qtwebkit: Mark known vulnerable by mweinelt · Pull Request #201028 · NixOS/nixpkgs

mweinelt · 2022-11-13T13:41:39Z

The browser engine is based off an old Webkit version, receives no security backports, does no releases.

The WebKitGTK people have counted over 500 CVEs they fixed since 2016.

Adding known vulnerable to make people aware they're using a browser engine that is not up to todays standards and could very likely be easily compromised.

https://blogs.gnome.org/mcatanzaro/2017/02/08/an-update-on-webkit-security-updates/
qutebrowser/qutebrowser#4039 (comment)
https://blogs.gnome.org/mcatanzaro/2022/11/04/stop-using-qtwebkit/

Description of changes

Things done

The browser engine is based off an old Webkit version, receives no security backports, does no releases. The WebKitGTK people have counted over 500 CVEs they fixed since 2016. Adding known vulnerable to make people aware they're using a browser engine that is not up to todays standards and could very likely be easily compromised. Projects are recomended to migrate to qtwebengine instead. https://blogs.gnome.org/mcatanzaro/2017/02/08/an-update-on-webkit-security-updates/ qutebrowser/qutebrowser#4039 (comment) https://blogs.gnome.org/mcatanzaro/2022/11/04/stop-using-qtwebkit/

mweinelt · 2022-11-13T13:47:48Z

52 packages affected:

alkimia (†8.1.1)
apitrace (†7.1-572-g26966134)
apmplanner2 (†2.0.28)
brewtarget (†2.3.1)
calligra (†3.2.1)
cb2bib (†2.0.0)
fontmatrix (†0.6.0-qt5)
foxitreader (†2.4.4.0911)
goldendict (†2022-05-10)
kdev-php (†22.08.3)
kdev-python (†22.08.3)
kdevelop (†22.08.3)
kdevelop-with-plugins (†)
kdewebkit (†5.99.0)
kexi (†3.2.0)
kmymoney (†5.1.3)
kreport (†3.2.0)
lsd2dsl (†0.5.4)
mendeley (†1.19.5-stable_amd64)
minizinc-ide (†2.5.5)
mythtv (†31.0)
nixnote2 (†2.0.2)
notepadqq (†1.4.8)
odoo (†15.0.20220506)
omedit (†1.18.0)
omshell (†1.18.0)
openboard (†1.6.1)
openlp (†2.4.6)
openlp-full (†2.4.6)
openmodelica-combined (†)
openshot-qt (†2.6.1)
pixinsight (†1.8.9-1)
python3.10-PyQt5 (†5.15.7)
python3.10-scudcloud (†1.65)
python3.9-PyQt5 (†5.15.7)
qgis (†3.22.10)
qgis (†3.26.2)
qlandkartegt (†1.8.1)
qt-full (†5.12.10)
qt-full (†5.14.2)
qt-full (†5.15.7)
qtwebkit (†5.212.0-alpha4)
qtwebkit-plugins-unstable (†2017-01-25)
quiterss (†0.19.4)
rocs (†22.08.3)
sleepyhead (†1.0.0-beta-git)
smtube (†21.10.0)
subsurface (†5.0.2)
swift-im (†4.0.2)
teamviewer (†15.29.4)
trojita-unstable (†2022-08-22)
wkhtmltopdf (†0.12.6)

K900 · 2022-11-13T13:47:52Z

Our fork is somewhat more maintained, but still not particularly well maintained, definitely not on the same level as Chromium or others. Also, just checking the list of things that depend on it, the only thing that jumps out at me is kdevelop, and that can use qtwebengine so should probably just be switched over (it currently depends on both for some reason).

K900 · 2022-11-13T13:51:00Z

Also checked rocs, also builds just fine without it.

K900 · 2022-11-13T13:51:46Z

apitrace is another thing I might care about but ours is disturbingly outdated anyway. I'll look into it.

Isn't used anyway.

Also seems unused.

K900 · 2022-11-13T14:13:07Z

apitrace update here: #201032

jian-lin · 2022-11-13T14:29:04Z

FYI, this fork of goldendict replaces qtwebkit with qtwebengine.

There is PR goldendict/goldendict#1542 to upstream.

mweinelt · 2022-11-13T15:12:11Z

FYI, this fork of goldendict replaces qtwebkit with qtwebengine.

cc @gebner @astsmtl @sikmir

ajs124 · 2022-11-13T19:55:28Z

Does this PR count towards progress for #53079?

