Merge remote-tracking branch 'upstream/master'

doc/changelog.asciidoc

@@ -29,6 +29,11 @@ Added
 Changed
 ~~~~~~~
 
+- QtWebEngine: Support for JavaScript Shared Web Workers have been disabled on
+  Qt versions older than 5.11 because of security issues in in Chromium.
+  You can get the same effect in earlier versions via
+  `:set qt.args ['disable-shared-workers']`. An equivalent workaround is also
+  contained in Qt 5.9.5 and 5.10.1.
 - The file dialog for downloads now has basic tab completion based on the
   entered text.
 - `:version` now shows OS information for POSIX OS other than Linux/macOS.

qutebrowser/config/configinit.py

@@ -26,7 +26,8 @@ from PyQt5.QtWidgets import QMessageBox
 
 from qutebrowser.config import (config, configdata, configfiles, configtypes,
                                 configexc, configcommands)
-from qutebrowser.utils import objreg, usertypes, log, standarddir, message
+from qutebrowser.utils import (objreg, usertypes, log, standarddir, message,
+                               qtutils)
 from qutebrowser.misc import msgbox, objects
 
 
@@ -161,4 +162,12 @@ def qt_args(namespace):
             argv += ['--' + name, value]
 
     argv += ['--' + arg for arg in config.val.qt.args]
+
+    if (objects.backend == usertypes.Backend.QtWebEngine and
+            not qtutils.version_check('5.11', compiled=False)):
+        # WORKAROUND equivalent to
+        # https://codereview.qt-project.org/#/c/217932/
+        # Needed for Qt < 5.9.5 and < 5.10.1
+        argv.append('--disable-shared-workers')
+
     return argv

tests/unit/config/test_configinit.py

@@ -347,6 +347,12 @@ class TestQtArgs:
         mocker.patch.object(parser, 'exit', side_effect=Exception)
         return parser
 
+    @pytest.fixture(autouse=True)
+    def patch_version_check(self, monkeypatch):
+        """Make sure no --disable-shared-workers argument gets added."""
+        monkeypatch.setattr(configinit.qtutils, 'version_check',
+                            lambda version, compiled: True)
+
     @pytest.mark.parametrize('args, expected', [
         # No Qt arguments
         (['--debug'], [sys.argv[0]]),
@@ -382,6 +388,15 @@ class TestQtArgs:
         config_stub.val.qt.args = ['bar']
         assert configinit.qt_args(parsed) == [sys.argv[0], '--foo', '--bar']
 
+    def test_shared_workers(self, config_stub, monkeypatch, parser):
+        monkeypatch.setattr(configinit.qtutils, 'version_check',
+                            lambda version, compiled: False)
+        monkeypatch.setattr(configinit.objects, 'backend',
+                            usertypes.Backend.QtWebEngine)
+        parsed = parser.parse_args([])
+        expected = [sys.argv[0], '--disable-shared-workers']
+        assert configinit.qt_args(parsed) == expected
+
 
 @pytest.mark.parametrize('arg, confval, used', [
     # overridden by commandline arg