQLite -> XML + XSL -> SVG SVG -> PNG PNG -> xloadimage Currently we need to wrap our text by hand, I'm extremely happy with the working flowtext. But speaking about nice features, justifying text and auto-hyphenation would be a killer app. I heard pjrm and njh have some ideas for this. The software is give-a-way GPL. So basically it spreads now around, not making it public (as in website) until all bugs are out of it though. (Any interest can receive a tarbal) Greetings, Stefan de Konink

3 2

Re: [Inkscape-devel] Re: Sanity checking files on open
by Ben Fowler 18 Oct '05

18 Oct '05

On 10/17/05, jiho <jo.irisson@...400...> wrote: > On 17 oct. 05, at 10:45, Ben Fowler wrote: > > On 10/16/05, jiho <jo.irisson@...400...> wrote: > >> On 15 oct. 05, at 20:23, Ben Fowler wrote: > >>> On 10/15/05, jiho <jo.irisson@...400...> wrote: > >>>> On 15 oct. 05, at 18:34, Ben Fowler wrote: > >>>>> On 10/15/05, bulia byak <buliabyak@...400...> wrote: > >>>>>> On 10/15/05, Ben Fowler <ben.the.mole@...400...> wrote: > > > > If it is necessary to 'fix up' objects individually, then you might > > want to select them one at a time and check the appearance > > and/or the properties. > > In this case, the problem was that the object had a huge bbox but was > invisible, so impossible to select individually. But I am conscious > that this is an individual problem and that general behavior should > be the one you advise. I think that you can select it (and that would agree with the comment that Bulia Byak made), and that would have the advantage that you could do whatever you needed to/decided to do to fix the problem, rather than say yes or no to some 'action at a distance'. If not (though this may be a low priority issue) then we ought to think about how to select hidden or invisible objects. Ben

1 0

win98 support?
by lode leroy 18 Oct '05

18 Oct '05

Does anyone know if installing "Microsoft Layer for Unicode on Windows 95, 98, and Me Systems" on a win98 pc makes it possible to use cairo and thus inkscape / gimp / ...? http://www.microsoft.com/downloads/details.aspx?FamilyID=73ba7bd7-ed06-4f0d…

4 4

Articifical Limits (was Re: Sanity checking files on open)
by Ben Fowler 17 Oct '05

17 Oct '05

On 10/16/05, jiho <jo.irisson@...400...> wrote: > On 15 oct. 05, at 20:23, Ben Fowler wrote: > > On 10/15/05, jiho <jo.irisson@...400...> wrote: > >> On 15 oct. 05, at 18:34, Ben Fowler wrote: > >>> On 10/15/05, bulia byak <buliabyak@...400...> wrote: > >>>> On 10/15/05, Ben Fowler <ben.the.mole@...400...> wrote: > > > Having said that, perhaps Inkscape compiled in debug mode should > > have some of these artifical limits, (just as we have assertion > > statements). It will help identify to developers just where the > > shoe pinches, but users do not need to handle this. > > If they could, why not? Once you pointed me to the problem the fix > was really easy. Having that build into inkscape would have avoided > you all my long emails ;-) Not really, the root cause of this e-mail conversation (maybe lengthy, but not unnecessary) is the fact that Inkscape did not gracefully handle a specific error condition. This wasn't deliberate. It was just that the precise combination of circumstances that brings it about had not occurred to any of the developers who had worked on that part of the code. Bringing this up up was very necessary. This kind of bug report is one of the most important raw materials needed for the production of good software. Now, release versions should not have 'articifical limits' or training wheels. Th assumption is that if the Application is in an unexpected state with a developer, it is because he or she got something wrong, and we want the earliest indication of when this is happening. If the application is in an unexpected state with a user, then the user is probably 'in the right' and merely doing something that hadn't been tested or anticipated. In the present case, if a scale factor exceeds 1 million, we are going to guess that on a developer's machine there is something wrong the code, but on a user's machine that he or she is simply working with large objects. Ben

5 5

[joxeankoret_at_yahoo_dot_es: Bug#330894: inkscape: Arbitrary code execution when opening a malicious file]
by Wolfram Quester 17 Oct '05

17 Oct '05

Hi allotogether, I just received a message at debian's BTS [1] which reports a possible security flaw in inkscape. It is surely a DOS since here on my PowerBook inkscape simply crashes saying wolfi@...453...:/tmp $ inkscape poc.svg Emergency save activated! Segmentation fault (core dumped) I attach the backtrace, which shows that inkscape is rather irritated: Core was generated by `aaaaaaaaaaaaaaaaa'. BTW, vim's syntax highlighter has certain toubles when editing this file, too. Thanks, Wolfi [1] http://bugs.debian.org/330894 ----- Forwarded message from Joxean Koret <joxeankoret_at_yahoo_dot_es> ----- Subject: Bug#330894: inkscape: Arbitrary code execution when opening a malicious file Reply-To: Joxean Koret <joxeankoret_at_yahoo_dot_es>, 330894@...499... Resent-From: Joxean Koret <joxeankoret_at_yahoo_dot_es> Resent-To: debian-bugs-dist@...501... Resent-Cc: Wolfram Quester <wolfi@...111...> Resent-Date: Fri, 30 Sep 2005 10:48:06 UTC Resent-Message-ID: <handler.330894.B.11280765119494@...499...> X-Debian-PR-Message: report 330894 X-Debian-PR-Package: inkscape X-Debian-PR-Keywords: From: Joxean Koret <joxeankoret_at_yahoo_dot_es> To: submit@...499... Date: Fri, 30 Sep 2005 12:51:04 +0200 Resent-Sender: Debian BTS <debbugs@...499...> X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at honk.physik.uni-konstanz.de X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at honk.physik.uni-konstanz.de Subject: inkscape: Arbitrary code execution opening a file Package: inkscape Version: 0.41-4.99.sarge0 Severity: grave Justification: user security hole Inkscape is vulnerable to, almost, one buffer overflow that may allow arbitrary code execution. I contacted the Inkscape team but, at the moment, there is no patch for the issue. Attached goes a Proof Of Concept. NOTE: I think the problem may not be exploitable because you need to write a shellcode using only valid XML characters. Regards, Joxean Koret -- System Information: [...snip...] ----- End forwarded message -----

