Security concern while handling html tag in QML text.

• Question.
  • Does Qt have any logic or histories ( like as applying any related CVE patches  or else ) to mitigate the vulnerability issue while supporting "HTML tag" in "QML text"?
  • image tag in below case( Concern) is simply one of examples to explain how HTML tag could be a trigger of malicious code.  I.e, we'd like to understand if there is any possibility to be affected by malicious code due to HTML tag in QML Text or not, not only for "image tag" but in general.

• Concern.
  • Text.AutoText is the default set unless "Text.PainText" is defined, according to https://doc.qt.io/qt-6/qml-qtquick-text.html#textFormat-prop.
  • In this case ( Text.AutoText), HTML tags like below might be supported.<b></b> - bold

                    <del></del> - strike out (removed content)

                    <s></s> - strike out (no longer accurate or no longer relevant content)

                    <strong></strong> - bold

                    <i></i> - italic

                    <br> - new line

                    <p> - paragraph

                    <u> - underlined text

                   <font color="color_name" size="1-7"></font>

                   <h1> to <h6> - headers

                   <a href=""> - anchor

                  <img src="" align="top,middle,bottom" width="" height=""> - inline images

                 <ol type="">, <ul type=""> and <li> - ordered and unordered lists

                  <pre></pre> - preformatted

                  All entities

• • And let's consider the case below.

                     Text {

                     id: hText1

                    width: parent.width

                    height: 100

                    text: "<img                    src=\”https://d2f9uwgpmber13.cloudfront.net/public/image_new/26fe75871805b8fa8ffcd1a94778be4c?.jpeg\”>"

                    verticalAlignment: Text.AlignVCenter

                    color: "white"

                    elide: Text.ElideRight

                   font.pixelSize: 32

                    }

• • For example, the file in the above URL an executable file with malicious code with jpeg extension which has been changed ( ex. Content-Type spoofing), actually not an image file such as jpeg, png, etc. Just in case, is there any logic to detect this kind of malicious code and prevent downloading the file in Qt? 

The customer would like to understand whether any security processing (e.g. multiple security systems such as file signature verification, entire file structure inspection, image decoding inspection, etc., rather than simply checking the extension) is in Qt or not.

And then, they might be able to consider the backup plan accordingly!!