Merge "Merge remote-tracking branch 'origin/5.12.4' into 5.12"

9 files changed, 115 insertions, 25 deletions

diff --git a/.qmake.conf b/.qmake.conf
index b6a222b54..18329bbf8 100644
--- a/.qmake.conf
+++ b/.qmake.conf
@@ -5,4 +5,4 @@ QTWEBENGINE_OUT_ROOT = $$shadowed($$PWD)
 load(qt_build_config)
 CONFIG += warning_clean
 
-MODULE_VERSION = 5.12.3
+MODULE_VERSION = 5.12.4
diff --git a/dist/changes-5.12.4 b/dist/changes-5.12.4
new file mode 100644
index 000000000..986c6871b
--- /dev/null
+++ b/dist/changes-5.12.4
@@ -0,0 +1,77 @@
+Qt 5.12.4 is a bug-fix release. It maintains both forward and backward
+compatibility (source and binary) with Qt 5.12.0 through 5.12.3.
+
+For more details, refer to the online documentation included in this
+distribution. The documentation is also available online:
+
+https://doc.qt.io/qt-5/index.html
+
+The Qt version 5.12 series is binary compatible with the 5.11.x series.
+Applications compiled for 5.11 will continue to run with 5.12.
+
+Some of the changes listed in this file include issue tracking numbers
+corresponding to tasks in the Qt Bug Tracker:
+
+https://bugreports.qt.io/
+
+Each of these identifiers can be entered in the bug tracker to obtain more
+information about a particular change.
+
+****************************************************************************
+*                              Qt 5.12.4 Changes                           *
+****************************************************************************
+
+General
+-------
+
+ - [QTBUG-57729, QTBUG-75539] Fixed automatic NTLM authentication, and added
+   support for --auth-server-whitelist.
+ - [QTBUG-60203] Fixed setting referer HTTP header in request interceptor.
+ - [QTBUG-74251, QTBUG-74698] Normalize download paths on Windows.
+ - [QTBUG-74864] Fixed resolving relative URLs with custom schemes.
+ - [QTBUG-75092] Fixed printing in landscape orientation.
+ - [QTBUG-75212] Added support for building with VS 2019.
+ - [QTBUG-75304] Fixed running non-MainWorld DocumentCreations scripts when
+   JavaScript is disabled.
+ - [QTBUG-75465] Fixed -no-gui builds.
+ - [QTBUG-75629] Fixed crash on Linux when pulseaudio had no devices.
+ - [QTBUG-76045] Fixed desktop capture on macOS.
+ - [QTBUG-73799] Try different versions when creating a CoreProfile context on macOS
+
+Chromium
+--------
+
+ - Security fixes from Chromium up to version 74.0.3729.157, including:
+
+    - CVE-2019-5805
+    - CVE-2019-5806
+    - CVE-2019-5808
+    - CVE-2019-5814
+    - CVE-2019-5815
+    - CVE-2019-5818
+    - CVE-2019-5819
+    - CVE-2019-5820
+    - CVE-2019-5821
+    - CVE-2019-5822
+    - CVE-2019-5823
+    - CVE-2019-5824
+    - CVE-2019-5825
+    - CVE-2019-5826
+    - CVE-2019-5827
+    - security issue 894933
+    - security issue 908669
+    - security issue 931949
+    - security issue 937663
+    - security issue 939316
+    - security issue 940205
+    - security issue 949015
+    - security issue 951322
+
+Qt WebEngine Widgets
+--------------------
+
+ - [QTBUG-75131, QTBUG-75175] Fixed QWebEngineView::setPage not deleting
+   old page.
+ - [QTBUG-75547] Fixed crash on exit when page and profile were deleted in
+   the wrong order.
+ - [QTBUG-75566] Added path validation to QWebEngineDownloadItem::setPath().
diff --git a/src/3rdparty b/src/3rdparty
-Subproject 8d400b021591c0b619269317e239d8a750ace14
+Subproject bd792030e194a0bcce4defbf2298041244b5412
diff --git a/src/core/configure.json b/src/core/configure.json
index fc23785df..6dccd1644 100644
--- a/src/core/configure.json
+++ b/src/core/configure.json
@@ -327,6 +327,11 @@
         "webengine-arm-thumb" : {
             "label": "thumb instruction set",
             "type": "hasThumbFlag"
+        },
+        "webengine-noexecstack" : {
+            "label": "linker supports -z noexecstack",
+            "type": "linkerSupportsFlag",
+            "flag": "-z,noexecstack"
         }
     },
 
