use AllowedLinkProtocolFromDocument in writer/calc/impress/draw

and add some protocols that don't make sense as floating frame targets

Change-Id: Id900a5eef248731d1184c1df501a2cf7a2de7eb9
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158910
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit 11ebdfef16501c6d35c3e3d0d62507f706557c71)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158901
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
(cherry picked from commit ca5225ae4a53a8e99640cfa9440e112f3b39b11b)

warn about exotic protocols as well

Change-Id: I50dcf4f36cd20d75f5ad3876353143268740a50f
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158902
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
(cherry picked from commit 1f5371361875629065a22560e39b9253eb87a23b)

default to ignoring libreoffice special-purpose protocols in calc hyperlink

Change-Id: Ib9f62be3acc05f24ca234dec0fec21e24579e9de
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158911
Tested-by: Jenkins
Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit b6062623b4d69c79e90e9365ac7c5e7f11986793)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159046
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
(cherry picked from commit 113e16674e94955702edde514a9fb86fbe70b3ae)

reuse AllowedLinkProtocolFromDocument in writer

reorg calc hyperlink check to reuse elsewhere

Change-Id: I20ae3c5df15502c3a0a366fb4a2924c06ffac3d0
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159487
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit e6a7537762e19fde446441edd10d301f9b37ce75)

reuse AllowedLinkProtocolFromDocument in writer

Change-Id: Iacf5e313fc6ca5f7d69ca6986a036f0e1ab1f2a0
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159488
Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit 32535dfa82200b54296838b52285c054fbe5e51d)

combine these hyperlink dispatchers into one call

Change-Id: Icb7822e811013de648ccf2fbb23a5f0be9e29bb0
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159489
Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit 0df175ccc6ea542bc5801f631ff72bed187042eb)

we can have just one LoadURL for writer

Change-Id: Ia0162ee1c275292fcf200bad4662e4c2c6b7b972
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159557
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit 521ca9cf6acbae96cf95d9740859c9682212013d)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159858
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
(cherry picked from commit e32b8601dbd63cf01497889601d6c9c1241106d6)

reuse AllowedLinkProtocolFromDocument in impress/draw

Change-Id: I73ca4f087946a45dbf92d69a0dc1e769de9b5690
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159843
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit f0942eed2eb328b04856f20613f5226d66b66a20)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159759
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159859
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
(cherry picked from commit 402fd49351123c476650c7280471d05d4de85d5d)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159923

18 files changed, 127 insertions, 42 deletions

diff --git a/dbaccess/source/core/dataaccess/ModelImpl.cxx b/dbaccess/source/core/dataaccess/ModelImpl.cxx
index c24e2376e41a..60c467af5ccc 100644
--- a/dbaccess/source/core/dataaccess/ModelImpl.cxx
+++ b/dbaccess/source/core/dataaccess/ModelImpl.cxx
@@ -1133,7 +1133,8 @@ bool ODatabaseModelImpl::checkMacrosOnLoading()
 {
     Reference< XInteractionHandler > xInteraction;
     xInteraction = m_aMediaDescriptor.getOrDefault( "InteractionHandler", xInteraction );
-    return m_aMacroMode.checkMacrosOnLoading( xInteraction );
+    const bool bHasMacros = m_aMacroMode.hasMacros();
+    return m_aMacroMode.checkMacrosOnLoading(xInteraction, false /*HasValidContentSignature*/, bHasMacros);
 }
 
 void ODatabaseModelImpl::resetMacroExecutionMode()
diff --git a/include/sfx2/docmacromode.hxx b/include/sfx2/docmacromode.hxx
index aa120240688e..c11601a40ae4 100644
--- a/include/sfx2/docmacromode.hxx
+++ b/include/sfx2/docmacromode.hxx
@@ -261,6 +261,8 @@ namespace sfx2
         */
         static bool storageHasMacros( const css::uno::Reference< css::embed::XStorage >& _rxStorage );
 
+        bool hasMacros() const;
+
         static bool containerHasBasicMacros( const css::uno::Reference< css::script::XLibraryContainer >& xContainer );
         /** checks the macro execution mode while loading the document.
 
