From 06b82bd37f4eb3acf042558d3395db245e89e90e Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Fri, 7 Jun 2019 14:04:07 +0100 Subject: explictly exclude LibreLogo from XScript usage MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Change-Id: I567647f0e2f8b82e4ef2995c673abe82f4564228 Reviewed-on: https://gerrit.libreoffice.org/73659 Tested-by: Jenkins Reviewed-by: Caolán McNamara Tested-by: Caolán McNamara --- sfx2/source/doc/objmisc.cxx | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'sfx2') diff --git a/sfx2/source/doc/objmisc.cxx b/sfx2/source/doc/objmisc.cxx index a5e62da8c0a2..02d79c356e54 100644 --- a/sfx2/source/doc/objmisc.cxx +++ b/sfx2/source/doc/objmisc.cxx @@ -1347,6 +1347,16 @@ namespace } } +namespace { + +// don't allow LibreLogo to be used with our mouseover/etc dom-alike events +bool UnTrustedScript(const OUString& rScriptURL) +{ + return rScriptURL.startsWithIgnoreAsciiCase("vnd.sun.star.script:LibreLogo"); +} + +} + ErrCode SfxObjectShell::CallXScript( const Reference< XInterface >& _rxScriptContext, const OUString& _rScriptURL, const Sequence< Any >& aParams, Any& aRet, Sequence< sal_Int16 >& aOutParamIndex, Sequence< Any >& aOutParam, bool bRaiseError, const css::uno::Any* pCaller ) { @@ -1359,6 +1369,9 @@ ErrCode SfxObjectShell::CallXScript( const Reference< XInterface >& _rxScriptCon if ( bIsDocumentScript && !lcl_isScriptAccessAllowed_nothrow( _rxScriptContext ) ) return ERRCODE_IO_ACCESSDENIED; + if ( UnTrustedScript(_rScriptURL) ) + return ERRCODE_IO_ACCESSDENIED; + bool bCaughtException = false; Any aException; try -- cgit