From: Caolán McNamara <caolan.mcnamara@collabora.com>
Date: Sat, 11 Jul 2026 23:43:49 +0000 (+0000)
Subject: [PATCH] sc: check the host when fetching an external data range
X-Git-Tag: archive/raspbian/4%25.2.3-2+rpi1+deb13u8^2~10
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=b826af060f2aca42a4fe9af9cca22341420a600f;p=libreoffice.git

[PATCH] sc: check the host when fetching an external data range

checked only the file path allowlist. reject hosts outside it
too, like ScExternalRefManager and ScWebServiceLink.

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I85baf17e028b8773a886945cfccd0482e5ae2b34
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6935
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 29b5cb45a18ca79b28ce3a02be22803d94a36368)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/208197
Reviewed-by: Dan Williams <dcbw@libreoffice.org>
Tested-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
Reviewed-by: Ilmari Lauhakangas <ilmari.lauhakangas@libreoffice.org>
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>

Gbp-Pq: Name CVE-2026-63267-2.diff
---

diff --git a/sc/source/ui/dataprovider/dataprovider.cxx b/sc/source/ui/dataprovider/dataprovider.cxx
index 0a6eab303aa..98f8694135a 100644
--- a/sc/source/ui/dataprovider/dataprovider.cxx
+++ b/sc/source/ui/dataprovider/dataprovider.cxx
@@ -17,6 +17,7 @@
 #include <unotools/charclass.hxx>
 #include <tools/stream.hxx>
 #include <comphelper/processfactory.hxx>
+#include <tools/hostfilter.hxx>
 #include <tools/urlobj.hxx>
 
 #include "htmldataprovider.hxx"
@@ -44,6 +45,12 @@ std::unique_ptr<SvStream> DataProvider::FetchStreamFromURL(const OUString& rURL,
         return nullptr;
     }
 
+    if (HostFilter::isForbidden(aURLObject.GetHost()))
+    {
+        SAL_WARN("sc.ui", "DataProvider::FetchStreamFromURL: blocked host: \"" << rURL << "\"");
+        return nullptr;
+    }
+
     try
     {
         uno::Reference< ucb::XSimpleFileAccess3 > xFileAccess = ucb::SimpleFileAccess::create( comphelper::getProcessComponentContext() );