@@ -288,7 +290,7 @@ namespace sfx2
         bool
                 checkMacrosOnLoading(
                     const css::uno::Reference< css::task::XInteractionHandler >& _rxInteraction,
-                    bool bHasValidContentSignature = false
+                    bool bHasValidContentSignature, bool bHasMacros
                 );
 
     private:
diff --git a/include/sfx2/objsh.hxx b/include/sfx2/objsh.hxx
index 872127048db1..5f19eb9adab0 100644
--- a/include/sfx2/objsh.hxx
+++ b/include/sfx2/objsh.hxx
@@ -206,6 +206,9 @@ private:
 
     SAL_DLLPRIVATE bool SaveTo_Impl(SfxMedium &rMedium, const SfxItemSet* pSet );
 
+    // true if the document had macros (or similar) on load to trigger warning user
+    SAL_DLLPRIVATE bool  GetHadCheckedMacrosOnLoad() const;
+
 protected:
                                 SfxObjectShell(SfxObjectCreateMode);
                                 SfxObjectShell(SfxModelFlags);    // see sfxmodelfactory.hxx
@@ -433,6 +436,9 @@ public:
     void                        SetMacroCallsSeenWhileLoading();
     bool                        GetMacroCallsSeenWhileLoading() const;
 
+    // true if this type of link, from a document, is allowed by the user to be passed to uno:OpenDoc
+    static bool                 AllowedLinkProtocolFromDocument(const OUString& rUrl, SfxObjectShell* pObjShell, weld::Window* pDialogParent);
+
     const css::uno::Sequence< css::beans::PropertyValue >& GetModifyPasswordInfo() const;
     bool                        SetModifyPasswordInfo( const css::uno::Sequence< css::beans::PropertyValue >& aInfo );
 
diff --git a/include/sfx2/strings.hrc b/include/sfx2/strings.hrc
index 317dd88061df..b1bfa6902793 100644
--- a/include/sfx2/strings.hrc
+++ b/include/sfx2/strings.hrc
@@ -101,6 +101,7 @@
 #define STR_GB                                  NC_("STR_GB", "GB")
 #define STR_QUERY_LASTVERSION                   NC_("STR_QUERY_LASTVERSION", "Cancel all changes?")
 #define STR_NO_WEBBROWSER_FOUND                 NC_("STR_NO_WEBBROWSER_FOUND", "Opening \"$(ARG1)\" failed with error code $(ARG2) and message: \"$(ARG3)\"\nMaybe no web browser could be found on your system. In that case, please check your Desktop Preferences or install a web browser (for example, Firefox) in the default location requested during the browser installation.")
+#define STR_DANGEROUS_TO_OPEN                   NC_("STR_DANGEROUS_TO_OPEN", "It might be dangerous to open \"$(ARG1)\".\nDo you really want to open it?")
 #define STR_NO_ABS_URI_REF                      NC_("STR_NO_ABS_URI_REF", "\"$(ARG1)\" cannot be passed to an external application to open it (e.g., it might not be an absolute URL, or might denote no existing file).")
 #define STR_GID_INTERN                          NC_("STR_GID_INTERN", "Internal")
 #define STR_GID_APPLICATION                     NC_("STR_GID_APPLICATION", "Application")
diff --git a/include/tools/urlobj.hxx b/include/tools/urlobj.hxx
index 1fb5f4e86aea..66c562f90062 100644
--- a/include/tools/urlobj.hxx
+++ b/include/tools/urlobj.hxx
@@ -920,6 +920,11 @@ public:
 
     void changeScheme(INetProtocol eTargetScheme);
 
