GNOME Bugzilla – Bug 248425
hyperlinks should show target URL as a tooltip
Last modified: 2017-02-09 13:37:54 UTC
Description of Problem: Evolution blindly trusts the text body to provide URL data in HTML email. This allows someone to send messages that look like one site but visit another, or which contain concealled tracking data. This is becoming a common path for identity theft and for spammers to validate addresses, along with picture tracking (which evolution already stops nicely) IMHO evo really should be 1. Putting the real URL as a tooltip of each clickable link 2. If the text of the <A>text</A> section contains a string that is in URL style format but does not match the href=".." string it should print both - eg ( http://www.ebay.com(http://www.evilscam.com?id=54379) This would markedly improve the safety of Evolution to end users.
running gtkhtml3.1-3.2.2.0.200410061620-0.snap.ximian.8.1 libgtkhtml3.1_11-3.2.2.0.200410061620-0.snap.ximian.8.1 evolution1.5-2.0.1.0.200410061620-0.snap.ximian.8.1 on suse9.0: first one (showing a tooltip) still missing when viewing an email in the preview pane in evolution, second one solved (only href location is shown in the status bar). therefore changing summary to "hyperlinks should show target URL as a tooltip".
so this is about the *rendering*, bug 225722 is about the *rendering*. same as per last comment in 3.7.4.
The exact URL is already displayed in status bar. Why should it also be displayed as a tooltip?
...because my status bar is mostly miles away from my current cursor and ear position. ;-) naaa....fair point, indeed.
garr.... "ear" should have been "eye". too early. need coffee.
Back in 2003 it didn't appear there either to my knowledge. Also it isn't a tooltip that is needed but as the original suggests putting the actual URL clearly visible if it does not match the text it is attached to. People will miss a tooltip but won't miss Contact Paypal Immediately <http://www.youare0wnz3D.org/> Thats probably not the right behaviour for web browsing but IMHO is for evolution
uh, right - it's a bit of a phishing protection. hmm... also see bug 256160.
in 2.5 one can hide the status bar. therefore i would really recommend to get this in for evolution 2.6. it's a security concern to me.
Bumping version to a stable release.
Still valid in 4.5.1-pre with WebKit rendering. dvratil, would this be easily implementable?
Not trivially - when there's no "title" attribute in the <a> tag, WebKit won't display the tooltip on it's own and manual DOM manipulation is not worth the effort, because URL of the link is displayed in the status bar though, which I think is sufficient.
On a related note, perhaps EWebView could benefit from an overlayed status bar for showing target URLs and other pointer hovering tooltips similar to the way Epiphany works now. The EWebView status bar could be switched off when packed in a main window and the main window's own task bar is visible. But it would allow us to drop the always-on status bar in the message window and also show tooltips for the first time ever in the composer window.
I should have mentioned GtkOverlay is of course the key to this.
Still valid in Evolution 3.12.8
GtkHtml is not under active development anymore. Evolution (its main consumer) switched to a WebKit backend a while ago. It is currently unlikely that there will be any further GtkHtml development. Closing this report as WONTFIX as part of Bugzilla Housekeeping (bug 778387) to reflect reality. Please feel free to reopen this bug report in the future if anyone takes the responsibility for active development again.