check if non-file uris could be interpreted as a file system pathname

Change-Id: If283bec44ad1d648c68a5d0f028855e09c09017e
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/179868
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>

shell/Library_syssh.mk

@@ -25,6 +25,10 @@ $(eval $(call gb_Library_use_system_win32_libs,syssh,\
 	shell32 \
 ))
 
+$(eval $(call gb_Library_use_libraries,syssh,\
+	tl \
+))
+
 $(eval $(call gb_Library_set_componentfile,syssh,shell/source/win32/syssh,services))
 
 $(eval $(call gb_Library_add_exception_objects,syssh,\

shell/source/win32/SysShExec.cxx

@@ -38,6 +38,7 @@
 #include <o3tl/runtimetooustring.hxx>
 #include <o3tl/safeCoInitUninit.hxx>
 #include <o3tl/string_view.hxx>
+#include <tools/urlobj.hxx>
 
 #include <prewin.h>
 #include <Shlobj.h>
@@ -342,6 +343,14 @@ void SAL_CALL CSysShExec::execute( const OUString& aCommand, const OUString& aPa
                     {}, 0);
             }
             preprocessed_command = checkFile(pathname, aCommand);
+        } else {
+            // Filter out input that technically is a non-file URI, but could be interpreted by
+            // ShellExecuteExW as a file system pathname.
+            if (INetURLObject(aCommand, INetProtocol::File).GetProtocol() == INetProtocol::File) {
+                throw css::lang::IllegalArgumentException(
+                    "XSystemShellExecute.execute URIS_ONLY with non-URI pathname " + aCommand,
+                    getXWeak(), 0);
+            }
         }
     }