+    // INetProtocol::Macro, INetProtocol::Uno, INetProtocol::Slot,
+    // vnd.sun.star.script, etc. All the types of URLs which shouldn't
+    // be accepted from an outside controlled source
+    bool IsExoticProtocol() const;
+
 private:
     // General Structure:
 
diff --git a/sc/source/core/data/global.cxx b/sc/source/core/data/global.cxx
index c7b34d27b7a5..50dc2fc62cc6 100644
--- a/sc/source/core/data/global.cxx
+++ b/sc/source/core/data/global.cxx
@@ -35,6 +35,8 @@
 #include <svl/zformat.hxx>
 #include <vcl/keycodes.hxx>
 #include <vcl/virdev.hxx>
+#include <vcl/weld.hxx>
+#include <vcl/window.hxx>
 #include <vcl/settings.hxx>
 #include <vcl/svapp.hxx>
 #include <unotools/charclass.hxx>
@@ -773,7 +775,7 @@ void ScGlobal::OpenURL(const OUString& rURL, const OUString& rTarget, bool bIgno
 
     OUString aUrlName( rURL );
     SfxViewFrame* pFrame = nullptr;
-    const SfxObjectShell* pObjShell = nullptr;
+    SfxObjectShell* pObjShell = nullptr;
     OUString aReferName;
     if ( pScActiveViewShell )
     {
@@ -807,6 +809,9 @@ void ScGlobal::OpenURL(const OUString& rURL, const OUString& rTarget, bool bIgno
             aUrlName = aNewUrlName;
     }
 
+    if (!SfxObjectShell::AllowedLinkProtocolFromDocument(aUrlName, pObjShell, pFrame ? pFrame->GetWindow().GetFrameWeld() : nullptr))
+        return;
+
     SfxStringItem aUrl( SID_FILE_NAME, aUrlName );
     SfxStringItem aTarget( SID_TARGETNAME, rTarget );
     if ( nScClickMouseModifier & KEY_SHIFT )     // control-click -> into new window
diff --git a/sd/source/ui/app/sdmod1.cxx b/sd/source/ui/app/sdmod1.cxx
index 35bf5ebfb5ea..7234a340c187 100644
--- a/sd/source/ui/app/sdmod1.cxx
+++ b/sd/source/ui/app/sdmod1.cxx
@@ -33,6 +33,7 @@
 #include <sfx2/docfile.hxx>
 #include <sfx2/request.hxx>
 #include <sfx2/templatedlg.hxx>
+#include <svl/stritem.hxx>
 #include <editeng/eeitem.hxx>
 
 #include <svx/svxids.hrc>
@@ -193,26 +194,32 @@ void SdModule::Execute(SfxRequest& rReq)
         {
             bool bIntercept = false;
             ::sd::DrawDocShell* pDocShell = dynamic_cast< ::sd::DrawDocShell *>( SfxObjectShell::Current() );
-            if (pDocShell)
+            ::sd::ViewShell* pViewShell = pDocShell ? pDocShell->GetViewShell() : nullptr;
+            if (pViewShell)
             {
-                ::sd::ViewShell* pViewShell = pDocShell->GetViewShell();
-                if (pViewShell)
+                if( sd::SlideShow::IsRunning( pViewShell->GetViewShellBase() ) )
                 {
-                    if( sd::SlideShow::IsRunning( pViewShell->GetViewShellBase() ) )
+                    // Prevent documents from opening while the slide
+                    // show is running, except when this request comes
+                    // from a shape interaction.
+                    if (rReq.GetArgs() == nullptr)
                     {
-                        // Prevent documents from opening while the slide
-                        // show is running, except when this request comes
-                        // from a shape interaction.
-                        if (rReq.GetArgs() == nullptr)
-                        {
-                            bIntercept = true;
-                        }
+                        bIntercept = true;
                     }
                 }
             }
 
             if (!bIntercept)
             {
+                if (const SfxStringItem* pURLItem = rReq.GetArg<SfxStringItem>(SID_FILE_NAME))
+                {
+                    if (!pViewShell || !SfxObjectShell::AllowedLinkProtocolFromDocument(pURLItem->GetValue(),
+                                                                                        pViewShell->GetObjectShell(),
+                                                                                        pViewShell->GetFrameWeld()))
+                    {
+                        return;
+                    }
+                }
                 SfxGetpApp()->ExecuteSlot(rReq, SfxGetpApp()->GetInterface());
             }
             else
diff --git a/sfx2/source/doc/docmacromode.cxx b/sfx2/source/doc/docmacromode.cxx
index c49f7cec00c6..919033cbaf5d 100644
--- a/sfx2/source/doc/docmacromode.cxx
+++ b/sfx2/source/doc/docmacromode.cxx
@@ -403,8 +403,12 @@ namespace sfx2
         return bHasMacros;
     }
 
