summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDamjan Jovanovic <damjan@apache.org>2018-10-04 17:49:09 +0000
committerDamjan Jovanovic <damjan@apache.org>2018-10-04 17:49:09 +0000
commitae1f34be5c9a49fae1eacdb3c1e5267acea53441 (patch)
tree7126952e5431beb59961fe3c9f3516ff8686d900
parent79bfa97245b3131d6103080523f299e02cbcce13 (diff)
Set up our own libxslt security context in xmlhelp, as per #117643.
Patch by: me
Notes
Notes: merged as: 99c59c594ff6747abef4529fbb2251751737eb7e
-rw-r--r--xmlhelp/source/cxxhelp/provider/urlparameter.cxx30
1 files changed, 23 insertions, 7 deletions
diff --git a/xmlhelp/source/cxxhelp/provider/urlparameter.cxx b/xmlhelp/source/cxxhelp/provider/urlparameter.cxx
index 0b4f71766910..537211ec1984 100644
--- a/xmlhelp/source/cxxhelp/provider/urlparameter.cxx
+++ b/xmlhelp/source/cxxhelp/provider/urlparameter.cxx
@@ -45,6 +45,7 @@
#include <libxslt/xslt.h>
#include <libxslt/transform.h>
#include <libxslt/xsltutils.h>
+#include <libxslt/security.h>
#include "db.hxx"
#include <com/sun/star/io/XActiveDataSink.hpp>
#include <com/sun/star/io/XInputStream.hpp>
@@ -1060,14 +1061,29 @@ InputStreamTransformer::InputStreamTransformer( URLParameter* urlParam,
xmlDocPtr doc = xmlParseFile("vnd.sun.star.zip:/");
- xmlDocPtr res = xsltApplyStylesheet(cur, doc, parameter);
- if (res)
+ xmlDocPtr res = NULL;
+ xsltTransformContextPtr transformContext = xsltNewTransformContext(cur, doc);
+ if (transformContext)
{
- xmlChar *doc_txt_ptr=0;
- int doc_txt_len;
- xsltSaveResultToString(&doc_txt_ptr, &doc_txt_len, res, cur);
- addToBuffer((const char*)doc_txt_ptr, doc_txt_len);
- xmlFree(doc_txt_ptr);
+ xsltSecurityPrefsPtr securityPrefs = xsltNewSecurityPrefs();
+ if (securityPrefs)
+ {
+ xsltSetSecurityPrefs(securityPrefs, XSLT_SECPREF_READ_FILE, xsltSecurityAllow);
+ if (xsltSetCtxtSecurityPrefs(securityPrefs, transformContext) == 0)
+ {
+ res = xsltApplyStylesheetUser(cur, doc, parameter, NULL, NULL, transformContext);
+ if (res)
+ {
+ xmlChar *doc_txt_ptr=0;
+ int doc_txt_len;
+ xsltSaveResultToString(&doc_txt_ptr, &doc_txt_len, res, cur);
+ addToBuffer((const char*)doc_txt_ptr, doc_txt_len);
+ xmlFree(doc_txt_ptr);
+ }
+ }
+ xsltFreeSecurityPrefs(securityPrefs);
+ }
+ xsltFreeTransformContext(transformContext);
}
xmlPopInputCallbacks(); //filePatch
xmlPopInputCallbacks(); //helpPatch