From f0a9ca24fd4bf79cac908bf0d6fdb8905dc504db Mon Sep 17 00:00:00 2001 From: Stephan Bergmann Date: Thu, 14 Nov 2013 10:39:27 +0100 Subject: rhbz#887420 Implement "block untrusted referer links" feature For now, this checks for a trusted referer (if the BlockUntrustedRefererLinks configuration prop is set) in utl::MediaDescriptor::impl_openStreamWithURL and SvxBrushItem::GetGraphicObject. Checking in additional places will probably be necessary to block /all/ unwanted communication. Also, some places marked /*TODO?*/ currently pass in an empty referer (which is always considered trusted) and will probably need to be adapted. Ideally, Referer URIs would never be empty (and consistently use something like for cases where access is explicitly initiated by the user and should never be blocked), but that's a very daunting task, so start small by identifying the places that potentially need blocking and adding appropriate Referer URIs there. Also, Referer information should always be computed as freshly as possible from the context in which an access attempt is made, but, again, always carrying the information from the context all the way to the relevant functions is a very daunting task, so for now store the information upon object instantiation in some cases (SvxBrushItem, SdrGrafObj, ...). The Referer URI (css.document.MediaDescriptor property; SID_REFERER) was already used to track macro execution, and there is one place in SfxApplication::OpenDocExec_Impl where opening of hyperlinks (explicitly clicked by the user) is done that needs the current document's URI as Referer to check execution of macro URIs but needs an empty (or , see above) Referer to not block non-macro URIs. Special code has been added there to handle that. Change-Id: Iafbdc07a9fe925d9ee580d4f5778448f18f2ebd9 --- sfx2/source/doc/docfile.cxx | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'sfx2/source/doc') diff --git a/sfx2/source/doc/docfile.cxx b/sfx2/source/doc/docfile.cxx index 0dd46584b46b..0a96f895b388 100644 --- a/sfx2/source/doc/docfile.cxx +++ b/sfx2/source/doc/docfile.cxx @@ -2854,6 +2854,20 @@ SfxMedium::SfxMedium(const OUString &rName, StreamMode nOpenMode, const SfxFilte Init_Impl(); } +SfxMedium::SfxMedium(const OUString &rName, const OUString &rReferer, StreamMode nOpenMode, const SfxFilter *pFlt, SfxItemSet *pInSet) : + pImp(new SfxMedium_Impl(this)) +{ + pImp->m_pSet = pInSet; + SfxItemSet * s = GetItemSet(); + if (s->GetItem(SID_REFERER) == 0) { + s->Put(SfxStringItem(SID_REFERER, rReferer)); + } + pImp->m_pFilter = pFlt; + pImp->m_aLogicName = rName; + pImp->m_nStorOpenMode = nOpenMode; + Init_Impl(); +} + SfxMedium::SfxMedium( const uno::Sequence& aArgs ) : pImp(new SfxMedium_Impl(this)) { -- cgit