Document which Qt modules and classes are meant to process untrusted data

Document Qt modules, classes, and methods that are meant to process untrusted data.

Background

A fundamental concept in cybersecurity analysis is identifying the processing of untrusted/unaudited data, and analyzing the data flow for it. Applications can use Qt functionality to audit and process such untrusted data. The documentation could make it explicit which Qt modules, classes, and methods are considered to be safe to process untrusted data.

Examples

Qt functionality that can process untrusted data:

• File functionality (QFile and friends)
• TCP Sockets
• Image format handling (for image formats in qt gui)
• Regular expressions
• ...

Qt functionality that is not meant to process untrusted data:

• QML / JS engine
• Plugin loading (QLibrary etc)
• ...

Text

This [module|class|function] is designed to process also data from untrusted sources. For more information, see the Qt Cyber Security Overview.