You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@openoffice.apache.org by ji...@apache.org on 2026/10/13 15:22:01 UTC
(openoffice) branch AOO50X updated (506689575e -> eb76c9b3bf)
This is an automated email from the ASF dual-hosted git repository.
jimjag pushed a change to branch AOO50X
in repository https://gitbox.apache.org/repos/asf/openoffice.git
from 506689575e macOS: skip the Mach-O load-command check for the language-pack app
new cb5c5ed04d VCL: when loading PNG's, ensure we do not reuse an object that was created on the stack
new 5ac6444975 More checks
new e9166edf3e Restore compatibility with provided files
new 2a3f89c4a4 Skip invalid entries
new 7746dcdedc Reject further invalid URLs
new 30a740d635 sw: ww8: validate PLCF length
new 0203c3bbfd Check lengths
new f510625c6b Limit paths for text caches for embedded databases
new 9e4e65485f Fix null pointer dereference
new 1b70b77715 Ignore meaningless attributes
new 49dd8164ed Accept local files
new f8f8f96e02 Tests for: accept local files
new 4b5e5dfc7a Fix acceptance of local files
new eb76c9b3bf svx, avmedia: put the media question when the URL is set, not while painting
The 14 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
main/avmedia/source/viewer/mediawindow.cxx | 15 +-
.../main/java/com/sun/star/comp/sdbc/ClassMap.java | 9 +-
.../main/java/com/sun/star/comp/sdbc/Tools.java | 67 ++++++++
.../sun/star/comp/sdbc/classloading/ClassMap.java | 11 +-
main/connectivity/qa/complex/sdbc/ToolsTest.java | 177 +++++++++++++++++++++
.../qa/complex/sdbc}/makefile.mk | 23 ++-
main/dbaccess/source/filter/xml/xmlDataSource.cxx | 3 -
main/dbaccess/source/filter/xml/xmlEnums.hxx | 1 -
main/dbaccess/source/filter/xml/xmlfilter.cxx | 18 ++-
main/hsqldb/makefile.mk | 2 +-
main/hsqldb/patches/text_tables.patch | 13 ++
main/jvmaccess/source/classpath.cxx | 65 +++++++-
main/package/source/package/zipapi/ZipFile.cxx | 4 +-
.../sdext/source/pdfimport/pdfparse/pdfentries.cxx | 22 ++-
main/sfx2/source/appl/appuno.cxx | 4 +-
main/svx/source/svdraw/svdomedia.cxx | 51 ++++++
...bigpointerarray.mk => GoogleTest_sw_ww8plcf.mk} | 16 +-
main/sw/Module_sw.mk | 1 +
main/sw/source/filter/ww8/qa/ww8plcf_test.cxx | 78 +++++++++
main/sw/source/filter/ww8/ww8scan.cxx | 15 ++
main/sw/source/filter/ww8/ww8scan.hxx | 3 +
main/tools/source/zcodec/zcodec.cxx | 1 +
main/vcl/source/gdi/pngread.cxx | 2 +-
23 files changed, 545 insertions(+), 56 deletions(-)
create mode 100644 main/connectivity/qa/complex/sdbc/ToolsTest.java
copy main/{testtools/qa/cli => connectivity/qa/complex/sdbc}/makefile.mk (77%)
create mode 100644 main/hsqldb/patches/text_tables.patch
copy main/sw/{GoogleTest_sw_bigpointerarray.mk => GoogleTest_sw_ww8plcf.mk} (69%)
create mode 100644 main/sw/source/filter/ww8/qa/ww8plcf_test.cxx
(openoffice) 05/14: Reject further invalid URLs
Posted by ji...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jimjag pushed a commit to branch AOO50X
in repository https://gitbox.apache.org/repos/asf/openoffice.git
commit 7746dcdedcdd5be443ec8cff69ddbba887a2a4c4
Author: Piotr P. Karwasz <pi...@github.copernik.eu>
AuthorDate: Fri Jul 3 09:18:19 2026 +0200
Reject further invalid URLs
Assisted-By: Claude Opus 4.8 <no...@anthropic.com>
(cherry picked from commit 181421139242694b309751fb666406eddc203c50)
---
main/jvmaccess/source/classpath.cxx | 30 ++++++++++++++++++++++++++++++
1 file changed, 30 insertions(+)
diff --git a/main/jvmaccess/source/classpath.cxx b/main/jvmaccess/source/classpath.cxx
index 54ab6a3a95..f241cb9ff6 100644
--- a/main/jvmaccess/source/classpath.cxx
+++ b/main/jvmaccess/source/classpath.cxx
@@ -48,6 +48,26 @@ namespace {
namespace css = ::com::sun::star;
+#if defined SOLAR_JAVA
+// URL schemes that resolve to the local file system or the running JVM image,
+// optionally wrapped in a jar: URL.
+//
+// com.sun.star.comp.sdbc.Tools enforces the same allow-list on the Java side;
+// keep the two in sync.
+bool isLocalClassPathUrl(::rtl::OUString const & url)
+{
+ return url.matchIgnoreAsciiCaseAsciiL(RTL_CONSTASCII_STRINGPARAM("file:"))
+ || url.matchIgnoreAsciiCaseAsciiL(RTL_CONSTASCII_STRINGPARAM("jrt:"))
+ || url.matchIgnoreAsciiCaseAsciiL(RTL_CONSTASCII_STRINGPARAM("jmod:"))
+ || url.matchIgnoreAsciiCaseAsciiL(
+ RTL_CONSTASCII_STRINGPARAM("jar:file:"))
+ || url.matchIgnoreAsciiCaseAsciiL(
+ RTL_CONSTASCII_STRINGPARAM("jar:jrt:"))
+ || url.matchIgnoreAsciiCaseAsciiL(
+ RTL_CONSTASCII_STRINGPARAM("jar:jmod:"));
+}
+#endif
+
}
void * ::jvmaccess::ClassPath::doTranslateToUrls(
@@ -93,6 +113,16 @@ void * ::jvmaccess::ClassPath::doTranslateToUrls(
css::uno::Reference< css::uno::XInterface >());
}
}
+ // Add only local entries; a non-local one is logged and skipped.
+ if (!isLocalClassPathUrl(url))
+ {
+ OSL_TRACE(
+ "jvmaccess::ClassPath: skipping non-local class path"
+ " entry: %s",
+ ::rtl::OUStringToOString(
+ url, RTL_TEXTENCODING_ASCII_US).getStr());
+ continue;
+ }
jvalue arg;
arg.l = env->NewString(
static_cast< jchar const * >(url.getStr()),
(openoffice) 12/14: Tests for: accept local files
Posted by ji...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jimjag pushed a commit to branch AOO50X
in repository https://gitbox.apache.org/repos/asf/openoffice.git
commit f8f8f96e02fdb2dbbcd35cd34a112f6af3637ab5
Author: Peter <pe...@apache.org>
AuthorDate: Sat Sep 26 22:16:30 2026 +0200
Tests for: accept local files
Co-Authored-By: Claude Opus 5.5 <no...@anthropic.com>
(cherry picked from commit 6af66d39c39162852c7402525ae40100cf9acca9)
(cherry picked from commit 7456e17c83b8fcc5806811ffdb156c6b3daf5785)
---
main/connectivity/qa/complex/sdbc/ToolsTest.java | 45 ++++++++++++++++++++++++
1 file changed, 45 insertions(+)
diff --git a/main/connectivity/qa/complex/sdbc/ToolsTest.java b/main/connectivity/qa/complex/sdbc/ToolsTest.java
index 3e5d1a9f85..ed0b6720a9 100644
--- a/main/connectivity/qa/complex/sdbc/ToolsTest.java
+++ b/main/connectivity/qa/complex/sdbc/ToolsTest.java
@@ -108,6 +108,51 @@ public final class ToolsTest {
assertTrue(collect("jar:wibble:/opt/a.jar!/").isEmpty());
}
+ @Test
+ public void testAddClassPathURLAddsLocalhostAndEscapedLocalFile() {
+ assertEquals(1, collect("file://localhost/opt/a.jar").size());
+ assertEquals(1, collect("file:///opt/Program%20Files/a.jar").size());
+ assertEquals(1, collect("file:///opt/a%2Fb/c.jar").size());
+ // One level of decoding only: this names a file called "%5C%5Chost".
