[PATCH] Some missing "block untrusted referer links" for form controls

...where "Referer" is now passed in as an additional property, so that the
relevant objects can decide whether to obtain graphics while loading a document

Change-Id: Ie3dabc574861713212b906a0d7793f438a7d50a8
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/168674
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <stephan.bergmann@allotropia.de>
(cherry picked from commit dc01a6e7efd3e4c41287dc10c7ea1fdfa1ab5cb5)

[backport]
Prepare CVE-2024-12426 fixes

origin: https://github.com/LibreOffice/core/commit/a32a6301e4ba0c979f5a6b593062749654f3c320

Gbp-Pq: Name CVE-2024-12426_1.patch

diff --git a/forms/source/component/ImageControl.cxx b/forms/source/component/ImageControl.cxx
index 97928cff6fa9b0e99c0dee52624230df9a05e6c1..98a8acd7404d9c3f97aeffa88aa242feefdf0043 100644 (file)
--- a/forms/source/component/ImageControl.cxx
+++ b/forms/source/component/ImageControl.cxx
@@ -51,6 +51,7 @@
 #include <comphelper/property.hxx>
 #include <comphelper/types.hxx>
 #include <cppuhelper/queryinterface.hxx>
+#include <unotools/securityoptions.hxx>
 #include <unotools/ucbstreamhelper.hxx>
 #include <svl/urihelper.hxx>
 
@@ -389,6 +390,12 @@ void OImageControlModel::read(const Reference<XObjectInputStream>& _rxInStream)
 
 bool OImageControlModel::impl_updateStreamForURL_lck( const OUString& _rURL, ValueChangeInstigator _eInstigator )
 {
+    OUString referer;
+    getPropertyValue("Referer") >>= referer;
+    if (SvtSecurityOptions().isUntrustedReferer(referer)) {
+        return false;
+    }
+
     // create a stream for the image specified by the URL
     std::unique_ptr< SvStream > pImageStream;
     Reference< XInputStream > xImageStream;

diff --git a/forms/source/component/clickableimage.cxx b/forms/source/component/clickableimage.cxx
index 68861e42cf30ed7aa7f3ccc28a81509534ddcca9..a8c6305081395e8b345c2c5c46c3d6fcd70a3ba1 100644 (file)
--- a/forms/source/component/clickableimage.cxx
+++ b/forms/source/component/clickableimage.cxx
@@ -46,6 +46,7 @@
 #include <comphelper/types.hxx>
 #include <cppuhelper/exc_hlp.hxx>
 #include <svtools/imageresourceaccess.hxx>
+#include <unotools/securityoptions.hxx>
 #define LOCAL_URL_PREFIX    '#'
 
 
@@ -763,8 +764,12 @@ namespace frm
 
             m_bProdStarted = false;
 
-            // Kick off download (caution: can be synchronous).
-            m_pMedium->Download(LINK(this, OClickableImageBaseModel, DownloadDoneLink));
+            OUString referer;
+            getPropertyValue("Referer") >>= referer;
+            if (!SvtSecurityOptions().isUntrustedReferer(referer)) {
+                // Kick off download (caution: can be synchronous).
+                m_pMedium->Download(LINK(this, OClickableImageBaseModel, DownloadDoneLink));
+            }
         }
         else
         {

diff --git a/include/toolkit/controls/unocontrols.hxx b/include/toolkit/controls/unocontrols.hxx
index eb75d36b6e97d4075a62476437816ac4d8c09333..a9474075ea9203d764d793339bf6cfcbbb632b83 100644 (file)
--- a/include/toolkit/controls/unocontrols.hxx
+++ b/include/toolkit/controls/unocontrols.hxx
@@ -69,7 +69,7 @@ public:
     // appropriately ( e.g. NULL if non GraphicObject scheme ) or a valid
     // object if the rURL points to a valid object
     static css::uno::Reference< css::graphic::XGraphic > getGraphicAndGraphicObjectFromURL_nothrow( css::uno::Reference< css::graphic::XGraphicObject >& xOutGraphicObject, const OUString& _rURL );
-    static css::uno::Reference< css::graphic::XGraphic > getGraphicFromURL_nothrow( const OUString& _rURL );
+    static css::uno::Reference< css::graphic::XGraphic > getGraphicFromURL_nothrow( const OUString& _rURL, OUString const & referer );
 
