Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

qtwebkit: Mark known vulnerable #201028

Merged
merged 3 commits into from
Nov 19, 2022
Merged

qtwebkit: Mark known vulnerable #201028

merged 3 commits into from
Nov 19, 2022

Conversation

mweinelt
Copy link
Member

@mweinelt mweinelt commented Nov 13, 2022 •
edited
Loading

The browser engine is based off an old Webkit version, receives no security backports, does no releases.

The WebKitGTK people have counted over 500 CVEs they fixed since 2016.

Adding known vulnerable to make people aware they're using a browser engine that is not up to todays standards and could very likely be easily compromised.

https://blogs.gnome.org/mcatanzaro/2017/02/08/an-update-on-webkit-security-updates/
qutebrowser/qutebrowser#4039 (comment)
https://blogs.gnome.org/mcatanzaro/2022/11/04/stop-using-qtwebkit/

Description of changes
Things done
  • Built on platform(s)
    • x86_64-linux
    • aarch64-linux
    • x86_64-darwin
    • aarch64-darwin
  • For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
  • Tested, as applicable:
  • Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
  • Tested basic functionality of all binary files (usually in ./result/bin/)
  • 22.11 Release Notes (or backporting 22.05 Release notes)
    • (Package updates) Added a release notes entry if the change is major or breaking
    • (Module updates) Added a release notes entry if the change is significant
    • (Module addition) Added a release notes entry if adding a new NixOS module
    • (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes
  • Fits CONTRIBUTING.md.

@mweinelt
qtwebkit: Mark known vulnerable
a505704 
The browser engine is based off an old Webkit version, receives no
security backports, does no releases.

The WebKitGTK people have counted over 500 CVEs they fixed since 2016.

Adding known vulnerable to make people aware they're using a browser
engine that is not up to todays standards and could very likely be
easily compromised.

Projects are recomended to migrate to qtwebengine instead.

https://blogs.gnome.org/mcatanzaro/2017/02/08/an-update-on-webkit-security-updates/
qutebrowser/qutebrowser#4039 (comment)
https://blogs.gnome.org/mcatanzaro/2022/11/04/stop-using-qtwebkit/
@mweinelt mweinelt added the 1.severity: security Issues which raise a security issue, or PRs that fix one label Nov 13, 2022
@mweinelt mweinelt requested review from K900, risicle and a team November 13, 2022 13:41
@mweinelt mweinelt requested a review from ttuegel as a code owner November 13, 2022 13:41
@mweinelt mweinelt changed the title qtwebkit: Mark known verulnable qtwebkit: Mark known vulnerable Nov 13, 2022
@mweinelt
Copy link
Member Author

mweinelt commented Nov 13, 2022 •
edited
Loading

52 packages affected:

  • alkimia (†8.1.1)
  • apitrace (†7.1-572-g26966134)
  • apmplanner2 (†2.0.28)
  • brewtarget (†2.3.1)
  • calligra (†3.2.1)
  • cb2bib (†2.0.0)
  • fontmatrix (†0.6.0-qt5)
  • foxitreader (†2.4.4.0911)
  • goldendict (†2022-05-10)
  • kdev-php (†22.08.3)
  • kdev-python (†22.08.3)
  • kdevelop (†22.08.3)
  • kdevelop-with-plugins (†)
  • kdewebkit (†5.99.0)
  • kexi (†3.2.0)
  • kmymoney (†5.1.3)
  • kreport (†3.2.0)
  • lsd2dsl (†0.5.4)
  • mendeley (†1.19.5-stable_amd64)
  • minizinc-ide (†2.5.5)
  • mythtv (†31.0)
  • nixnote2 (†2.0.2)
  • notepadqq (†1.4.8)
  • odoo (†15.0.20220506)
  • omedit (†1.18.0)
  • omshell (†1.18.0)
  • openboard (†1.6.1)
  • openlp (†2.4.6)
  • openlp-full (†2.4.6)
  • openmodelica-combined (†)
  • openshot-qt (†2.6.1)
  • pixinsight (†1.8.9-1)
  • python3.10-PyQt5 (†5.15.7)
  • python3.10-scudcloud (†1.65)
  • python3.9-PyQt5 (†5.15.7)
  • qgis (†3.22.10)
  • qgis (†3.26.2)
  • qlandkartegt (†1.8.1)
  • qt-full (†5.12.10)
  • qt-full (†5.14.2)
  • qt-full (†5.15.7)
  • qtwebkit (†5.212.0-alpha4)
  • qtwebkit-plugins-unstable (†2017-01-25)
  • quiterss (†0.19.4)
  • rocs (†22.08.3)
  • sleepyhead (†1.0.0-beta-git)
  • smtube (†21.10.0)
  • subsurface (†5.0.2)
  • swift-im (†4.0.2)
  • teamviewer (†15.29.4)
  • trojita-unstable (†2022-08-22)
  • wkhtmltopdf (†0.12.6)

