eabdullin
50fd5124e0
- add some protocols that don't make sense as floating frame targets - warn about exotic protocols as well - default to ignoring libreoffice special-purpose protocols in calc hyperlink - reuse AllowedLinkProtocolFromDocument in writer - reuse AllowedLinkProtocolFromDocument in impress/draw - CVE-2023-6186 backporting
94 lines
3.5 KiB
Diff
94 lines
3.5 KiB
Diff
From 37d73a1ab94b43e03866d5a910cb58331543b8c3 Mon Sep 17 00:00:00 2001
|
|
Message-ID: <37d73a1ab94b43e03866d5a910cb58331543b8c3.1703086247.git.erack@redhat.com>
|
|
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
|
|
Date: Fri, 3 Nov 2023 17:14:26 +0000
|
|
Subject: [PATCH] add some protocols that don't make sense as floating frame
|
|
targets
|
|
MIME-Version: 1.0
|
|
Content-Type: multipart/mixed; boundary="------------erAck-patch-parts"
|
|
|
|
This is a multi-part message in MIME format.
|
|
--------------erAck-patch-parts
|
|
Content-Type: text/plain; charset=UTF-8; format=fixed
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
|
|
Change-Id: Id900a5eef248731d1184c1df501a2cf7a2de7eb9
|
|
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158910
|
|
Tested-by: Jenkins
|
|
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
|
|
(cherry picked from commit 11ebdfef16501c6d35c3e3d0d62507f706557c71)
|
|
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158900
|
|
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
|
|
(cherry picked from commit bab433911bdecb344f7ea94dbd00690241a08c54)
|
|
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159582
|
|
|
|
erAck: backported to 7.1.8.1
|
|
|
|
---
|
|
include/tools/urlobj.hxx | 5 +++++
|
|
sfx2/source/doc/iframe.cxx | 5 ++++-
|
|
tools/source/fsys/urlobj.cxx | 8 ++++++++
|
|
3 files changed, 17 insertions(+), 1 deletion(-)
|
|
|
|
|
|
--------------erAck-patch-parts
|
|
Content-Type: text/x-patch; name="0001-add-some-protocols-that-don-t-make-sense-as-floating.patch"
|
|
Content-Transfer-Encoding: 8bit
|
|
Content-Disposition: attachment; filename="0001-add-some-protocols-that-don-t-make-sense-as-floating.patch"
|
|
|
|
diff --git a/include/tools/urlobj.hxx b/include/tools/urlobj.hxx
|
|
index 9d6820ddf241..dfd658722826 100644
|
|
--- a/include/tools/urlobj.hxx
|
|
+++ b/include/tools/urlobj.hxx
|
|
@@ -915,6 +915,11 @@ public:
|
|
|
|
void changeScheme(INetProtocol eTargetScheme);
|
|
|
|
+ // INetProtocol::Macro, INetProtocol::Uno, INetProtocol::Slot,
|
|
+ // vnd.sun.star.script, etc. All the types of URLs which shouldn't
|
|
+ // be accepted from an outside controlled source
|
|
+ bool IsExoticProtocol() const;
|
|
+
|
|
private:
|
|
// General Structure:
|
|
|
|
diff --git a/sfx2/source/doc/iframe.cxx b/sfx2/source/doc/iframe.cxx
|
|
index 150218b436e9..b81ce82fd32e 100644
|
|
--- a/sfx2/source/doc/iframe.cxx
|
|
+++ b/sfx2/source/doc/iframe.cxx
|
|
@@ -168,8 +168,11 @@ sal_Bool SAL_CALL IFrameObject::load(
|
|
xTrans->parseStrict( aTargetURL );
|
|
|
|
INetURLObject aURLObject(aTargetURL.Complete);
|
|
- if (aURLObject.GetProtocol() == INetProtocol::Macro || aURLObject.isSchemeEqualTo(u"vnd.sun.star.script"))
|
|
+ if (aURLObject.IsExoticProtocol())
|
|
+ {
|
|
+ //SAL_WARN("sfx", "IFrameObject::load ignoring: " << aTargetURL.Complete);
|
|
return false;
|
|
+ }
|
|
|
|
uno::Reference<frame::XFramesSupplier> xParentFrame = xFrame->getCreator();
|
|
SfxObjectShell* pDoc = SfxMacroLoader::GetObjectShell(xParentFrame);
|
|
diff --git a/tools/source/fsys/urlobj.cxx b/tools/source/fsys/urlobj.cxx
|
|
index 764bb28ef623..2a9f7bc3d7dc 100644
|
|
--- a/tools/source/fsys/urlobj.cxx
|
|
+++ b/tools/source/fsys/urlobj.cxx
|
|
@@ -4829,4 +4829,12 @@ OUString INetURLObject::CutExtension()
|
|
? aTheExtension : OUString();
|
|
}
|
|
|
|
+bool INetURLObject::IsExoticProtocol() const
|
|
+{
|
|
+ return m_eScheme == INetProtocol::Slot ||
|
|
+ m_eScheme == INetProtocol::Macro ||
|
|
+ m_eScheme == INetProtocol::Uno ||
|
|
+ isSchemeEqualTo(u"vnd.sun.star.script");
|
|
+}
|
|
+
|
|
/* vim:set shiftwidth=4 softtabstop=4 expandtab: */
|
|
|
|
--------------erAck-patch-parts--
|
|
|
|
|