K900 · 2022-11-13T19:56:27Z

Well, it drops at least two packages, so I'd say yes.

gador · 2022-11-19T13:03:07Z

teamviewer seems to be working fine without qtwebkit too

mweinelt · 2022-11-19T13:03:51Z

Feel free to provide a follow-up PR!

vcunat · 2022-11-19T16:06:19Z

vcunat · 2022-11-19T18:21:19Z

Oh no... both graphical ISOs got also removed by this!

vlinkz · 2022-11-19T18:39:25Z

Yeah without that some qml parts of calamares break, but should be possible to pinpoint exactly which packages are needed instead. I'll look into it

aidalgol · 2022-11-19T18:59:42Z

Looks like kmymoney is affected by this because it takes kdewebkit as an input. What should it be using instead? Upstream's dependency list does not specify any specific web engine, but CMakeLists.txt tries to find WebEngineWidgets and WebKitWidgets.

See PR NixOS#201028 and issue NixOS#53079

das-g · 2022-11-19T19:31:14Z

PR to switch kmymoney from qtwebkit to qtwebengine: #201953

AndersonTorres · 2022-11-19T23:36:56Z

I believe pyqt5_with_qtwebkit is the one offending openshot.

vlinkz · 2022-11-20T00:18:22Z

PR for calamares installation cd: Installation-cd: Remove libsForQt5.full #201991

due to NixOS#201028 and the deprecation of qtwebkit teamviewer refuses to evaluate. qtwebkit isn't needed for teamviewer and is therefore removed. Signed-off-by: Florian Brandes <florian.brandes@posteo.de>

vcunat · 2022-11-20T09:00:54Z

Note that qtwebengine currently depends on long-vulnerable python2, so it would also get dropped "soon", e.g. by PR #201859

K900 · 2022-11-20T09:02:00Z

Arch has patches for building it with Python3, maybe we should yoink those: https://github.com/archlinux/svntogit-packages/tree/packages/qt5-webengine/trunk

(to get rid of transitive dependency on qtwebkit) See PR NixOS#201028 and issue NixOS#53079

AndersonTorres · 2022-11-20T18:10:24Z

#202059

mweinelt · 2022-11-21T00:01:35Z

Thanks everyone for helping clean up!

due to #201028 and the deprecation of qtwebkit teamviewer refuses to evaluate. qtwebkit isn't needed for teamviewer and is therefore removed. Signed-off-by: Florian Brandes <florian.brandes@posteo.de> (cherry picked from commit b9a8eae)

tobiasBora · 2023-01-08T09:58:06Z

I'm beaten by this bug when I put full, but qtbase is not enough to build the package (errors about UiTools). Is there a full-like package that only contains packages that build?

Edit: I ended up adding qttools, discovered using nix-locate. But still interested to here about a full that only contains valid packages.

K900 · 2023-01-08T10:15:26Z

The package you want is qttools in nativeBuildInputs.

tobiasBora · 2023-01-08T10:20:12Z

Ahah thanks, I come up to the same conclusion using nix-locate, so I guess full should not be used anymore? Should'nt we provide a full-like for quick development? Also, what's the difference between qtbas of qtdeclarative?

K900 · 2023-01-08T10:23:06Z

I'd say we should have never had a full-like. qtbase is QtCore and QtWidgets, qtdeclarative is, well, QtDeclarative.

mweinelt added the 1.severity: security Issues which raise a security issue, or PRs that fix one label Nov 13, 2022

mweinelt requested review from a team, K900 and risicle November 13, 2022 13:41

mweinelt requested a review from ttuegel as a code owner November 13, 2022 13:41

github-actions bot added the 6.topic: qt/kde Object-oriented framework for GUI creation label Nov 13, 2022

mweinelt changed the title ~~qtwebkit: Mark known verulnable~~ qtwebkit: Mark known vulnerable Nov 13, 2022

ofborg bot added 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin. 10.rebuild-linux: 0 This PR does not cause any packages to rebuild on Linux. labels Nov 13, 2022

K900 added 2 commits November 13, 2022 17:08

kdevelop: remove qtwebkit from inputs

145bd93

Isn't used anyway.

