Reminder: QtWebKit known vulnerabilities

["Alex Xu (Hello71)" <alex_y_xu () yahoo ca>]

Quoting Christophe Giboudeaux [0] (excerpted, rewrapped),

> QtWebKit was a rendering engine for web content released with Qt until 
> 5.6. It was replaced with QtWebEngine after that.
>
> Despite a community fork in 2016, nothing really happened to keep it 
> alive and secure.
> Quoting the QtWebKit release page on Github:
>
> "WARNING: This release is based on old WebKit revision with known 
> unpatched vulnerabilities.
> Please use it carefully and avoid visiting untrusted websites and 
> using it for transmission of sensitive data."

As of today, Repology reports that 246 packages still exist for 
qt5-webkit, in dozens of Linux distros (most of them overcounted, e.g. 
qt5-qtwebkit-dev).

Of particular concern is the 104 packages known for wkhtmltopdf. As 
repeated multiple times on the website (unfortunately not prominently 
enough), "Do not use wkhtmltopdf with any untrusted HTML". However, it's 
fair to say that many users likely do not follow this advice.

Readers of this list will likely be familiar with the regular postings 
regarding WebKitGTK vulnerabilities: many of them are likely applicable 
to QtWebKit too, especially the WebKitGTK-based fork.

Fortunately, as opposed to the webkitgtk issues a few years ago, most 
programs now support Qt WebEngine, QTextBrowser (part of Qt Widgets), or 
don't require any browser engine anymore. Almost all exceptions are no 
longer maintained upstream. wkhtmltopdf is likely the most used package 
that still requires QtWebKit, but in my opinion is the most dangerous, 
as users may unknowingly install it from distro repositories and use it 
to process untrusted data. Users can migrate to weasyprint, puppeteer, 
or another alternative.

Alpine Linux has removed QtWebKit [1], Gentoo Linux has masked it [2] 
(meaning users must manually approve the installation), and OpenSUSE 
will be removing it soon [0]. In the absence of a maintained QtWebKit, 
I urge other distros to follow suit to protect Linux users.

[0] https://lists.opensuse.org/archives/list/factory () lists opensuse org/thread/GXVEFT7VY5DQNATX6FHJBQBRDHRC3NRN/
[1] https://gitlab.alpinelinux.org/alpine/aports/-/issues/12888
[2] https://bugs.gentoo.org/684580

Regards,
Alex.