+    bool DocumentMacroMode::hasMacros() const
+    {
+        return m_xData->m_rDocumentAccess.documentStorageHasMacros() || hasMacroLibrary() || m_xData->m_rDocumentAccess.macroCallsSeenWhileLoading();
+    }
 
-    bool DocumentMacroMode::checkMacrosOnLoading( const Reference< XInteractionHandler >& rxInteraction, bool bHasValidContentSignature )
+    bool DocumentMacroMode::checkMacrosOnLoading( const Reference< XInteractionHandler >& rxInteraction, bool bHasValidContentSignature, bool bHasMacros )
     {
         bool bAllow = false;
         if ( SvtSecurityOptions().IsMacroDisabled() )
@@ -414,7 +418,7 @@ namespace sfx2
         }
         else
         {
-            if (m_xData->m_rDocumentAccess.documentStorageHasMacros() || hasMacroLibrary() || m_xData->m_rDocumentAccess.macroCallsSeenWhileLoading())
+            if (bHasMacros)
             {
                 if (m_xData->m_rDocumentAccess.macroCallsSeenWhileLoading())
                     m_bNeedsContentSigned = true;
diff --git a/sfx2/source/doc/iframe.cxx b/sfx2/source/doc/iframe.cxx
index e73fb1f1f2d1..714d9da73775 100644
--- a/sfx2/source/doc/iframe.cxx
+++ b/sfx2/source/doc/iframe.cxx
@@ -18,6 +18,7 @@
  */
 
 #include <sal/config.h>
+#include <sal/log.hxx>
 
 #include <com/sun/star/awt/XWindowPeer.hpp>
 #include <com/sun/star/frame/XDispatch.hpp>
@@ -167,8 +168,11 @@ sal_Bool SAL_CALL IFrameObject::load(
         xTrans->parseStrict( aTargetURL );
 
         INetURLObject aURLObject(aTargetURL.Complete);
-        if (aURLObject.GetProtocol() == INetProtocol::Macro || aURLObject.isSchemeEqualTo(u"vnd.sun.star.script"))
+        if (aURLObject.IsExoticProtocol())
+        {
+            SAL_WARN("sfx", "IFrameObject::load ignoring: " << aTargetURL.Complete);
             return false;
+        }
 
         uno::Reference<frame::XFramesSupplier> xParentFrame = xFrame->getCreator();
         SfxObjectShell* pDoc = SfxMacroLoader::GetObjectShell(xParentFrame);
diff --git a/sfx2/source/doc/objmisc.cxx b/sfx2/source/doc/objmisc.cxx
index 75d8e1505987..ca6995fb55c4 100644
--- a/sfx2/source/doc/objmisc.cxx
+++ b/sfx2/source/doc/objmisc.cxx
@@ -944,9 +944,42 @@ void SfxObjectShell::CheckSecurityOnLoading_Impl()
 
     // check macro security
     const bool bHasValidContentSignature = HasValidSignatures();
-    pImpl->aMacroMode.checkMacrosOnLoading( xInteraction, bHasValidContentSignature );
+    const bool bHasMacros = pImpl->aMacroMode.hasMacros();
+    pImpl->aMacroMode.checkMacrosOnLoading( xInteraction, bHasValidContentSignature, bHasMacros );
+    pImpl->m_bHadCheckedMacrosOnLoad = bHasMacros;
 }
 
