diff options
| author | Caolán McNamara <caolan.mcnamara@collabora.com> | 2025-01-07 08:59:25 +0000 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2025-01-09 14:42:31 +0100 |
| commit | 17e2f28d4be1e159fcbc03e5f56a8d7e145dcb20 (patch) | |
| tree | 29706d3949bd9f4752f5276cf9bc871e8b8915ab | |
| parent | 858569d1ecfb621ea28b6e18b4489319fd07a3dd (diff) | |
check if non-file uris could be interpreted as a file system pathname
co-23.05.18-1distro/collabora/co-23.05
Change-Id: If283bec44ad1d648c68a5d0f028855e09c09017e
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/179868
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit 400970acf4241632d084f66275161fc4b4ac1b21)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/180012
Reviewed-by: Andras Timar <andras.timar@collabora.com>
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
| -rw-r--r-- | shell/Library_syssh.mk | 4 | ||||
| -rw-r--r-- | shell/source/win32/SysShExec.cxx | 9 |
2 files changed, 13 insertions, 0 deletions
diff --git a/shell/Library_syssh.mk b/shell/Library_syssh.mk index 72ff73842dc3..27657c4456aa 100644 --- a/shell/Library_syssh.mk +++ b/shell/Library_syssh.mk @@ -25,6 +25,10 @@ $(eval $(call gb_Library_use_system_win32_libs,syssh,\ shell32 \ )) +$(eval $(call gb_Library_use_libraries,syssh,\ + tl \ +)) + $(eval $(call gb_Library_set_componentfile,syssh,shell/source/win32/syssh,services)) $(eval $(call gb_Library_add_exception_objects,syssh,\ diff --git a/shell/source/win32/SysShExec.cxx b/shell/source/win32/SysShExec.cxx index 7be77d6344de..c485cb8c37e2 100644 --- a/shell/source/win32/SysShExec.cxx +++ b/shell/source/win32/SysShExec.cxx @@ -38,6 +38,7 @@ #include <o3tl/runtimetooustring.hxx> #include <o3tl/safeCoInitUninit.hxx> #include <o3tl/string_view.hxx> +#include <tools/urlobj.hxx> #include <prewin.h> #include <Shlobj.h> @@ -360,6 +361,14 @@ void SAL_CALL CSysShExec::execute( const OUString& aCommand, const OUString& aPa } } } + } else { + // Filter out input that technically is a non-file URI, but could be interpreted by + // ShellExecuteExW as a file system pathname. + if (INetURLObject(aCommand, INetProtocol::File).GetProtocol() == INetProtocol::File) { + throw css::lang::IllegalArgumentException( + "XSystemShellExecute.execute URIS_ONLY with non-URI pathname " + aCommand, + static_cast< cppu::OWeakObject * >(this), 0); + } } } |