rhbz#887420 Implement "block untrusted referer links" feature

For now, this checks for a trusted referer (if the BlockUntrustedRefererLinks
configuration prop is set) in utl::MediaDescriptor::impl_openStreamWithURL and
SvxBrushItem::GetGraphicObject.  Checking in additional places will probably be
necessary to block /all/ unwanted communication.  Also, some places marked
/*TODO?*/ currently pass in an empty referer (which is always considered
trusted) and will probably need to be adapted.

Ideally, Referer URIs would never be empty (and consistently use something like
<private:user> for cases where access is explicitly initiated by the user and
should never be blocked), but that's a very daunting task, so start small by
identifying the places that potentially need blocking and adding appropriate
Referer URIs there.  Also, Referer information should always be computed as
freshly as possible from the context in which an access attempt is made, but,
again, always carrying the information from the context all the way to the
relevant functions is a very daunting task, so for now store the information
upon object instantiation in some cases (SvxBrushItem, SdrGrafObj, ...).

The Referer URI (css.document.MediaDescriptor property; SID_REFERER) was already
used to track macro execution, and there is one place in
SfxApplication::OpenDocExec_Impl where opening of hyperlinks (explicitly clicked
by the user) is done that needs the current document's URI as Referer to check
execution of macro URIs but needs an empty (or <private:user>, see above)
Referer to not block non-macro URIs.  Special code has been added there to
handle that.

Change-Id: Iafbdc07a9fe925d9ee580d4f5778448f18f2ebd9

15 files changed, 63 insertions, 41 deletions

diff --git a/svx/source/inc/xmlxtimp.hxx b/svx/source/inc/xmlxtimp.hxx
index 294a477b19f2..3b3ad7935059 100644
--- a/svx/source/inc/xmlxtimp.hxx
+++ b/svx/source/inc/xmlxtimp.hxx
@@ -41,7 +41,7 @@ public:
 
     virtual ~SvxXMLXTableImport() throw ();
 
-    static bool load( const OUString &rPath,
+    static bool load( const OUString &rPath, const OUString &rReferer,
                       const ::com::sun::star::uno::Reference < ::com::sun::star::embed::XStorage > &xStorage,
                       const ::com::sun::star::uno::Reference< ::com::sun::star::container::XNameContainer >& xTable,
                       bool *bOptLoadedFromStorage ) throw();
diff --git a/svx/source/svdraw/svdmodel.cxx b/svx/source/svdraw/svdmodel.cxx
index 6e29042008e9..fe0a540e18d3 100644
--- a/svx/source/svdraw/svdmodel.cxx
+++ b/svx/source/svdraw/svdmodel.cxx
@@ -694,7 +694,7 @@ void SdrModel::ImpCreateTables()
     {
         if( !bExtColorTable || i != XCOLOR_LIST )
             maProperties[i] = XPropertyList::CreatePropertyList (
-                (XPropertyListType) i, aTablePath );
+                (XPropertyListType) i, aTablePath, ""/*TODO?*/ );
     }
 }
 
diff --git a/svx/source/svdraw/svdograf.cxx b/svx/source/svdraw/svdograf.cxx
index 5dff972e7910..9a96952f7c3d 100644
--- a/svx/source/svdraw/svdograf.cxx
+++ b/svx/source/svdraw/svdograf.cxx
@@ -102,11 +102,11 @@ sal_uInt32 getCacheTimeInMs()
     return 0;
 }
 
-const Graphic ImpLoadLinkedGraphic( const OUString& aFileName, const OUString& aFilterName )
+const Graphic ImpLoadLinkedGraphic( const OUString& aFileName, const OUString& aReferer, const OUString& aFilterName )
 {
     Graphic aGraphic;
 
-    SfxMedium xMed( aFileName, STREAM_STD_READ );
+    SfxMedium xMed( aFileName, aReferer, STREAM_STD_READ );
     xMed.DownLoad();
 
