diff options
author | Stephan Bergmann <sbergman@redhat.com> | 2019-08-06 13:29:22 +0200 |
---|---|---|
committer | Thorsten Behrens <Thorsten.Behrens@CIB.de> | 2019-08-30 23:32:29 +0200 |
commit | 8fa1edee95c9e131aa424c0d11b98cd8d4587c49 (patch) | |
tree | 680cb70bbb7ed88557794aea4bbbe8be395376e3 | |
parent | expand LibreLogo check to global events (diff) | |
download | core-8fa1edee95c9e131aa424c0d11b98cd8d4587c49.tar.gz core-8fa1edee95c9e131aa424c0d11b98cd8d4587c49.zip |
Properly obtain location
Change-Id: I9fb0d883a3623394343cd54ef61e5610544198c8
Reviewed-on: https://gerrit.libreoffice.org/77019
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
(cherry picked from commit a9cde2557242a0c343d99533f3ee032599c66f42)
Reviewed-on: https://gerrit.libreoffice.org/77023
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 28c6af3ddc283ca9c5712359a9abcb385c1575b4)
Reviewed-on: https://gerrit.libreoffice.org/77097
Reviewed-by: Thorsten Behrens <Thorsten.Behrens@CIB.de>
Tested-by: Thorsten Behrens <Thorsten.Behrens@CIB.de>
-rw-r--r-- | scripting/source/protocolhandler/scripthandler.cxx | 9 | ||||
-rw-r--r-- | sfx2/source/doc/objmisc.cxx | 21 |
2 files changed, 19 insertions, 11 deletions
diff --git a/scripting/source/protocolhandler/scripthandler.cxx b/scripting/source/protocolhandler/scripthandler.cxx index 85573b51a5c3..e75897ef5894 100644 --- a/scripting/source/protocolhandler/scripthandler.cxx +++ b/scripting/source/protocolhandler/scripthandler.cxx @@ -51,6 +51,7 @@ #include "com/sun/star/uri/XUriReference.hpp" #include "com/sun/star/uri/UriReferenceFactory.hpp" #include "com/sun/star/uri/XVndSunStarScriptUrl.hpp" +#include <com/sun/star/uri/XVndSunStarScriptUrlReference.hpp> #include <memory> @@ -146,8 +147,12 @@ void SAL_CALL ScriptProtocolHandler::dispatchWithNotification( { try { - bool bIsDocumentScript = ( aURL.Complete.indexOf( "document" ) !=-1 ); - // TODO: isn't this somewhat strange? This should be a test for a location=document parameter, shouldn't it? + css::uno::Reference<css::uri::XUriReferenceFactory> urifac( + css::uri::UriReferenceFactory::create(m_xContext)); + css::uno::Reference<css::uri::XVndSunStarScriptUrlReference> uri( + urifac->parse(aURL.Complete), css::uno::UNO_QUERY_THROW); + auto const loc = uri->getParameter("location"); + bool bIsDocumentScript = loc == "document"; if ( bIsDocumentScript ) { diff --git a/sfx2/source/doc/objmisc.cxx b/sfx2/source/doc/objmisc.cxx index 330c475efb8b..b3e7e510fdeb 100644 --- a/sfx2/source/doc/objmisc.cxx +++ b/sfx2/source/doc/objmisc.cxx @@ -1473,19 +1473,22 @@ ErrCode SfxObjectShell::CallXScript( const Reference< XInterface >& _rxScriptCon OSL_TRACE( "in CallXScript" ); ErrCode nErr = ERRCODE_NONE; - bool bIsDocumentScript = ( _rScriptURL.indexOf( "location=document" ) >= 0 ); - // TODO: we should parse the URL, and check whether there is a parameter with this name. - // Otherwise, we might find too much. - if ( bIsDocumentScript && !lcl_isScriptAccessAllowed_nothrow( _rxScriptContext ) ) - return ERRCODE_IO_ACCESSDENIED; - - if ( UnTrustedScript(_rScriptURL) ) - return ERRCODE_IO_ACCESSDENIED; - bool bCaughtException = false; Any aException; try { + css::uno::Reference<css::uri::XUriReferenceFactory> urifac( + css::uri::UriReferenceFactory::create(comphelper::getProcessComponentContext())); + css::uno::Reference<css::uri::XVndSunStarScriptUrlReference> uri( + urifac->parse(_rScriptURL), css::uno::UNO_QUERY_THROW); + auto const loc = uri->getParameter("location"); + bool bIsDocumentScript = loc == "document"; + if ( bIsDocumentScript && !lcl_isScriptAccessAllowed_nothrow( _rxScriptContext ) ) + return ERRCODE_IO_ACCESSDENIED; + + if ( UnTrustedScript(_rScriptURL) ) + return ERRCODE_IO_ACCESSDENIED; + // obtain/create a script provider Reference< provider::XScriptProvider > xScriptProvider; Reference< provider::XScriptProviderSupplier > xSPS( _rxScriptContext, UNO_QUERY ); |