warn on load when a document binds an event to a macro

a) treat shared/Scripts equivalently to document scripts

This doesn't automatically warn/block running those scripts when used in a
freshly loaded document on its own however

because DocumentMacroMode::checkMacrosOnLoading will see at...

if ( m_xData->m_rDocumentAccess.documentStorageHasMacros() || hasMacroLibrary() )

that the document contains no macros and flip the allow macros flag to true so
that potentially new uses of macros added by the user during the edit are
allowed to run

b) so, add an additional flag to indicate existence of use of macros in a document

c) for odf import, set it when a script:event-listener tag is encountered
d) for html import when registerScriptEvents or SwFormatINetFormat::SetMacroTable is called
e) for doc import when Read_F_Macro or StoreMacroCmds is called as well for good measure
f) for xls import when registerScriptEvent or ScMacroInfo::SetMacro is called
g) for oox import when VbaProject::attachMacros is called

Change-Id: Ic1203d8ec7dfc217aa217135033ae9db2888e19b
Reviewed-on: https://gerrit.libreoffice.org/77386
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl@cib.de>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

7 files changed, 78 insertions, 29 deletions

diff --git a/sfx2/source/doc/docmacromode.cxx b/sfx2/source/doc/docmacromode.cxx
index 41b25170b8a3..3bba9fb09c6c 100644
--- a/sfx2/source/doc/docmacromode.cxx
+++ b/sfx2/source/doc/docmacromode.cxx
@@ -399,7 +399,7 @@ namespace sfx2
         }
         else
         {
-            if ( m_xData->m_rDocumentAccess.documentStorageHasMacros() || hasMacroLibrary() )
+            if (m_xData->m_rDocumentAccess.documentStorageHasMacros() || hasMacroLibrary() || m_xData->m_rDocumentAccess.macroCallsSeenWhileLoading())
             {
                 bAllow = adjustMacroMode( rxInteraction );
             }
diff --git a/sfx2/source/doc/objmisc.cxx b/sfx2/source/doc/objmisc.cxx
index ab41b147d2c7..1106f399650e 100644
--- a/sfx2/source/doc/objmisc.cxx
+++ b/sfx2/source/doc/objmisc.cxx
@@ -1388,13 +1388,7 @@ ErrCode SfxObjectShell::CallXScript( const Reference< XInterface >& _rxScriptCon
     Any aException;
     try
     {
-        css::uno::Reference<css::uri::XUriReferenceFactory> urifac(
-            css::uri::UriReferenceFactory::create(comphelper::getProcessComponentContext()));
-        css::uno::Reference<css::uri::XVndSunStarScriptUrlReference> uri(
-            urifac->parse(_rScriptURL), css::uno::UNO_QUERY_THROW);
-        auto const loc = uri->getParameter("location");
-        bool bIsDocumentScript = loc == "document";
-        if ( bIsDocumentScript && !lcl_isScriptAccessAllowed_nothrow( _rxScriptContext ) )
+        if ( !lcl_isScriptAccessAllowed_nothrow( _rxScriptContext ) )
             return ERRCODE_IO_ACCESSDENIED;
 
         if ( UnTrustedScript(_rScriptURL) )
@@ -1756,6 +1750,11 @@ bool SfxObjectShell_Impl::documentStorageHasMacros() const
     return ::sfx2::DocumentMacroMode::storageHasMacros( m_xDocStorage );
 }
 
+bool SfxObjectShell_Impl::macroCallsSeenWhileLoading() const
+{
+    return rDocShell.GetMacroCallsSeenWhileLoading();
+}
+
 Reference< XEmbeddedScripts > SfxObjectShell_Impl::getEmbeddedDocumentScripts() const
 {
     return Reference< XEmbeddedScripts >( rDocShell.GetModel(), UNO_QUERY );
diff --git a/sfx2/source/doc/objstor.cxx b/sfx2/source/doc/objstor.cxx
index 359ac6077838..651258d1fdec 100644
--- a/sfx2/source/doc/objstor.cxx
+++ b/sfx2/source/doc/objstor.cxx
@@ -3595,6 +3595,16 @@ void SfxObjectShell::SetConfigOptionsChecked( bool bChecked )
     pImpl->m_bConfigOptionsChecked = bChecked;
 }
 
