QML: Explicitly reject malformed file imports

You cannot just pass a resource path or absolute path. We expect a URL
after all. A relative path is a relative URL, so you can pass that.

Fixes: QTBUG-98181
Change-Id: I010bc08b8cb0ff06712f7b0353955bee96ae36c1
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
(cherry picked from commit 1240a440f29762850a9206bdf9961cebe015c1fa)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>

1 files changed, 12 insertions, 0 deletions

diff --git a/src/qml/qml/qqmlimport.cpp b/src/qml/qml/qqmlimport.cpp
index c5f5811755..d97c35618c 100644
--- a/src/qml/qml/qqmlimport.cpp
+++ b/src/qml/qml/qqmlimport.cpp
@@ -1393,6 +1393,18 @@ QTypeRevision QQmlImportsPrivate::addFileImport(
         const QString& uri, const QString &prefix, QTypeRevision version, uint flags,
         QQmlImportDatabase *database, QList<QQmlError> *errors)
 {
+    if (uri.startsWith(Slash) || uri.startsWith(Colon)) {
+        QQmlError error;
+        const QString fix = uri.startsWith(Slash) ? QLatin1String("file:") + uri
+                                                  : QLatin1String("qrc") + uri;
+        error.setDescription(QQmlImportDatabase::tr(
+                                 "\"%1\" is not a valid import URL. "
+                                 "You can pass relative paths or URLs with schema, but not "
+                                 "absolute paths or resource paths. Try \"%2\".").arg(uri, fix));
+        errors->prepend(error);
+        return QTypeRevision();
+    }
+
     Q_ASSERT(errors);
 
     QQmlImportNamespace *nameSpace = importNamespace(prefix);