+bool SfxObjectShell::GetHadCheckedMacrosOnLoad() const
+{
+    return pImpl->m_bHadCheckedMacrosOnLoad;
+}
+
+bool SfxObjectShell::AllowedLinkProtocolFromDocument(const OUString& rUrl, SfxObjectShell* pObjShell, weld::Window* pDialogParent)
+{
+    if (!INetURLObject(rUrl).IsExoticProtocol())
+        return true;
+    // Default to ignoring exotic protocols
+    bool bAllow = false;
+    if (pObjShell)
+    {
+        // If the document had macros when loaded then follow the allowed macro-mode
+        if (pObjShell->GetHadCheckedMacrosOnLoad())
+            bAllow = pObjShell->AdjustMacroMode();
+        else // otherwise ask the user, defaulting to cancel
+        {
+            //Reuse URITools::onOpenURI warning string
+            std::unique_ptr<weld::MessageDialog> xQueryBox(Application::CreateMessageDialog(pDialogParent,
+                                                           VclMessageType::Warning, VclButtonsType::YesNo,
+                                                           SfxResId(STR_DANGEROUS_TO_OPEN)));
+            xQueryBox->set_primary_text(xQueryBox->get_primary_text().replaceFirst("$(ARG1)",
+                INetURLObject::decode(rUrl, INetURLObject::DecodeMechanism::Unambiguous)));
+            xQueryBox->set_default_response(RET_NO);
+            bAllow = xQueryBox->run() == RET_YES;
+        }
+    }
+    SAL_WARN_IF(!bAllow, "sfx.appl", "SfxObjectShell::AllowedLinkProtocolFromDocument ignoring: " << rUrl);
+    return bAllow;
+}
 
 void SfxObjectShell::CheckEncryption_Impl( const uno::Reference< task::XInteractionHandler >& xHandler )
 {
diff --git a/sfx2/source/doc/objxtor.cxx b/sfx2/source/doc/objxtor.cxx
index bc54bcc7e40b..de02b35fb854 100644
--- a/sfx2/source/doc/objxtor.cxx
+++ b/sfx2/source/doc/objxtor.cxx
@@ -210,6 +210,7 @@ SfxObjectShell_Impl::SfxObjectShell_Impl( SfxObjectShell& _rDocShell )
     ,m_bAllowShareControlFileClean( true )
     ,m_bConfigOptionsChecked( false )
     ,m_bMacroCallsSeenWhileLoading( false )
+    ,m_bHadCheckedMacrosOnLoad( false )
     ,lErr(ERRCODE_NONE)
     ,nEventId ( SfxEventHintId::NONE )
     ,nLoadedFlags ( SfxLoadedFlags::ALL )
diff --git a/sfx2/source/inc/objshimp.hxx b/sfx2/source/inc/objshimp.hxx
index 21799f7cad49..d98a6d0673d5 100644
--- a/sfx2/source/inc/objshimp.hxx
+++ b/sfx2/source/inc/objshimp.hxx
@@ -90,7 +90,8 @@ struct SfxObjectShell_Impl : public ::sfx2::IMacroDocumentAccess
                         m_bSharedXMLFlag:1, // whether the document should be edited in shared mode
                         m_bAllowShareControlFileClean:1, // whether the flag should be stored in xml file
                         m_bConfigOptionsChecked:1, // whether or not the user options are checked after the Options dialog is closed.
-                        m_bMacroCallsSeenWhileLoading:1; // whether or not the user options are checked after the Options dialog is closed.
+                        m_bMacroCallsSeenWhileLoading:1, // whether or not macro calls were seen when loading document.
+                        m_bHadCheckedMacrosOnLoad:1; // if document contained macros (or calls) when loaded
 
     IndexBitSet         aBitSet;
     ErrCode             lErr;
diff --git a/sw/source/filter/html/htmlplug.cxx b/sw/source/filter/html/htmlplug.cxx
index 90036cfac67a..424b7d10b159 100644
--- a/sw/source/filter/html/htmlplug.cxx
+++ b/sw/source/filter/html/htmlplug.cxx
@@ -1092,7 +1092,7 @@ void SwHTMLParser::InsertFloatingFrame()
 
                 OUString sHRef = aFrameDesc.GetURL().GetMainURL( INetURLObject::DecodeMechanism::NONE );
 