     SvStream* pInStrm = xMed.GetInStream();
@@ -152,6 +152,8 @@ public:
     bool                Connect() { return 0 != GetRealObject(); }
     void                UpdateAsynchron();
     void                RemoveGraphicUpdater();
+
+    OUString getReferer() const { return rGrafObj.aReferer; }
 };
 
 class SdrGraphicUpdater : public ::osl::Thread
@@ -210,7 +212,7 @@ void SAL_CALL SdrGraphicUpdater::onTerminated(void)
 
 void SAL_CALL SdrGraphicUpdater::run(void)
 {
-    Graphic aGraphic( ImpLoadLinkedGraphic( maFileName, maFilterName ) );
+    Graphic aGraphic( ImpLoadLinkedGraphic( maFileName, mrGraphicLink.getReferer(), maFilterName ) );
     SolarMutexGuard aSolarGuard;
     if ( !mbIsTerminated )
     {
@@ -655,10 +657,11 @@ void SdrGrafObj::ImpLinkAbmeldung()
     }
 }
 
-void SdrGrafObj::SetGraphicLink(const OUString& rFileName, const OUString& rFilterName)
+void SdrGrafObj::SetGraphicLink(const OUString& rFileName, const OUString& rReferer, const OUString& rFilterName)
 {
     ImpLinkAbmeldung();
     aFileName = rFileName;
+    aReferer = rReferer;
     aFilterName = rFilterName;
     ImpLinkAnmeldung();
     pGraphic->SetUserData();
@@ -671,6 +674,7 @@ void SdrGrafObj::ReleaseGraphicLink()
 {
     ImpLinkAbmeldung();
     aFileName = OUString();
+    aReferer = "";
     aFilterName = OUString();
 }
 
@@ -733,7 +737,7 @@ bool SdrGrafObj::ImpUpdateGraphicLink( bool bAsynchron ) const
         if ( bAsynchron )
             pGraphicLink->UpdateAsynchron();
         else
-            pGraphicLink->DataChanged( ImpLoadLinkedGraphic( aFileName, aFilterName ) );
+            pGraphicLink->DataChanged( ImpLoadLinkedGraphic( aFileName, aReferer, aFilterName ) );
         bRet = true;
     }
     return bRet;
@@ -889,7 +893,7 @@ SdrGrafObj& SdrGrafObj::operator=( const SdrGrafObj& rObj )
 
     if( rObj.pGraphicLink != NULL)
     {
-        SetGraphicLink( aFileName, aFilterName );
+        SetGraphicLink( aFileName, rObj.aReferer, aFilterName );
     }
 
     ImpSetAttrToGrafInfo();
diff --git a/svx/source/tbxctrls/fillctrl.cxx b/svx/source/tbxctrls/fillctrl.cxx
index 499bccf54fa9..f6beef210d03 100644
--- a/svx/source/tbxctrls/fillctrl.cxx
+++ b/svx/source/tbxctrls/fillctrl.cxx
@@ -302,7 +302,7 @@ void SvxFillToolBoxControl::Update( const SfxPoolItem* pState )
                         aTmpStr = TMP_STR_BEGIN + aString + TMP_STR_END;
 
                         XGradientEntry* pEntry = new XGradientEntry( pGradientItem->GetGradientValue(), aTmpStr );
-                        XGradientList aGradientList( "" );
+                        XGradientList aGradientList( "", ""/*TODO?*/ );
                         aGradientList.Insert( pEntry );
                         aGradientList.SetDirty( sal_False );
                         const Bitmap aBmp = aGradientList.GetUiBitmap( 0 );
@@ -347,7 +347,7 @@ void SvxFillToolBoxControl::Update( const SfxPoolItem* pState )
                         aTmpStr = TMP_STR_BEGIN + aString + TMP_STR_END;
 
                         XHatchEntry* pEntry = new XHatchEntry( pHatchItem->GetHatchValue(), aTmpStr );
-                        XHatchList aHatchList( "" );
+                        XHatchList aHatchList( "", ""/*TODO?*/ );
                         aHatchList.Insert( pEntry );
                         aHatchList.SetDirty( sal_False );
                         const Bitmap aBmp = aHatchList.GetUiBitmap( 0 );
@@ -401,7 +401,7 @@ void SvxFillToolBoxControl::Update( const SfxPoolItem* pState )
                         XBitmapEntry* pEntry = new XBitmapEntry(pBitmapItem->GetGraphicObject(), aTmpStr);
                         XBitmapListRef xBitmapList =
                             XPropertyList::CreatePropertyList(XBITMAP_LIST,
-                            OUString("TmpList"))->AsBitmapList();
+                            OUString("TmpList"), ""/*TODO?*/)->AsBitmapList();
                         xBitmapList->Insert( pEntry );
                         xBitmapList->SetDirty( sal_False );
                         pFillAttrLB->Fill( xBitmapList );
diff --git a/svx/source/unodraw/unoctabl.cxx b/svx/source/unodraw/unoctabl.cxx
index e059060b3d11..37c34c5e554e 100644
--- a/svx/source/unodraw/unoctabl.cxx
+++ b/svx/source/unodraw/unoctabl.cxx
@@ -77,7 +77,7 @@ public:
 