rocs: remove qtwebkit from inputs

c1c816d

Also seems unused.

ofborg bot added 10.rebuild-linux: 11-100 This PR causes between 11 and 100 packages to rebuild on Linux. and removed 10.rebuild-linux: 0 This PR does not cause any packages to rebuild on Linux. labels Nov 13, 2022

SuperSandro2000 approved these changes Nov 13, 2022

View reviewed changes

mweinelt merged commit c099aa3 into NixOS:master Nov 19, 2022

mweinelt deleted the qtwebkit-vulnerable branch November 19, 2022 00:46

das-g added a commit to das-g/nixpkgs that referenced this pull request Nov 19, 2022

alkimia: switch from qtwebkit to qtwebengine

1e64f5e

See PR NixOS#201028 and issue NixOS#53079

das-g mentioned this pull request Nov 19, 2022

kmymoney: switch from qtwebkit to qtwebengine #201953

Merged

13 tasks

vlinkz mentioned this pull request Nov 20, 2022

Installation-cd: Remove libsForQt5.full #201991

Merged

13 tasks

gador mentioned this pull request Nov 20, 2022

teamviewer: remove qtwebkit #202024

Merged

13 tasks

K900 added the 8.has: clean-up This PR removes packages or removes other cruft label Nov 20, 2022

das-g added a commit to das-g/nixpkgs that referenced this pull request Nov 20, 2022

kmymoney: switch from kdewebkit to qtwebengine

89739b5

(to get rid of transitive dependency on qtwebkit) See PR NixOS#201028 and issue NixOS#53079

krav mentioned this pull request Nov 20, 2022

Remove sleepyhead #202055

Merged

13 tasks

schmittlauch mentioned this pull request Dec 2, 2022

[22.11] subsurface: 5.0.2 -> 5.0.10 and unbreak build #204167

Merged

13 tasks

damhiya mentioned this pull request Dec 9, 2022

mendeley: remove qtwebkit dependency #205291

Closed

13 tasks

muscaln mentioned this pull request Dec 10, 2022

openboard: 1.6.1 -> unstable-2022-11-28 #205482

Merged

13 tasks

K900 mentioned this pull request Apr 17, 2023

QtWebKit needs to be deprecated #53079

Closed

69 tasks

totoroot mentioned this pull request Apr 17, 2023

qlandkartegt: remove #226652

Merged

12 tasks

Uh oh!

Conversation

mweinelt commented Nov 13, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description of changes

Things done

Uh oh!

mweinelt commented Nov 13, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

K900 commented Nov 13, 2022

Uh oh!

K900 commented Nov 13, 2022

Uh oh!

K900 commented Nov 13, 2022

Uh oh!

K900 commented Nov 13, 2022

Uh oh!

jian-lin commented Nov 13, 2022 • edited by sikmir Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mweinelt commented Nov 13, 2022

Uh oh!

ajs124 commented Nov 13, 2022

Uh oh!

K900 commented Nov 13, 2022

Uh oh!

gador commented Nov 19, 2022

Uh oh!

mweinelt commented Nov 19, 2022

Uh oh!

vcunat commented Nov 19, 2022

Uh oh!

vcunat commented Nov 19, 2022

Uh oh!

vlinkz commented Nov 19, 2022

Uh oh!

aidalgol commented Nov 19, 2022

Uh oh!

das-g commented Nov 19, 2022

Uh oh!

AndersonTorres commented Nov 19, 2022

Uh oh!

vlinkz commented Nov 20, 2022 • edited by mweinelt Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vcunat commented Nov 20, 2022

Uh oh!

K900 commented Nov 20, 2022

Uh oh!

AndersonTorres commented Nov 20, 2022

Uh oh!

mweinelt commented Nov 21, 2022

Uh oh!

tobiasBora commented Jan 8, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

K900 commented Jan 8, 2023

Uh oh!

tobiasBora commented Jan 8, 2023

Uh oh!

K900 commented Jan 8, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

mweinelt commented Nov 13, 2022 •

edited

Loading

mweinelt commented Nov 13, 2022 •

edited

Loading

jian-lin commented Nov 13, 2022 •

edited by sikmir

Loading

vlinkz commented Nov 20, 2022 •

edited by mweinelt

Loading

tobiasBora commented Jan 8, 2023 •

edited

Loading