diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2019-06-07 14:04:07 +0100 |
|---|---|---|
| committer | Michael Stahl <Michael.Stahl@cib.de> | 2019-06-17 16:15:06 +0200 |
| commit | 5f3013969bc25e26c675aee25e72e5a8afce2a10 (patch) | |
| tree | cfc03d10f5826f9490ef6d9f808c4e155859f429 | |
| parent | f417038e7a5cfef52bc4fc1b8c2d8b50f641ad6d (diff) | |
explictly exclude LibreLogo from XScript usage
Change-Id: I567647f0e2f8b82e4ef2995c673abe82f4564228
Reviewed-on: https://gerrit.libreoffice.org/73659
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit cb0024e3668979dfdef44db5aa15ddfaf035e695)
| -rw-r--r-- | sfx2/source/doc/objmisc.cxx | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/sfx2/source/doc/objmisc.cxx b/sfx2/source/doc/objmisc.cxx index 8bee369851ec..8594e9522e48 100644 --- a/sfx2/source/doc/objmisc.cxx +++ b/sfx2/source/doc/objmisc.cxx @@ -1346,6 +1346,16 @@ namespace } } +namespace { + +// don't allow LibreLogo to be used with our mouseover/etc dom-alike events +bool UnTrustedScript(const OUString& rScriptURL) +{ + return rScriptURL.startsWithIgnoreAsciiCase("vnd.sun.star.script:LibreLogo"); +} + +} + ErrCode SfxObjectShell::CallXScript( const Reference< XInterface >& _rxScriptContext, const OUString& _rScriptURL, const Sequence< Any >& aParams, Any& aRet, Sequence< sal_Int16 >& aOutParamIndex, Sequence< Any >& aOutParam, bool bRaiseError, const css::uno::Any* pCaller ) { @@ -1358,6 +1368,9 @@ ErrCode SfxObjectShell::CallXScript( const Reference< XInterface >& _rxScriptCon if ( bIsDocumentScript && !lcl_isScriptAccessAllowed_nothrow( _rxScriptContext ) ) return ERRCODE_IO_ACCESSDENIED; + if ( UnTrustedScript(_rScriptURL) ) + return ERRCODE_IO_ACCESSDENIED; + bool bCaughtException = false; Any aException; try |