| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
We assume that QML or JS code comes from a trusted source. Therefore,
most files are deemed to be significant even if they parse data. This
includes the source code itself but also the associated metadata or
cache files.
However, the QML compiler also generates C++ code. Extra care needs to
be taken with the generator as a vulnerability there could propagate and
have a disproportionate effect on the program's security. It is marked
as critical.
QUIP: 23
Fixes: QTBUG-136195
Pick-to: 6.10 6.9 6.8
Change-Id: I70630361ec8e9cb3969f78a3fdf36a41334a33b3
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
|
| |
|
|
|
|
|
|
|
| |
We already do this for return types, but it's fatal on any type.
Pick-to: 6.9
Fixes: QTBUG-135342
Change-Id: I7aee2a19ffcd39d2707eceb34b5073057d8b5ebb
Reviewed-by: Olivier De Cannière <olivier.decanniere@qt.io>
|
| |
|
|
|
|
|
|
|
|
| |
There is no need anymore to create a new QQmlJSRegisterContentPrivate
just to add a storage type. Furthermore, we should record the
generalization origin when generalizing storage.
Task-number: QTBUG-124670
Change-Id: Ib1413e645fbc927806f85c7aa235c95a4cbfaa96
Reviewed-by: Olivier De Cannière <olivier.decanniere@qt.io>
|
| |
|
|
|
|
|
|
|
| |
We create a new QQmlJSRegisterContent in all the cases where it's used
anyway.
Task-number: QTBUG-124670
Change-Id: I4315b0485569c2a7fb77a78ab9d25f88d2371d96
Reviewed-by: Olivier De Cannière <olivier.decanniere@qt.io>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This is the central piece of the refactoring. Instead of re-writing the
QQmlJSScopes on adjustment we now rewrite the QQmlJSRegisterContents.
The main benefit of this is that we can locally link
QQmlJSRegisterContents together without invoking QQmlJSTypeResolver. The
other benefit is that we gain more control over where the re-written
types show up. QQmlJSScope is stored in many places that should really
not be re-written. QQmlJSRegisterContent is only used locally when
analyzing a binding or function. Finally, we can now chain the type
adjustments with other operations on QQmlJSRegisterContents, without
restrictions.
This makes a few methods of QQmlJSTypeResolver obsolete. Those will be
removed in a separate step.
In order to get this right, we need to deviate from the notion that
every read register is either a rename or a conversion. Rather, we must
pass any "as-is" read of a register through that way. We rely on those
to be re-written when the original register is.
Task-number: QTBUG-124670
Change-Id: I0d968dfe495b82d9d9f67d598447bd2ad5bdcd04
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
Reviewed-by: Olivier De Cannière <olivier.decanniere@qt.io>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
We want an easy way to hold pointers to other QQmlJSRegisterContents in
QQmlJSRegisterContent. Furthermore, copying a QQmlJSRegisterContent so
far is very expensive. Solve both problems by introducing the PIMPL
pattern with a shared d-pointer.
This also changes the equality semantics of QQmlJSRegisterContent. Two
QQmlJSRegisterContents are only equal if they contain the same d-pointer
now, not if their contents are otherwise equal. However, since we
generally don't rely on immediate equality of QQmlJSRegisterContent
anyway, this is not a problem. QQmlJSTypeResolver::equals() still works.
There is one place where the equality was used, though. That one is
adapted.
Furthermore, we now want to keep the register contents in a pool that's
automatically cleared when we're done with our analysis. Therefore the
creation methods cannot be static anymore and storedIn() as well as
castTo() need to go through the pool as well.
Task-number: QTBUG-124670
Change-Id: I0a51b609fc769ccb33c1d82930bda83c2a40e1a5
Reviewed-by: Olivier De Cannière <olivier.decanniere@qt.io>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Currently only one DiagnosticMessage can be stored at a time when using
the compiler. However, we want to be able to show more than one to the
user.
Therefore, use a list that gets passed inside the compiler instead of a
pointer to the sole error.
This also means that the error is valid by its very existence. There is
no need to check validity explicitly anymore.
Task-number: QTBUG-127624
Change-Id: I356db917b86703b508dc1ad52de7825d82eafd71
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
Reviewed-by: Sami Shalayel <sami.shalayel@qt.io>
|
|
|
Add a separate pass to populate the stored types and only run that after
we're done with all the type propagation and optimization.
Task-number: QTBUG-124670
Change-Id: I740063908b22684f5d2c72d6261fad98850d8636
Reviewed-by: Olivier De Cannière <olivier.decanniere@qt.io>
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
|
