rhbz#887420 Implement "block untrusted referer links" feature

For now, this checks for a trusted referer (if the BlockUntrustedRefererLinks
configuration prop is set) in utl::MediaDescriptor::impl_openStreamWithURL and
SvxBrushItem::GetGraphicObject.  Checking in additional places will probably be
necessary to block /all/ unwanted communication.  Also, some places marked
/*TODO?*/ currently pass in an empty referer (which is always considered
trusted) and will probably need to be adapted.

Ideally, Referer URIs would never be empty (and consistently use something like
<private:user> for cases where access is explicitly initiated by the user and
should never be blocked), but that's a very daunting task, so start small by
identifying the places that potentially need blocking and adding appropriate
Referer URIs there.  Also, Referer information should always be computed as
freshly as possible from the context in which an access attempt is made, but,
again, always carrying the information from the context all the way to the
relevant functions is a very daunting task, so for now store the information
upon object instantiation in some cases (SvxBrushItem, SdrGrafObj, ...).

The Referer URI (css.document.MediaDescriptor property; SID_REFERER) was already
used to track macro execution, and there is one place in
SfxApplication::OpenDocExec_Impl where opening of hyperlinks (explicitly clicked
by the user) is done that needs the current document's URI as Referer to check
execution of macro URIs but needs an empty (or <private:user>, see above)
Referer to not block non-macro URIs.  Special code has been added there to
handle that.

Change-Id: Iafbdc07a9fe925d9ee580d4f5778448f18f2ebd9

4 files changed, 34 insertions, 1 deletions

diff --git a/sfx2/source/appl/appopen.cxx b/sfx2/source/appl/appopen.cxx
index e1f2479d4c97..e8e23c5d1a4c 100644
--- a/sfx2/source/appl/appopen.cxx
+++ b/sfx2/source/appl/appopen.cxx
@@ -1064,6 +1064,19 @@ void SfxApplication::OpenDocExec_Impl( SfxRequest& rReq )
         // convert items to properties for framework API calls
         Sequence < PropertyValue > aArgs;
         TransformItems( SID_OPENDOC, *rReq.GetArgs(), aArgs );
+        // Any Referer (that was relevant in the above call to
+        // SvtSecurityOptions::isSecureMacroUri) is no longer relevant, assuming
+        // this "open" request is initiated directly by the user:
+        for (sal_Int32 i = 0; i != aArgs.getLength(); ++i) {
+            if (aArgs[i].Name == "Referer") {
+                ++i;
+                for (; i != aArgs.getLength(); ++i) {
+                    aArgs[i - 1] = aArgs[i];
+                }
+                aArgs.realloc(aArgs.getLength()-1);
+                break;
+            }
+        }
 
         // TODO/LATER: either remove LinkItem or create an asynchronous process for it
         if( bHidden || pLinkItem || rReq.IsSynchronCall() )
diff --git a/sfx2/source/appl/fileobj.cxx b/sfx2/source/appl/fileobj.cxx
index 547a6344594b..1ffdaef6bd55 100644
--- a/sfx2/source/appl/fileobj.cxx
+++ b/sfx2/source/appl/fileobj.cxx
@@ -265,7 +265,7 @@ sal_Bool SvFileObject::LoadFile_Impl()
         return sal_False;
 
     // at the moment on the current DocShell
-    xMed = new SfxMedium( sFileNm, STREAM_STD_READ );
+    xMed = new SfxMedium( sFileNm, sReferer, STREAM_STD_READ );
     SvLinkSource::StreamToLoadFrom aStreamToLoadFrom =
         getStreamToLoadFrom();
     xMed->setStreamToLoadFrom(
diff --git a/sfx2/source/bastyp/fltfnc.cxx b/sfx2/source/bastyp/fltfnc.cxx
index daee557adadb..65974d01b0f7 100644
--- a/sfx2/source/bastyp/fltfnc.cxx
+++ b/sfx2/source/bastyp/fltfnc.cxx
@@ -445,6 +445,12 @@ sal_uInt32  SfxFilterMatcher::GuessFilterControlDefaultUI( SfxMedium& rMedium, c
             aDescriptor[utl::MediaDescriptor::PROP_URL()               ] <<= sURL;
             aDescriptor[utl::MediaDescriptor::PROP_INPUTSTREAM()       ] <<= xInStream;
             aDescriptor[utl::MediaDescriptor::PROP_INTERACTIONHANDLER()] <<= rMedium.GetInteractionHandler();
+            SfxStringItem const * it = static_cast<SfxStringItem const *>(
+                rMedium.GetItemSet()->GetItem(SID_REFERER));
+            if (it != 0) {
+                aDescriptor[utl::MediaDescriptor::PROP_REFERRER()]
+                    <<= it->GetValue();
+            }
 
             if ( !m_rImpl.aName.isEmpty() )
                 aDescriptor[utl::MediaDescriptor::PROP_DOCUMENTSERVICE()] <<= m_rImpl.aName;
diff --git a/sfx2/source/doc/docfile.cxx b/sfx2/source/doc/docfile.cxx
index 0dd46584b46b..0a96f895b388 100644
--- a/sfx2/source/doc/docfile.cxx
+++ b/sfx2/source/doc/docfile.cxx
@@ -2854,6 +2854,20 @@ SfxMedium::SfxMedium(const OUString &rName, StreamMode nOpenMode, const SfxFilte
     Init_Impl();
 }
 
+SfxMedium::SfxMedium(const OUString &rName, const OUString &rReferer, StreamMode nOpenMode, const SfxFilter *pFlt, SfxItemSet *pInSet) :
+    pImp(new SfxMedium_Impl(this))
+{
+    pImp->m_pSet = pInSet;
+    SfxItemSet * s = GetItemSet();
+    if (s->GetItem(SID_REFERER) == 0) {
+        s->Put(SfxStringItem(SID_REFERER, rReferer));
+    }
+    pImp->m_pFilter = pFlt;
+    pImp->m_aLogicName = rName;
+    pImp->m_nStorOpenMode = nOpenMode;
+    Init_Impl();
+}
+
 SfxMedium::SfxMedium( const uno::Sequence<beans::PropertyValue>& aArgs ) :
     pImp(new SfxMedium_Impl(this))
 {