There is no security critic code in qmldom. Everything remains
at the default "signicant" security level. Exception is one file
containing only headers marked "insignificant".
QUIP: 23
Fixes: QTBUG-136197
Pick-to: 6.10 6.9 6.8
Change-Id: Ied3f8f9299b8c429e903922b815ee5db8f2d1a9e
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
There is no security critic code in qmlformat. Everything remains
at the default "signicant" security level.
QUIP: 23
Fixes: QTBUG-136198
Pick-to: 6.10 6.9 6.8
Change-Id: Iac1c84748bc98a9c921fc8ae895a2dcd53d01270
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
No data parsing or critical situation is found.
QUIP: 23
Fixes: QTBUG-136181
Pick-to: 6.10 6.9 6.8
Change-Id: I8fe748a6cd82d4e6f762dcda8e16967282a8403f
Reviewed-by: Jan Arve Sæther <jan-arve.saether@qt.io>
We assume that QML or JS code comes from a trusted source. Therefore,
most files are deemed to be significant even if they parse data. This
includes the source code itself but also the associated metadata or
cache files.
However, the QML compiler also generates C++ code. Extra care needs to
be taken with the generator as a vulnerability there could propagate and
have a disproportionate effect on the program's security. It is marked
as critical.
QUIP: 23
Fixes: QTBUG-136195
Pick-to: 6.10 6.9 6.8
Change-Id: I70630361ec8e9cb3969f78a3fdf36a41334a33b3
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
As we assume that all QML comes from trusted sources, everything remains
at the default "signicant" security level. The exception are the module
headers which only include other headers and add a few defines.
QUIP: 23
Fixes: QTBUG-136203
Pick-to: 6.10 6.9 6.8
Change-Id: Ib1a2abbb94dbb25420f03e01a2b444f89517a902
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
The header is only used to add meta-data to source files.
Pick-to: 6.10 6.9 6.8
Fixes: QTBUG-136199
Change-Id: Ib2a5c55b68613b9d2c3d7bd619841358201b9341
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
Everything gets default significance. Note: there's a QML custom parser
in usage, but that's not "real" parsing, and we document that QML
documents have to be from a trusted source.
Pick-to: 6.10 6.9 6.8
Fixes: QTBUG-136202
Change-Id: Ifbc5a2a33cc527c14dc5aa328da8f634f63df5f8
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
- Mark the global heades as insignificant, they don't contain any logic.
- Mark qv4serialize as critical: String data that might get passed to a
worker script might come from an untrusted context, and thus the
serialization process needs some basic care.
- Evertything else gets the default significant marker to indicate that
it has been reviewed.
Pick-to: 6.10 6.9 6.8
Fixes: QTBUG-136209
Change-Id: Ib820d551f687cbd41f0306d39552e55e8642a2b3
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
Mark the lexing / parsing code as security critical, because they are
data parsers. While _running_ QML code needs to assume trusted input, we
probably should not have this restriction on the parser, so that tools
like qmllint, qmlls and qdoc can safely pass any file to the parser,
without having to worry about security implications.
The criticality extends to qqmljskeywords_p.h, as we do custom bounds
checking in the functions defined there.
qqmljsastfwd_p is marked as insignificant, as it only contains fowrard
declarations and no logic at all.
The other marked files have the default level (significant).
QUIP: 23
Task-number: QTBUG-136966
Pick-to: 6.10 6.9 6.8
Change-Id: I1e44f346d91d6d66c8e9632f0dec4a11fffc935a
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
This relies heavily on the documented fact that we only support trusted
QML/JS content, meaning most files are only significant, not critical.
This also extends to the handling of qmlc files (as in
compilationunitmapper), as we store them in a user owned, non-shared
cache directory – so any vulnerability there would already mean that an
attacker has write-priviledges on user data.
An exception is ArrayBuffer, which can be used with arbitrary user data,
and should create a valid QBA.
Fixes: QTBUG-136970
Pick-to: 6.10 6.9 6.8
QUIP: 23
Change-Id: I22033fe6ab4acf8362a8183e25b92331d45cb32c
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
qtbase commit 92a65fdac69d7773b114584f1637946622cf4f72 changed what
happened when deleting a QWindow with child windows: they are now
deleted earlier, from ~QWindow rather than from ~QObject.
As a consequence, if the deletion of the child window triggers any
signal (such as QSGRenderContext::invalidated), the parent window
now receives it (while before, the code in ~QObject would disconnect
the parent window from all senders).
