sfx2/source/doc/iframe.cxx | 4 ++++ sfx2/source/inc/eventsupplier.hxx | 1 - 2 files changed, 4 insertions(+), 1 deletion(-)
New commits: commit b19e0a6676b800b9d3c362c722913f1362113006 Author: Samuel Mehrbrodt <[email protected]> AuthorDate: Mon Feb 27 15:27:24 2023 +0100 Commit: Caolán McNamara <[email protected]> CommitDate: Tue Mar 7 09:01:46 2023 +0000 Check iframe target for allowed document URLs Change-Id: I00e4192becbc160282a43ab89dcd269f3d1012d8 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147919 Tested-by: Jenkins Reviewed-by: Samuel Mehrbrodt <[email protected]> (cherry picked from commit 288c0920a8475f9f2c537212e04aa7649192ad8c) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/148229 Reviewed-by: Caolán McNamara <[email protected]> diff --git a/sfx2/source/doc/iframe.cxx b/sfx2/source/doc/iframe.cxx index 80e0c4e68457..15e0a7cf5c9c 100644 --- a/sfx2/source/doc/iframe.cxx +++ b/sfx2/source/doc/iframe.cxx @@ -45,6 +45,7 @@ #include <vcl/window.hxx> #include <tools/debug.hxx> #include <macroloader.hxx> +#include <eventsupplier.hxx> using namespace ::com::sun::star; @@ -173,6 +174,9 @@ sal_Bool SAL_CALL IFrameObject::load( return false; } + if (!SfxEvents_Impl::isScriptURLAllowed(aTargetURL.Complete)) + return false; + DBG_ASSERT( !mxFrame.is(), "Frame already existing!" ); VclPtr<vcl::Window> pParent = VCLUnoHelper::GetWindow( xFrame->getContainerWindow() ); VclPtr<IFrameWindow_Impl> pWin = VclPtr<IFrameWindow_Impl>::Create( pParent, maFrmDescr.IsFrameBorderOn() ); diff --git a/sfx2/source/inc/eventsupplier.hxx b/sfx2/source/inc/eventsupplier.hxx index 56aa8f95e75f..316b3b1836d7 100644 --- a/sfx2/source/inc/eventsupplier.hxx +++ b/sfx2/source/inc/eventsupplier.hxx @@ -81,7 +81,6 @@ public: SfxObjectShell* i_document ); static void Execute( css::uno::Sequence < css::beans::PropertyValue > const & aEventData, const css::document::DocumentEvent& aTrigger, SfxObjectShell* pDoc ); -private: /// Check if script URL whitelist exists, and if so, if current script url is part of it static bool isScriptURLAllowed(const OUString& aScriptURL); };
