Regression: Request Interceptor Blocking All Documentation (QT/5.11)

[neoh4x0r]

OPERATING SYSTEM: Debian 10 Buster
QT VERSION: 5.11 (might be ok on 5.15)

The following commit reintroduced a custom request interceptor (66aff30)

That commit ends up blocking the following urls

1. qrc:///<path>
2. blob:http://127.0.0.1:<port>/<path>
3. blob:<guid>

None of these urls are making external requests and, therefore, shouldn't be blocked.

This means that the welcome page doesn't work, and no documentation can be viewed.

Currently the only way to view the documentation is to right-click in the viewer and select 'open with/in browser'.

PS: This could be a problem with QT 5.11

[mquinson]

Hello,
I can't reproduce this. I can see the documentation normally with the latest git version on my Debian testing. My Qt version is 5.14.4, so maybe that's why.

Could you please be more specific about the issue that you are experiencing, or maybe close it if it was solved in between?

Thanks,

[neoh4x0r]

Hello, I can't reproduce this. I can see the documentation normally with the latest git version on my Debian testing. My Qt version is 5.14.4, so maybe that's why.

Could you please be more specific about the issue that you are experiencing, or maybe close it if it was solved in between?

Thanks,

It was happening on QT 5.11 and those urls were being blocked by the url request interceptor -- honestly, there isn't any way to be more specific about it.

https://github.com/zealdocs/zeal/blob/master/src/libs/browser/urlrequestinterceptor.cpp#L39-L64

[mquinson]

So, we agree that it was not because of Zeal but of QT 5.11 that is not used anymore (in which case I think that we could close it), or do you still manage to reproduce it on either the stable or testing version of Debian (that seem to use respectively 5.15.2 and 5.15.4)?

If you prefer to keep the bug open, what kind of resolution would you be looking for?

Thanks,

[neoh4x0r]

So, we agree that it was not because of Zeal but of QT 5.11 that is not used anymore (in which case I think that we could close it), or do you still manage to reproduce it on either the stable or testing version of Debian (that seem to use respectively 5.15.2 and 5.15.4)?

If you prefer to keep the bug open, what kind of resolution would you be looking for?

Thanks,

I tested it on QT 5.15. I don't see reports about those urls being blocked and the documentation is being displayed.

However, it will be broken for anyone that uses QT 5.11 (and either does not want to / cannot upgrade to a newer version).

---

Here s a diff that fixes it in QT/5.11

diff --git a/src/libs/browser/urlrequestinterceptor.cpp b/src/libs/browser/urlrequestinterceptor.cpp
index 49c4e12..4344de7 100644
--- a/src/libs/browser/urlrequestinterceptor.cpp
+++ b/src/libs/browser/urlrequestinterceptor.cpp
@@ -43,15 +43,29 @@ void UrlRequestInterceptor::interceptRequest(QWebEngineUrlRequestInfo &info)

     // Block invalid requests.
     if (!requestUrl.isValid() || !firstPartyUrl.isValid()) {
-        blockRequest(info);
-        return;
-    }

+               // Allow blob: urls
+               if      ((firstPartyUrl.isEmpty()) &&
+                       (requestUrl.toString().startsWith("blob:", Qt::CaseInsensitive))
+               ) {
+                       if (requestUrl.toString().startsWith("blob:http://", Qt::CaseInsensitive)) {
+                               // if it starts with blob:http:// only allow 127.0.0.1
+                               if (requestUrl.toString().startsWith("blob:http://127.0.0.1", Qt::CaseInsensitive)) {
+                                       return;
+                               } else { blockRequest(info); return; }
+                       }
+                       // allow other blob: urls as long as they don't start with http:// (eg. a guid)
+                       return;
+               }
+               blockRequest(info); return;
+    }
     bool isFirstPartyUrlLocal = Core::NetworkAccessManager::isLocalUrl(firstPartyUrl);
     bool isRequestUrlLocal = Core::NetworkAccessManager::isLocalUrl(requestUrl);

     // Direct links are controlled in the WebPage
-    if (info.resourceType() == QWebEngineUrlRequestInfo::ResourceTypeMainFrame) {
+    if ( (info.resourceType() == QWebEngineUrlRequestInfo::ResourceTypeMainFrame) ||
+               (requestUrl.toString().startsWith("qrc", Qt::CaseInsensitive))
+               ) {
         return;
     }

@@ -59,7 +73,6 @@ void UrlRequestInterceptor::interceptRequest(QWebEngineUrlRequestInfo &info)
     if (isFirstPartyUrlLocal == isRequestUrlLocal) {
         return;
     }
-
     blockRequest(info);
 }