-                if (INetURLObject(sHRef).GetProtocol() == INetProtocol::Macro)
+                if (INetURLObject(sHRef).IsExoticProtocol())
                     NotifyMacroEventRead();
 
                 xSet->setPropertyValue("FrameURL", uno::makeAny( sHRef ) );
diff --git a/sw/source/filter/xml/xmltexti.cxx b/sw/source/filter/xml/xmltexti.cxx
index eaf45dd91cd4..267f4cad960f 100644
--- a/sw/source/filter/xml/xmltexti.cxx
+++ b/sw/source/filter/xml/xmltexti.cxx
@@ -860,7 +860,7 @@ uno::Reference< XPropertySet > SwXMLTextImportHelper::createAndInsertFloatingFra
                 OUString sHRef = URIHelper::SmartRel2Abs(
                             INetURLObject( GetXMLImport().GetBaseURL() ), rHRef );
 
-                if (INetURLObject(sHRef).GetProtocol() == INetProtocol::Macro)
+                if (INetURLObject(sHRef).IsExoticProtocol())
                     GetXMLImport().NotifyMacroEventRead();
 
                 xSet->setPropertyValue("FrameURL",
diff --git a/sw/source/uibase/shells/drwtxtex.cxx b/sw/source/uibase/shells/drwtxtex.cxx
index 9f754443d68d..139e85fd0f19 100644
--- a/sw/source/uibase/shells/drwtxtex.cxx
+++ b/sw/source/uibase/shells/drwtxtex.cxx
@@ -525,12 +525,8 @@ void SwDrawTextShell::Execute( SfxRequest &rReq )
             const SvxFieldData* pField = pOLV->GetFieldAtCursor();
             if (const SvxURLField* pURLField = dynamic_cast<const SvxURLField*>(pField))
             {
-                SfxStringItem aUrl(SID_FILE_NAME, pURLField->GetURL());
-                SfxStringItem aTarget(SID_TARGETNAME, pURLField->GetTargetFrame());
-                SfxBoolItem aNewView(SID_OPEN_NEW_VIEW, false);
-                SfxBoolItem aBrowsing(SID_BROWSE, true);
-                GetView().GetViewFrame()->GetDispatcher()->ExecuteList(
-                    SID_OPENDOC, SfxCallMode::SYNCHRON, { &aUrl, &aTarget, &aNewView, &aBrowsing });
+                ::LoadURL(GetShell(), pURLField->GetURL(), LoadUrlFlags::NONE,
+                          pURLField->GetTargetFrame());
             }
         }
         break;
diff --git a/sw/source/uibase/wrtsh/wrtsh2.cxx b/sw/source/uibase/wrtsh/wrtsh2.cxx
index 93cd532781ff..ea4219ef981e 100644
--- a/sw/source/uibase/wrtsh/wrtsh2.cxx
+++ b/sw/source/uibase/wrtsh/wrtsh2.cxx
@@ -476,30 +476,24 @@ bool SwWrtShell::ClickToINetGrf( const Point& rDocPt, LoadUrlFlags nFilter )
     return bRet;
 }
 
-void LoadURL( SwViewShell& rVSh, const OUString& rURL, LoadUrlFlags nFilter,
-              const OUString& rTargetFrameName )
+static void LoadURL(SwView& rView, const OUString& rURL, LoadUrlFlags nFilter,
+                    const OUString& rTargetFrameName)
 {
-    OSL_ENSURE( !rURL.isEmpty(), "what should be loaded here?" );
-    if( rURL.isEmpty() )
-        return ;
+    SwDocShell* pDShell = rView.GetDocShell();
+    OSL_ENSURE( pDShell, "No DocShell?!");
+    SfxViewFrame* pViewFrame = rView.GetViewFrame();
 
-    // The shell could be 0 also!!!!!
-    if ( dynamic_cast<const SwCursorShell*>( &rVSh) ==  nullptr )
+    if (!SfxObjectShell::AllowedLinkProtocolFromDocument(rURL, pDShell, rView.GetFrameWeld()))
         return;
 