 SvxUnoColorTable::SvxUnoColorTable() throw()
 {
-    pList = XPropertyList::CreatePropertyList( XCOLOR_LIST, SvtPathOptions().GetPalettePath() )->AsColorList();
+    pList = XPropertyList::CreatePropertyList( XCOLOR_LIST, SvtPathOptions().GetPalettePath(), "" )->AsColorList();
 }
 
 SvxUnoColorTable::~SvxUnoColorTable() throw()
diff --git a/svx/source/unodraw/unomod.cxx b/svx/source/unodraw/unomod.cxx
index 0c9eddea63c9..782f3d0309aa 100644
--- a/svx/source/unodraw/unomod.cxx
+++ b/svx/source/unodraw/unomod.cxx
@@ -168,8 +168,10 @@ sal_Bool SvxUnoDrawMSFactory::createEvent( const SdrModel* pDoc, const SdrHint*
     return sal_True;
 }
 
-uno::Reference< uno::XInterface > SAL_CALL SvxUnoDrawMSFactory::createInstance( const OUString& rServiceSpecifier )
-    throw( uno::Exception, uno::RuntimeException )
+namespace {
+
+css::uno::Reference<css::uno::XInterface> create(
+    OUString const & rServiceSpecifier, OUString const & referer)
 {
     if( rServiceSpecifier.startsWith("com.sun.star.drawing.") )
     {
@@ -179,7 +181,7 @@ uno::Reference< uno::XInterface > SAL_CALL SvxUnoDrawMSFactory::createInstance(
             sal_uInt16 nT = (sal_uInt16)(nType & ~E3D_INVENTOR_FLAG);
             sal_uInt32 nI = (nType & E3D_INVENTOR_FLAG)?E3dInventor:SdrInventor;
 
-            return uno::Reference< uno::XInterface >( (drawing::XShape*) SvxDrawPage::CreateShapeByTypeAndInventor( nT, nI ) );
+            return uno::Reference< uno::XInterface >( (drawing::XShape*) SvxDrawPage::CreateShapeByTypeAndInventor( nT, nI, 0, 0, referer ) );
         }
     }
     else if ( rServiceSpecifier == "com.sun.star.document.ImportGraphicObjectResolver" )
@@ -190,21 +192,35 @@ uno::Reference< uno::XInterface > SAL_CALL SvxUnoDrawMSFactory::createInstance(
         return xRet;
     }
 
-    uno::Reference< uno::XInterface > xRet( createTextField( rServiceSpecifier ) );
+    uno::Reference< uno::XInterface > xRet( SvxUnoDrawMSFactory::createTextField( rServiceSpecifier ) );
     if( !xRet.is() )
         throw lang::ServiceNotRegisteredException();
 
     return xRet;
 }
 
+}
+
+uno::Reference< uno::XInterface > SAL_CALL SvxUnoDrawMSFactory::createInstance( const OUString& rServiceSpecifier )
+    throw( uno::Exception, uno::RuntimeException )
+{
+    return create(rServiceSpecifier, "");
+}
+
 uno::Reference< uno::XInterface > SAL_CALL SvxUnoDrawMSFactory::createTextField( const OUString& ServiceSpecifier ) throw(::com::sun::star::uno::Exception, ::com::sun::star::uno::RuntimeException)
 {
     return SvxUnoTextCreateTextField( ServiceSpecifier );
 }
 
