diff options
| -rw-r--r-- | include/tools/urlobj.hxx | 5 | ||||
| -rw-r--r-- | sfx2/source/doc/iframe.cxx | 5 | ||||
| -rw-r--r-- | tools/source/fsys/urlobj.cxx | 8 |
3 files changed, 17 insertions, 1 deletions
diff --git a/include/tools/urlobj.hxx b/include/tools/urlobj.hxx index 9d6820ddf241..dfd658722826 100644 --- a/include/tools/urlobj.hxx +++ b/include/tools/urlobj.hxx @@ -915,6 +915,11 @@ public: void changeScheme(INetProtocol eTargetScheme); + // INetProtocol::Macro, INetProtocol::Uno, INetProtocol::Slot, + // vnd.sun.star.script, etc. All the types of URLs which shouldn't + // be accepted from an outside controlled source + bool IsExoticProtocol() const; + private: // General Structure: diff --git a/sfx2/source/doc/iframe.cxx b/sfx2/source/doc/iframe.cxx index 150218b436e9..b81ce82fd32e 100644 --- a/sfx2/source/doc/iframe.cxx +++ b/sfx2/source/doc/iframe.cxx @@ -168,8 +168,11 @@ sal_Bool SAL_CALL IFrameObject::load( xTrans->parseStrict( aTargetURL ); INetURLObject aURLObject(aTargetURL.Complete); - if (aURLObject.GetProtocol() == INetProtocol::Macro || aURLObject.isSchemeEqualTo(u"vnd.sun.star.script")) + if (aURLObject.IsExoticProtocol()) + { + SAL_WARN("sfx", "IFrameObject::load ignoring: " << aTargetURL.Complete); return false; + } uno::Reference<frame::XFramesSupplier> xParentFrame = xFrame->getCreator(); SfxObjectShell* pDoc = SfxMacroLoader::GetObjectShell(xParentFrame); diff --git a/tools/source/fsys/urlobj.cxx b/tools/source/fsys/urlobj.cxx index 764bb28ef623..2a9f7bc3d7dc 100644 --- a/tools/source/fsys/urlobj.cxx +++ b/tools/source/fsys/urlobj.cxx @@ -4829,4 +4829,12 @@ OUString INetURLObject::CutExtension() ? aTheExtension : OUString(); } +bool INetURLObject::IsExoticProtocol() const +{ + return m_eScheme == INetProtocol::Slot || + m_eScheme == INetProtocol::Macro || + m_eScheme == INetProtocol::Uno || + isSchemeEqualTo(u"vnd.sun.star.script"); +} + /* vim:set shiftwidth=4 softtabstop=4 expandtab: */ |