+ assertEquals(1, collect("file:///opt/%255C%255Chost/a.jar").size());
+ }
+
+ @Test
+ public void testAddClassPathURLSkipsFileOnAnotherHost() {
+ assertTrue(collect(
+ "file://host/share/a.jar",
+ "file://wsl.localhost/distro/a.jar",
+ "jar:file://host/share/b.jar!/").isEmpty());
+ }
+
+ @Test
+ public void testAddClassPathURLSkipsPathNamingAnotherHost() {
+ assertTrue(collect(
+ "file:////host/share/a.jar",
+ "file://localhost//host/share/b.jar",
+ "jar:file:////host/share/c.jar!/").isEmpty());
+ }
+
+ @Test
+ public void testAddClassPathURLSkipsEscapedSeparatorNamingAnotherHost() {
+ // The file: handler decodes the path and, on Windows, turns slashes
+ // into backslashes, so each of these would be opened as \\host\share.
+ assertTrue(collect(
+ "file:///%5C%5Chost/share/a.jar",
+ "file:///%5c%5chost/share/b.jar",
+ "file:///%2F%2Fhost/share/c.jar",
+ "file:/%2Fhost/share/d.jar",
+ "file://localhost/%5C%5Chost/share/e.jar",
+ "jar:file:///%5C%5Chost/share/f.jar!/").isEmpty());
+ }
+
+ @Test
+ public void testAddClassPathURLSkipsBackslash() {
+ assertTrue(collect(
+ "file:\\\\host\\share\\a.jar",
+ "file:///C:%5C..%5Cb.jar").isEmpty());
+ }
+
@Test
public void testAddClassPathURLKeepsOnlyLocalEntriesInOrder() {
List<URL> urls = collect(
(openoffice) 13/14: Fix acceptance of local files
Posted by ji...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jimjag pushed a commit to branch AOO50X
in repository https://gitbox.apache.org/repos/asf/openoffice.git
commit 4b5e5dfc7a8141f1c51334450d1d6522b690d260
Author: Piotr P. Karwasz <pi...@github.copernik.eu>
AuthorDate: Fri Oct 2 21:57:00 2026 +0200
Fix acceptance of local files
Assisted-By: Claude Opus 5.5 <no...@anthropic.com>
(cherry picked from commit bb3a5a855831b861943c55afcadf2a8cf42eff01)
---
.../main/java/com/sun/star/comp/sdbc/Tools.java | 95 +++++------------
main/connectivity/qa/complex/sdbc/ToolsTest.java | 44 ++++----
main/jvmaccess/source/classpath.cxx | 116 +++++++--------------
3 files changed, 84 insertions(+), 171 deletions(-)
diff --git a/main/connectivity/java/sdbc_jdbc/src/main/java/com/sun/star/comp/sdbc/Tools.java b/main/connectivity/java/sdbc_jdbc/src/main/java/com/sun/star/comp/sdbc/Tools.java
index a9e23d6618..02144190d0 100644
--- a/main/connectivity/java/sdbc_jdbc/src/main/java/com/sun/star/comp/sdbc/Tools.java
+++ b/main/connectivity/java/sdbc_jdbc/src/main/java/com/sun/star/comp/sdbc/Tools.java
@@ -20,13 +20,11 @@
*************************************************************/
package com.sun.star.comp.sdbc;
+import java.io.UnsupportedEncodingException;
import java.net.MalformedURLException;
import java.net.URL;
-import java.util.Arrays;
+import java.net.URLDecoder;
import java.util.Collection;
-import java.util.Collections;
-import java.util.HashSet;
-import java.util.Set;
import java.util.logging.Level;
import java.util.logging.Logger;
@@ -46,15 +44,6 @@ public class Tools {
private static final Logger LOGGER = Logger.getLogger(Tools.class.getName());
- /**
- * URL schemes that resolve to the local filesystem or the running JVM image.
- *
- * <p>jvmaccess/source/classpath.cxx enforces the same allow-list in C++ for
- * the UNO bootstrap class path; keep the two in sync.</p>
- */
- private static final Set<String> LOCAL_PROTOCOLS =
- Collections.unmodifiableSet(new HashSet<>(Arrays.asList("file", "jrt", "jmod")));
-
public static SQLException toUnoException(Object source, Throwable throwable) {
return toUnoException(source, throwable, 0);
}
@@ -153,26 +142,21 @@ public class Tools {
/**
* Appends a class path entry to the list of URLs used to build a class loader.
*
- * <p>Only local entries or a jar: wrapping a local entry are added; a file: entry must
- * in addition name a path on this machine. A malformed or non-local entry is logged and
- * skipped.</p>
+ * <p>Only a file: entry naming a path on this machine is added.
+ * A malformed or non-local entry is logged and skipped.</p>
*
* @param urls the list of class path URLs to append to
* @param url the class path entry to parse and validate
*/
public static void addClassPathURL(Collection<URL> urls, String url) {
URL javaURL;
- URL effectiveURL;
try {
javaURL = new URL(url);
- effectiveURL = getEffectiveURL(javaURL);
} catch (MalformedURLException e) {
LOGGER.log(Level.WARNING, e, () -> "Skipping malformed class path entry: " + url);
return;
}
- String protocol = effectiveURL.getProtocol();
- if (LOCAL_PROTOCOLS.contains(protocol)
- && (!"file".equals(protocol) || isLocalFileLocation(effectiveURL))) {
+ if (isLocalFileUrl(javaURL)) {
LOGGER.fine(() -> "Adding class path entry: " + url);
urls.add(javaURL);
} else {
@@ -181,65 +165,34 @@ public class Tools {
}
/**
- * Returns the URL that actually locates the resource.
- *
- * <p>Since {@code jar:} only wraps another URL, that wrapped URL is returned.
- * For any other URL the URL itself is returned.</p>
- *
- * @param url the class path URL to inspect
- * @return the effective URL
- * @throws MalformedURLException if the wrapped jar: URL cannot be parsed
- */
- private static URL getEffectiveURL(URL url) throws MalformedURLException {
- if (!"jar".equals(url.getProtocol())) {
- return url;
- }
- String path = url.getPath();
- int separator = path.lastIndexOf("!/");
- return new URL(separator == -1 ? path : path.substring(0, separator));
- }
-
- /**
- * Tells whether a file: URL names a path on this machine.
+ * Tells whether a class path entry is a file: URL naming a path on this machine.
