Groups > linux.debian.bugs.dist > #1179506

Bug#1057755: Qt WebEngine Security Support In Stable

From	Dmitry Shachnev <mitya57@debian.org>
Newsgroups	linux.debian.bugs.dist, linux.debian.devel.release
Subject	Bug#1057755: Qt WebEngine Security Support In Stable
Date	2023-12-20 15:10 +0100
Message-ID	<HN5qN-eStE-1@gated-at.bofh.it> (permalink)
References	(1 earlier) <HLNPj-e5sc-1@gated-at.bofh.it> <HLWpA-eaK0-9@gated-at.bofh.it> <HMpKW-esBG-21@gated-at.bofh.it> <HIy0p-c3Z0-1@gated-at.bofh.it> <HMpKW-esBG-21@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Mon, Dec 18, 2023 at 10:34:17AM -0700, Soren Stoutner wrote:
> Adrian,
> 
> On Sunday, December 17, 2023 3:11:10 AM MST Adrian Bunk wrote:
> > I don't know what's going on with the headers, but there is a reason why
> > the dependency gets generated:
> > 
> > $ nm -D /usr/bin/angelfish-webapp | grep Qt_5_PRIVATE_API
> >                  U
> > _ZN22QQuickWebEngineProfile16downloadFinishedEP27QQuickWebEngineDownloadIte
> > m@Qt_5_PRIVATE_API U
> > _ZN22QQuickWebEngineProfile17downloadRequestedEP27QQuickWebEngineDownloadIt
> > em@Qt_5_PRIVATE_API $
> 
> The public version of this class is found in:
> 
> qquickwebengineprofile.h
> 
> Which is part of the qtwebengine5-dev package.
> 
> Private versions of this class can be found in:
> 
> qquickwebengineprofile_p.h
> qquickwebenginedownloaditem_p.h
> 
> which are part of the qtwebengine5-private-dev package.
> 
> This does beg the question of how angelfish builds against this private header 
> without build-depending on qtwebengine5-private-dev.  Perhaps that is an 
> answer that one of the angelfish maintainers, Pirate or Nilesh, can answer.

QQuickWebEngineProfile is public. However, QQuickWebEngineDownloadItem, which
is the argument of downloadFinished() and downloadRequested(), is private.
In Qt 6 this class is renamed to QQuickWebEngineDownloadRequest, but it is
still private for some reason.

Angelfish includes the private header when building against Qt 6, and uses a
stub header for Qt 5, as can be seen from the following code:

  #if QT_VERSION < QT_VERSION_CHECK(6, 0, 0)
  #include "qquickwebenginedownloaditem.h"
  using DownloadItem = QQuickWebEngineDownloadItem;
  #else
  #include <private/qquickwebenginedownloadrequest_p.h>
  using DownloadItem = QQuickWebEngineDownloadRequest;
  #endif

Using a stub header results in dependency on private ABI just like including
a normal header.

I think that angelfish developers should ask Qt upstream to make that class
public, explaining how and why they use it.

--
Dmitry Shachnev

Thread

Bug#1057755: qt6-webengine: Support security updates in stable Soren Stoutner <soren@stoutner.com> - 2023-12-08 02:40 +0100
  Bug#1057755: Qt WebEngine Security Support In Stable Patrick Franz <deltaone@debian.org> - 2023-12-13 21:20 +0100
    Re: Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-13 22:20 +0100
      Bug#1057755: Qt WebEngine Security Support In Stable Patrick Franz <deltaone@debian.org> - 2023-12-13 23:10 +0100
        Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-14 00:50 +0100
          Bug#1057755: Qt WebEngine Security Support In Stable Mike Gabriel <sunweaver@debian.org> - 2023-12-14 09:10 +0100
      Re: Bug#1057755: Qt WebEngine Security Support In Stable Adrian Bunk <bunk@debian.org> - 2023-12-14 02:40 +0100
        Re: Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-14 05:00 +0100
          Re: Bug#1057755: Qt WebEngine Security Support In Stable Paul Gevers <elbrus@debian.org> - 2023-12-14 08:40 +0100
            Re: Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-14 08:50 +0100
              Re: Bug#1057755: Qt WebEngine Security Support In Stable Paul Gevers <elbrus@debian.org> - 2023-12-14 09:10 +0100
                Re: Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-14 21:00 +0100
          Re: Bug#1057755: Qt WebEngine Security Support In Stable Adrian Bunk <bunk@debian.org> - 2023-12-14 13:40 +0100
          Bug#1057755: Qt WebEngine Security Support In Stable Alberto Garcia <berto@igalia.com> - 2023-12-15 02:30 +0100
            Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-16 21:30 +0100
              Bug#1057755: Qt WebEngine Security Support In Stable Adrian Bunk <bunk@debian.org> - 2023-12-17 00:20 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-17 00:40 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Patrick Franz <deltaone@debian.org> - 2023-12-17 01:00 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-17 01:30 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-17 02:10 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Adrian Bunk <bunk@debian.org> - 2023-12-17 11:20 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-18 18:40 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Dmitry Shachnev <mitya57@debian.org> - 2023-12-20 15:10 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-20 20:30 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Dmitry Shachnev <mitya57@debian.org> - 2023-12-20 21:30 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-20 22:10 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Dmitry Shachnev <mitya57@debian.org> - 2023-12-21 11:10 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-21 21:00 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Dmitry Shachnev <mitya57@debian.org> - 2023-12-21 22:00 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-22 23:00 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2024-01-09 02:50 +0100
                Bug#1057755: Qt WebEngine Security Support In Stable Dmitry Shachnev <mitya57@debian.org> - 2023-12-20 14:40 +0100
  Bug#1057755: Qt WebEngine Security Support In Stable Adrian Bunk <bunk@debian.org> - 2023-12-15 00:30 +0100
  Bug#1057755: Qt WebEngine Security Support In Stable Adrian Bunk <bunk@debian.org> - 2023-12-15 09:50 +0100
    Bug#1057755: Qt WebEngine Security Support In Stable Moritz Muehlenhoff <jmm@inutil.org> - 2023-12-15 20:30 +0100
  Bug#1057755: Qt WebEngine Security Support In Stable Ratchanan Srirattanamet <ratchanan@ubports.com> - 2023-12-23 15:10 +0100
  Bug#1057755: Qt WebEngine Security Support In Stable Adrian Bunk <bunk@debian.org> - 2023-12-24 12:00 +0100
    Bug#1057755: Qt WebEngine Security Support In Stable Soren Stoutner <soren@stoutner.com> - 2023-12-26 20:00 +0100

csiph-web