Fixed by explicit disconnects, using a std::array of
QMetaObject::Connections, like in QSortFilterProxyModel for instance.
Task-number: QTBUG-140170
Pick-to: 6.10 6.10.0
Change-Id: Id2c402d3121c8a3e6962cfed0afe1e90f5f14b3f
Reviewed-by: Marc Mutz <marc.mutz@qt.io>
Reviewed-by: Tor Arne Vestbø <tor.arne.vestbo@qt.io>
The QUnifiedTimer generally outlives the QML animation timer and needs
to be notified about that latter's deletion. Otherwise it will hold a
dangling pointer.
Pick-to: 6.10 6.9 6.8
Fixes: QTBUG-136629
Change-Id: I52b7f2f3ae716128e4acac628ea29477fc17b677
Reviewed-by: Sami Shalayel <sami.shalayel@qt.io>
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
Fix the module name, it seems that the author didn't realize the
mismatched case probably due to his case-insensitive file system. Also
add an artificial warning (assigning to inexisting property `invalid`)
to better distinguish the cases of "qmlls has no lint warnings to show
about the module import" and "qmlls crashed and thats why no lint
warnings are to be seen".
Task-number: QTBUG-119163
Change-Id: I32735dfa08417ca1dba11f4a4899a040907c4999
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
The introduction of QQmlCodeModelManager made the per-root-url build
path map of QQmlCodeModel redundant. Replace the per-root-url build
path map with a single list of build paths. The API is adjusted
accordingly:
- replace buildPathsForRootUrl() with buildPaths()
- replace setBuildPathsForRootUrl() with setBuildPaths()
- remove unused helpers for root-url matching
The build paths are now stored in a QStringList instead of a
QHash keyed by root URL. This simplifies the logic in
buildPathsForFileUrl(), which now falls back directly to settings
when no explicit build paths are set via the environment or the
commandline option of qmlls.
Also fix a test to actually write a settings file on disk, as we now
avoid reading settings values if no settings file was found.
Change-Id: I4e7f409a9cf1368cc6afa134a1386fd98833693f
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
Otherwise one gets errors like the following in standalone examples
build:
CMake Error at tools/svgtoqml/Qt6SvgToQmlMacros.cmake:65
(add_custom_command):
Error evaluating generator expression:
$
No target "Qt6::svgtoqml"
Because the examples now use the new qt_target_qml_from_svg()
function, which will try to reference a non-existent svgtoqml tool
target.
Change-Id: I16b10c4fa31bd73d0d95bbad371cde54f17c236a
Reviewed-by: Alexey Edelev <alexey.edelev@qt.io>
Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io>
Previously it was returning event->allPointsAccepted(), which can be
false even if the event was accepted, because the event points'
accepted states are set to false before delivery.
This fixes an issue where a MouseArea under a ContextMenu created by a
text editing control would emit its pressed signal when a MenuItem in a
popup window above it was clicked.
Fixes: QTBUG-139342
Change-Id: I4d4043929c316a8e70fecdb4a8b23b48f9442390
Reviewed-by: Mitch Curtis <mitch.curtis@qt.io>
Reviewed-by: Shawn Rutledge <shawn.rutledge@qt.io>
Allow QQmlDelegateModelItemMetaType to store any QQmlInstanceModel, but
also store the kind of model we're dealing with so that we can quickly
produce a QQmlDelegateModel or a QQmlTableInstanceModel when necessary.
This allows us to send the modelChanged() signal. We do not expect to
perform the same trickery that QQmlDelegateModel and
QQmlTableInstanceModel do more often. Therefore this solution does not
need to scale beyond those.
Pick-to: 6.10
Task-number: QTBUG-139941
Change-Id: Id6d2a8ae5f96b755a776eb354e6ae291314dbf7b
Reviewed-by: Sami Shalayel <sami.shalayel@qt.io>
If the delegate changes the model, those changes need to be visible in
the "model" property of the view. To this end, use
QQmlTableInstanceModel's model variant instead of the assigned one once
it has been synchronized.
The inner change signaling from the delegates to the view will be
added in a separate change.
Pick-to: 6.10
Task-number: QTBUG-139941
Change-Id: I1296fa2c886dad063b6b39defef56cb7faf1e943
Reviewed-by: Sami Shalayel <sami.shalayel@qt.io>
You can override a QObject method with a JavaScript function and take
away the JavaScript function later by swapping out objects. This should
not crash.