*
- * <p>The host must be empty or {@code localhost}, and the path must not name another
- * machine by itself. The path is judged decoded, because the file: handler
- * percent-decodes it and, on Windows, turns slashes into backslashes before opening
- * it; a leading escaped slash or backslash would otherwise reach the file system as a
- * reference to a share.</p>
+ * <p>jvmaccess/source/classpath.cxx enforces the same check in C++; keep the two in sync.</p>
*
- * @param url a URL with the file: scheme
+ * @param url the class path entry
* @return whether the URL names a local path
*/
- private static boolean isLocalFileLocation(URL url) {
+ private static boolean isLocalFileUrl(URL url) {
+ if (!"file".equals(url.getProtocol())) {
+ return false;
+ }
+ // The authority, if any, must be empty or localhost.
String host = url.getHost();
if (host != null && !host.isEmpty() && !"localhost".equalsIgnoreCase(host)) {
return false;
}
- String path = percentDecoded(url.getPath());
+ // The decoded path must start with exactly one slash,
+ // which also rules out a path without a leading slash,
+ // and must contain no backslash at all.
+ String path;
+ try {
+ // URLDecoder decodes form data, so a literal '+' is escaped to keep it a '+'.
+ path = URLDecoder.decode(url.getPath().replace("+", "%2B"), "UTF-8");
+ } catch (UnsupportedEncodingException | java.lang.IllegalArgumentException e) {
+ // A malformed escape, which the file: handler cannot decode either.
+ return false;
+ }
return path.length() >= 2 && path.charAt(0) == '/' && path.charAt(1) != '/'
&& path.indexOf('\\') == -1;
}
-
- /**
- * Undoes one level of %HH escapes, as the file: handler does. Only the ASCII
- * separators matter to the caller, so each escape becomes the character of its byte
- * value; a malformed escape is kept.
- */
- private static String percentDecoded(String s) {
- StringBuilder buf = new StringBuilder(s.length());
- for (int i = 0; i < s.length(); i++) {
- char c = s.charAt(i);
- if (c == '%' && s.length() - i > 2) {
- int hi = Character.digit(s.charAt(i + 1), 16);
- int lo = Character.digit(s.charAt(i + 2), 16);
- if (hi != -1 && lo != -1) {
- c = (char) (hi * 16 + lo);
- i += 2;
- }
- }
- buf.append(c);
- }
- return buf.toString();
- }
}
diff --git a/main/connectivity/qa/complex/sdbc/ToolsTest.java b/main/connectivity/qa/complex/sdbc/ToolsTest.java
index ed0b6720a9..f6cfa4c97e 100644
--- a/main/connectivity/qa/complex/sdbc/ToolsTest.java
+++ b/main/connectivity/qa/complex/sdbc/ToolsTest.java
@@ -23,12 +23,10 @@ package complex.sdbc;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertTrue;
-import java.net.MalformedURLException;
import java.net.URL;
import java.util.ArrayList;
import java.util.List;
-import org.junit.Assume;
import org.junit.Test;
import com.sun.star.comp.sdbc.Tools;
@@ -47,16 +45,6 @@ public final class ToolsTest {
return urls;
}
- /** True if the running JRE has a URL stream handler for the given scheme. */
- private static boolean schemeSupported(String scheme) {
- try {
- new URL(scheme + ":/probe");
- return true;
- } catch (MalformedURLException e) {
- return false;
- }
- }
-
@Test
public void testAddClassPathURLAddsLocalFileEntry() {
List<URL> urls = collect("file:/opt/a.jar");
@@ -65,14 +53,14 @@ public final class ToolsTest {
}
@Test
- public void testAddClassPathURLAddsJarWrappedLocalFile() {
- assertEquals(1, collect("jar:file:/opt/a.jar!/").size());
+ public void testAddClassPathURLTreatsSchemeCaseInsensitively() {
+ assertEquals(1, collect("FILE:/opt/a.jar").size());
}
@Test
- public void testAddClassPathURLTreatsJarInnerSchemeCaseInsensitively() {
- // URL.getPath() does not normalize the wrapped URL.
- assertEquals(1, collect("jar:FILE:/opt/a.jar!/").size());
+ public void testAddClassPathURLSkipsJarWrappedLocalFile() {
+ // A JAR file is added by its own file: URL; a jar: URL is never needed.
+ assertTrue(collect("jar:file:/opt/a.jar!/").isEmpty());
}
@Test
@@ -166,14 +154,24 @@ public final class ToolsTest {
}
@Test
- public void testAddClassPathURLAddsJrtSchemeWhenSupported() {
- Assume.assumeTrue(schemeSupported("jrt"));
- assertEquals(1, collect("jrt:/java.base/module-info.class").size());
+ public void testAddClassPathURLAddsPathWithPlus() {
+ List<URL> urls = collect("file:/opt/c++/a.jar");
+ assertEquals(1, urls.size());
+ assertEquals("/opt/c++/a.jar", urls.get(0).getPath());
}
@Test
- public void testAddClassPathURLAddsJmodSchemeWhenSupported() {
- Assume.assumeTrue(schemeSupported("jmod"));
- assertEquals(1, collect("jmod:/x").size());
+ public void testAddClassPathURLSkipsMalformedEscape() {
+ assertTrue(collect(
+ "file:/opt/%zz.jar",
+ "file:/opt/a.jar%").isEmpty());
+ }
+
+ @Test
+ public void testAddClassPathURLSkipsJvmImageSchemes() {
+ // Unsupported schemes fail to parse and are skipped as well.
+ assertTrue(collect(
+ "jrt:/java.base/module-info.class",
+ "jmod:/x").isEmpty());
}
}
diff --git a/main/jvmaccess/source/classpath.cxx b/main/jvmaccess/source/classpath.cxx
index 100f509590..1ae940335d 100644
--- a/main/jvmaccess/source/classpath.cxx
+++ b/main/jvmaccess/source/classpath.cxx
@@ -34,10 +34,12 @@
#include "com/sun/star/uno/XComponentContext.hpp"
#include "com/sun/star/uno/XInterface.hpp"
#include "com/sun/star/uri/UriReferenceFactory.hpp"
+#include "com/sun/star/uri/XUriReference.hpp"
+#include "com/sun/star/uri/XUriReferenceFactory.hpp"
#include "com/sun/star/uri/XVndSunStarExpandUrlReference.hpp"
#include "com/sun/star/util/XMacroExpander.hpp"
#include "osl/diagnose.h"
-#include "rtl/ustrbuf.hxx"
+#include "rtl/uri.hxx"
#include "rtl/ustring.hxx"
#include "sal/types.h"
@@ -50,88 +52,48 @@ namespace {
namespace css = ::com::sun::star;
#if defined SOLAR_JAVA
-int hexDigitValue(sal_Unicode c)
-{
- if (c >= '0' && c <= '9') {
- return c - '0';
- }
- if (c >= 'A' && c <= 'F') {
- return c - 'A' + 10;
- }
- if (c >= 'a' && c <= 'f') {
- return c - 'a' + 10;
- }
- return -1;
-}
-
-// Undoes one level of %HH escapes, as the JDK's file: handler does before it
-// opens a path. Only the ASCII separators matter to the caller, so each escape
-// simply becomes the code unit of its byte value; a malformed escape is kept.
