From 06c1d9c38d34d42aff7f2b90226f32c462cffd2c Mon Sep 17 00:00:00 2001 From: Debian LibreOffice Maintainers Date: Sat, 25 Mar 2023 16:22:16 +0000 Subject: [PATCH] explictly-exclude-LibreLogo-from-XScript-usage =================================================================== Gbp-Pq: Name explictly-exclude-LibreLogo-from-XScript-usage.diff --- sfx2/source/doc/objmisc.cxx | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/sfx2/source/doc/objmisc.cxx b/sfx2/source/doc/objmisc.cxx index 8bee369851e..8594e9522e4 100644 --- a/sfx2/source/doc/objmisc.cxx +++ b/sfx2/source/doc/objmisc.cxx @@ -1346,6 +1346,16 @@ namespace } } +namespace { + +// don't allow LibreLogo to be used with our mouseover/etc dom-alike events +bool UnTrustedScript(const OUString& rScriptURL) +{ + return rScriptURL.startsWithIgnoreAsciiCase("vnd.sun.star.script:LibreLogo"); +} + +} + ErrCode SfxObjectShell::CallXScript( const Reference< XInterface >& _rxScriptContext, const OUString& _rScriptURL, const Sequence< Any >& aParams, Any& aRet, Sequence< sal_Int16 >& aOutParamIndex, Sequence< Any >& aOutParam, bool bRaiseError, const css::uno::Any* pCaller ) { @@ -1358,6 +1368,9 @@ ErrCode SfxObjectShell::CallXScript( const Reference< XInterface >& _rxScriptCon if ( bIsDocumentScript && !lcl_isScriptAccessAllowed_nothrow( _rxScriptContext ) ) return ERRCODE_IO_ACCESSDENIED; + if ( UnTrustedScript(_rScriptURL) ) + return ERRCODE_IO_ACCESSDENIED; + bool bCaughtException = false; Any aException; try -- 2.30.2