Qt D-Bus Security Considerations

This page covers security considerations for applications using Qt D-Bus.

Exporting QObjects directly

QDBusConnection::registerObject() can export a QObject's own slots directly, by passing ExportNonScriptableSlots or ExportAllSlots. Doing so makes all of that object's invocables accessible remotely, including those inherited from any superclass, not only the ones declared on the object's own class. Only QObject's own built-in slots (such as deleteLater()) are excluded.

If you need precise, explicit control over which methods are bus-callable, use the adaptor pattern instead. See Using Qt D-Bus Adaptors for details.

Message validation relies on libdbus-1

Qt D-Bus does not itself validate incoming message size, nesting depth, or type validity. This is delegated to libdbus-1, which rejects malformed messages before Qt D-Bus reads them. Qt D-Bus links against whichever libdbus-1 is installed on the system, not a version it ships or controls, so this validation depends on that system library's version and behavior.