security: force PlainText on status bar label (title spoofing)

ober

ae0fac9762edb241e9d20c087d7a636b3113056d

diff --git a/qt-webengine/src/browser_window.cpp b/qt-webengine/src/browser_window.cpp
index 506fced..1f70026 100644
--- a/qt-webengine/src/browser_window.cpp
+++ b/qt-webengine/src/browser_window.cpp
@@ -117,6 +117,13 @@ JWB_API JwbHandle jwb_window_open(void) {
   w->stack = new QStackedWidget(central);
   w->status = new QLabel(central);
   w->status->setObjectName("jwb_status");
+  // The status line embeds the page's document.title, which is attacker
+  // controlled. QLabel defaults to Qt::AutoText, so a title containing markup
+  // (e.g. "<font ...>https://bank.com</font>") is rendered as rich text and can
+  // spoof a trusted URL in the only place this browser shows the current site
+  // (there is no address bar), and even pull in remote <img> resources from the
+  // browser chrome. Force literal rendering.
+  w->status->setTextFormat(Qt::PlainText);
   w->minibuffer = new QLineEdit(central);
   w->minibuffer->setObjectName("jwb_minibuffer");
   w->minibuffer->hide(); // shown only while a prompt is active (Stage 2)