[SOLVED] - qml sandboxing of components

[harchu]

Hi, I am new to Qt/QML. I was wondering if there is a way to sandbox qml components that are loaded from external qml files (either using Loader or javascript - createComponent/createObject) in the application. Also, which is the preferred method to load these external files?
Thank you,
Rohit

[dheerendra]

welcome to the forum. You can you put all the QML components in specific directory. You can add the path using QmlEngine::addImportPath.. or QML_IMPORT_PATH environment variable or

[harchu]

Thanks.
Actually what i meant to ask was - is there a way to prevent the loaded component/object from accessing the parent object or its siblings?

[dheerendra]

There is no way to do this. What are you trying to prevent ? You can dis-associate parent and child relation ship by changing the parent.

[harchu]

I am trying to load a qml created by some 3rd party, but do not want it to change/add/delete widgets/properties on my application. I think its mandatory to have this feature for security purposes.

How do I change the parent? I still want to display the widgets specified in the qml in my application.

[dheerendra]

ok. I got it. Conceptually how will the third app know about your code/app/object name etc in your code ? You will be using the third party component. Whatever it does it will be within it's own code. So your code is controlling the third party component. So I feel this issue may not arise. Hope I'm not missing something in your explanation or thought process.

[jeremy_k]

An instance of a QML component can always walk its way up the parent chain until it reaches the ultimate parent in the context, and then inspect the children.

One option is to place the 3rd party code in a separate QML context, making access to other objects harder.

[harchu]

@dheerendra: the third party qml component can walk up the parent chain and then look at other children of the parents...which is something i want to prevent

@jeremy_k: how do i create a separate QML context when i am dynamically loading these QML components? can you point me to some documentation or some examples. Thanks.

[jeremy_k]

The only way I know of creating a separate context is to use a new QQmlEngine, QQuickWindow, or derived class.

Depending on what the third party code is expected to do, maybe it should go in its own window, or even in a new process.

[harchu]

I was able to achieve this by creating a new QML component which basically creates a new Engine and loads the source in there. Also any access to the parent property from this sandboxed component returns a null.