GuideMe (TeaseMe v2.0) - Current Build 0.4.4

[RemiHiyama]

Welp, here we go.

GuideMe Release v0.4.5-alpha.1

This mostly contains stuff that EroticDevelopment had already released; my main contribution is the addition of repeating and decimal-length timers. Hopefully the video bug reported by wheresmything should be fixed as well.

Spoiler: show

I'm not sure exactly which of the things I did convinced Github to start building the release files, only that eventually something did.

[PlayfulGuy]

So, has anyone heard from EroticDevelopment lately?

I actually got a functioning build environment for this working, and think I understand enough of the coding side of things to start trying to fix some issues and add some features, but I don't really get git, so...

Ugh, I don't know what I'm trying to say. I mean, it's open source and so anyone can fork it at any time, but I don't want to step on any toes, you know?

He hasn't posted lately of course, but I did send him a PM a while back, and he did reply several days (a couple weeks?) later. He's a busy guy.

It's worth sending him a PM with any questions, just expect it to be a while before you get a reply.
I'm sure he won't mind the help, and he did say he would accept pull requests. Since I've never used git or anything like it I sort of know what that means, but wouldn't know how to submit one, but maybe you do...

Great work by the way figuring all that out!

I'll try and get some time and energy to play with your new version a bit, but both of those are in short supply for me right now (life is seriously interfering with my play time lately!)

Eroticdevelopment did make changes in version 4.3 or 4.4 so that you could have buttons (and timers?) execute javascript without changing pages, so it must be doable, but probably requires code updates somewhere to check for an empty target.

PG

[RemiHiyama]

He hasn't posted lately of course, but I did send him a PM a while back, and he did reply several days (a couple weeks?) later. He's a busy guy.

Not just hasn't posted, according to user statistics he hasn't done anything on the site since August, which is the sort of thing that makes me wonder if maybe he's just moved on.

I think for now I'm just going to focus on implementing stuff. (I think I've figured out several of the existing issues related to EOS conversion, though mitigating side effects is going to take some more digging.)

I'll try and get some time and energy to play with your new version a bit, but both of those are in short supply for me right now (life is seriously interfering with my play time lately!)

Yeah, I know how that goes.

What would be most helpful at this point is making sure timers don't start acting weird in existing teases. I put a fair amount of effort into making sure only whole seconds would be used unless deliberately invoked, but that also involved changing a number of things that used to use seconds to using milliseconds, and while I think I caught everything it's possible I missed an edge case somewhere.

Eroticdevelopment did make changes in version 4.3 or 4.4 so that you could have buttons (and timers?) execute javascript without changing pages, so it must be doable, but probably requires code updates somewhere to check for an empty target.

Yeah, I found that already, it's actually a pretty straightforward fix. (Though I was confused for a bit because the comments have the class name of a different listener in there, so I ended up in another part of the code not sure what was going on.) I don't have a solution to the debouncing problem I'm happy with though. Given the way the browser behaves though, requiring the user to do some work to cover things may be the only way.

[RemiHiyama]

So I'm going through the outstanding bugs, trying to come up with fixes...

[*]Bugs in the handling of javascript on buttons etc. For example, if you have a javascript function call like addResponse("True, you got me there",19) the comma in the quoted string ends up terminating the first argument, and the closing parenthesis inside the quoted string terminates the function call, so the arguments the function receives are not what was intended. It seems Guideme is ignoring the quoted string. Also, quoted strings sometimes arrive with the quotes still there and then you have to strip them off.

This wasn't too hard to find. In Jscript.java function run, it takes the first ) it finds as the end of the arguments, then splits the string by commas. Absolutely no attempt at handling quotes is made. I've got some ideas on how to handle this, but it'll take some experimenting.

(Not sure about the "arriving with quotes" one - probably need to see if a solution to the rest also fixes that one.)

[*]If you use eval to evaluate a statement that references a function defined in the page it fails with a function name not defined error, but if you put the function in GlobalJavascript it works. Can functions defined in the page javascript be made available to "eval"?

This, on the other hand, has no obvious cause, and I'm unable to replicate it - when I tried using an eval that called a function in the page, it worked just fine. Can you check and see if you still have this issue, and if so provide me a test case so I can try to run down the problem that way?

[PlayfulGuy]

So I'm going through the outstanding bugs, trying to come up with fixes...

