d2weber

@adbenitez@mastodon.social Currently we cannot use PlainText, because this would break anchor links too.

@dreddie@social.vivaldi.net What in the code makes you think it loads an external resource, the resource() call? As far as I understand this only loads local resources: https://codebrowser.dev/data/symbol.html?root=../qt6/&ref=_ZNK13QTextDocument8resourceEiRK4QUrl

@adbenitez@mastodon.social yes in (3/3) I pointed out that there is a PlainText option, but that disables all rich text features.

@dreddie@social.vivaldi.net I investigated background-image and it doesn't appear to fetch remote URLs. Looking at the source, background-image resolution happens during HTML parsing via applyBackgroundImage(), which just stores the URL without fetching. See: https://codebrowser.dev/qt6/qtbase/src/gui/text/qtexthtmlparser.cpp.html#_ZN19QTextHtmlParserNode20applyBackgroundImageERK7QStringPK13QTextDocument In contrast, tags are resolved during rendering when QML's network-enabled image loader (QQuickPixmap) is active. I confirmed this empirically, background-image with a remote URL didn't trigger a network request while did.

(3/3) For Qt5 on the other hand, tags that contain upper case letters are not rendered. If you don't need any rich text formatting, you can set the text format of the component to PlainText (which is not the default).

(2/3) A malicious sender could embed an `` tag and learn the recipient's IP address the moment the message is previewed in the list of chats. Minimal qml to reproduce: Text { text: '' } Our mitigation is to escape image tags before display from C++ s.replace(QRegularExpression("<(\\s*img)", QRegularExpression::CaseInsensitiveOption), "<\\1"); If you use Qt6 the regular expression is mandatory to be case insensitive.

(1/3) Default Qt rich text fetches remote images:
While working on DeltaTouch, we discovered that Qt's `Text` and `Label` components by default automatically fetch remote resources when rendering HTML content containing `` tags. This happens immediately when the component is displayed, no user interaction required. For our messenger where all network traffic should be routed through the DeltaChat core library, this was an unexpected privacy leak. #qt

Just realised that “Rustacean” can be accurately translated to German: “Rustentier”. (Crustacean can be translated to Krustentier)

#rustlang #rustentier