Re: Porting KUrl::prettyUrl: please do not reintroduce CVE-2013-2074!

2014-10-18 Thread Andrea Iacovitti
url.toDisplayString() should be equivalent to call url.toString(QUrl::RemovePassword) Andrea

Re: Porting KUrl::prettyUrl: please do not reintroduce CVE-2013-2074!

2014-10-18 Thread Andrea Iacovitti
url.toDisplayString() should be equivalent to call url.toString(QUrl::RemovePassword) Andrea

Re: Porting KUrl::prettyUrl: please do not reintroduce CVE-2013-2074!

2014-10-17 Thread Kevin Kofler
I wrote: just a small public service announcement: The correct replacement for: url.prettyUrl() in Qt 5 is NOT: url.toString() // BAD! but: url.toString(QUrl::RemovePassword) or, even better: url.toDisplayString() as pointed out by Andrea Iacovitti. (I guess his message is pending

Re: Porting KUrl::prettyUrl: please do not reintroduce CVE-2013-2074!

2014-10-16 Thread Dawit A
I personally think QUrl should remove the password by default when converting to string and force caller of the API to explicitly request the inclusion of the password say by changing the modifier option to a QUrl::IncludePassword. It is better to be safer out of the box. On Thu, Oct 16, 2014 at