[*]Bugs in the handling of javascript on buttons etc. For example, if you have a javascript function call like addResponse("True, you got me there",19) the comma in the quoted string ends up terminating the first argument, and the closing parenthesis inside the quoted string terminates the function call, so the arguments the function receives are not what was intended. It seems Guideme is ignoring the quoted string. Also, quoted strings sometimes arrive with the quotes still there and then you have to strip them off.

This wasn't too hard to find. In Jscript.java function run, it takes the first ) it finds as the end of the arguments, then splits the string by commas. Absolutely no attempt at handling quotes is made. I've got some ideas on how to handle this, but it'll take some experimenting.

(Not sure about the "arriving with quotes" one - probably need to see if a solution to the rest also fixes that one.)

[*]If you use eval to evaluate a statement that references a function defined in the page it fails with a function name not defined error, but if you put the function in GlobalJavascript it works. Can functions defined in the page javascript be made available to "eval"?

This, on the other hand, has no obvious cause, and I'm unable to replicate it - when I tried using an eval that called a function in the page, it worked just fine. Can you check and see if you still have this issue, and if so provide me a test case so I can try to run down the problem that way?

Giving me a memory test eh? When the heck did I post that?

The function call thing will probably require a parsing function to more or less manually split it up. I ended up doing several parsing functions for the Script Engine and the new downloader to handle similar stuff. If you want I can send you some of my current code.

I'll refresh my memory and try to come up with some examples, but it will probably be a week at least before I get to that. Life is a little crazy right now and I'm mostly exhausted.

What version of Guideme did you test the eval issue in? I ran into that while working on the downloader in a couple cases.

Thanks,

PG

[RemiHiyama]

The function call thing will probably require a parsing function to more or less manually split it up. I ended up doing several parsing functions for the Script Engine and the new downloader to handle similar stuff. If you want I can send you some of my current code.

Thanks for the offer, but that one's dealt with now, no binary release yet but it's already merged into the develop branch on my repository.

The thing I realized when I thought about it is that since GuideMe uses Rhino, it's already *got* a javascript parser. I just had to find somebody explaining how to feed it in to do what I wanted it to do, and then write some functions to handle the resulting syntax tree.

The default behavior is to just split things into strings and throw them at the function; they shouldn't include delimiters but my understanding is that behavior was inconsistent anyway so it should be fine either way. Turn on ConvertArgumentTypes in the settings node, and it'll turn every literal type I could find except regular expressions and template strings (but including arrays and objects, though the latter may require different handling of the result than normal) into suitable object types, as well as pulling values from ScriptVars when it finds a name. Seems like those could both save a whole bunch of repetitive horsing around.

I'll refresh my memory and try to come up with some examples, but it will probably be a week at least before I get to that. Life is a little crazy right now and I'm mostly exhausted.

What version of Guideme did you test the eval issue in? I ran into that while working on the downloader in a couple cases.

At that point I'd only tried it on mine, but I just ran a test on 4.4 and it came up the same. But my example is pretty trivial, and it's possible something less trivial would produce issues... but I really don't understand how based on what it looks like the code is doing.

No rush on the examples, I'm trying to squish all the bugs that I can find references to, but I've still got others to pursue. Not to mention new development. I've got this idea that it'd be much more pleasant to write this:

Code: Select all

addButton({target: "exit", text: "Stop", hotkey: "s"})

than this:

Code: Select all

addButton("exit", "Stop", "", "", "", "", "s")

And so on for the various functions that often have multiple versions, some with very long parameter lists, which sometimes require numbers to be in strings and sometimes to not be, and adding any new features (like some of the things you've mentioned liking to be able to do with buttons) would make them even longer... It'd be nice to not have to keep checking that I have the right number of empty strings.

[RemiHiyama]

I've released a new alpha build.

https://github.com/hiss-remi/GuideMe/re ... .5-alpha.2

I believe I've now fixed all the open bugs except the linux mint crash (which appears to be a GTK bug, not a GuideMe bug) and the eval bug (which I can't replicate). Also, text areas are now supported in html forms (actually pretty easy), and confirmation dialogues for restart and reload (adding the configuration option for whether or not to do that was a huge pain).

Barring any new bugs to squish showing up, this is probably going to be the cutoff point for 0.4.5; work on new features including but not limited to the previously mentioned javascript improvements will go into 0.4.6. (Unless I'm convinced it justifies bumping up to 0.5... I'm not sure any of us are using semantic versioning properly here. o.o )

[PlayfulGuy]

I've got this idea that it'd be much more pleasant to write this:

Code: Select all

addButton({target: "exit", text: "Stop", hotkey: "s"})

than this:

Code: Select all

addButton("exit", "Stop", "", "", "", "", "s")

And so on for the various functions that often have multiple versions, some with very long parameter lists, which sometimes require numbers to be in strings and sometimes to not be, and adding any new features (like some of the things you've mentioned liking to be able to do with buttons) would make them even longer... It'd be nice to not have to keep checking that I have the right number of empty strings.

