block access to local files on Windows when an invalid URL is used

If you use an absolute path e.g. C:\TEST.PNG it is incorrectly
interpreted as an URL with the scheme as "C". This shows up as a
warning which was added in QTBUG-17731:

QNetworkAccessFileBackendFactory: URL has no schema set, use file:// for files

However, we should simply not process such URLs similar to what was
done for Qt5 via qtproject/qtbase@9581c90395086932d2e853864bf962b0896597d5.

Fixes #1639

CHANGELOG.md

@@ -5,6 +5,7 @@ v0.12.2 (unreleased)
 * add option --dump-render-tree for viewing the WebKit render tree
 * **#1539**: **[qt]** using OpenType fonts now results in selectable text on Windows
 * **#1638**: **[qt]** fix incorrect rendering of JPEG images on Windows Server 2008 x64
+* **#1639**: block access to local files on Windows when an invalid URL is used
 * **#1640**: **[qt]** make table page-break logic opt-in via CSS at the row level
 * **#1676**: do not allow overriding the header/footer settings for cover pages
 * **#1676**: set page margins correctly via computed header/footer heights for multiple URLs

src/lib/multipageloader.cc

@@ -78,7 +78,8 @@ QNetworkReply * MyNetworkAccessManager::createRequest(Operation op, const QNetwo
 		return QNetworkAccessManager::createRequest(op, r2, outgoingData);
 	}
 
-	if (req.url().scheme() == "file" && settings.blockLocalFileAccess) {
+	bool isLocalFileAccess = req.url().scheme().length() <= 1 || req.url().scheme() == "file";
+	if (isLocalFileAccess && settings.blockLocalFileAccess) {
 		bool ok=false;
 		QString path = QFileInfo(req.url().toLocalFile()).canonicalFilePath();
 		QString old = "";