 };
 

diff --git a/include/toolkit/helper/property.hxx b/include/toolkit/helper/property.hxx
index efc924a1ad2bf417709825ceac9b91288b3974e8..196548abcc83cec666e40aefd6af139e06a369e4 100644 (file)
--- a/include/toolkit/helper/property.hxx
+++ b/include/toolkit/helper/property.hxx
@@ -208,6 +208,7 @@ namespace uno {
 #define BASEPROPERTY_ACTIVE_SEL_TEXT_COLOR          167
 #define BASEPROPERTY_INACTIVE_SEL_TEXT_COLOR        168
 #define BASEPROPERTY_TYPEDITEMLIST                  169 // AnySequence
+#define BASEPROPERTY_REFERER                        172
 
 
 // These properties are not bound, they are always extracted from the BASEPROPERTY_FONTDESCRIPTOR property

diff --git a/toolkit/source/awt/vclxwindows.cxx b/toolkit/source/awt/vclxwindows.cxx
index b97988934e22d110f6d281cd94183130863c101c..e5b091d5d6c287acfb08a76bee5c8c5cb48fc697 100644 (file)
Binary files a/toolkit/source/awt/vclxwindows.cxx and b/toolkit/source/awt/vclxwindows.cxx differ

diff --git a/toolkit/source/controls/dialogcontrol.cxx b/toolkit/source/controls/dialogcontrol.cxx
index a4c695223f5747d197e66a9f90b21e722f26e252..80297803e053ee2c4b73fc35058fe679c1f6eb5d 100644 (file)
--- a/toolkit/source/controls/dialogcontrol.cxx
+++ b/toolkit/source/controls/dialogcontrol.cxx
@@ -410,7 +410,7 @@ void UnoDialogControl::PrepareWindowDescriptor( css::awt::WindowDescriptor& rDes
         ( !aImageURL.isEmpty() ))
     {
         OUString absoluteUrl = getPhysicalLocation(ImplGetPropertyValue(PROPERTY_DIALOGSOURCEURL), uno::makeAny(aImageURL));
-        xGraphic = ImageHelper::getGraphicFromURL_nothrow( absoluteUrl );
+        xGraphic = ImageHelper::getGraphicFromURL_nothrow( absoluteUrl, "" );
         ImplSetPropertyValue( PROPERTY_GRAPHIC, uno::makeAny( xGraphic ), true );
     }
 }
@@ -623,7 +623,7 @@ void UnoDialogControl::ImplModelPropertiesChanged( const Sequence< PropertyChang
                 ( !aImageURL.isEmpty() ))
             {
                 OUString absoluteUrl = getPhysicalLocation(ImplGetPropertyValue(GetPropertyName(BASEPROPERTY_DIALOGSOURCEURL)), uno::makeAny(aImageURL));
-                xGraphic = ImageHelper::getGraphicFromURL_nothrow( absoluteUrl );
+                xGraphic = ImageHelper::getGraphicFromURL_nothrow( absoluteUrl, "" );
             }
             ImplSetPropertyValue(  GetPropertyName( BASEPROPERTY_GRAPHIC), uno::makeAny( xGraphic ), true );
             break;

diff --git a/toolkit/source/controls/unocontrols.cxx b/toolkit/source/controls/unocontrols.cxx
index 945b1f7d721427e054b210b81f2dc5afa7e66921..0972ae679cf14ad404ca8f969ec292ace8ca6a4e 100644 (file)
--- a/toolkit/source/controls/unocontrols.cxx
+++ b/toolkit/source/controls/unocontrols.cxx
@@ -34,6 +34,7 @@
 #include <toolkit/helper/property.hxx>
 #include <helper/servicenames.hxx>
 #include <toolkit/helper/macros.hxx>
+#include <unotools/securityoptions.hxx>
 
