|
 |
91334d |
From 143eedd298113bb20c2807baa49a4c83c2cef70b Mon Sep 17 00:00:00 2001
|
|
|
91334d |
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
|
|
|
91334d |
Date: Fri, 26 Jul 2019 13:25:31 +0100
|
|
|
91334d |
Subject: [PATCH 1/3] decode url escape codes and check each path segment
|
|
|
91334d |
|
|
|
91334d |
Change-Id: Ie8f7cef912e8dacbc2a0bca73534a7a242a53ca1
|
|
|
91334d |
Reviewed-on: https://gerrit.libreoffice.org/76378
|
|
|
91334d |
Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
|
|
|
91334d |
Tested-by: Jenkins
|
|
|
91334d |
(cherry picked from commit 7942929685fafb0f9c82feb8da7279e5103c87f0)
|
|
|
91334d |
Reviewed-on: https://gerrit.libreoffice.org/76451
|
|
|
91334d |
Reviewed-by: Thorsten Behrens <Thorsten.Behrens@CIB.de>
|
|
|
91334d |
Tested-by: Thorsten Behrens <Thorsten.Behrens@CIB.de>
|
|
|
91334d |
---
|
|
|
91334d |
sfx2/source/doc/objmisc.cxx | 30 +++++++++++++++++++++++++++++-
|
|
|
91334d |
1 file changed, 29 insertions(+), 1 deletion(-)
|
|
|
91334d |
|
|
|
91334d |
diff --git a/sfx2/source/doc/objmisc.cxx b/sfx2/source/doc/objmisc.cxx
|
|
|
91334d |
index 8594e9522e48..7e9288524b34 100644
|
|
|
91334d |
--- a/sfx2/source/doc/objmisc.cxx
|
|
|
91334d |
+++ b/sfx2/source/doc/objmisc.cxx
|
|
|
91334d |
@@ -41,6 +41,8 @@
|
|
|
91334d |
#include <com/sun/star/script/provider/XScriptProvider.hpp>
|
|
|
91334d |
#include <com/sun/star/script/provider/XScriptProviderSupplier.hpp>
|
|
|
91334d |
#include <com/sun/star/ucb/SimpleFileAccess.hpp>
|
|
|
91334d |
+#include <com/sun/star/uri/UriReferenceFactory.hpp>
|
|
|
91334d |
+#include <com/sun/star/uri/XVndSunStarScriptUrlReference.hpp>
|
|
|
91334d |
#include <com/sun/star/util/XModifiable.hpp>
|
|
|
91334d |
|
|
|
91334d |
#include <toolkit/helper/vclunohelper.hxx>
|
|
|
91334d |
@@ -1351,7 +1353,33 @@ namespace {
|
|
|
91334d |
// don't allow LibreLogo to be used with our mouseover/etc dom-alike events
|
|
|
91334d |
bool UnTrustedScript(const OUString& rScriptURL)
|
|
|
91334d |
{
|
|
|
91334d |
- return rScriptURL.startsWithIgnoreAsciiCase("vnd.sun.star.script:LibreLogo");
|
|
|
91334d |
+ if (!rScriptURL.startsWith("vnd.sun.star.script:"))
|
|
|
91334d |
+ return false;
|
|
|
91334d |
+
|
|
|
91334d |
+ // ensure URL Escape Codes are decoded
|
|
|
91334d |
+ css::uno::Reference<css::uri::XUriReference> uri(
|
|
|
91334d |
+ css::uri::UriReferenceFactory::create(comphelper::getProcessComponentContext())->parse(rScriptURL));
|
|
|
91334d |
+ css::uno::Reference<css::uri::XVndSunStarScriptUrl> sfUri(uri, css::uno::UNO_QUERY);
|
|
|
91334d |
+
|
|
|
91334d |
+ if (!sfUri.is())
|
|
|
91334d |
+ return false;
|
|
|
91334d |
+
|
|
|
91334d |
+ // pyuno encodes path separator as |
|
|
|
91334d |
+ OUString sScript = sfUri->getName().replace('|', '/');
|
|
|
91334d |
+
|
|
|
91334d |
+ // check if any path portion matches LibreLogo and ban it if it does
|
|
|
91334d |
+ sal_Int32 nIndex = 0;
|
|
|
91334d |
+ do
|
|
|
91334d |
+ {
|
|
|
91334d |
+ OUString aToken = sScript.getToken(0, '/', nIndex);
|
|
|
91334d |
+ if (aToken.startsWithIgnoreAsciiCase("LibreLogo"))
|
|
|
91334d |
+ {
|
|
|
91334d |
+ return true;
|
|
|
91334d |
+ }
|
|
|
91334d |
+ }
|
|
|
91334d |
+ while (nIndex >= 0);
|
|
|
91334d |
+
|
|
|
91334d |
+ return false;
|
|
|
91334d |
}
|
|
|
91334d |
|
|
|
91334d |
}
|
|
|
91334d |
--
|
|
|
91334d |
2.21.0
|
|
|
91334d |
|