diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2019-07-26 13:25:31 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2019-07-29 18:04:23 +0200 |
| commit | 8c51b91f13b391982084e5d4081b219d9e19308f (patch) | |
| tree | 5a8b1e3c9da5113bc31cb03afe2e9fc9a28fd884 | |
| parent | 3bd449fff209b8cc5ea4443648920f1a96934f3d (diff) | |
decode url escape codes and check each path segment
Change-Id: Ie8f7cef912e8dacbc2a0bca73534a7a242a53ca1
Reviewed-on: https://gerrit.libreoffice.org/76396
Reviewed-by: Michael Stahl <Michael.Stahl@cib.de>
Tested-by: Jenkins
| -rw-r--r-- | sfx2/source/doc/objmisc.cxx | 29 |
1 files changed, 28 insertions, 1 deletions
diff --git a/sfx2/source/doc/objmisc.cxx b/sfx2/source/doc/objmisc.cxx index 7411eacd592a..f6712b5cdff9 100644 --- a/sfx2/source/doc/objmisc.cxx +++ b/sfx2/source/doc/objmisc.cxx @@ -42,6 +42,8 @@ #include <com/sun/star/script/provider/XScriptProvider.hpp> #include <com/sun/star/script/provider/XScriptProviderSupplier.hpp> #include <com/sun/star/ucb/SimpleFileAccess.hpp> +#include <com/sun/star/uri/UriReferenceFactory.hpp> +#include <com/sun/star/uri/XVndSunStarScriptUrlReference.hpp> #include <com/sun/star/util/XModifiable.hpp> #include <toolkit/helper/vclunohelper.hxx> @@ -1343,7 +1345,32 @@ namespace // don't allow LibreLogo to be used with our mouseover/etc dom-alike events bool SfxObjectShell::UnTrustedScript(const OUString& rScriptURL) { - return rScriptURL.startsWithIgnoreAsciiCase("vnd.sun.star.script:LibreLogo"); + if (!rScriptURL.startsWith("vnd.sun.star.script:")) + return false; + + // ensure URL Escape Codes are decoded + css::uno::Reference<css::uri::XUriReference> uri( + css::uri::UriReferenceFactory::create(comphelper::getProcessComponentContext())->parse(rScriptURL)); + css::uno::Reference<css::uri::XVndSunStarScriptUrl> sfUri(uri, css::uno::UNO_QUERY); + + if (!sfUri.is()) + return false; + + OUString sScript = sfUri->getName(); + + // check if any path portion matches LibreLogo and ban it if it does + sal_Int32 nIndex = 0; + do + { + OUString aToken = sScript.getToken(0, '/', nIndex); + if (aToken.startsWithIgnoreAsciiCase("LibreLogo")) + { + return true; + } + } + while (nIndex >= 0); + + return false; } ErrCode SfxObjectShell::CallXScript( const Reference< XInterface >& _rxScriptContext, const OUString& _rScriptURL, |