Bug 422228 - plasmashell has QML debugging enabled
Summary: plasmashell has QML debugging enabled
Status: RESOLVED FIXED
Alias: None
Product: plasmashell
Classification: Plasma
Component: general (show other bugs)
Version: master
Platform: openSUSE Linux
: NOR normal
Target Milestone: 1.0
Assignee: Bhushan Shah
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-05-29 13:55 UTC by Fabian Vogt
Modified: 2020-06-10 08:22 UTC (History)
2 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Fabian Vogt 2020-05-29 13:55:28 UTC
When starting plasmashell, it prints

QML debugging is enabled. Only use this in a safe environment.

Most likely caused by 5f2abe1e676efd6d027a05261ab4d83da32eb459 in p-w.

If this is security relevant, it has to be disabled. If not, it should disable the warning message.
Comment 1 David Edmundson 2020-05-29 14:11:01 UTC
The message is from Qt.

I don't see how it's a security issue. It doesn't do actively do anything till one adds -qmljsdebugger to the args starting it. 

But we should do something.
Comment 2 David Edmundson 2020-06-10 08:22:19 UTC
Git commit dd24739479b33263c1016ec3938d4c81abdc981a by David Edmundson.
Committed on 09/06/2020 at 20:08.
Pushed by davidedmundson into branch 'Plasma/5.19'.

Guard QQmldebuggingEnabled by an env var

I don't understand why QQmlDebuggingEnabler prints a warning, it's no
less secure until other command line args are passed.

However the warning is scary, so lets put a guard on it.

M  +3    -1    shell/main.cpp

https://invent.kde.org/plasma/plasma-workspace/commit/dd24739479b33263c1016ec3938d4c81abdc981a