-uno::Reference< uno::XInterface > SAL_CALL SvxUnoDrawMSFactory::createInstanceWithArguments( const OUString&, const uno::Sequence< ::com::sun::star::uno::Any >& )
+uno::Reference< uno::XInterface > SAL_CALL SvxUnoDrawMSFactory::createInstanceWithArguments( const OUString& ServiceSpecifier, const uno::Sequence< ::com::sun::star::uno::Any >& Arguments )
     throw( uno::Exception, uno::RuntimeException )
 {
+    OUString arg;
+    if (ServiceSpecifier == "com.sun.star.drawing.GraphicObjectShape"
+        && Arguments.getLength() == 1 && (Arguments[0] >>= arg))
+    {
+        return create(ServiceSpecifier, arg);
+    }
     throw lang::NoSupportException();
 }
 
diff --git a/svx/source/unodraw/unopage.cxx b/svx/source/unodraw/unopage.cxx
index ee6ba75547ea..acf0ce864dd7 100644
--- a/svx/source/unodraw/unopage.cxx
+++ b/svx/source/unodraw/unopage.cxx
@@ -565,7 +565,7 @@ void SvxDrawPage::GetTypeAndInventor( sal_uInt16& rType, sal_uInt32& rInventor,
     }
 }
 
-SvxShape* SvxDrawPage::CreateShapeByTypeAndInventor( sal_uInt16 nType, sal_uInt32 nInventor, SdrObject *pObj, SvxDrawPage *mpPage ) throw()
+SvxShape* SvxDrawPage::CreateShapeByTypeAndInventor( sal_uInt16 nType, sal_uInt32 nInventor, SdrObject *pObj, SvxDrawPage *mpPage, OUString const & referer ) throw()
 {
     SvxShape* pRet = NULL;
     switch( nInventor )
@@ -647,7 +647,7 @@ SvxShape* SvxDrawPage::CreateShapeByTypeAndInventor( sal_uInt16 nType, sal_uInt3
                     pRet = new SvxShapeText( pObj );
                     break;
                 case OBJ_GRAF:
-                    pRet = new SvxGraphicObject( pObj );
+                    pRet = new SvxGraphicObject( pObj, referer );
                     break;
                 case OBJ_FRAME:
                     pRet = new SvxFrameShape( pObj );
diff --git a/svx/source/unodraw/unoshap2.cxx b/svx/source/unodraw/unoshap2.cxx
index 62b842d3946f..cc6ee03089b7 100644
--- a/svx/source/unodraw/unoshap2.cxx
+++ b/svx/source/unodraw/unoshap2.cxx
@@ -1443,8 +1443,8 @@ uno::Sequence< OUString > SAL_CALL SvxShapePolyPolygonBezier::getSupportedServic
 #include <toolkit/helper/vclunohelper.hxx>
 
 //----------------------------------------------------------------------
-SvxGraphicObject::SvxGraphicObject( SdrObject* pObj ) throw()
-:   SvxShapeText( pObj, getSvxMapProvider().GetMap(SVXMAP_GRAPHICOBJECT), getSvxMapProvider().GetPropertySet(SVXMAP_GRAPHICOBJECT, SdrObject::GetGlobalDrawObjectItemPool()) )
+SvxGraphicObject::SvxGraphicObject( SdrObject* pObj, OUString const & referer ) throw()
+:   SvxShapeText( pObj, getSvxMapProvider().GetMap(SVXMAP_GRAPHICOBJECT), getSvxMapProvider().GetPropertySet(SVXMAP_GRAPHICOBJECT, SdrObject::GetGlobalDrawObjectItemPool()) ), referer_(referer)
 {
 }
 
@@ -1529,7 +1529,7 @@ bool SvxGraphicObject::setPropertyValueImpl( const OUString& rName, const SfxIte
                 // normal link
                 OUString            aFilterName;
                 const SfxFilter*    pSfxFilter = NULL;
-                SfxMedium           aSfxMedium( aURL, STREAM_READ | STREAM_SHARE_DENYNONE );
+                SfxMedium           aSfxMedium( aURL, referer_, STREAM_READ | STREAM_SHARE_DENYNONE );
 
                 SFX_APP()->GetFilterMatcher().GuessFilter( aSfxMedium, &pSfxFilter, SFX_FILTER_IMPORT, SFX_FILTER_NOTINSTALLED | SFX_FILTER_EXECUTABLE );
 
