summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorCaolán McNamara <caolanm@redhat.com>2019-06-07 14:04:07 +0100
committerThorsten Behrens <Thorsten.Behrens@CIB.de>2019-08-30 22:53:57 +0200
commitc8e7cbcf716097f45c7e9447de4263cb683abedb (patch)
treeb3e8da58af85a2abf925ab8b6b30afc98e96b47a
parent1be871b9e6f8df0126a8a67bd6b98f9f7f36fd48 (diff)
explictly exclude LibreLogo from XScript usage
Change-Id: I567647f0e2f8b82e4ef2995c673abe82f4564228 Reviewed-on: https://gerrit.libreoffice.org/73659 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> Tested-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit cb0024e3668979dfdef44db5aa15ddfaf035e695) (cherry picked from commit 9b4d3561b4d8dd7e96695ffaabb805db1d4e25ab)
-rw-r--r--sfx2/source/doc/objmisc.cxx13
1 files changed, 13 insertions, 0 deletions
diff --git a/sfx2/source/doc/objmisc.cxx b/sfx2/source/doc/objmisc.cxx
index 4285fafe8f2a..9e5116521038 100644
--- a/sfx2/source/doc/objmisc.cxx
+++ b/sfx2/source/doc/objmisc.cxx
@@ -1506,6 +1506,16 @@ namespace
}
}
+namespace {
+
+// don't allow LibreLogo to be used with our mouseover/etc dom-alike events
+bool UnTrustedScript(const OUString& rScriptURL)
+{
+ return rScriptURL.startsWithIgnoreAsciiCase("vnd.sun.star.script:LibreLogo");
+}
+
+}
+
ErrCode SfxObjectShell::CallXScript( const Reference< XInterface >& _rxScriptContext, const OUString& _rScriptURL,
const Sequence< Any >& aParams, Any& aRet, Sequence< sal_Int16 >& aOutParamIndex, Sequence< Any >& aOutParam, bool bRaiseError, const ::com::sun::star::uno::Any* pCaller )
{
@@ -1518,6 +1528,9 @@ ErrCode SfxObjectShell::CallXScript( const Reference< XInterface >& _rxScriptCon
if ( bIsDocumentScript && !lcl_isScriptAccessAllowed_nothrow( _rxScriptContext ) )
return ERRCODE_IO_ACCESSDENIED;
+ if ( UnTrustedScript(_rScriptURL) )
+ return ERRCODE_IO_ACCESSDENIED;
+
bool bCaughtException = false;
Any aException;
try