@@ -658,6 +663,11 @@
             "label": "Thumb instruction set",
             "condition": "config.linux && features.webengine-embedded-build && arch.arm && tests.webengine-arm-thumb",
             "output": [ "privateFeature" ]
+        },
+        "webengine-noexecstack": {
+            "label": "linker supports -z noexecstack",
+            "condition": "config.unix && tests.webengine-noexecstack",
+            "output": [ "privateFeature" ]
         }
     },
 
diff --git a/src/core/core_chromium.pri b/src/core/core_chromium.pri
index e92dd60ff..60eaf1f06 100644
--- a/src/core/core_chromium.pri
+++ b/src/core/core_chromium.pri
@@ -33,8 +33,6 @@ RCC_DIR = $$OUT_PWD/$$getConfigDir()/.rcc
 # whenever we are cross compiling.
 qtConfig(webengine-embedded-build): DEFINES += QTWEBENGINE_EMBEDDED_SWITCHES
 
-qtConfig(egl): CONFIG += egl
-
 INCLUDEPATH += $$PWD $$PWD/api
 
 SOURCES = \
diff --git a/src/core/core_common.pri b/src/core/core_common.pri
index 5f9f3c4f6..01f40eb09 100644
--- a/src/core/core_common.pri
+++ b/src/core/core_common.pri
@@ -2,8 +2,8 @@
 # gyp/ninja will take care of the compilation, qmake/make will finish with linking and install.
 
 TARGET = QtWebEngineCore
-QT += qml quick
-QT_PRIVATE += quick-private gui-private core-private webenginecoreheaders-private
+QT += qml-private quick-private gui-private core-private
+QT_PRIVATE += webenginecoreheaders-private
 
 qtConfig(webengine-geolocation): QT += positioning
 qtConfig(webengine-webchannel): QT += webchannel
diff --git a/src/core/core_headers.pro b/src/core/core_headers.pro
index 21b5d58c3..cd5352eb7 100644
--- a/src/core/core_headers.pro
+++ b/src/core/core_headers.pro
@@ -1,5 +1,6 @@
 TARGET = QtWebEngineCore
 CONFIG += no_private_module header_module internal_module no_plist
+QT -= core gui
 MODULE = webenginecoreheaders
 MODULE_CFG_FILE = qtwebenginecore-config
 load(qt_module)
diff --git a/src/core/core_module.pro b/src/core/core_module.pro
index 3b5d37f29..9bd56f9de 100644
--- a/src/core/core_module.pro
+++ b/src/core/core_module.pro
@@ -10,8 +10,6 @@ linking_pri = $$OUT_PWD/$$getConfigDir()/$${TARGET}.pri
     error("Could not find the linking information that gn should have generated.")
 }
 
-load(qt_module)
-
 api_library_name = qtwebenginecoreapi$$qtPlatformTargetSuffix()
 api_library_path = $$OUT_PWD/api/$$getConfigDir()
 
@@ -25,19 +23,24 @@ isEmpty(NINJA_LIBS): error("Missing library files from QtWebEngineCore linking p
 NINJA_OBJECTS = $$eval($$list($$NINJA_OBJECTS))
 # Do manual response file linking for macOS and Linux
 
-RSP_FILE = $$OUT_PWD/$$getConfigDir()/$${TARGET}.rsp
-for(object, NINJA_OBJECTS): RSP_CONTENT += $$object
-write_file($$RSP_FILE, RSP_CONTENT)
-macos:LIBS_PRIVATE += -Wl,-filelist,$$shell_quote($$RSP_FILE)
-linux:LIBS_PRIVATE += @$$RSP_FILE
+RSP_OBJECT_FILE = $$OUT_PWD/$$getConfigDir()/$${TARGET}_o.rsp
+for(object, NINJA_OBJECTS): RSP_O_CONTENT += $$object
+write_file($$RSP_OBJECT_FILE, RSP_O_CONTENT)
+RSP_ARCHIVE_FILE = $$OUT_PWD/$$getConfigDir()/$${TARGET}_a.rsp
+for(archive, NINJA_ARCHIVES): RSP_A_CONTENT += $$archive
+write_file($$RSP_ARCHIVE_FILE, RSP_A_CONTENT)
+macos:LIBS_PRIVATE += -Wl,-filelist,$$shell_quote($$RSP_OBJECT_FILE)
+linux:QMAKE_LFLAGS += @$${RSP_OBJECT_FILE}
 # QTBUG-58710 add main rsp file on windows
-win32:QMAKE_LFLAGS += @$$RSP_FILE
-linux: LIBS_PRIVATE += -Wl,--start-group $$NINJA_ARCHIVES -Wl,--end-group
+win32:QMAKE_LFLAGS += @$${RSP_OBJECT_FILE}
+linux:QMAKE_LFLAGS += -Wl,--start-group @$${RSP_ARCHIVE_FILE} -Wl,--end-group
 else: LIBS_PRIVATE += $$NINJA_ARCHIVES
 LIBS_PRIVATE += $$NINJA_LIB_DIRS $$NINJA_LIBS
 # GN's LFLAGS doesn't always work across all the Linux configurations we support.
 # The Windows and macOS ones from GN does provide a few useful flags however
 