Now THAT would be awesome! I can't count how many times I've had to copy paste a command, or count arguments to make sure I had the right number, and in the right order.

I'm looking forward to trying the new version and features. You've accomplished a tremendous amount in a short time. My time and energy will still be a bit limited the next week or so but this will be fun!

I don't recall if either you or eroticdevelopment mentioned it, but do you know if the ability to "Include" using a wildcard was ever implemented? Like <Include id="*.xml"> or <Include id="*.js"> to include all the matching files in a folder?

Thanks for all your work on this

PG

[RemiHiyama]

Wildcard includes appear to be supported already. I'm not sure exactly when or by who it was added, since there's an issue for it in EroticDevelopment's repository that was added in June, but if I'm reading this right it was put in before November 2020.

The way it's written is a little weird (only strings with * immediately before the extension will be treated as containing wildcards), but within that limit it looks like it should work.

[RemiHiyama]

So you may have heard that there's a remote code execution vulnerability in Log4j, a popular Java logging library.

What you may not realize is that GuideMe uses a vulnerable version of the library. A maliciously programmed guide can trigger a call to a remote server and potentially leak information or run arbitrary java code.

Is this likely? Eh... I don't know, maybe. It's not as obviously attractive a target compared to internet server exploits for a lot of reasons, but why take chances?

Therefore, I highly recommend that all users of GuideMe do one of the following:

* Update to GuideMe 0.4.5, which I've pushed to release early to include an updated version of Log4j.

* Edit the startup command for GuideMe to disable JNDI lookups. On windows, this would mean replacing the last line of start.bat with

Code: Select all

start javaw -Dlog4j2.formatMsgNoLookups=true -Xms1024m -Xmx1024m -jar GuideMe.jar

Mac and Linux users would insert the same new option... somewhere or other... in their .sh files. (Probably in the JAVA_OPTS line for Linux and right after the 'java' on Mac, but I don't have access to those environments and can't be sure.)

To check your install's vulnerability, you can get a Log4Shell token at https://canarytokens.org/, and add this line to the javascript in any tease:

Code: Select all

jscriptLog("TOKEN_GOES_HERE"); //Replace TOKEN_GOES_HERE with the token received from the site above.

If the line is run on a vulnerable install, you'll be able to see that it was triggered on the token management page.

Also, keep in mind that GuideMe is not a secure sandbox. I'm not aware of any other code execution vulnerabilities, but a guide can still send data to any web server it wants via ordinary html. Use caution with teases made by people you don't know, and I recommend not entering your real name or other personally identifiable information into GuideMe.

[RemiHiyama]

Oh, and here's something fun that I hadn't noticed before. Because of the frankly bizarre way GuideMe processes javascript, it just *might* fire the exploit when loading the Guide, even when the log line is commented out. It definitely causes major lag during the loading process (something like 45 seconds during a test where I had things running in a way that let me check timestamps), so it's not exactly subtle, but still. This is a weird, weird issue.

[DarkPassenger]

For those that are running Guideme on Linux, which distribution and which version of the Java JRE are you running?
I'm using Arch and with openjdk-17 I get this error on startup:

Spoiler: show

Code: Select all

21:47:44.901 [main] TRACE org.guideme.guideme.ui.DebugShell - Enter createShell

(SWT:6607): Gtk-WARNING **: 21:47:44.999: Negative content width -17 (allocation 1, extents 9x9) while allocating gadget (node entry, owner GtkEntry)