     // We are doing tiledRendering, let the client handles the URL loading,
     // unless we are jumping to a TOC mark.
     if (comphelper::LibreOfficeKit::isActive() && !rURL.startsWith("#"))
     {
-        rVSh.GetSfxViewShell()->libreOfficeKitViewCallback(LOK_CALLBACK_HYPERLINK_CLICKED, rURL.toUtf8().getStr());
+        rView.libreOfficeKitViewCallback(LOK_CALLBACK_HYPERLINK_CLICKED, rURL.toUtf8().getStr());
         return;
     }
 
-    //A CursorShell is always a WrtShell
-    SwWrtShell &rSh = static_cast<SwWrtShell&>(rVSh);
-
-    SwDocShell* pDShell = rSh.GetView().GetDocShell();
-    OSL_ENSURE( pDShell, "No DocShell?!");
     OUString sTargetFrame(rTargetFrameName);
     if (sTargetFrame.isEmpty() && pDShell)
     {
@@ -514,7 +508,6 @@ void LoadURL( SwViewShell& rVSh, const OUString& rURL, LoadUrlFlags nFilter,
     OUString sReferer;
     if( pDShell && pDShell->GetMedium() )
         sReferer = pDShell->GetMedium()->GetName();
-    SfxViewFrame* pViewFrame = rSh.GetView().GetViewFrame();
     SfxFrameItem aView( SID_DOCFRAME, pViewFrame );
     SfxStringItem aName( SID_FILE_NAME, rURL );
     SfxStringItem aTargetFrameName( SID_TARGETNAME, sTargetFrame );
@@ -540,6 +533,23 @@ void LoadURL( SwViewShell& rVSh, const OUString& rURL, LoadUrlFlags nFilter,
             SfxCallMode::ASYNCHRON|SfxCallMode::RECORD );
 }
 
+void LoadURL( SwViewShell& rVSh, const OUString& rURL, LoadUrlFlags nFilter,
+              const OUString& rTargetFrameName )
+{
+    OSL_ENSURE( !rURL.isEmpty(), "what should be loaded here?" );
+    if( rURL.isEmpty() )
+        return ;
+
+    // The shell could be 0 also!!!!!
+    if ( dynamic_cast<const SwCursorShell*>( &rVSh) ==  nullptr )
+        return;
+
+    //A CursorShell is always a WrtShell
+    SwWrtShell &rSh = static_cast<SwWrtShell&>(rVSh);
+
+    ::LoadURL(rSh.GetView(), rURL, nFilter, rTargetFrameName);
+}
+
 void SwWrtShell::NavigatorPaste( const NaviContentBookmark& rBkmk,
                                     const sal_uInt16 nAction )
 {
diff --git a/tools/source/fsys/urlobj.cxx b/tools/source/fsys/urlobj.cxx
index d52edb1d2f2a..a7efc3fc363d 100644
--- a/tools/source/fsys/urlobj.cxx
+++ b/tools/source/fsys/urlobj.cxx
@@ -4762,4 +4762,13 @@ OUString INetURLObject::CutExtension()
         ? aTheExtension : OUString();
 }
 
+bool INetURLObject::IsExoticProtocol() const
+{
+    return m_eScheme == INetProtocol::Slot ||
+           m_eScheme == INetProtocol::Macro ||
+           m_eScheme == INetProtocol::Uno ||
+           isSchemeEqualTo(u"vnd.sun.star.script") ||
+           isSchemeEqualTo(u"service");
+}
+
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/xmloff/source/draw/ximpshap.cxx b/xmloff/source/draw/ximpshap.cxx
index 259e9e2fe88e..dba1253a3303 100644
--- a/xmloff/source/draw/ximpshap.cxx
+++ b/xmloff/source/draw/ximpshap.cxx
@@ -3264,7 +3264,7 @@ void SdXMLFloatingFrameShapeContext::StartElement( const css::uno::Reference< cs
 
         if( !maHref.isEmpty() )
         {
-            if (INetURLObject(maHref).GetProtocol() == INetProtocol::Macro)
+            if (INetURLObject(maHref).IsExoticProtocol())
                 GetImport().NotifyMacroEventRead();
 
             xProps->setPropertyValue("FrameURL", Any(maHref) );