windeployqt: Patch qt_prfxpath when deploying Qt5Core

Patch the preconfigured Qt path in Qt5Core to '.'. This allows one to
immediately test whether the generated package is self-contained, without
Qt being able to 'fall back' to the installed Qt for loading plugins. It
is also fixing a potential security issue where Qt tries to load plugins
from 'unexpected' places.

The effect is the same as adding a qt.conf file with all the defaults.
However, a lot of people consider adding a qt.conf ugly.

[ChangeLog][Important behavior changes][windeployqt] windeployqt now
changes the hardcoded QLibraryInfo::PrefixPath in Qt5Core to be relative
to the executable.

Change-Id: Ib59d84453913f28b806ae78a0ef138eb4f0045fa
Reviewed-by: Oliver Wolff <oliver.wolff@theqtcompany.com>
Reviewed-by: Björn Breitmeyer <bjoern.breitmeyer@kdab.com>
Reviewed-by: Lars Knoll <lars.knoll@theqtcompany.com>
Reviewed-by: Friedemann Kleint <Friedemann.Kleint@theqtcompany.com>

3 files changed, 57 insertions, 0 deletions

diff --git a/src/windeployqt/main.cpp b/src/windeployqt/main.cpp
index 753c54895..5eb0cbc49 100644
--- a/src/windeployqt/main.cpp
+++ b/src/windeployqt/main.cpp
@@ -1248,6 +1248,12 @@ static DeployResult deploy(const Options &options,
             if (!updateFile(qtLib, targetPath, options.updateFileFlags, options.json, errorMessage))
                 return result;
         }
+
+        const QString qt5CoreName = QFileInfo(libraryPath(libraryLocation, "Qt5Core", qtLibInfix,
+                                                          options.platform, isDebug)).fileName();
+
+        if (!patchQtCore(targetPath + QLatin1Char('/') + qt5CoreName, errorMessage))
+            return result;
     } // optLibraries
 
     // Update plugins
diff --git a/src/windeployqt/utils.cpp b/src/windeployqt/utils.cpp
index 20a1829e6..62cdd17c5 100644
--- a/src/windeployqt/utils.cpp
+++ b/src/windeployqt/utils.cpp
@@ -921,4 +921,53 @@ QString findD3dCompiler(Platform, const QString &, unsigned)
 
 #endif // !Q_OS_WIN
 
+// Search for "qt_prfxpath=xxxx" in \a path, and replace it with "qt_prfxpath=."
+bool patchQtCore(const QString &path, QString *errorMessage)
+{
+    if (optVerboseLevel)
+        std::wcout << "Patching " << QFileInfo(path).fileName() << "...\n";
+
+    QFile file(path);
+    if (!file.open(QIODevice::ReadWrite)) {
+        *errorMessage = QString::fromLatin1("Unable to patch %1: %2").arg(
+                    QDir::toNativeSeparators(path), file.errorString());
+        return false;
+    }
+    QByteArray content = file.readAll();
+
+    if (content.isEmpty()) {
+        *errorMessage = QString::fromLatin1("Unable to patch %1: Could not read file content").arg(
+                    QDir::toNativeSeparators(path));
+        return false;
+    }
+
+    QByteArray prfxpath("qt_prfxpath=");
+    int startPos = content.indexOf(prfxpath);
+    if (startPos == -1) {
+        *errorMessage = QString::fromLatin1(
+                    "Unable to patch %1: Could not locate pattern \"qt_prfxpath=\"").arg(
+                    QDir::toNativeSeparators(path));
+        return false;
+    }
+    startPos += prfxpath.length();
+    int endPos = content.indexOf(char(0), startPos);
+    if (endPos == -1) {
+        *errorMessage = QString::fromLatin1("Unable to patch %1: Internal error").arg(
+                    QDir::toNativeSeparators(path));
+        return false;
+    }
+
+    QByteArray replacement = QByteArray(endPos - startPos, char(0));
+    replacement[0] = '.';
+    content.replace(startPos, endPos - startPos, replacement);
+
+    if (!file.seek(0)
+            || (file.write(content) != content.size())) {
+        *errorMessage = QString::fromLatin1("Unable to patch %1: Could not write to file").arg(
+                    QDir::toNativeSeparators(path));
+        return false;
+    }
+    return true;
+}
+
 QT_END_NAMESPACE
diff --git a/src/windeployqt/utils.h b/src/windeployqt/utils.h
index e7c2776a9..1df624797 100644
--- a/src/windeployqt/utils.h
+++ b/src/windeployqt/utils.h
@@ -214,6 +214,8 @@ inline QStringList findDependentLibraries(const QString &executableFileName, Pla
 
 QString findD3dCompiler(Platform platform, const QString &qtBinDir, unsigned wordSize);
 
+bool patchQtCore(const QString &path, QString *errorMessage);
+
 extern int optVerboseLevel;
 
 // Recursively update a file or directory, matching DirectoryFileEntryFunction against the QDir