@@ -1558,7 +1558,7 @@ bool SvxGraphicObject::setPropertyValueImpl( const OUString& rName, const SfxIte
                 //          it is possible that our shape is removed while where in this
                 //          method.
                 if( mpObj.is() )
-                    static_cast<SdrGrafObj*>(mpObj.get())->SetGraphicLink( aURL, aFilterName );
+                    static_cast<SdrGrafObj*>(mpObj.get())->SetGraphicLink( aURL, referer_, aFilterName );
 
             }
             bOk = true;
diff --git a/svx/source/xml/xmlxtimp.cxx b/svx/source/xml/xmlxtimp.cxx
index ca821cf6c768..5eba668b376d 100644
--- a/svx/source/xml/xmlxtimp.cxx
+++ b/svx/source/xml/xmlxtimp.cxx
@@ -369,7 +369,7 @@ static void openStorageStream( xml::sax::InputSource *pParserInput,
     *ppGraphicHelper = SvXMLGraphicHelper::Create( xStorage, GRAPHICHELPER_MODE_READ );
 }
 
-bool SvxXMLXTableImport::load( const OUString &rPath,
+bool SvxXMLXTableImport::load( const OUString &rPath, const OUString &rReferer,
                                const uno::Reference < embed::XStorage > &xStorage,
                                const uno::Reference< XNameContainer >& xTable,
                                bool *bOptLoadedFromStorage ) throw()
@@ -391,7 +391,7 @@ bool SvxXMLXTableImport::load( const OUString &rPath,
 
         if( !bUseStorage || !xStorage.is() )
         {
-            SfxMedium aMedium( rPath, STREAM_READ | STREAM_NOCREATE );
+            SfxMedium aMedium( rPath, rReferer, STREAM_READ | STREAM_NOCREATE );
             aParserInput.sSystemId = aMedium.GetName();
 
             if( aMedium.IsStorage() )
diff --git a/svx/source/xoutdev/xtabcolr.cxx b/svx/source/xoutdev/xtabcolr.cxx
index a1e6eb5c5a2f..d70a4fbcdb5e 100644
--- a/svx/source/xoutdev/xtabcolr.cxx
+++ b/svx/source/xoutdev/xtabcolr.cxx
@@ -30,7 +30,7 @@ using namespace com::sun::star;
 XColorListRef XColorList::CreateStdColorList()
 {
     return XPropertyList::CreatePropertyList(
-        XCOLOR_LIST, SvtPathOptions().GetPalettePath() )->AsColorList();
+        XCOLOR_LIST, SvtPathOptions().GetPalettePath(), "" )->AsColorList();
 }
 
 XColorListRef XColorList::GetStdColorList()
diff --git a/svx/source/xoutdev/xtabdash.cxx b/svx/source/xoutdev/xtabdash.cxx
index d34e60fe156d..0b81754c596a 100644
--- a/svx/source/xoutdev/xtabdash.cxx
+++ b/svx/source/xoutdev/xtabdash.cxx
@@ -33,8 +33,8 @@
 
 using namespace com::sun::star;
 
-XDashList::XDashList(const OUString& rPath)
-    : XPropertyList(XDASH_LIST, rPath)
+XDashList::XDashList(const OUString& rPath, const OUString& rReferer)
+    : XPropertyList(XDASH_LIST, rPath, rReferer)
     , maBitmapSolidLine()
     , maStringSolidLine()
     , maStringNoLine()
diff --git a/svx/source/xoutdev/xtabgrdt.cxx b/svx/source/xoutdev/xtabgrdt.cxx
index a78cde57e1c9..5c03ccab5923 100644
--- a/svx/source/xoutdev/xtabgrdt.cxx
+++ b/svx/source/xoutdev/xtabgrdt.cxx
@@ -34,8 +34,8 @@
 
 using namespace com::sun::star;
 
-XGradientList::XGradientList( const OUString& rPath )
-:   XPropertyList( XGRADIENT_LIST, rPath )
+XGradientList::XGradientList( const OUString& rPath, const OUString& rReferer )
+:   XPropertyList( XGRADIENT_LIST, rPath, rReferer )
 {
 }
 
diff --git a/svx/source/xoutdev/xtabhtch.cxx b/svx/source/xoutdev/xtabhtch.cxx
index ba75ca3265c2..3baa12335f2c 100644
--- a/svx/source/xoutdev/xtabhtch.cxx
+++ b/svx/source/xoutdev/xtabhtch.cxx
@@ -34,8 +34,8 @@
 using namespace ::com::sun::star;
 using namespace ::rtl;
 
