diff options
| author | Shawn Rutledge <shawn.rutledge@qt.io> | 2025-09-23 16:12:39 +0200 |
|---|---|---|
| committer | Shawn Rutledge <shawn.rutledge@qt.io> | 2025-09-26 18:23:43 +0200 |
| commit | ad6afabdb244cf9bab9dc2767442c3fe17b1cf13 (patch) | |
| tree | ca15ad99a9b4e982dd27178b6048184ae33f8342 /src/plugins/platforminputcontexts/compose/qcomposeplatforminputcontext.cpp | |
| parent | f2319ada91a27b0fc08646be178a9c6193c7e0e1 (diff) | |
CRA review: plugins/platforminputcontexts/*
The files that we maintain by hand are marked as significant.
- D-Bus is security critical, but the Qt I-Bus implementation is merely
a user, and does not do any parsing or communication on its own. The
last known vulnerability CVE-2019-14822 was in the server, not in Qt.
- Likewise, QComposeInputContext uses xkb_compose functionality, so any
risk is there, not in Qt.
- Both of these plugins work with keyboard events, but we do not
consider that a risk in general.
- The remaining source files in the ibus directory are auto-generated,
with a comment explaining that, so we do not modify them. If a
vulnerability were found, we would need to fix qdbusxml2cpp first
and then re-generate these.
QUIP: 23
Fixes: QTBUG-135725
Pick-to: 6.10 6.8
Change-Id: Ie4b0ef3d8151406ab5ddc758098d7871f320fe89
Reviewed-by: Liang Qi <liang.qi@qt.io>
Diffstat (limited to 'src/plugins/platforminputcontexts/compose/qcomposeplatforminputcontext.cpp')
| -rw-r--r-- | src/plugins/platforminputcontexts/compose/qcomposeplatforminputcontext.cpp | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/plugins/platforminputcontexts/compose/qcomposeplatforminputcontext.cpp b/src/plugins/platforminputcontexts/compose/qcomposeplatforminputcontext.cpp index 3e741890768..a32d3556831 100644 --- a/src/plugins/platforminputcontexts/compose/qcomposeplatforminputcontext.cpp +++ b/src/plugins/platforminputcontexts/compose/qcomposeplatforminputcontext.cpp @@ -1,5 +1,7 @@ // Copyright (C) 2019 The Qt Company Ltd. // SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only +// Qt-Security score:significant reason:default + #include "qcomposeplatforminputcontext.h" #include <QtCore/QCoreApplication> |