+void SfxObjectShell::SetMacroCallsSeenWhileLoading()
+{
+    pImpl->m_bMacroCallsSeenWhileLoading = true;
+}
+
+bool SfxObjectShell::GetMacroCallsSeenWhileLoading() const
+{
+    return pImpl->m_bMacroCallsSeenWhileLoading;
+}
+
 bool SfxObjectShell::QuerySaveSizeExceededModules_Impl( const uno::Reference< task::XInteractionHandler >& xHandler )
 {
 #if !HAVE_FEATURE_SCRIPTING
diff --git a/sfx2/source/doc/objxtor.cxx b/sfx2/source/doc/objxtor.cxx
index 375b3919d291..12f2a1ab51f6 100644
--- a/sfx2/source/doc/objxtor.cxx
+++ b/sfx2/source/doc/objxtor.cxx
@@ -234,6 +234,7 @@ SfxObjectShell_Impl::SfxObjectShell_Impl( SfxObjectShell& _rDocShell )
     ,m_bSharedXMLFlag( false )
     ,m_bAllowShareControlFileClean( true )
     ,m_bConfigOptionsChecked( false )
+    ,m_bMacroCallsSeenWhileLoading( false )
     ,lErr(ERRCODE_NONE)
     ,nEventId ( SfxEventHintId::NONE )
     ,nLoadedFlags ( SfxLoadedFlags::ALL )
diff --git a/sfx2/source/doc/sfxbasemodel.cxx b/sfx2/source/doc/sfxbasemodel.cxx
index 4caf74eb15c6..1f39d9f3efef 100644
--- a/sfx2/source/doc/sfxbasemodel.cxx
+++ b/sfx2/source/doc/sfxbasemodel.cxx
@@ -889,8 +889,15 @@ sal_Bool SAL_CALL SfxBaseModel::attachResource( const   OUString&
             pObjectShell->BreakMacroSign_Impl( bBreakMacroSign );
         }
 
+        bool bMacroEventRead = false;
+        if ((aArgs.get("MacroEventRead") >>= bMacroEventRead) && bMacroEventRead)
+        {
+            pObjectShell->SetMacroCallsSeenWhileLoading();
+        }
+
         aArgs.remove( "WinExtent" );
         aArgs.remove( "BreakMacroSignature" );
+        aArgs.remove( "MacroEventRead" );
         aArgs.remove( "Stream" );
         aArgs.remove( "InputStream" );
         aArgs.remove( "URL" );
diff --git a/sfx2/source/inc/objshimp.hxx b/sfx2/source/inc/objshimp.hxx
index d31414b8588f..d52ee83d9a3c 100644
--- a/sfx2/source/inc/objshimp.hxx
+++ b/sfx2/source/inc/objshimp.hxx
@@ -90,7 +90,8 @@ struct SfxObjectShell_Impl : public ::sfx2::IMacroDocumentAccess
                         bSaveVersionOnClose:1,
                         m_bSharedXMLFlag:1, // whether the document should be edited in shared mode
                         m_bAllowShareControlFileClean:1, // whether the flag should be stored in xml file
-                        m_bConfigOptionsChecked:1; // whether or not the user options are checked after the Options dialog is closed.
+                        m_bConfigOptionsChecked:1, // whether or not the user options are checked after the Options dialog is closed.
+                        m_bMacroCallsSeenWhileLoading:1; // whether or not the user options are checked after the Options dialog is closed.
 
     IndexBitSet         aBitSet;
     ErrCode             lErr;
@@ -138,6 +139,7 @@ struct SfxObjectShell_Impl : public ::sfx2::IMacroDocumentAccess
     virtual void setCurrentMacroExecMode( sal_uInt16 nMacroMode ) override;
     virtual OUString getDocumentLocation() const override;
     virtual bool documentStorageHasMacros() const override;
+    virtual bool macroCallsSeenWhileLoading() const override;
     virtual css::uno::Reference< css::document::XEmbeddedScripts > getEmbeddedDocumentScripts() const override;
     virtual SignatureState getScriptingSignatureState() override;
 
diff --git a/sfx2/source/notify/eventsupplier.cxx b/sfx2/source/notify/eventsupplier.cxx
index b434122ed789..3b020cf29605 100644
--- a/sfx2/source/notify/eventsupplier.cxx
+++ b/sfx2/source/notify/eventsupplier.cxx
@@ -19,11 +19,13 @@
 
