From: Debian LibreOffice Maintainers <debian-openoffice@lists.debian.org>
Date: Tue, 18 Jun 2019 18:36:04 +0000 (+0100)
Subject: explictly-exclude-LibreLogo-from-XScript-usage
X-Git-Tag: archive/raspbian/1%6.1.5-3+rpi1+deb10u2^2~2
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=c0cead9acf3410b4c558d1eb167c935fbe380d43;p=libreoffice.git

explictly-exclude-LibreLogo-from-XScript-usage


Gbp-Pq: Name explictly-exclude-LibreLogo-from-XScript-usage.diff
---

diff --git a/sfx2/source/doc/objmisc.cxx b/sfx2/source/doc/objmisc.cxx
index 8bee369851e..8594e9522e4 100644
--- a/sfx2/source/doc/objmisc.cxx
+++ b/sfx2/source/doc/objmisc.cxx
@@ -1346,6 +1346,16 @@ namespace
     }
 }
 
+namespace {
+
+// don't allow LibreLogo to be used with our mouseover/etc dom-alike events
+bool UnTrustedScript(const OUString& rScriptURL)
+{
+    return rScriptURL.startsWithIgnoreAsciiCase("vnd.sun.star.script:LibreLogo");
+}
+
+}
+
 ErrCode SfxObjectShell::CallXScript( const Reference< XInterface >& _rxScriptContext, const OUString& _rScriptURL,
     const Sequence< Any >& aParams, Any& aRet, Sequence< sal_Int16 >& aOutParamIndex, Sequence< Any >& aOutParam, bool bRaiseError, const css::uno::Any* pCaller )
 {
@@ -1358,6 +1368,9 @@ ErrCode SfxObjectShell::CallXScript( const Reference< XInterface >& _rxScriptCon
     if ( bIsDocumentScript && !lcl_isScriptAccessAllowed_nothrow( _rxScriptContext ) )
         return ERRCODE_IO_ACCESSDENIED;
 
+    if ( UnTrustedScript(_rScriptURL) )
+        return ERRCODE_IO_ACCESSDENIED;
+
     bool bCaughtException = false;
     Any aException;
     try