Pick-to: 6.10 6.9
Fixes: QTBUG-140074
Change-Id: I85b17f4f619235024d0f1a27b4ff4128c7a57083
Reviewed-by: Sami Shalayel <sami.shalayel@qt.io>
QQuickTreeView can't handle array or object models and therefore
we don't need to take special measures to propagate changes to arrays
back out of the view.
Change-Id: I0d0bc2ea04b5862c1a2eac71cb9f5195c5b07af6
Reviewed-by: Sami Shalayel <sami.shalayel@qt.io>
It's the length of the groupNames +/-1, depending on context. We often
want to count from 1 to end included, because the flags are offset by
one. That does not change the number of groups, though.
Change-Id: I6dfd4cc6f31bf85156a54b8ff3164e4275c7ff15
Reviewed-by: Sami Shalayel <sami.shalayel@qt.io>
Split the buildPathsForFileUrl method into a static helper method.
Future commits will use it to add early exits in buildPathsForFileUrl().
Change-Id: Icadb89e8ea04bcf3e07f6b163c2cf9213e7d5945
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
Amends 288e03a84d that removed the need
for the ParseMode struct, but didn't removed it.
Change-Id: Id5b05b1e3c4907c42f822b4722cc721fc39c5125
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
Unwrap any QJSValues right away and eliminate a copy of the model.
Pick-to: 6.10
Task-number: QTBUG-139941
Change-Id: I7f4a3ea97ae64cf0bb24aa032f8307c56bf7a597
Reviewed-by: Santhosh Kumar <santhosh.kumar.selvaraj@qt.io>
QSvgRenderer already obeys the QPen::isCosmetic() setting.
Now we add a ShapePath.cosmeticStroke property and try to support
cosmetic stroking both with SVG and with Shapes, in all renderers.
The curve renderer now starts with skinny triangles: each segment's end
vertices are passed to the vertex shader with their original positions,
and the shader uses the normal and the stroke width to expand the stroke
triangles outwards as needed. We always add triangles for end caps,
regardless whether they are square or round. We get rid of
addBevelTriangle and fix bevels, square caps and miters:
All three of these cases are done by drawing lines adjusted to the
right direction within the respective triangles. And to avoid seeing
rounded ends at any reasonable zoom level, we need the line equation
coefficients to take the line very far outside the actual triangles.
Square caps are really square: we render line segments in those three
triangles, not extensions of the adjacent curve or line.
Miters are also rendered as straight tangent lines.
The bevel's triangle is very short when the join is an acute angle,
and almost as tall as the full stroke width when the join is very
obtuse. But when the triangle is short, we need to diminish the stroke
width rendered in the fragment shader so that the center of the stroke
falls on the inner corner of that triangle, and the edge of the stroke
is rendered along the outer bevel edge rather than trying to go outside.
That's achieved by multiplying the stroke width by the cosine of half
the total angle, AKA the dot product. That is now in the normalExt.z
vertex attribute.
Normals (normalExt.xy) can be premultiplied rather than normalized:
in fact some of them already have length > 1.
In qsgbatchrenderer, Renderer::prepareAlphaBatches() breaks batches
when overlaps occur. Now that we stroke lines with vertices that
represent them as zero-width lines (and thus Element.bounds has
the same x or y coordinates on both corners), we must consider lines
right on top of each other to be overlapping: e.g. the stacks of
horizontal (dashed) line segments in paint-stroke-202-t.svg must be
in separate batches.
At the time QQuickShape::updatePaintNode() is called, the available
transform node (from UpdatePaintNodeData or an individual node's parent
which is a transform node) does not contain the scaling factor that we
need to allow for the stroke width to be adjusted for cosmetic stroking.
But in QQuickShapePrivate::sync(), windowToItemTransform() is known, and
from bde55ad574 we have a precedent in
QSGCurveStrokeMaterialShader::updateUniformData() for using the square
root of the matrix determinant as a scaling approximation (ok when the
scaling is uniform). QQuickShapeSoftwareRenderer::setNode() was already
adjusting a path's bounding rect by its stroke width, and we need a
multiplicative factor there to account for cosmetic stroking, to avoid
excessive clipping in the software renderer. So now we have another use
for the triangulationScale that was introduced in
bcfcaeb87b.