@K900
Copy link
Contributor

K900 commented Nov 13, 2022

Our fork is somewhat more maintained, but still not particularly well maintained, definitely not on the same level as Chromium or others. Also, just checking the list of things that depend on it, the only thing that jumps out at me is kdevelop, and that can use qtwebengine so should probably just be switched over (it currently depends on both for some reason).

@K900
Copy link
Contributor

K900 commented Nov 13, 2022

Also checked rocs, also builds just fine without it.

@K900
Copy link
Contributor

K900 commented Nov 13, 2022

apitrace is another thing I might care about but ours is disturbingly outdated anyway. I'll look into it.

@ofborg ofborg bot added 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin 10.rebuild-linux: 0 This PR does not cause any packages to rebuild on Linux labels Nov 13, 2022
@K900
Copy link
Contributor

K900 commented Nov 13, 2022

apitrace update here: #201032

@ofborg ofborg bot added 10.rebuild-linux: 11-100 and removed 10.rebuild-linux: 0 This PR does not cause any packages to rebuild on Linux labels Nov 13, 2022
@jian-lin
Copy link
Contributor

jian-lin commented Nov 13, 2022 •
edited by sikmir
Loading

FYI, this fork of goldendict replaces qtwebkit with qtwebengine.

There is PR goldendict/goldendict#1542 to upstream.

@mweinelt
Copy link
Member Author

FYI, this fork of goldendict replaces qtwebkit with qtwebengine.

cc @gebner @astsmtl @sikmir

@ajs124
Copy link
Member

ajs124 commented Nov 13, 2022

Does this PR count towards progress for #53079?

@K900
Copy link
Contributor

K900 commented Nov 13, 2022

Well, it drops at least two packages, so I'd say yes.

@mweinelt mweinelt merged commit c099aa3 into NixOS:master Nov 19, 2022
@mweinelt mweinelt deleted the qtwebkit-vulnerable branch November 19, 2022 00:46
@gador
Copy link
Member

gador commented Nov 19, 2022

teamviewer seems to be working fine without qtwebkit too

@mweinelt
Copy link
Member Author

Feel free to provide a follow-up PR!

@vcunat
Copy link
Member

vcunat commented Nov 19, 2022

Some of the newly disappeared packages still have meta.maintainers, so those might want to know:

@vlinkz
Copy link
Member

vlinkz commented Nov 19, 2022

Yeah without that some qml parts of calamares break, but should be possible to pinpoint exactly which packages are needed instead. I'll look into it

@aidalgol
Copy link
Contributor

Looks like kmymoney is affected by this because it takes kdewebkit as an input. What should it be using instead? Upstream's dependency list does not specify any specific web engine, but CMakeLists.txt tries to find WebEngineWidgets and WebKitWidgets.

das-g added a commit to das-g/nixpkgs that referenced this pull request Nov 19, 2022
@das-g
alkimia: switch from qtwebkit to qtwebengine
1e64f5e 
See PR NixOS#201028 and issue NixOS#53079
@das-g
Copy link
Member

das-g commented Nov 19, 2022

PR to switch kmymoney from qtwebkit to qtwebengine: #201953

@das-g das-g mentioned this pull request Nov 19, 2022
Merged
13 tasks
@AndersonTorres
Copy link
Member

I believe pyqt5_with_qtwebkit is the one offending openshot.

