On 29/07/2026 10:52, Kai Uwe Broulik wrote:
I therefore propose that for Qt 7 we switch to PlainText format by
default. We then need to figure out a way to make the transition
easier (e.g. have an environment variable that lets you force it right
now to test your app, or static code analysis that checks for HTML
tags in strings, or…?). Additionally, we may need to add additional
textFormat properties where useful.
FWIW, I agree with this. `Qt::AutoText` is a default for a different
era. Historically, relying on the users of libraries to be aware that
they are dealing with untrusted input (and perform escaping or change
modes accordingly themselves) to deal with injection attacks is... not
a successful approach. Defaults should be safe.
Additionally, it is a shame that string interpolation is still the main
way to create composite labels, especially when external data is
involved. I think it could be worthwhile to learn from something like
t-strings, which were recently introduced in Python 3.14. A type like
that can carry information about which parts of a string are
application-controlled and which are externally-controlled all the way
to a widget/control and allow more easily doing the "right thing" safely.
Best,
Igor
--
Development mailing list
[email protected]
https://lists.qt-project.org/listinfo/development