-::rtl::OUString percentDecoded(::rtl::OUString const & s)
-{
- sal_Int32 const n = s.getLength();
- ::rtl::OUStringBuffer buf(n);
- for (sal_Int32 i = 0; i != n; ++i) {
- sal_Unicode c = s[i];
- if (c == '%' && n - i > 2) {
- int const hi = hexDigitValue(s[i + 1]);
- int const lo = hexDigitValue(s[i + 2]);
- if (hi != -1 && lo != -1) {
- c = static_cast< sal_Unicode >(hi * 16 + lo);
- i += 2;
- }
- }
- buf.append(c);
- }
- return buf.makeStringAndClear();
-}
-
-// Whether the part of a file: URL after the scheme names a path on this
-// machine: the authority, if any, must be empty or localhost, and the path must
-// not name another machine by itself. The path is judged decoded, because the
-// JDK's file: handler percent-decodes it and, on Windows, turns slashes into
-// backslashes before opening it -- a leading escaped slash or backslash would
-// otherwise reach the file system as a reference to a share.
-bool isLocalFileLocation(::rtl::OUString const & afterScheme)
+// Whether a class path entry is a file: URL naming a path on this machine.
+//
+// On Windows, Java opens a file: URL as a UNC path, i.e. a file on another
+// machine, in two cases:
+//
+// - if its authority names a host, e.g. file://host/share/a.jar;
+// - if its path (or opaque part), once percent-decoded and with backslashes
+// read as slashes, starts with two slashes, e.g. file:////host/share/a.jar,
+// file:/%5C%5Chost/share/a.jar or file:%5C%5Chost/share/a.jar.
+//
+// com.sun.star.comp.sdbc.Tools enforces the same check on the Java side; keep
+// the two in sync.
+bool isLocalFileUrl(
+ css::uno::Reference< css::uri::XUriReferenceFactory > const & factory,
+ ::rtl::OUString const & url)
{
- ::rtl::OUString rest(afterScheme);
- if (rest.indexOf('\\') != -1) {
+ css::uno::Reference< css::uri::XUriReference > const uriRef(
+ factory->parse(url));
+ if (!uriRef.is()
+ || !uriRef->getScheme().equalsIgnoreAsciiCaseAsciiL(
+ RTL_CONSTASCII_STRINGPARAM("file")))
+ {
return false;
}
- if (rest.matchAsciiL(RTL_CONSTASCII_STRINGPARAM("//"))) {
- sal_Int32 const end = rest.indexOf('/', 2);
- ::rtl::OUString const authority(
- end == -1 ? rest.copy(2) : rest.copy(2, end - 2));
+ // The authority, if any, must be empty or localhost.
+ if (uriRef->hasAuthority()) {
+ ::rtl::OUString const authority(uriRef->getAuthority());
if (authority.getLength() != 0
&& !authority.equalsIgnoreAsciiCaseAsciiL(
RTL_CONSTASCII_STRINGPARAM("localhost")))
{
return false;
}
- rest = end == -1 ? ::rtl::OUString() : rest.copy(end);
- }
- rest = percentDecoded(rest);
- return rest.getLength() >= 2 && rest[0] == '/' && rest[1] != '/'
- && rest.indexOf('\\') == -1;
-}
-
-// URL schemes that resolve to the local file system or the running JVM image,
-// optionally wrapped in a jar: URL; a file: URL must in addition name a path on
-// this machine.
-//
-// com.sun.star.comp.sdbc.Tools enforces the same allow-list on the Java side;
-// keep the two in sync.
-bool isLocalClassPathUrl(::rtl::OUString const & url)
-{
- ::rtl::OUString rest(url);
- if (rest.matchIgnoreAsciiCaseAsciiL(RTL_CONSTASCII_STRINGPARAM("jar:"))) {
- rest = rest.copy(RTL_CONSTASCII_LENGTH("jar:"));
- }
- if (rest.matchIgnoreAsciiCaseAsciiL(RTL_CONSTASCII_STRINGPARAM("file:"))) {
- return isLocalFileLocation(rest.copy(RTL_CONSTASCII_LENGTH("file:")));
}
- return rest.matchIgnoreAsciiCaseAsciiL(RTL_CONSTASCII_STRINGPARAM("jrt:"))
- || rest.matchIgnoreAsciiCaseAsciiL(RTL_CONSTASCII_STRINGPARAM("jmod:"));
+ // The decoded path must start with exactly one slash, which also rules out
+ // the opaque form, and must contain no backslash at all.
+ ::rtl::OUString const path(
+ ::rtl::Uri::decode(
+ uriRef->getPath(), rtl_UriDecodeWithCharset,
+ RTL_TEXTENCODING_UTF8));
+ return path.getLength() >= 2 && path[0] == '/' && path[1] != '/'
+ && path.indexOf('\\') == -1;
}
#endif
@@ -153,14 +115,14 @@ void * ::jvmaccess::ClassPath::doTranslateToUrls(
if (ctorUrl == 0) {
return 0;
}
+ css::uno::Reference< css::uri::XUriReferenceFactory > const factory(
+ css::uri::UriReferenceFactory::create(context));
::std::vector< jobject > urls;
for (::sal_Int32 i = 0; i != -1;) {
::rtl::OUString url(classPath.getToken(0, ' ', i));
if (url.getLength() != 0) {
css::uno::Reference< css::uri::XVndSunStarExpandUrlReference >
- expUrl(
- css::uri::UriReferenceFactory::create(context)->parse(url),
- css::uno::UNO_QUERY);
+ expUrl(factory->parse(url), css::uno::UNO_QUERY);
if (expUrl.is()) {
css::uno::Reference< css::util::XMacroExpander > expander(
context->getValueByName(
@@ -181,7 +143,7 @@ void * ::jvmaccess::ClassPath::doTranslateToUrls(
}
}
// Add only local entries; a non-local one is logged and skipped.
- if (!isLocalClassPathUrl(url))
+ if (!isLocalFileUrl(factory, url))
{
OSL_TRACE(
"jvmaccess::ClassPath: skipping non-local class path"
(openoffice) 11/14: Accept local files
Posted by ji...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jimjag pushed a commit to branch AOO50X
in repository https://gitbox.apache.org/repos/asf/openoffice.git
commit 49dd8164eddc002321a38d7693053b5c3c32232d
Author: Peter <pe...@apache.org>
AuthorDate: Sat Sep 26 22:16:29 2026 +0200
Accept local files
Co-Authored-By: Claude Opus 5.5 <no...@anthropic.com>
(cherry picked from commit 14eaf708515ab11319faef612741acb86321c914)
(cherry picked from commit 06d7e6fcc50631716e4dd8909f5d630a5b1f52c5)
---
.../main/java/com/sun/star/comp/sdbc/Tools.java | 71 +++++++++++++++---
main/jvmaccess/source/classpath.cxx | 87 +++++++++++++++++++---
2 files changed, 136 insertions(+), 22 deletions(-)
diff --git a/main/connectivity/java/sdbc_jdbc/src/main/java/com/sun/star/comp/sdbc/Tools.java b/main/connectivity/java/sdbc_jdbc/src/main/java/com/sun/star/comp/sdbc/Tools.java
index 9725949b32..a9e23d6618 100644
--- a/main/connectivity/java/sdbc_jdbc/src/main/java/com/sun/star/comp/sdbc/Tools.java
+++ b/main/connectivity/java/sdbc_jdbc/src/main/java/com/sun/star/comp/sdbc/Tools.java
@@ -153,23 +153,26 @@ public class Tools {
/**
* Appends a class path entry to the list of URLs used to build a class loader.