 // for introspection
 #include <toolkit/awt/vclxwindows.hxx>
@@ -60,14 +61,14 @@ uno::Reference< graphic::XGraphic >
 ImageHelper::getGraphicAndGraphicObjectFromURL_nothrow( uno::Reference< graphic::XGraphicObject >& xOutGraphicObj, const OUString& _rURL )
 {
     xOutGraphicObj = nullptr;
-    return ImageHelper::getGraphicFromURL_nothrow( _rURL );
+    return ImageHelper::getGraphicFromURL_nothrow( _rURL, "" );
 }
 
 css::uno::Reference< css::graphic::XGraphic >
-ImageHelper::getGraphicFromURL_nothrow( const OUString& _rURL )
+ImageHelper::getGraphicFromURL_nothrow( const OUString& _rURL, OUString const & referer )
 {
     uno::Reference< graphic::XGraphic > xGraphic;
-    if ( _rURL.isEmpty() )
+    if ( _rURL.isEmpty() || SvtSecurityOptions().isUntrustedReferer(referer) )
         return xGraphic;
 
     try
@@ -609,7 +610,11 @@ void SAL_CALL GraphicControlModel::setFastPropertyValue_NoBroadcast( sal_Int32 n
                 mbAdjustingGraphic = true;
                 OUString sImageURL;
                 OSL_VERIFY( rValue >>= sImageURL );
-                setDependentFastPropertyValue( BASEPROPERTY_GRAPHIC, uno::makeAny( ImageHelper::getGraphicFromURL_nothrow( sImageURL ) ) );
+                css::uno::Any any;
+                getFastPropertyValue(any, BASEPROPERTY_REFERER);
+                OUString referer;
+                any >>= referer;
+                setDependentFastPropertyValue( BASEPROPERTY_GRAPHIC, uno::makeAny( ImageHelper::getGraphicFromURL_nothrow( sImageURL, referer ) ) );
                 mbAdjustingGraphic = false;
             }
             break;

diff --git a/toolkit/source/helper/property.cxx b/toolkit/source/helper/property.cxx
index c3b67df41ac4419f3c9e5fe72059e3cc8a2ebbc4..cb3face4bf631cdea9feb60702ed5fee39dacd2a 100644 (file)
--- a/toolkit/source/helper/property.cxx
+++ b/toolkit/source/helper/property.cxx
@@ -267,6 +267,8 @@ static ImplPropertyInfo* ImplGetPropertyInfos( sal_uInt16& rElementCount )
         DECL_PROP_3     ( "InactiveSelectionBackgroundColor", INACTIVE_SEL_BACKGROUND_COLOR, sal_Int32, BOUND, MAYBEDEFAULT, MAYBEVOID ),
         DECL_PROP_3     ( "ActiveSelectionTextColor",         ACTIVE_SEL_TEXT_COLOR,         sal_Int32, BOUND, MAYBEDEFAULT, MAYBEVOID ),
         DECL_PROP_3     ( "InactiveSelectionTextColor",       INACTIVE_SEL_TEXT_COLOR,       sal_Int32, BOUND, MAYBEDEFAULT, MAYBEVOID ),
+
+        DECL_PROP_2("Referer", REFERER, OUString, BOUND, MAYBEVOID),
     };
     rElementCount = SAL_N_ELEMENTS(aImplPropertyInfos);
     return aImplPropertyInfos;

diff --git a/xmloff/source/forms/elementimport.cxx b/xmloff/source/forms/elementimport.cxx
index 622d7101863369767b26dbfb9c8e42d128aff677..7b4c81f21f53b58bccfeb852ac8423af3d326eea 100644 (file)
--- a/xmloff/source/forms/elementimport.cxx
+++ b/xmloff/source/forms/elementimport.cxx
@@ -558,6 +558,15 @@ namespace xmloff
             OSL_ENSURE(xPure.is(),
                         OStringBuffer("OElementImport::createElement: service factory gave me no object (service name: ").append(OUStringToOString(m_sServiceName, RTL_TEXTENCODING_ASCII_US)).append(")!").getStr());
             xReturn.set(xPure, UNO_QUERY);
+            if (auto const props = Reference<css::beans::XPropertySet>(xPure, css::uno::UNO_QUERY))
+            {
+                try {
+                    props->setPropertyValue(
+                        "Referer", css::uno::Any(m_rFormImport.getGlobalContext().GetBaseURL()));
+                } catch (css::uno::Exception &) {
+                    TOOLS_INFO_EXCEPTION("xmloff.forms", "setPropertyValue Referer failed");
+                }
+            }
         }
         else
             OSL_FAIL("OElementImport::createElement: no service name to create an element!");