+unix:qtConfig(webengine-noexecstack): \
+    QMAKE_LFLAGS += -Wl,-z,noexecstack
 linux {
     QMAKE_LFLAGS += -Wl,--gc-sections -Wl,-O1 -Wl,-z,now
     # Embedded address sanitizer symbols are undefined and are picked up by the dynamic link loader
@@ -71,7 +74,7 @@ osx {
     # API library as response file to the linker.
     QMAKE_LFLAGS += @$${api_library_path}$${QMAKE_DIR_SEP}$${api_library_name}.lib.objects
 } else {
-    LIBS_PRIVATE += -Wl,-whole-archive -l$$api_library_name -Wl,-no-whole-archive
+    QMAKE_LFLAGS += -Wl,-whole-archive -l$$api_library_name -Wl,-no-whole-archive
 }
 
 win32-msvc* {
@@ -84,8 +87,6 @@ win32-msvc* {
 # and doesn't let Chromium get access to libc symbols through dlsym.
 CONFIG -= bsymbolic_functions
 
-qtConfig(egl): CONFIG += egl
-
 linux:qtConfig(separate_debug_info): QMAKE_POST_LINK="cd $(DESTDIR) && $(STRIP) --strip-unneeded $(TARGET)"
 
 REPACK_DIR = $$OUT_PWD/$$getConfigDir()
@@ -154,3 +155,6 @@ OTHER_FILES = \
     $$files(../3rdparty/chromium/*.gypi, true) \
     $$files(../3rdparty/chromium/*.gn, true) \
     $$files(../3rdparty/chromium/*.gni, true)
+
+load(qt_module)
+
diff --git a/src/core/profile_io_data_qt.cpp b/src/core/profile_io_data_qt.cpp
index 63585b2c3..dd363f74d 100644
--- a/src/core/profile_io_data_qt.cpp
+++ b/src/core/profile_io_data_qt.cpp
@@ -48,6 +48,7 @@
 #include "content/public/common/content_features.h"
 #include "chrome/browser/custom_handlers/protocol_handler_registry_factory.h"
 #include "chrome/browser/net/chrome_mojo_proxy_resolver_factory.h"
+#include "chrome/common/chrome_switches.h"
 #include "net/cert/cert_verifier.h"
 #include "net/cert/ct_log_verifier.h"
 #include "net/cert/ct_policy_enforcer.h"
@@ -88,13 +89,6 @@
 
 namespace QtWebEngineCore {
 
-static const char* const kDefaultAuthSchemes[] = { net::kBasicAuthScheme,
-                                                   net::kDigestAuthScheme,
-#if QT_CONFIG(webengine_kerberos)
-                                                   net::kNegotiateAuthScheme,
-#endif
-                                                   net::kNtlmAuthScheme };
-
 static bool doNetworkSessionParamsMatch(const net::HttpNetworkSession::Params &first,
                                         const net::HttpNetworkSession::Params &second)
 {
@@ -297,8 +291,14 @@ void ProfileIODataQt::generateStorage()
     m_storage->set_ct_policy_enforcer(base::WrapUnique(new net::DefaultCTPolicyEnforcer()));
     m_storage->set_host_resolver(net::HostResolver::CreateDefaultResolver(NULL));
     m_storage->set_ssl_config_service(std::make_unique<net::SSLConfigServiceDefaults>());
+    if (!m_httpAuthPreferences) {
+        m_httpAuthPreferences.reset(new net::HttpAuthPreferences());
+        std::string serverWhitelist = base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII(switches::kAuthServerWhitelist);
+        m_httpAuthPreferences->SetServerWhitelist(serverWhitelist);
+    }
     m_storage->set_http_auth_handler_factory(net::HttpAuthHandlerFactory::CreateDefault(
-                                                 m_urlRequestContext->host_resolver()));
+                                                 m_urlRequestContext->host_resolver(),
+                                                 m_httpAuthPreferences.get()));
     m_storage->set_transport_security_state(std::make_unique<net::TransportSecurityState>());
 
     if (!m_dataPath.isEmpty()) {