*
- * <p>Only local entries or a jar: wrapping a local entry are added.
- * A malformed or non-local entry is logged and skipped.</p>
+ * <p>Only local entries or a jar: wrapping a local entry are added; a file: entry must
+ * in addition name a path on this machine. A malformed or non-local entry is logged and
+ * skipped.</p>
*
* @param urls the list of class path URLs to append to
* @param url the class path entry to parse and validate
*/
public static void addClassPathURL(Collection<URL> urls, String url) {
URL javaURL;
- String protocol;
+ URL effectiveURL;
try {
javaURL = new URL(url);
- protocol = getEffectiveProtocol(javaURL);
+ effectiveURL = getEffectiveURL(javaURL);
} catch (MalformedURLException e) {
LOGGER.log(Level.WARNING, e, () -> "Skipping malformed class path entry: " + url);
return;
}
- if (LOCAL_PROTOCOLS.contains(protocol)) {
+ String protocol = effectiveURL.getProtocol();
+ if (LOCAL_PROTOCOLS.contains(protocol)
+ && (!"file".equals(protocol) || isLocalFileLocation(effectiveURL))) {
LOGGER.fine(() -> "Adding class path entry: " + url);
urls.add(javaURL);
} else {
@@ -178,21 +181,65 @@ public class Tools {
}
/**
- * Returns the scheme that actually locates the resource.
+ * Returns the URL that actually locates the resource.
*
- * <p>Since {@code jar:} only wraps another URL, the scheme of that wrapped URL is returned.
- * For any other URL its own scheme is returned.</p>
+ * <p>Since {@code jar:} only wraps another URL, that wrapped URL is returned.
+ * For any other URL the URL itself is returned.</p>
*
* @param url the class path URL to inspect
- * @return the effective URL scheme
+ * @return the effective URL
* @throws MalformedURLException if the wrapped jar: URL cannot be parsed
*/
- private static String getEffectiveProtocol(URL url) throws MalformedURLException {
+ private static URL getEffectiveURL(URL url) throws MalformedURLException {
if (!"jar".equals(url.getProtocol())) {
- return url.getProtocol();
+ return url;
}
String path = url.getPath();
int separator = path.lastIndexOf("!/");
- return new URL(separator == -1 ? path : path.substring(0, separator)).getProtocol();
+ return new URL(separator == -1 ? path : path.substring(0, separator));
+ }
+
+ /**
+ * Tells whether a file: URL names a path on this machine.
+ *
+ * <p>The host must be empty or {@code localhost}, and the path must not name another
+ * machine by itself. The path is judged decoded, because the file: handler
+ * percent-decodes it and, on Windows, turns slashes into backslashes before opening
+ * it; a leading escaped slash or backslash would otherwise reach the file system as a
+ * reference to a share.</p>
+ *
+ * @param url a URL with the file: scheme
+ * @return whether the URL names a local path
+ */
+ private static boolean isLocalFileLocation(URL url) {
+ String host = url.getHost();
+ if (host != null && !host.isEmpty() && !"localhost".equalsIgnoreCase(host)) {
+ return false;
+ }
+ String path = percentDecoded(url.getPath());
+ return path.length() >= 2 && path.charAt(0) == '/' && path.charAt(1) != '/'
+ && path.indexOf('\\') == -1;
+ }
+
+ /**
+ * Undoes one level of %HH escapes, as the file: handler does. Only the ASCII
+ * separators matter to the caller, so each escape becomes the character of its byte
+ * value; a malformed escape is kept.
+ */
+ private static String percentDecoded(String s) {
+ StringBuilder buf = new StringBuilder(s.length());
+ for (int i = 0; i < s.length(); i++) {
+ char c = s.charAt(i);
+ if (c == '%' && s.length() - i > 2) {
+ int hi = Character.digit(s.charAt(i + 1), 16);
+ int lo = Character.digit(s.charAt(i + 2), 16);
+ if (hi != -1 && lo != -1) {
+ c = (char) (hi * 16 + lo);
+ i += 2;
+ }
+ }
+ buf.append(c);
+ }
+ return buf.toString();
}
}
diff --git a/main/jvmaccess/source/classpath.cxx b/main/jvmaccess/source/classpath.cxx
index f241cb9ff6..100f509590 100644
--- a/main/jvmaccess/source/classpath.cxx
+++ b/main/jvmaccess/source/classpath.cxx
@@ -37,6 +37,7 @@
#include "com/sun/star/uri/XVndSunStarExpandUrlReference.hpp"
#include "com/sun/star/util/XMacroExpander.hpp"
#include "osl/diagnose.h"
+#include "rtl/ustrbuf.hxx"
#include "rtl/ustring.hxx"
#include "sal/types.h"
@@ -49,22 +50,88 @@ namespace {
namespace css = ::com::sun::star;
#if defined SOLAR_JAVA
+int hexDigitValue(sal_Unicode c)
+{
+ if (c >= '0' && c <= '9') {
+ return c - '0';
+ }
+ if (c >= 'A' && c <= 'F') {
+ return c - 'A' + 10;
+ }
+ if (c >= 'a' && c <= 'f') {
+ return c - 'a' + 10;
+ }
+ return -1;
+}
+
+// Undoes one level of %HH escapes, as the JDK's file: handler does before it
+// opens a path. Only the ASCII separators matter to the caller, so each escape
+// simply becomes the code unit of its byte value; a malformed escape is kept.
+::rtl::OUString percentDecoded(::rtl::OUString const & s)
+{
+ sal_Int32 const n = s.getLength();
+ ::rtl::OUStringBuffer buf(n);
+ for (sal_Int32 i = 0; i != n; ++i) {
+ sal_Unicode c = s[i];
+ if (c == '%' && n - i > 2) {
+ int const hi = hexDigitValue(s[i + 1]);
+ int const lo = hexDigitValue(s[i + 2]);
+ if (hi != -1 && lo != -1) {
+ c = static_cast< sal_Unicode >(hi * 16 + lo);
+ i += 2;
+ }
+ }
+ buf.append(c);
+ }
+ return buf.makeStringAndClear();
+}
+
+// Whether the part of a file: URL after the scheme names a path on this
+// machine: the authority, if any, must be empty or localhost, and the path must
+// not name another machine by itself. The path is judged decoded, because the
+// JDK's file: handler percent-decodes it and, on Windows, turns slashes into
+// backslashes before opening it -- a leading escaped slash or backslash would
+// otherwise reach the file system as a reference to a share.
+bool isLocalFileLocation(::rtl::OUString const & afterScheme)
+{
+ ::rtl::OUString rest(afterScheme);
+ if (rest.indexOf('\\') != -1) {
+ return false;
+ }
+ if (rest.matchAsciiL(RTL_CONSTASCII_STRINGPARAM("//"))) {
+ sal_Int32 const end = rest.indexOf('/', 2);
+ ::rtl::OUString const authority(
+ end == -1 ? rest.copy(2) : rest.copy(2, end - 2));
+ if (authority.getLength() != 0
+ && !authority.equalsIgnoreAsciiCaseAsciiL(
+ RTL_CONSTASCII_STRINGPARAM("localhost")))
+ {
+ return false;
+ }
+ rest = end == -1 ? ::rtl::OUString() : rest.copy(end);
+ }
+ rest = percentDecoded(rest);
+ return rest.getLength() >= 2 && rest[0] == '/' && rest[1] != '/'
+ && rest.indexOf('\\') == -1;
+}
+
// URL schemes that resolve to the local file system or the running JVM image,
-// optionally wrapped in a jar: URL.