-XHatchList::XHatchList(const OUString& rPath)
-  : XPropertyList( XHATCH_LIST, rPath )
+XHatchList::XHatchList(const OUString& rPath, const OUString& rReferer)
+  : XPropertyList( XHATCH_LIST, rPath, rReferer )
 {
 }
 
diff --git a/svx/source/xoutdev/xtable.cxx b/svx/source/xoutdev/xtable.cxx
index 53894b838a2e..e0d0d4b0da36 100644
--- a/svx/source/xoutdev/xtable.cxx
+++ b/svx/source/xoutdev/xtable.cxx
@@ -122,10 +122,11 @@ XBitmapEntry::XBitmapEntry(const XBitmapEntry& rOther)
 
 XPropertyList::XPropertyList(
     XPropertyListType type,
-    const OUString& rPath
+    const OUString& rPath, const OUString& rReferer
 ) : meType           ( type ),
     maName           ( RTL_CONSTASCII_USTRINGPARAM( "standard" ) ),
     maPath           ( rPath ),
+    maReferer        ( rReferer ),
     mbListDirty      ( true ),
     mbEmbedInDocument( false )
 {
@@ -249,7 +250,7 @@ bool XPropertyList::Load()
         if( aURL.getExtension().isEmpty() )
             aURL.setExtension( GetDefaultExt() );
 
-        return SvxXMLXTableImport::load( aURL.GetMainURL( INetURLObject::NO_DECODE ),
+        return SvxXMLXTableImport::load( aURL.GetMainURL( INetURLObject::NO_DECODE ), maReferer,
                                          uno::Reference < embed::XStorage >(),
                                          createInstance(), NULL );
     }
@@ -257,12 +258,12 @@ bool XPropertyList::Load()
 }
 
 bool XPropertyList::LoadFrom( const uno::Reference < embed::XStorage > &xStorage,
-                                  const OUString &rURL )
+                              const OUString &rURL, const OUString &rReferer )
 {
     if( !mbListDirty )
         return false;
     mbListDirty = false;
-    return SvxXMLXTableImport::load( rURL, xStorage, createInstance(), &mbEmbedInDocument );
+    return SvxXMLXTableImport::load( rURL, rReferer, xStorage, createInstance(), &mbEmbedInDocument );
 }
 
 bool XPropertyList::Save()
@@ -292,12 +293,13 @@ bool XPropertyList::SaveTo( const uno::Reference< embed::XStorage > &xStorage,
 }
 
 XPropertyListRef XPropertyList::CreatePropertyList( XPropertyListType t,
-                                                    const OUString& rPath )
+                                                    const OUString& rPath,
+                                                    const OUString& rReferer )
 {
     XPropertyListRef pRet;
 
 #define MAP(e,c) \
-        case e: pRet = XPropertyListRef (new c( rPath ) ); break
+        case e: pRet = XPropertyListRef (new c( rPath, rReferer ) ); break
     switch (t) {
         MAP( XCOLOR_LIST, XColorList );
         MAP( XLINE_END_LIST, XLineEndList );
@@ -326,7 +328,7 @@ XPropertyList::CreatePropertyListFromURL( XPropertyListType t,
     aPathURL.removeFinalSlash();
 
     XPropertyListRef pList = XPropertyList::CreatePropertyList(
-        t, aPathURL.GetMainURL( INetURLObject::NO_DECODE ) );
+        t, aPathURL.GetMainURL( INetURLObject::NO_DECODE ), "" );
     pList->SetName( aURL.getName() );
 
     return pList;
diff --git a/svx/source/xoutdev/xtablend.cxx b/svx/source/xoutdev/xtablend.cxx
index 4e782027f7ff..6db53818b43f 100644
--- a/svx/source/xoutdev/xtablend.cxx
+++ b/svx/source/xoutdev/xtablend.cxx
@@ -33,8 +33,8 @@
 
 using namespace com::sun::star;
 
-XLineEndList::XLineEndList( const OUString& rPath )
-    : XPropertyList( XLINE_END_LIST, rPath )
+XLineEndList::XLineEndList( const OUString& rPath, const OUString& rReferer )
+    : XPropertyList( XLINE_END_LIST, rPath, rReferer )
 {
 }