ODFstudio/odfstudio
2
0
Fork 0
Code Issues Packages Activity

move isScriptURLAllowed onto SfxObjectShell

Browse Source 
it was private to sfx2's eventsupplier.hxx, so nothing outside sfx2
could run the AllowedDocumentEventURLs test

Change-Id: I814a965cafc245eb7b7f2d8fb18a81d1f7b7e50f
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/10920
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 4a5b2dd74b4e82b183961ca8f50d80bd485d5359)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/210591
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
(cherry picked from commit 890f388a78)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211800
This commit is contained in:
Caolán McNamara
2026-10-05 20:32:27 +02:00
committed by Xisco Fauli
parent d2c3ac40a2
commit 8aedcd05ab
4 changed files with 33 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/sfx2/objsh.hxx
+3
View File
@@ -440,6 +440,9 @@ public:
static bool UnTrustedScript(const OUString& rScriptURL);
/// Check if script URL whitelist exists, and if so, if current script url is part of it
static bool isScriptURLAllowed(const OUString& rScriptURL);
static bool isScriptAccessAllowed(const css::uno::Reference<css::uno::XInterface>& rScriptContext);
SvKeyValueIterator* GetHeaderAttributes();
sfx2/source/doc/objmisc.cxx
+29
View File
@@ -84,6 +84,10 @@
#include <ucbhelper/simpleinteractionrequest.hxx>
#include <officecfg/Office/Common.hxx>
#include <unicode/errorcode.h>
#include <unicode/regex.h>
#include <unicode/unistr.h>
#include <sfx2/brokenpackageint.hxx>
#include <sfx2/signaturestate.hxx>
#include <sfx2/app.hxx>
@@ -1458,6 +1462,31 @@ ErrCode SfxObjectShell::CallBasic( std::u16string_view rMacro,
return nRet;
}
bool SfxObjectShell::isScriptURLAllowed(const OUString& rScriptURL)
{
std::optional<uno::Sequence<OUString>> allowedEvents(
officecfg::Office::Common::Security::Scripting::AllowedDocumentEventURLs::get());
// When AllowedDocumentEventURLs is empty, all event URLs are allowed
if (!allowedEvents)
return true;
icu::ErrorCode status;
const uint32_t rMatcherFlags = UREGEX_CASE_INSENSITIVE;
icu::UnicodeString usInput(rScriptURL.getStr());
const uno::Sequence<OUString>& rAllowedEvents = *allowedEvents;
for (auto const& allowedEvent : rAllowedEvents)
{
icu::UnicodeString usRegex(allowedEvent.getStr());
icu::RegexMatcher rmatch1(usRegex, usInput, rMatcherFlags, status);
if (rScriptURL.startsWith(allowedEvent) || rmatch1.matches(status))
{
return true;
}
}
return false;
}
bool SfxObjectShell::isScriptAccessAllowed( const Reference< XInterface >& _rxScriptContext )
{
try
sfx2/source/inc/eventsupplier.hxx
-4
View File
@@ -80,10 +80,6 @@ public:
::comphelper::NamedValueCollection& o_normalizedDescriptor,
SfxObjectShell* i_document );
static void Execute( css::uno::Sequence < css::beans::PropertyValue > const & aEventData, const css::document::DocumentEvent& aTrigger, SfxObjectShell* pDoc );
private:
/// Check if script URL whitelist exists, and if so, if current script url is part of it
static bool isScriptURLAllowed(const OUString& aScriptURL);
};
#endif
sfx2/source/notify/eventsupplier.cxx
+1 -29
View File
@@ -43,9 +43,6 @@
#include <sfx2/frame.hxx>
#include <macroloader.hxx>
#include <unicode/errorcode.h>
#include <unicode/regex.h>
#include <unicode/unistr.h>
using namespace css;
using namespace ::com::sun::star;
@@ -155,31 +152,6 @@ sal_Bool SAL_CALL SfxEvents_Impl::hasElements()
return maEventNames.hasElements();
}
bool SfxEvents_Impl::isScriptURLAllowed(const OUString& aScriptURL)
{
std::optional<css::uno::Sequence<OUString>> allowedEvents(
officecfg::Office::Common::Security::Scripting::AllowedDocumentEventURLs::get());
// When AllowedDocumentEventURLs is empty, all event URLs are allowed
if (!allowedEvents)
return true;
icu::ErrorCode status;
const uint32_t rMatcherFlags = UREGEX_CASE_INSENSITIVE;
icu::UnicodeString usInput(aScriptURL.getStr());
const css::uno::Sequence<OUString>& rAllowedEvents = *allowedEvents;
for (auto const& allowedEvent : rAllowedEvents)
{
icu::UnicodeString usRegex(allowedEvent.getStr());
icu::RegexMatcher rmatch1(usRegex, usInput, rMatcherFlags, status);
if (aScriptURL.startsWith(allowedEvent) || rmatch1.matches(status))
{
return true;
}
}
return false;
}
void SfxEvents_Impl::Execute( css::uno::Sequence < css::beans::PropertyValue > const & aProperties, const document::DocumentEvent& aTrigger, SfxObjectShell* pDoc )
{
OUString aType;
@@ -214,7 +186,7 @@ void SfxEvents_Impl::Execute( css::uno::Sequence < css::beans::PropertyValue > c
if (aScript.isEmpty())
return;
if (!isScriptURLAllowed(aScript))
if (!SfxObjectShell::isScriptURLAllowed(aScript))
return;
if (!pDoc)