(SWT:6607): Gtk-WARNING **: 21:47:44.999: Negative content width -17 (allocation 1, extents 9x9) while allocating gadget (node entry, owner GtkEntry)
21:47:45.021 [main] TRACE org.guideme.guideme.ui.DebugShell - Exit createShell
21:47:45.135 [main] TRACE org.guideme.guideme.ui.MainShell - Video Enter
21:47:45.225 [main] TRACE org.guideme.guideme.ui.MainShell - Video Exit
Exception in thread "main" org.eclipse.swt.SWTError: Not implemented (java.lang.IllegalAccessException: class org.eclipse.swt.awt.SWT_AWT cannot access class sun.awt.X11.XEmbeddedFrame (in module java.desktop) because module java.desktop does not export sun.awt.X11 to unnamed module @243c4f91)
	at org.eclipse.swt.SWT.error(Unknown Source)
	at org.eclipse.swt.SWT.error(Unknown Source)
	at org.eclipse.swt.awt.SWT_AWT.new_Frame(Unknown Source)
	at org.guideme.guideme.ui.MainShell.createShell(MainShell.java:483)
	at org.guideme.guideme.App.main(App.java:113)
Caused by: java.lang.IllegalAccessException: class org.eclipse.swt.awt.SWT_AWT cannot access class sun.awt.X11.XEmbeddedFrame (in module java.desktop) because module java.desktop does not export sun.awt.X11 to unnamed module @243c4f91
	at java.base/jdk.internal.reflect.Reflection.newIllegalAccessException(Reflection.java:392)
	at java.base/java.lang.reflect.AccessibleObject.checkAccess(AccessibleObject.java:674)
	at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:489)
	at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:480)
	... 3 more

Any idea what this means? I know nothing about Java. It looks like I'm missing a library or something, but I can't find any package called awt or swt. Besides I thought this was always a part of Java?

I also tried with earlier versions of the JRE (openjdk 11, 8 and 7) and then it goes a bit further but I get this error instead:

Spoiler: show

Code: Select all

21:54:04.093 [main] TRACE org.guideme.guideme.settings.GuideSettings - GuideSettings saveSettings save file: data/startup.state

(SWT:7141): Gtk-CRITICAL **: 21:54:04.105: gtk_box_gadget_distribute: assertion 'size >= 0' failed in GtkScrollbar

(SWT:7141): Gtk-CRITICAL **: 21:54:04.111: gtk_box_gadget_distribute: assertion 'size >= 0' failed in GtkScrollbar

(SWT:7141): Gtk-CRITICAL **: 21:54:04.115: gtk_box_gadget_distribute: assertion 'size >= 0' failed in GtkScrollbar
21:54:04.116 [main] TRACE org.guideme.guideme.App - open shell
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0x00007f2a2e22e424, pid=7141, tid=7142
#
# JRE version: OpenJDK Runtime Environment (11.0.13+8) (build 11.0.13+8)
# Java VM: OpenJDK 64-Bit Server VM (11.0.13+8, mixed mode, tiered, compressed oops, g1 gc, linux-amd64)
# Problematic frame:
# C  [libpthread.so.0+0xb424]  pthread_mutex_lock+0x4
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h" (or dumping to /home/sylvaint/gm/core.7141)
#
# An error report file with more information is saved as:
# /home/sylvaint/gm/hs_err_pid7141.log
#
# If you would like to submit a bug report, please visit:
#   https://bugreport.java.com/bugreport/crash.jsp
# The crash happened outside the Java Virtual Machine in native code.
# See problematic frame for where to report the bug.
#

Does anyone knows how to fix this?

[RemiHiyama]

I also tried with earlier versions of the JRE (openjdk 11, 8 and 7) and then it goes a bit further but I get this error instead:

What version of GTK3 are you running?

I ask because the error for this looks a lot like the one rtsgua reported here, and when I went searching for possible causes, it looked like the error could be there, so if your version is older than gtk3-3.22.30-7.el8, you might try updating and see if that fixes it.

If that doesn't help... well, I got nothing. GuideMe doesn't touch GTK directly, and if GuidMe was calling SWT wrong than everyone should be affected. So I just don't know.

[DarkPassenger]

I'm using GTK3 version 3.24
Browsing through the issues I also found this one. I dismissed it at first because I'm not using Wayland, but the second error message looks a lot like mine. I used the fix (added -D VLCJ_INITX=no to start.sh). I have no idea what the fix does, but at least GuideMe is working now :)

The only last issue I have is that GuideMe won't exit properly and I need to kill it manually, but I can live with that.

[tr0gd0r]

I'm using GTK3 version 3.24
Browsing through the issues I also found this one. I dismissed it at first because I'm not using Wayland, but the second error message looks a lot like mine. I used the fix (added -D VLCJ_INITX=no to start.sh). I have no idea what the fix does, but at least GuideMe is working now :)

The only last issue I have is that GuideMe won't exit properly and I need to kill it manually, but I can live with that.

Yes! Running Ubuntu 18.04 here, installing openjdk-11-jre and adding the -DVLCJ_INITX=no to start.sh and I have a running (well starts at least) GuideMe on Linux!