diff --git a/include/sfx2/objsh.hxx b/include/sfx2/objsh.hxx index ae5f6a6fe5ef..63cfacb2850d 100644 --- a/include/sfx2/objsh.hxx +++ b/include/sfx2/objsh.hxx @@ -440,6 +440,9 @@ public: static bool UnTrustedScript(const OUString& rScriptURL); + /// Check if script URL whitelist exists, and if so, if current script url is part of it + static bool isScriptURLAllowed(const OUString& rScriptURL); + static bool isScriptAccessAllowed(const css::uno::Reference& rScriptContext); SvKeyValueIterator* GetHeaderAttributes(); diff --git a/sfx2/source/doc/objmisc.cxx b/sfx2/source/doc/objmisc.cxx index 2ff1fca3bfde..b553738ef966 100644 --- a/sfx2/source/doc/objmisc.cxx +++ b/sfx2/source/doc/objmisc.cxx @@ -84,6 +84,10 @@ #include #include +#include +#include +#include + #include #include #include @@ -1458,6 +1462,31 @@ ErrCode SfxObjectShell::CallBasic( std::u16string_view rMacro, return nRet; } +bool SfxObjectShell::isScriptURLAllowed(const OUString& rScriptURL) +{ + std::optional> allowedEvents( + officecfg::Office::Common::Security::Scripting::AllowedDocumentEventURLs::get()); + // When AllowedDocumentEventURLs is empty, all event URLs are allowed + if (!allowedEvents) + return true; + + icu::ErrorCode status; + const uint32_t rMatcherFlags = UREGEX_CASE_INSENSITIVE; + icu::UnicodeString usInput(rScriptURL.getStr()); + const uno::Sequence& rAllowedEvents = *allowedEvents; + for (auto const& allowedEvent : rAllowedEvents) + { + icu::UnicodeString usRegex(allowedEvent.getStr()); + icu::RegexMatcher rmatch1(usRegex, usInput, rMatcherFlags, status); + if (rScriptURL.startsWith(allowedEvent) || rmatch1.matches(status)) + { + return true; + } + } + + return false; +} + bool SfxObjectShell::isScriptAccessAllowed( const Reference< XInterface >& _rxScriptContext ) { try diff --git a/sfx2/source/inc/eventsupplier.hxx b/sfx2/source/inc/eventsupplier.hxx index 56aa8f95e75f..f552c1fa043e 100644 --- a/sfx2/source/inc/eventsupplier.hxx +++ b/sfx2/source/inc/eventsupplier.hxx @@ -80,10 +80,6 @@ public: ::comphelper::NamedValueCollection& o_normalizedDescriptor, SfxObjectShell* i_document ); static void Execute( css::uno::Sequence < css::beans::PropertyValue > const & aEventData, const css::document::DocumentEvent& aTrigger, SfxObjectShell* pDoc ); - -private: - /// Check if script URL whitelist exists, and if so, if current script url is part of it - static bool isScriptURLAllowed(const OUString& aScriptURL); }; #endif diff --git a/sfx2/source/notify/eventsupplier.cxx b/sfx2/source/notify/eventsupplier.cxx index be47bed36cfb..102621242dc6 100644 --- a/sfx2/source/notify/eventsupplier.cxx +++ b/sfx2/source/notify/eventsupplier.cxx @@ -43,9 +43,6 @@ #include #include -#include -#include -#include using namespace css; using namespace ::com::sun::star; @@ -155,31 +152,6 @@ sal_Bool SAL_CALL SfxEvents_Impl::hasElements() return maEventNames.hasElements(); } -bool SfxEvents_Impl::isScriptURLAllowed(const OUString& aScriptURL) -{ - std::optional> allowedEvents( - officecfg::Office::Common::Security::Scripting::AllowedDocumentEventURLs::get()); - // When AllowedDocumentEventURLs is empty, all event URLs are allowed - if (!allowedEvents) - return true; - - icu::ErrorCode status; - const uint32_t rMatcherFlags = UREGEX_CASE_INSENSITIVE; - icu::UnicodeString usInput(aScriptURL.getStr()); - const css::uno::Sequence& rAllowedEvents = *allowedEvents; - for (auto const& allowedEvent : rAllowedEvents) - { - icu::UnicodeString usRegex(allowedEvent.getStr()); - icu::RegexMatcher rmatch1(usRegex, usInput, rMatcherFlags, status); - if (aScriptURL.startsWith(allowedEvent) || rmatch1.matches(status)) - { - return true; - } - } - - return false; -} - void SfxEvents_Impl::Execute( css::uno::Sequence < css::beans::PropertyValue > const & aProperties, const document::DocumentEvent& aTrigger, SfxObjectShell* pDoc ) { OUString aType; @@ -214,7 +186,7 @@ void SfxEvents_Impl::Execute( css::uno::Sequence < css::beans::PropertyValue > c if (aScript.isEmpty()) return; - if (!isScriptURLAllowed(aScript)) + if (!SfxObjectShell::isScriptURLAllowed(aScript)) return; if (!pDoc)