This is an automated email from the ASF dual-hosted git repository. ardovm pushed a commit to branch AOO41X in repository https://gitbox.apache.org/repos/asf/openoffice.git
commit 95923fd437e06edd38a4f0e139a27c755a6f3ba6 Author: Piotr P. Karwasz <[email protected]> AuthorDate: Fri Jul 3 09:18:19 2026 +0200 Reject further invalid URLs Assisted-By: Claude Opus 4.8 <[email protected]> (cherry picked from commit 181421139242694b309751fb666406eddc203c50) --- main/jvmaccess/source/classpath.cxx | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/main/jvmaccess/source/classpath.cxx b/main/jvmaccess/source/classpath.cxx index adb11ae48f..c27a530ba7 100644 --- a/main/jvmaccess/source/classpath.cxx +++ b/main/jvmaccess/source/classpath.cxx @@ -48,6 +48,26 @@ namespace { namespace css = ::com::sun::star; +#if defined SOLAR_JAVA +// URL schemes that resolve to the local file system or the running JVM image, +// optionally wrapped in a jar: URL. +// +// com.sun.star.comp.sdbc.Tools enforces the same allow-list on the Java side; +// keep the two in sync. +bool isLocalClassPathUrl(::rtl::OUString const & url) +{ + return url.matchIgnoreAsciiCaseAsciiL(RTL_CONSTASCII_STRINGPARAM("file:")) + || url.matchIgnoreAsciiCaseAsciiL(RTL_CONSTASCII_STRINGPARAM("jrt:")) + || url.matchIgnoreAsciiCaseAsciiL(RTL_CONSTASCII_STRINGPARAM("jmod:")) + || url.matchIgnoreAsciiCaseAsciiL( + RTL_CONSTASCII_STRINGPARAM("jar:file:")) + || url.matchIgnoreAsciiCaseAsciiL( + RTL_CONSTASCII_STRINGPARAM("jar:jrt:")) + || url.matchIgnoreAsciiCaseAsciiL( + RTL_CONSTASCII_STRINGPARAM("jar:jmod:")); +} +#endif + } void * ::jvmaccess::ClassPath::doTranslateToUrls( @@ -93,6 +113,16 @@ void * ::jvmaccess::ClassPath::doTranslateToUrls( css::uno::Reference< css::uno::XInterface >()); } } + // Add only local entries; a non-local one is logged and skipped. + if (!isLocalClassPathUrl(url)) + { + OSL_TRACE( + "jvmaccess::ClassPath: skipping non-local class path" + " entry: %s", + ::rtl::OUStringToOString( + url, RTL_TEXTENCODING_ASCII_US).getStr()); + continue; + } jvalue arg; arg.l = env->NewString( static_cast< jchar const * >(url.getStr()),