When QQShapeGenericRenderer is used (rendererType == GeometryRenderer),
and any ShapePath has cosmeticStroke, we need it to re-triangulate
whenever scale changes. QQuickShapeGenericRenderer::triangulateStroke()
calls QTriangulatingStroker::setInvScale(1 / triangulationScale), and
QTriangulatingStroker::process() multiplies its m_width by the inverse
scale that was set (since 2009). So this tells us that the intended
meaning of triangulationScale is the inverse of the factor by which we
multiply the pen width. And when QQShapeGenericRenderer is in use,
and there are cosmetic strokes, QQuickShape::itemChange triggers
re-triangulation on changes in scale.
When setting the QQuickShapeCurveRenderer::DebugWireframe debug
visualization flag, we need to repeat the vertex shader calculations to
expand the "skinny" triangles according to stroke width, just as we do
with the actual stroking vertices.
For now customTriangulator2 remains as legacy code, to be removed later
on. It's poorly named, and returns a list of TriangleData which need to
be iterated afterwards ("fix it in post"), looking up the
QQuadPath::Element again in that second loop, which can go wrong when a
path contains a move command. (For example, it could calculate a bevel
between the end-tangent of one subpath and the start-tangent of the
next.) customTriangulator2() was called from only one place,
processStroke(), to which addStrokeTriangleCallback() is given: so the
new way is to just call the callback directly as soon as we've
calculated each triangle. Because we are not iterating again afterwards,
the switch(type) is not needed in that case, and we no longer need
TriangleData::type, except for supporting customTriangulator2().
[ChangeLog][QtQuick][Shapes] ShapePath now has a cosmeticStroke
property which causes strokeWidth to be constant despite scaling.
Set the environment variable QT_QUICKSHAPES_STROKE_EXPANDING to 1 to
enable an experimental method of expanding strokes in the vertex shader,
minimizing the need to re-triangulate when strokeWidth changes.
Task-number: QTBUG-124638
Change-Id: I4eac0ddcd6f623b79bc70c766ff116f4b77736cb
Reviewed-by: Paul Olav Tvete <paul.tvete@qt.io>
Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io>
If the model contents change we need to notify. This enables the signal
propagation for Instantiator, Repeater, ListView, and GridView.
Pick-to: 6.10
Task-number: QTBUG-139941
Change-Id: I384dcd296068ca7abfd1cad9fe662ae6e8938338
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
Use the common pattern for setModel() and use
QQmlDelegateModel::createForView(). In turn, remove the hacky
effectiveReset mechanism. Also remove the "initial 0" optimization.
There's barely a point to this since the default model is 1. You had to
go out of your way to trigger it.
Change-Id: I80030ef36b82b312e6b7600616eebf2615a2f3d8
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
Reviewed-by: Sami Shalayel <sami.shalayel@qt.io>
Instantiator is almost entirely useless without QQmlDelegateModel. The
only thing you can do is give it a list of pre-constructed objects which
it then reflects in its own "objects" property. I don't see a reasonable
use case for such a thing.
[ChangeLog][QtQml] If you build with -no-feature-qml-delegate-model,
along with most functionality of QtQml.Models, Instantiator will also
be missing now. It makes no sense to provide an Instantiator that can't
actually instantiate anything.
Change-Id: If0c31346c43ebea21abf1aef53dc3a76f96f6fbd
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
When writing through a delegate, the original data is already written.
We are only missing change signals.
Pick-to: 6.10
Task-number: QTBUG-139941
Change-Id: I3124a8dc5852e3858a1e9bd9b74c07608bb5e446
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
Without this we effectively soft-leak the contents of any
SimpleArrayData whenever we truncate it. Only when the array was either
completely dropped or re-filled would the extra objects be reclaimed.
Task-number: QTBUG-139025
Pick-to: 6.10 6.9 6.8
Change-Id: I88e9dc3ea8ec57c1de71b7b5417ebcfbaa75bb61
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
The section item has not been removed or added to the section cache
in all cases when the corresponding delegate item has been moved out
of the visible area, either during flick or scroll. This happens in
a case where the delegate item has been requested to be removed (as
it goes out of the visible area) from the list view, but it's not
released from the delegate model due to its caching mechanism. When
an item is outside the visible area, releaseItem() is triggered,
intended to free the item and its sections. The problem arises when
releaseItem() calls QQmlInstanceModel::release(), which caches the
item in the delegate model, but does not free the section. This
prevents the section item from being released properly.
This patch releases the section item whenever removeItem is
triggered from the list view, which happens when the delegate item
is moved out of the visible area.
