[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Bug#1057755: Qt WebEngine Security Support In Stable



On Mon, Dec 18, 2023 at 10:34:17AM -0700, Soren Stoutner wrote:
> Adrian,
> 
> On Sunday, December 17, 2023 3:11:10 AM MST Adrian Bunk wrote:
> > I don't know what's going on with the headers, but there is a reason why
> > the dependency gets generated:
> > 
> > $ nm -D /usr/bin/angelfish-webapp | grep Qt_5_PRIVATE_API
> >                  U
> > _ZN22QQuickWebEngineProfile16downloadFinishedEP27QQuickWebEngineDownloadIte
> > m@Qt_5_PRIVATE_API U
> > _ZN22QQuickWebEngineProfile17downloadRequestedEP27QQuickWebEngineDownloadIt
> > em@Qt_5_PRIVATE_API $
> 
> The public version of this class is found in:
> 
> qquickwebengineprofile.h
> 
> Which is part of the qtwebengine5-dev package.
> 
> Private versions of this class can be found in:
> 
> qquickwebengineprofile_p.h
> qquickwebenginedownloaditem_p.h
> 
> which are part of the qtwebengine5-private-dev package.
> 
> This does beg the question of how angelfish builds against this private header 
> without build-depending on qtwebengine5-private-dev.  Perhaps that is an 
> answer that one of the angelfish maintainers, Pirate or Nilesh, can answer.

QQuickWebEngineProfile is public. However, QQuickWebEngineDownloadItem, which
is the argument of downloadFinished() and downloadRequested(), is private.
In Qt 6 this class is renamed to QQuickWebEngineDownloadRequest, but it is
still private for some reason.

Angelfish includes the private header when building against Qt 6, and uses a
stub header for Qt 5, as can be seen from the following code:

  #if QT_VERSION < QT_VERSION_CHECK(6, 0, 0)
  #include "qquickwebenginedownloaditem.h"
  using DownloadItem = QQuickWebEngineDownloadItem;
  #else
  #include <private/qquickwebenginedownloadrequest_p.h>
  using DownloadItem = QQuickWebEngineDownloadRequest;
  #endif

Using a stub header results in dependency on private ABI just like including
a normal header.

I think that angelfish developers should ask Qt upstream to make that class
public, explaining how and why they use it.

--
Dmitry Shachnev

Attachment: signature.asc
Description: PGP signature


Reply to: