[PATCH] sc: check the host when fetching an external data range

checked only the file path allowlist. reject hosts outside it
too, like ScExternalRefManager and ScWebServiceLink.

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I85baf17e028b8773a886945cfccd0482e5ae2b34
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6935
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 29b5cb45a18ca79b28ce3a02be22803d94a36368)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/208197
Reviewed-by: Dan Williams <dcbw@libreoffice.org>
Tested-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
Reviewed-by: Ilmari Lauhakangas <ilmari.lauhakangas@libreoffice.org>
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Gbp-Pq: Name CVE-2026-63267-2.diff

diff --git a/sc/source/ui/dataprovider/dataprovider.cxx b/sc/source/ui/dataprovider/dataprovider.cxx
index 0a6eab303aa5be8216adc67df2201fbd461b5465..98f8694135a88cd08f9028dfbaef1bbf03fe6f7c 100644 (file)
--- a/sc/source/ui/dataprovider/dataprovider.cxx
+++ b/sc/source/ui/dataprovider/dataprovider.cxx
@@ -17,6 +17,7 @@
 #include <unotools/charclass.hxx>
 #include <tools/stream.hxx>
 #include <comphelper/processfactory.hxx>
+#include <tools/hostfilter.hxx>
 #include <tools/urlobj.hxx>
 
 #include "htmldataprovider.hxx"
@@ -44,6 +45,12 @@ std::unique_ptr<SvStream> DataProvider::FetchStreamFromURL(const OUString& rURL,
         return nullptr;
     }
 
+    if (HostFilter::isForbidden(aURLObject.GetHost()))
+    {
+        SAL_WARN("sc.ui", "DataProvider::FetchStreamFromURL: blocked host: \"" << rURL << "\"");
+        return nullptr;
+    }
+
     try
     {
         uno::Reference< ucb::XSimpleFileAccess3 > xFileAccess = ucb::SimpleFileAccess::create( comphelper::getProcessComponentContext() );