Fixes: QTBUG-137172
Pick-to: 6.10 6.9 6.8 6.5
Change-Id: Ib7e78309e076e76750b03f3238a7501563a3962a
Reviewed-by: Oliver Eftevaag <oliver.eftevaag@qt.io>
Also ifndef QT_NO_DEBUG_STREAM around the QQuadPath debug op.
Both will be omitted from the build if QT_NO_DEBUG_STREAM is set.
Change-Id: Ie86577ba61fc4f2b118d7e0a2b1ab702b318a473
Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io>
QT_NAMESPACE is a public API to access the namespace from the Qt::Core
target, replacing the private _qt_namespace property
Pick-to: 6.10
Change-Id: I013be62bbe9068e0a9eb77ea2ffb40ac2f2f1b2e
Reviewed-by: Alexandru Croitor <alexandru.croitor@qt.io>
As part of the comment generated by svgtoqml, we would include the
entire file path as it was provided in the arguments. With the
introduction of the automatic svgtoqml build step, this argument
will now include the full absolute path.
Since the QML file is embedded in the binary, this caused internal
file paths from our build farm to leak into the binaries, triggering
an alert in the QA system.
Change-Id: Iecffb5cfcf1cee127186b2c5d2e21e2ccc47f48a
Reviewed-by: Samuli Piippo <samuli.piippo@qt.io>
The Qt SVG parser depends on having a QGuiApplication in order
to load e.g. fonts. We want to prefer the default plugin on
desktop platforms, since you will then be able to use SVGs that
depend on system fonts as well.
However, in a host build, where there are no GUI-enabled QPA
plugins, we fall back to offscreen, which has some font
support but which does not depend on a window manager.
Task-number: QTBUG-139976
Change-Id: Ia9a5239c3d16f1daa4ad68d66412f519109361c2
Reviewed-by: Eirik Aavitsland <eirik.aavitsland@qt.io>
Use modern string literals and replace #if-defery by a check on
QOperatingSystemVersion::currentType().
Pick-to: 6.10 6.9
Change-Id: I319b6c7665a4c4cadd7d1e711d8527f79ca35261
Reviewed-by: Mitch Curtis <mitch.curtis@qt.io>
Amends 9601b74dab
The example no longer runs with Qt 6.9 or older as it uses the new
(Horizontal|Vertical)HeaderViewDelegate types.
Change-Id: I8430f4e9a48ddc9f72b20a4e998fde21480c4032
Pick-to: 6.10.0 6.10
Reviewed-by: Mitch Curtis <mitch.curtis@qt.io>
ScopedStackFrame has no locals and we don't want to crash if we manage
to run the GC while e.g. initializing a component.
Amends commmit 2d016a2653
Fixes: QTBUG-140057
Pick-to: 6.10.0 6.10 6.9 6.8
Change-Id: I7aeb39d6cb1f0ca0a661b8cfa2e7c159f968e224
Reviewed-by: Sami Shalayel <sami.shalayel@qt.io>
It's only valid in the MetaTypesStackFrame and we should use its
accessor.
Amends commit 2d016a2653.
Change-Id: I6900fc01a0af2acf29324e54c0206c84f032c22d
Reviewed-by: Sami Shalayel <sami.shalayel@qt.io>
The dynamic metaobject of QQmlDelegateModelAttached likes to override
them, which produces warnings.
Amends commit 9355b7173c.
Pick-to: 6.10 6.9 6.8
Change-Id: Iaf0d6627fe6c373177f7f28a750fa2baf5fa2a7e
Reviewed-by: Sami Shalayel <sami.shalayel@qt.io>
The components used by QQmlSortFilterProxyModel (such as
QQmlSorterCompositor) require access to the
QQmlSortFilterProxyModelPrivate members, which are not possible as
of now, and thus it would be better to keep it separate and,
include it wherever required.
Pick-to: 6.10
Change-Id: I4159a0ef988dc0a67dfb2ed8443137fa91e5a5d9
Reviewed-by: Mitch Curtis <mitch.curtis@qt.io>
Semih Yavuz
MohammadHossein Qanbari
Olivier De Cannière
Mitch Curtis
Alexey Zerkin
Fabian Kosmale
David Faure
Santhosh Kumar
Ulf Hermann
Sami Shalayel
Alexandru Croitor
Andreas Hartmetz
Assam Boudjelthia
Shawn Rutledge
Tim Blechmann
Eskil Abrahamsen Blomfeldt
Friedemann Kleint
Sze Howe Koh