 #include <com/sun/star/beans/PropertyValue.hpp>
 
+#include <com/sun/star/document/XEmbeddedScripts.hpp>
+#include <com/sun/star/document/XScriptInvocationContext.hpp>
 #include <com/sun/star/util/URL.hpp>
-
 #include <com/sun/star/frame/Desktop.hpp>
 #include <com/sun/star/util/URLTransformer.hpp>
 #include <com/sun/star/util/XURLTransformer.hpp>
+#include <com/sun/star/uno/XInterface.hpp>
 #include <tools/urlobj.hxx>
 #include <tools/diagnose_ex.h>
 #include <svl/macitem.hxx>
@@ -47,6 +49,8 @@
 #include <macroloader.hxx>
 
 using namespace css;
+using namespace ::com::sun::star;
+
 
 
     //  --- XNameReplace ---
@@ -165,6 +169,29 @@ sal_Bool SAL_CALL SfxEvents_Impl::hasElements()
     return maEventNames.hasElements();
 }
 
+namespace
+{
+    bool lcl_isScriptAccessAllowed_nothrow(const uno::Reference<uno::XInterface>& rxScriptContext)
+    {
+        try
+        {
+            uno::Reference<document::XEmbeddedScripts> xScripts(rxScriptContext, uno::UNO_QUERY);
+            if (!xScripts.is())
+            {
+                uno::Reference<document::XScriptInvocationContext> xContext(rxScriptContext, uno::UNO_QUERY_THROW);
+                xScripts.set(xContext->getScriptContainer(), uno::UNO_SET_THROW);
+            }
+
+            return xScripts->getAllowMacroExecution();
+        }
+        catch( const uno::Exception& )
+        {
+            DBG_UNHANDLED_EXCEPTION("sfx.doc");
+        }
+        return false;
+    }
+}
+
 void SfxEvents_Impl::Execute( uno::Any const & aEventData, const document::DocumentEvent& aTrigger, SfxObjectShell* pDoc )
 {
     uno::Sequence < beans::PropertyValue > aProperties;
@@ -198,31 +225,39 @@ void SfxEvents_Impl::Execute( uno::Any const & aEventData, const document::Docum
         nIndex += 1;
     }
 
-    if (aType == STAR_BASIC && !aScript.isEmpty())
+    if (aType.isEmpty())
+    {
+        // Empty type means no active binding for the event. Just ignore do nothing.
+        return;
+    }
+
+    if (aScript.isEmpty())
+        return;
+
+    if (!pDoc)
+        pDoc = SfxObjectShell::Current();
+
+    if (pDoc && !lcl_isScriptAccessAllowed_nothrow(pDoc->GetModel()))
+        return;
+
+    if (aType == STAR_BASIC)
     {
         uno::Any aAny;
         SfxMacroLoader::loadMacro( aScript, aAny, pDoc );
     }
-    else if (aType == "Service" ||
-              aType == "Script")
+    else if (aType == "Service" || aType == "Script")
     {
-        bool bAllowed = false;
         util::URL aURL;
-        if (!aScript.isEmpty())
-        {
-            uno::Reference < util::XURLTransformer > xTrans( util::URLTransformer::create( ::comphelper::getProcessComponentContext() ) );
+        uno::Reference < util::XURLTransformer > xTrans( util::URLTransformer::create( ::comphelper::getProcessComponentContext() ) );
 
-            aURL.Complete = aScript;
-            xTrans->parseStrict( aURL );
+        aURL.Complete = aScript;
+        xTrans->parseStrict( aURL );
 
-            bAllowed = !SfxObjectShell::UnTrustedScript(aURL.Complete);
-        }
+        bool bAllowed = !SfxObjectShell::UnTrustedScript(aURL.Complete);
 
         if (bAllowed)
         {
-            SfxViewFrame* pView = pDoc ?
-                SfxViewFrame::GetFirst( pDoc ) :
-                SfxViewFrame::Current();
+            SfxViewFrame* pView = SfxViewFrame::GetFirst(pDoc);
 
             uno::Reference
                 < frame::XDispatchProvider > xProv;
@@ -245,7 +280,6 @@ void SfxEvents_Impl::Execute( uno::Any const & aEventData, const document::Docum
 
             if ( xDisp.is() )
             {
-
                 beans::PropertyValue aEventParam;
                 aEventParam.Value <<= aTrigger;
                 uno::Sequence< beans::PropertyValue > aDispatchArgs( &aEventParam, 1 );
@@ -253,10 +287,6 @@ void SfxEvents_Impl::Execute( uno::Any const & aEventData, const document::Docum
             }
         }
     }
-    else if ( aType.isEmpty() )
-    {
-        // Empty type means no active binding for the event. Just ignore do nothing.
-    }
     else
     {
         SAL_WARN( "sfx.notify", "notifyEvent(): Unsupported event type" );