5 7

Re: [Inkscape-devel] Static RPM isn't Very Static
by DJA 17 Oct '05

17 Oct '05

Jean-Francois Lemaire wrote: > On Friday 14 October 2005 20:00, you wrote: > >>Jean-Francois Lemaire wrote: >> >>>I've just uploaded inkscape-0.42.2-0.static.i686.rpm to >>>SourceForge. Would you please check it out and report back? > > >>That fixed that problem, but...umm...here's a new one: >> >>[dallen@...1044... miscellaneous]$ inkscape >>inkscape: error while loading shared libraries: >>libpangocairo-1.0.so.0: cannot open shared object file: No such file >>or directory > > > libpangocairo is not statically linked on purpose. It's not unreasonable to expect the user to install some support libraries or tweak the run-time environment. However, if there are libraries required by the package, then it shouldn't be called a static package. > Aren't you able to install it on your system? Isn't it part of your distribution? I will look for that library. No, Cairo[1] is not part of the Fedora Core distribution, and this is a full ("Install everything") install. Neither is Inkscape, BTW. > We can't link statically every library needed by Inkscape. Fair enough. But then you shouldn't call that package static. > We have to make reasonable choices. Now, maybe libpangocairo should be added. Your choice. Just let the users know what is required to install the package or binary. If there are library or environment requirements for the Inkscape package, then those requirements should be listed on the download (or some conspicuous) page on the Web site, preferably with links pointing to wherever contemporary versions of those files/packages can be found. [1] I'm assuming 'Cairo' is the library name - I'm not familiar with it. No doubt you will have many users new to your app who are not up to speed on all the latest graphics libraries and support packages. All the more reason to spell out exactly what one needs to experience your app. -- Best Regards, ~DJA.

5 9

Re: Sanity checking files on open
by Ben Fowler 17 Oct '05

17 Oct '05

On 10/16/05, jiho <jo.irisson@...400...> wrote: > On 15 oct. 05, at 20:23, Ben Fowler wrote: > > On 10/15/05, jiho <jo.irisson@...400...> wrote: > >> On 15 oct. 05, at 18:34, Ben Fowler wrote: > >>> On 10/15/05, bulia byak <buliabyak@...400...> wrote: > >>>> On 10/15/05, Ben Fowler <ben.the.mole@...400...> wrote: > >> > OK with this: > If the file cannot be read if not corrected (=definition of error > for me) the fix should be automatic. > . if the file can be read (as it was for mine: the syntax was OK) but > contains some unusual values, the correction should not be made > automatically. but, in addition of issuing a warning, I think it > would be great if a fix was proposed. then the user can choose to > accept it (in most cases, yes) or to reject it (in this case user > probably know what he is doing and will reject it if necessary). > In addition to that... This is RFE [ 1119025 ] repair broken xml on load http://sourceforge.net/tracker/index.php?func=detail&aid=1119025&group_id=9… You might want to: * Add a comment there * Put it onto the roadmap * Add a wiki page to record progress Note that this may not be 'interesting' to an open source developer, and you may find that progress is sporadic, but if a start is made so that there is a place to add code for handling new sorts of errors, I expect that eventually this will get done. Ben

1 0

Re: Sanity checking files on open
by Ben Fowler 17 Oct '05

17 Oct '05

On 10/16/05, jiho <jo.irisson@...400...> wrote: > On 15 oct. 05, at 20:23, Ben Fowler wrote: > > On 10/15/05, jiho <jo.irisson@...400...> wrote: > >> On 15 oct. 05, at 18:34, Ben Fowler wrote: > >>> On 10/15/05, bulia byak <buliabyak@...400...> wrote: > >>>> On 10/15/05, Ben Fowler <ben.the.mole@...400...> wrote: > > - that some criteria are chosen in the sanity check and some fixes > are proposed when these criteria are met. As I mentioned before, I am > thinking about scaling objects that have insane bbox or that are > really big/small in comparison with the rest of the drawing. Or even > scaling the whole drawing if it is huge (as it was the case > previously with somebody who couldn't zoom out far enough to see the > whole drawing if I remember well) or tiny (as it is the case with the > other file I have). And having the possibility to accept or reject > any change individually make this feature not too intrusive. Once > again I don't know if all this even means something. Just correct me > if this is stupid. If it is necessary to 'fix up' objects individually, then you might want to select them one at a time and check the appearance and/or the properties. Ben

1 0