Skip to content
Permalink
Browse files

explictly exclude LibreLogo from XScript usage

Change-Id: I567647f0e2f8b82e4ef2995c673abe82f4564228
Reviewed-on: https://gerrit.libreoffice.org/73708
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
  • Loading branch information...
Caolán McNamara authored and stbergmann committed Jun 7, 2019
1 parent 4d51531 commit 3dd024a28a98a9d4b4efc3c7ec6acaa94d2b25fd
Showing with 13 additions and 0 deletions.
  1. +13 −0 sfx2/source/doc/objmisc.cxx
@@ -1340,6 +1340,16 @@ namespace
}
}

namespace {

// don't allow LibreLogo to be used with our mouseover/etc dom-alike events
bool UnTrustedScript(const OUString& rScriptURL)
{
return rScriptURL.startsWithIgnoreAsciiCase("vnd.sun.star.script:LibreLogo");
}

}

ErrCode SfxObjectShell::CallXScript( const Reference< XInterface >& _rxScriptContext, const OUString& _rScriptURL,
const Sequence< Any >& aParams, Any& aRet, Sequence< sal_Int16 >& aOutParamIndex, Sequence< Any >& aOutParam, bool bRaiseError, const css::uno::Any* pCaller )
{
@@ -1352,6 +1362,9 @@ ErrCode SfxObjectShell::CallXScript( const Reference< XInterface >& _rxScriptCon
if ( bIsDocumentScript && !lcl_isScriptAccessAllowed_nothrow( _rxScriptContext ) )
return ERRCODE_IO_ACCESSDENIED;

if ( UnTrustedScript(_rScriptURL) )
return ERRCODE_IO_ACCESSDENIED;

bool bCaughtException = false;
Any aException;
try

0 comments on commit 3dd024a

Please sign in to comment.
You can’t perform that action at this time.