+// optionally wrapped in a jar: URL; a file: URL must in addition name a path on
+// this machine.
//
// com.sun.star.comp.sdbc.Tools enforces the same allow-list on the Java side;
// keep the two in sync.
bool isLocalClassPathUrl(::rtl::OUString const & url)
{
- return url.matchIgnoreAsciiCaseAsciiL(RTL_CONSTASCII_STRINGPARAM("file:"))
- || url.matchIgnoreAsciiCaseAsciiL(RTL_CONSTASCII_STRINGPARAM("jrt:"))
- || url.matchIgnoreAsciiCaseAsciiL(RTL_CONSTASCII_STRINGPARAM("jmod:"))
- || url.matchIgnoreAsciiCaseAsciiL(
- RTL_CONSTASCII_STRINGPARAM("jar:file:"))
- || url.matchIgnoreAsciiCaseAsciiL(
- RTL_CONSTASCII_STRINGPARAM("jar:jrt:"))
- || url.matchIgnoreAsciiCaseAsciiL(
- RTL_CONSTASCII_STRINGPARAM("jar:jmod:"));
+ ::rtl::OUString rest(url);
+ if (rest.matchIgnoreAsciiCaseAsciiL(RTL_CONSTASCII_STRINGPARAM("jar:"))) {
+ rest = rest.copy(RTL_CONSTASCII_LENGTH("jar:"));
+ }
+ if (rest.matchIgnoreAsciiCaseAsciiL(RTL_CONSTASCII_STRINGPARAM("file:"))) {
+ return isLocalFileLocation(rest.copy(RTL_CONSTASCII_LENGTH("file:")));
+ }
+ return rest.matchIgnoreAsciiCaseAsciiL(RTL_CONSTASCII_STRINGPARAM("jrt:"))
+ || rest.matchIgnoreAsciiCaseAsciiL(RTL_CONSTASCII_STRINGPARAM("jmod:"));
}
#endif
(openoffice) 03/14: Restore compatibility with provided files
Posted by ji...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jimjag pushed a commit to branch AOO50X
in repository https://gitbox.apache.org/repos/asf/openoffice.git
commit e9166edf3eb388f1e8e1497075bf3a12566edb84
Author: Arrigo Marchiori <ar...@yahoo.it>
AuthorDate: Wed Sep 16 22:16:36 2026 +0200
Restore compatibility with provided files
Certain documents are slightly invalid ZIP's: their entries have a data
descriptor, but their "flags" field say otherwise. Remain compatible
with our past bugs.
Thanks to Czesław Wolański for reporting, and Peter Kovacs for proposing
this fix!
(cherry picked from commit 57cd559d060c509755c8b0f6cac469b512911542)
---
main/package/source/package/zipapi/ZipFile.cxx | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/main/package/source/package/zipapi/ZipFile.cxx b/main/package/source/package/zipapi/ZipFile.cxx
index 921d144bc3..7fd234bffc 100644
--- a/main/package/source/package/zipapi/ZipFile.cxx
+++ b/main/package/source/package/zipapi/ZipFile.cxx
@@ -982,7 +982,7 @@ sal_Int32 ZipFile::readCEN()
throw ZipException(OUString( RTL_CONSTASCII_USTRINGPARAM ( "ZIP file contains a hole between local descriptor and file data" ) ), uno::Reference < XInterface > () );
// File data
nPos += aIt->second.nCompressedSize;
- if ( aIt->second.nFlag & ( 1 << 3 ) ) {
+ if ( aIt->second.bHasDataDescriptor ) {
// Data descriptor...
nPos += 16; // ...with signature
nPos2 = nPos - 4; // ...without signature
(openoffice) 02/14: More checks
Posted by ji...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jimjag pushed a commit to branch AOO50X
in repository https://gitbox.apache.org/repos/asf/openoffice.git
commit 5ac6444975cad3b1fed3c34a592131d806712195
Author: Arrigo Marchiori <ar...@yahoo.it>
AuthorDate: Tue Sep 15 21:40:39 2026 +0200
More checks
(cherry picked from commit 66ab9c1188ef75c84225c856a87bc93d575247ca)
---
main/package/source/package/zipapi/ZipFile.cxx | 2 ++
1 file changed, 2 insertions(+)
diff --git a/main/package/source/package/zipapi/ZipFile.cxx b/main/package/source/package/zipapi/ZipFile.cxx
index 32b6e4fffe..921d144bc3 100644
--- a/main/package/source/package/zipapi/ZipFile.cxx
+++ b/main/package/source/package/zipapi/ZipFile.cxx
@@ -655,6 +655,8 @@ static void readExtraFields( MemoryByteGrabber &rMemGrabber, sal_Int16 nLength,
throw ZipException( OUString( RTL_CONSTASCII_USTRINGPARAM ( "Invalid ZIP extra fields" ) ), uno::Reference < XInterface > () );
switch ( nHeaderID ) {
case 0x7075: // Info-ZIP Unicode Path Extra Field
+ if ( nDataSize < 5 )
+ throw ZipException( OUString( RTL_CONSTASCII_USTRINGPARAM ( "Invalid size for ZIP unicode path extra field" ) ), uno::Reference < XInterface > () );
rMemGrabber >> n8; // Version
rMemGrabber.skipBytes( 4 ); // skip NameCRC32
s = rtl::OUString::intern ( (sal_Char *) rMemGrabber.getCurrentPos(),
(openoffice) 09/14: Fix null pointer dereference
Posted by ji...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jimjag pushed a commit to branch AOO50X
in repository https://gitbox.apache.org/repos/asf/openoffice.git
commit 9e4e65485f44bee147d0029d3190d73f2ee3f217
Author: Arrigo Marchiori <ar...@yahoo.it>
AuthorDate: Sun Sep 20 09:12:57 2026 +0200
Fix null pointer dereference
(cherry picked from commit c8c07ca898e41fafebb34bcd6a71572aca680e5d)
---
main/sfx2/source/appl/appuno.cxx | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/main/sfx2/source/appl/appuno.cxx b/main/sfx2/source/appl/appuno.cxx
index e1dff44482..f5e8a17774 100644
--- a/main/sfx2/source/appl/appuno.cxx
+++ b/main/sfx2/source/appl/appuno.cxx
@@ -1907,6 +1907,8 @@ ErrCode SfxMacroLoader::loadMacro( const ::rtl::OUString& rURL, com::sun::star::
if ( !pCurrent->AdjustMacroMode( String() ) )
return ERRCODE_IO_ACCESSDENIED;
}
+ else
+ return ERRCODE_IO_ACCESSDENIED;
}
// find BASIC method
@@ -1972,7 +1974,7 @@ ErrCode SfxMacroLoader::loadMacro( const ::rtl::OUString& rURL, com::sun::star::
else
{
// direct API call on a specified object
- if ( !pCurrent->AdjustMacroMode( String() ) )
+ if ( !pCurrent || !pCurrent->AdjustMacroMode( String() ) )
// check forbids execution
return ERRCODE_IO_ACCESSDENIED;
String aCall( '[' );
(openoffice) 10/14: Ignore meaningless attributes
Posted by ji...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jimjag pushed a commit to branch AOO50X
in repository https://gitbox.apache.org/repos/asf/openoffice.git
commit 1b70b777157dcbb79a4cc453049088a664557e4b
Author: Piotr P. Karwasz <pi...@github.copernik.eu>
AuthorDate: Sat Oct 3 20:44:25 2026 +0200
Ignore meaningless attributes
Stop recognizing the db:java-classpath attribute, and drop JavaDriverClassPath
and SystemProperties when importing data source settings.
