From: Caolán McNamara <caolan.mcnamara@collabora.com>
Date: Sat, 11 Jul 2026 23:43:39 +0000 (+0000)
Subject: [PATCH] don't bother loading exotic protocols for document-supplied data
X-Git-Tag: archive/raspbian/4%25.2.3-2+rpi1+deb13u8^2~16
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=58af7c08a2fba5831d9b7e830d1c372201fd4ef1;p=libreoffice.git

[PATCH] don't bother loading exotic protocols for document-supplied data

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I5415f4f1804a85a04ff6396d71b7a61b230e1685
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6686
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
(cherry picked from commit 0274803ae273fa6bdbd1124cedf37395ce847148)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/208193
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Ilmari Lauhakangas <ilmari.lauhakangas@libreoffice.org>
Reviewed-by: Ilmari Lauhakangas <ilmari.lauhakangas@libreoffice.org>
Reviewed-by: Hossein <hossein@libreoffice.org>

Gbp-Pq: Name do-not-load-exotic-protocols-for-document-supplied-data.diff
---

diff --git a/forms/source/xforms/model.cxx b/forms/source/xforms/model.cxx
index 105f7f44996..27844c6398d 100644
--- a/forms/source/xforms/model.cxx
+++ b/forms/source/xforms/model.cxx
@@ -32,7 +32,9 @@
 
 #include <rtl/ustring.hxx>
 #include <rtl/ustrbuf.hxx>
+#include <sal/log.hxx>
 #include <tools/debug.hxx>
+#include <tools/urlobj.hxx>
 
 #include <comphelper/processfactory.hxx>
 #include <comphelper/servicehelper.hxx>
@@ -318,6 +320,12 @@ void Model::loadInstance( sal_Int32 nInstance )
     if( sURL.isEmpty() )
         return;
 
+    if( INetURLObject( sURL ).IsExoticProtocol() )
+    {
+        SAL_WARN("forms.xforms", "Model::loadInstance: blocked exotic protocol: \"" << sURL << "\"");
+        return;
+    }
+
     try
     {
         Reference<XInputStream> xInput =
diff --git a/sc/source/core/tool/webservicelink.cxx b/sc/source/core/tool/webservicelink.cxx
index c30f34300ed..fb5d81afc87 100644
--- a/sc/source/core/tool/webservicelink.cxx
+++ b/sc/source/core/tool/webservicelink.cxx
@@ -40,6 +40,13 @@ sfx2::SvBaseLink::UpdateResult ScWebServiceLink::DataChanged(const OUString&, co
     bHasResult = false;
 
     INetURLObject aURLObject(aURL);
+    if (aURLObject.IsExoticProtocol())
+    {
+        SAL_WARN("sc.ui",
+                 "ScWebServiceLink::DataChanged: blocked exotic protocol: \"" << aURL << "\"");
+        return ERROR_GENERAL;
+    }
+
     const OUString sHost = aURLObject.GetHost();
     if (HostFilter::isForbidden(sHost))
     {
diff --git a/sc/source/ui/dataprovider/dataprovider.cxx b/sc/source/ui/dataprovider/dataprovider.cxx
index dced70cca0b..3c3302c23c5 100644
--- a/sc/source/ui/dataprovider/dataprovider.cxx
+++ b/sc/source/ui/dataprovider/dataprovider.cxx
@@ -17,6 +17,7 @@
 #include <unotools/charclass.hxx>
 #include <tools/stream.hxx>
 #include <comphelper/processfactory.hxx>
+#include <tools/urlobj.hxx>
 
 #include "htmldataprovider.hxx"
 #include "xmldataprovider.hxx"
@@ -32,6 +33,13 @@ namespace sc {
 
 std::unique_ptr<SvStream> DataProvider::FetchStreamFromURL(const OUString& rURL, OStringBuffer& rBuffer)
 {
+    INetURLObject aURLObject(rURL);
+    if (aURLObject.IsExoticProtocol())
+    {
+        SAL_WARN("sc.ui", "DataProvider::FetchStreamFromURL: blocked exotic protocol: \"" << rURL << "\"");
+        return nullptr;
+    }
+
     try
     {
         uno::Reference< ucb::XSimpleFileAccess3 > xFileAccess = ucb::SimpleFileAccess::create( comphelper::getProcessComponentContext() );
diff --git a/sc/source/ui/dataprovider/sqldataprovider.cxx b/sc/source/ui/dataprovider/sqldataprovider.cxx
index 05401075bf8..7521e340ca7 100644
--- a/sc/source/ui/dataprovider/sqldataprovider.cxx
+++ b/sc/source/ui/dataprovider/sqldataprovider.cxx
@@ -9,6 +9,8 @@
 
 #include "sqldataprovider.hxx"
 #include <datatransformation.hxx>
+#include <sal/log.hxx>
+#include <tools/urlobj.hxx>
 #include <salhelper/thread.hxx>
 #include <com/sun/star/sdb/DatabaseContext.hpp>
 #include <com/sun/star/sdb/XCompletedConnection.hpp>
@@ -63,6 +65,13 @@ void SQLFetchThread::execute()
     OUString aTable = maID.copy(0, nIndex);
     OUString aDatabase = maID.copy(nIndex + 1);
 
+    if (INetURLObject(aDatabase).IsExoticProtocol())
+    {
+        SAL_WARN("sc.ui",
+                 "SQLFetchThread::execute: blocked exotic protocol: \"" << aDatabase << "\"");
+        return;
+    }
+
     try
     {
         uno::Reference<sdb::XDatabaseContext> xContext