@vlinkz vlinkz mentioned this pull request Nov 20, 2022
Merged
13 tasks
@vlinkz
Copy link
Member

vlinkz commented Nov 20, 2022 •
edited by mweinelt
Loading

gador added a commit to gador/nixpkgs that referenced this pull request Nov 20, 2022
@gador
teamviewer: remove qtwebkit
b9a8eae 
due to NixOS#201028 and
the deprecation of qtwebkit teamviewer refuses to evaluate.

qtwebkit isn't needed for teamviewer and is therefore removed.

Signed-off-by: Florian Brandes <[email protected]>
@vcunat
Copy link
Member

vcunat commented Nov 20, 2022

Note that qtwebengine currently depends on long-vulnerable python2, so it would also get dropped "soon", e.g. by PR #201859

@K900
Copy link
Contributor

K900 commented Nov 20, 2022

Arch has patches for building it with Python3, maybe we should yoink those: https://github.com/archlinux/svntogit-packages/tree/packages/qt5-webengine/trunk

@gador gador mentioned this pull request Nov 20, 2022
Merged
13 tasks
das-g added a commit to das-g/nixpkgs that referenced this pull request Nov 20, 2022
@das-g
kmymoney: switch from kdewebkit to qtwebengine
89739b5 
(to get rid of transitive dependency on qtwebkit)
See PR NixOS#201028 and issue NixOS#53079
@krav krav mentioned this pull request Nov 20, 2022
Merged
13 tasks
@AndersonTorres
Copy link
Member

#202059

@mweinelt
Copy link
Member Author

Thanks everyone for helping clean up!

github-actions bot pushed a commit that referenced this pull request Nov 22, 2022
@gador @github-actions
teamviewer: remove qtwebkit
5fc1d15 
due to #201028 and
the deprecation of qtwebkit teamviewer refuses to evaluate.

qtwebkit isn't needed for teamviewer and is therefore removed.

Signed-off-by: Florian Brandes <[email protected]>
(cherry picked from commit b9a8eae)
@schmittlauch schmittlauch mentioned this pull request Dec 2, 2022
Merged
13 tasks
@damhiya damhiya mentioned this pull request Dec 9, 2022
Closed
13 tasks
@muscaln muscaln mentioned this pull request Dec 10, 2022
Merged
13 tasks
@tobiasBora
Copy link
Contributor

tobiasBora commented Jan 8, 2023 •
edited
Loading

I'm beaten by this bug when I put full, but qtbase is not enough to build the package (errors about UiTools). Is there a full-like package that only contains packages that build?

Edit: I ended up adding qttools, discovered using nix-locate. But still interested to here about a full that only contains valid packages.

@K900
Copy link
Contributor

K900 commented Jan 8, 2023

The package you want is qttools in nativeBuildInputs.

@tobiasBora
Copy link
Contributor

Ahah thanks, I come up to the same conclusion using nix-locate, so I guess full should not be used anymore? Should'nt we provide a full-like for quick development? Also, what's the difference between qtbas of qtdeclarative?

@K900
Copy link
Contributor

K900 commented Jan 8, 2023

I'd say we should have never had a full-like. qtbase is QtCore and QtWidgets, qtdeclarative is, well, QtDeclarative.

@K900 K900 mentioned this pull request Apr 17, 2023
Closed
69 tasks
@totoroot totoroot mentioned this pull request Apr 17, 2023
Merged
12 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@SuperSandro2000 SuperSandro2000 SuperSandro2000 approved these changes

@K900 K900 Awaiting requested review from K900

@risicle risicle Awaiting requested review from risicle

@ttuegel ttuegel Awaiting requested review from ttuegel

Assignees
No one assigned
Labels
1.severity: security Issues which raise a security issue, or PRs that fix one 6.topic: qt/kde 8.has: clean-up 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin 10.rebuild-linux: 11-100
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.