Assisted-By: Claude Opus 5.5 <no...@anthropic.com>
(cherry picked from commit 430d1577c639ad8ba4ece164a179111734112fd9)
---
main/dbaccess/source/filter/xml/xmlDataSource.cxx | 3 ---
main/dbaccess/source/filter/xml/xmlEnums.hxx | 1 -
main/dbaccess/source/filter/xml/xmlfilter.cxx | 18 ++++++++++++++++--
3 files changed, 16 insertions(+), 6 deletions(-)
diff --git a/main/dbaccess/source/filter/xml/xmlDataSource.cxx b/main/dbaccess/source/filter/xml/xmlDataSource.cxx
index 0d26ccaff0..743db1f830 100644
--- a/main/dbaccess/source/filter/xml/xmlDataSource.cxx
+++ b/main/dbaccess/source/filter/xml/xmlDataSource.cxx
@@ -189,9 +189,6 @@ OXMLDataSource::OXMLDataSource( ODBFilter& rImport,
aProperty.Name = INFO_CONN_LDAP_ROWCOUNT;
aProperty.Value <<= sValue.toInt32();
break;
- case XML_TOK_JAVA_CLASSPATH:
- aProperty.Name = ::rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("JavaDriverClassPath"));
- break;
}
if ( aProperty.Name.getLength() )
{
diff --git a/main/dbaccess/source/filter/xml/xmlEnums.hxx b/main/dbaccess/source/filter/xml/xmlEnums.hxx
index 7625997929..bcf2461efe 100644
--- a/main/dbaccess/source/filter/xml/xmlEnums.hxx
+++ b/main/dbaccess/source/filter/xml/xmlEnums.hxx
@@ -81,7 +81,6 @@ namespace dbaxml
XML_TOK_DATABASE_NAME,
XML_TOK_CONNECTION_DATA,
XML_TOK_DRIVER_SETTINGS,
- XML_TOK_JAVA_CLASSPATH,
XML_TOK_CHARACTER_SET,
XML_TOK_APPLICATION_CONNECTION_SETTINGS
};
diff --git a/main/dbaccess/source/filter/xml/xmlfilter.cxx b/main/dbaccess/source/filter/xml/xmlfilter.cxx
index 69348d3166..a29fc19aa8 100644
--- a/main/dbaccess/source/filter/xml/xmlfilter.cxx
+++ b/main/dbaccess/source/filter/xml/xmlfilter.cxx
@@ -132,6 +132,7 @@
#include <connectivity/CommonTools.hxx>
#include <connectivity/DriversConfig.hxx>
#include "dsntypes.hxx"
+#include <set>
using namespace ::com::sun::star;
@@ -741,7 +742,7 @@ const SvXMLTokenMap& ODBFilter::GetDataSourceElemTokenMap() const
{ XML_NAMESPACE_DB, XML_LOCAL_SOCKET, XML_TOK_LOCAL_SOCKET},
{ XML_NAMESPACE_DB, XML_DATABASE_NAME, XML_TOK_DATABASE_NAME},
{ XML_NAMESPACE_DB, XML_DRIVER_SETTINGS, XML_TOK_DRIVER_SETTINGS},
- { XML_NAMESPACE_DB, XML_JAVA_CLASSPATH, XML_TOK_JAVA_CLASSPATH},
+ // db:java-classpath is intentionally not mapped
{ XML_NAMESPACE_DB, XML_CHARACTER_SET, XML_TOK_CHARACTER_SET},
{ XML_NAMESPACE_DB, XML_APPLICATION_CONNECTION_SETTINGS,XML_TOK_APPLICATION_CONNECTION_SETTINGS},
XML_TOKEN_MAP_END
@@ -954,7 +955,20 @@ void ODBFilter::setPropertyInfo()
Sequence<PropertyValue> aInfo;
if ( !m_aInfoSequence.empty() )
- aInfo = Sequence<PropertyValue>(&(*m_aInfoSequence.begin()),m_aInfoSequence.size());
+ {
+ // Ignore UNO property names that do not belong to documents.
+ static const ::std::set< ::rtl::OUString > s_aDeniedSettings = {
+ ::rtl::OUString( RTL_CONSTASCII_USTRINGPARAM( "JavaDriverClassPath" ) ),
+ ::rtl::OUString( RTL_CONSTASCII_USTRINGPARAM( "SystemProperties" ) )
+ };
+ ::std::vector< PropertyValue > aAccepted;
+ aAccepted.reserve( m_aInfoSequence.size() );
+ for ( const auto & i : m_aInfoSequence )
+ if ( s_aDeniedSettings.find( i.Name ) == s_aDeniedSettings.end() )
+ aAccepted.push_back( i );
+ if ( !aAccepted.empty() )
+ aInfo = Sequence<PropertyValue>( &(*aAccepted.begin()), aAccepted.size() );
+ }
aDataSourceSettings.merge( ::comphelper::NamedValueCollection( aInfo ), true );
aDataSourceSettings >>= aInfo;
(openoffice) 07/14: Check lengths
Posted by ji...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jimjag pushed a commit to branch AOO50X
in repository https://gitbox.apache.org/repos/asf/openoffice.git
commit 0203c3bbfd1cbe4ab26ac63f88abd384ae98c034
Author: Peter Kovacs <pe...@apache.org>
AuthorDate: Sun Aug 30 10:39:04 2026 +0200
Check lengths
Also fix the allocation check which tested ppStream rather than *ppStream
Co-Authored-By: Claude Opus 5 <no...@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UWgzQY2r1XwFvgeLPFWPsi
(cherry picked from commit a076163db497445461c819d3ae9afe052eb01982)
---
.../sdext/source/pdfimport/pdfparse/pdfentries.cxx | 22 +++++++++++++++++++---
1 file changed, 19 insertions(+), 3 deletions(-)
diff --git a/main/sdext/source/pdfimport/pdfparse/pdfentries.cxx b/main/sdext/source/pdfimport/pdfparse/pdfentries.cxx
index 029d45c1ee..485f951731 100644
--- a/main/sdext/source/pdfimport/pdfparse/pdfentries.cxx
+++ b/main/sdext/source/pdfimport/pdfparse/pdfentries.cxx
@@ -676,7 +676,7 @@ bool PDFObject::getDeflatedStream( char** ppStream, unsigned int* pBytes, const
{
unsigned int nOuterStreamLen = m_pStream->m_nEndOffset - m_pStream->m_nBeginOffset;
*ppStream = static_cast<char*>(rtl_allocateMemory( nOuterStreamLen ));
- if( ! ppStream )
+ if( ! *ppStream )
{
*pBytes = 0;
return false;
@@ -719,6 +719,12 @@ bool PDFObject::getDeflatedStream( char** ppStream, unsigned int* pBytes, const
pStream++;
// get the compressed length
*pBytes = m_pStream->getDictLength( pObjectContainer );
+ // pStream has already advanced past the "stream" keyword inside it.
