[PATCH] don't bother loading exotic protocols for document-supplied data

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I5415f4f1804a85a04ff6396d71b7a61b230e1685
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6686
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
(cherry picked from commit 0274803ae273fa6bdbd1124cedf37395ce847148)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/208193
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Ilmari Lauhakangas <ilmari.lauhakangas@libreoffice.org>
Reviewed-by: Ilmari Lauhakangas <ilmari.lauhakangas@libreoffice.org>
Reviewed-by: Hossein <hossein@libreoffice.org>
Gbp-Pq: Name do-not-load-exotic-protocols-for-document-supplied-data.diff

diff --git a/forms/source/xforms/model.cxx b/forms/source/xforms/model.cxx
index 105f7f449963b5500e342653ad2908bc4e4d7215..27844c6398d5239b0fee4c644eea5fb9d562d2da 100644 (file)
--- a/forms/source/xforms/model.cxx
+++ b/forms/source/xforms/model.cxx
@@ -32,7 +32,9 @@
 
 #include <rtl/ustring.hxx>
 #include <rtl/ustrbuf.hxx>
+#include <sal/log.hxx>
 #include <tools/debug.hxx>
+#include <tools/urlobj.hxx>
 
 #include <comphelper/processfactory.hxx>
 #include <comphelper/servicehelper.hxx>
@@ -318,6 +320,12 @@ void Model::loadInstance( sal_Int32 nInstance )
     if( sURL.isEmpty() )
         return;
 
+    if( INetURLObject( sURL ).IsExoticProtocol() )
+    {
+        SAL_WARN("forms.xforms", "Model::loadInstance: blocked exotic protocol: \"" << sURL << "\"");
+        return;
+    }
+
     try
     {
         Reference<XInputStream> xInput =

diff --git a/sc/source/core/tool/webservicelink.cxx b/sc/source/core/tool/webservicelink.cxx
index c30f34300edf1d35bb555d589efb1eaf5b3e2194..fb5d81afc87b775f6b070e7364dbe8d480e83c05 100644 (file)
--- a/sc/source/core/tool/webservicelink.cxx
+++ b/sc/source/core/tool/webservicelink.cxx
@@ -40,6 +40,13 @@ sfx2::SvBaseLink::UpdateResult ScWebServiceLink::DataChanged(const OUString&, co
     bHasResult = false;
 
     INetURLObject aURLObject(aURL);
+    if (aURLObject.IsExoticProtocol())
+    {
+        SAL_WARN("sc.ui",
+                 "ScWebServiceLink::DataChanged: blocked exotic protocol: \"" << aURL << "\"");
+        return ERROR_GENERAL;
+    }
+
     const OUString sHost = aURLObject.GetHost();
     if (HostFilter::isForbidden(sHost))
     {

diff --git a/sc/source/ui/dataprovider/dataprovider.cxx b/sc/source/ui/dataprovider/dataprovider.cxx
index dced70cca0bdc06100b6bb2f06f1c4a927e56e02..3c3302c23c58974d0a85f90958b0caad0c4342f2 100644 (file)
--- a/sc/source/ui/dataprovider/dataprovider.cxx
+++ b/sc/source/ui/dataprovider/dataprovider.cxx
@@ -17,6 +17,7 @@
 #include <unotools/charclass.hxx>
 #include <tools/stream.hxx>
 #include <comphelper/processfactory.hxx>
+#include <tools/urlobj.hxx>
 
 #include "htmldataprovider.hxx"
 #include "xmldataprovider.hxx"
@@ -32,6 +33,13 @@ namespace sc {
 
 std::unique_ptr<SvStream> DataProvider::FetchStreamFromURL(const OUString& rURL, OStringBuffer& rBuffer)
 {
+    INetURLObject aURLObject(rURL);
+    if (aURLObject.IsExoticProtocol())
+    {
+        SAL_WARN("sc.ui", "DataProvider::FetchStreamFromURL: blocked exotic protocol: \"" << rURL << "\"");
+        return nullptr;
+    }
+
     try
     {
         uno::Reference< ucb::XSimpleFileAccess3 > xFileAccess = ucb::SimpleFileAccess::create( comphelper::getProcessComponentContext() );

diff --git a/sc/source/ui/dataprovider/sqldataprovider.cxx b/sc/source/ui/dataprovider/sqldataprovider.cxx
index 05401075bf86f5366e88d8a2805a9abc577811ba..7521e340ca7a7042e930e129d91939573ce63de3 100644 (file)
--- a/sc/source/ui/dataprovider/sqldataprovider.cxx
+++ b/sc/source/ui/dataprovider/sqldataprovider.cxx
@@ -9,6 +9,8 @@
 
 #include "sqldataprovider.hxx"
 #include <datatransformation.hxx>
+#include <sal/log.hxx>
+#include <tools/urlobj.hxx>
 #include <salhelper/thread.hxx>
 #include <com/sun/star/sdb/DatabaseContext.hpp>
 #include <com/sun/star/sdb/XCompletedConnection.hpp>
@@ -63,6 +65,13 @@ void SQLFetchThread::execute()
     OUString aTable = maID.copy(0, nIndex);
     OUString aDatabase = maID.copy(nIndex + 1);
 
+    if (INetURLObject(aDatabase).IsExoticProtocol())
+    {
+        SAL_WARN("sc.ui",
+                 "SQLFetchThread::execute: blocked exotic protocol: \"" << aDatabase << "\"");
+        return;
+    }
+
     try
     {
         uno::Reference<sdb::XDatabaseContext> xContext