+ const unsigned int nSkipped =
+ static_cast<unsigned int>( pStream - *ppStream );
+ const unsigned int nAvailable = nOuterStreamLen - nSkipped;
+ if( *pBytes > nAvailable )
+ *pBytes = nAvailable;
if( pStream != *ppStream )
rtl_moveMemory( *ppStream, pStream, *pBytes );
if( rContext.m_bDecrypt )
@@ -1361,8 +1367,18 @@ PDFFileImplData* PDFFile::impl_getData() const
if( len != pDict->m_aMap.end() )
{
PDFNumber* pNum = dynamic_cast<PDFNumber*>(len->second);
- if( pNum )
- m_pData->m_nKeyLength = static_cast<sal_uInt32>(pNum->m_fValue) / 8;
+ // m_aDecryptionKey holds ENCRYPTION_KEY_LEN + 5
+ // bytes: the key, plus the object and generation
+ // numbers appended after it.
+ if( pNum && pNum->m_fValue > 0 )
+ {
+ sal_uInt32 nBits =
+ static_cast<sal_uInt32>(pNum->m_fValue) / 8;
+ if( nBits > ENCRYPTION_KEY_LEN )
+ nBits = ENCRYPTION_KEY_LEN;
+ if( nBits > 0 )
+ m_pData->m_nKeyLength = nBits;
+ }
}
PDFName* pFilter = dynamic_cast<PDFName*>(filter->second);
if( pFilter && pFilter->getFilteredName().equalsAscii( "Standard" ) )
(openoffice) 04/14: Skip invalid entries
Posted by ji...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jimjag pushed a commit to branch AOO50X
in repository https://gitbox.apache.org/repos/asf/openoffice.git
commit 2a3f89c4a4c337f2e3884c65a689cf5e84dd6c23
Author: Piotr P. Karwasz <pi...@github.copernik.eu>
AuthorDate: Fri Jul 3 09:16:41 2026 +0200
Skip invalid entries
Detect malformed URLs, log them and and skip them.
The per-entry handling is factored into a shared Tools.addClassPathURL
helper used by both ClassMap variants, with ToolsTest covering the
accepted and skipped schemes (subsequent JUnit test under
connectivity/qa/complex/sdbc).
Assisted-By: Claude Opus 4.8 <no...@anthropic.com>
(cherry picked from commit 45c5a00162811bd03b87fcb4fe9996782f2b59ec)
---
.../main/java/com/sun/star/comp/sdbc/ClassMap.java | 9 +-
.../main/java/com/sun/star/comp/sdbc/Tools.java | 67 +++++++++++
.../sun/star/comp/sdbc/classloading/ClassMap.java | 11 +-
main/connectivity/qa/complex/sdbc/ToolsTest.java | 134 +++++++++++++++++++++
main/connectivity/qa/complex/sdbc/makefile.mk | 58 +++++++++
5 files changed, 269 insertions(+), 10 deletions(-)
diff --git a/main/connectivity/java/sdbc_jdbc/src/main/java/com/sun/star/comp/sdbc/ClassMap.java b/main/connectivity/java/sdbc_jdbc/src/main/java/com/sun/star/comp/sdbc/ClassMap.java
index 6bdd506af2..fc7b93d698 100644
--- a/main/connectivity/java/sdbc_jdbc/src/main/java/com/sun/star/comp/sdbc/ClassMap.java
+++ b/main/connectivity/java/sdbc_jdbc/src/main/java/com/sun/star/comp/sdbc/ClassMap.java
@@ -21,7 +21,6 @@
package com.sun.star.comp.sdbc;
import java.lang.ref.WeakReference;
-import java.net.MalformedURLException;
import java.net.URL;
import java.net.URLClassLoader;
import java.util.ArrayList;
@@ -86,7 +85,7 @@ public class ClassMap {
private final LinkedList<ClassMapEntry> map = new LinkedList<>();
public synchronized ClassLoaderAndClass loadClass(XComponentContext context, String classPath, String className)
- throws MalformedURLException, ClassNotFoundException {
+ throws ClassNotFoundException {
ClassLoader classLoader = null;
Class<?> classObject = null;
@@ -130,7 +129,7 @@ public class ClassMap {
return new ClassLoaderAndClass(classLoader, classObject);
}
- private static List<URL> translateToUrls(XComponentContext context, String classPath) throws MalformedURLException {
+ private static List<URL> translateToUrls(XComponentContext context, String classPath) {
StringTokenizer tokenizer = new StringTokenizer(classPath, " ", false);
ArrayList<URL> urls = new ArrayList<>();
while (tokenizer.hasMoreTokens()) {
@@ -159,8 +158,8 @@ public class ClassMap {
CompHelper.disposeComponent(expUrl);
CompHelper.disposeComponent(macroExpander);
}
- URL javaURL = new URL(url);
- urls.add(javaURL);
+ // Add local entries to classpath
+ Tools.addClassPathURL(urls, url);
}
return urls;
}
diff --git a/main/connectivity/java/sdbc_jdbc/src/main/java/com/sun/star/comp/sdbc/Tools.java b/main/connectivity/java/sdbc_jdbc/src/main/java/com/sun/star/comp/sdbc/Tools.java
index 49cb07cb0f..9725949b32 100644
--- a/main/connectivity/java/sdbc_jdbc/src/main/java/com/sun/star/comp/sdbc/Tools.java
+++ b/main/connectivity/java/sdbc_jdbc/src/main/java/com/sun/star/comp/sdbc/Tools.java
@@ -20,6 +20,16 @@
*************************************************************/
package com.sun.star.comp.sdbc;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Set;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
import org.apache.openoffice.comp.sdbc.dbtools.comphelper.ResourceBasedEventLogger;
import org.apache.openoffice.comp.sdbc.dbtools.util.StandardSQLState;
@@ -34,6 +44,17 @@ import com.sun.star.uno.AnyConverter;
public class Tools {
private static final int MAX_EXCEPTION_NESTING = 8;
+ private static final Logger LOGGER = Logger.getLogger(Tools.class.getName());
+
+ /**
+ * URL schemes that resolve to the local filesystem or the running JVM image.
+ *
+ * <p>jvmaccess/source/classpath.cxx enforces the same allow-list in C++ for
+ * the UNO bootstrap class path; keep the two in sync.</p>
+ */
+ private static final Set<String> LOCAL_PROTOCOLS =
+ Collections.unmodifiableSet(new HashSet<>(Arrays.asList("file", "jrt", "jmod")));
+
public static SQLException toUnoException(Object source, Throwable throwable) {
return toUnoException(source, throwable, 0);
}
@@ -128,4 +149,50 @@ public class Tools {
}
return ret;
}
+
+ /**
+ * Appends a class path entry to the list of URLs used to build a class loader.
+ *
+ * <p>Only local entries or a jar: wrapping a local entry are added.
+ * A malformed or non-local entry is logged and skipped.</p>
+ *
+ * @param urls the list of class path URLs to append to
+ * @param url the class path entry to parse and validate
+ */
+ public static void addClassPathURL(Collection<URL> urls, String url) {
+ URL javaURL;
+ String protocol;
+ try {
+ javaURL = new URL(url);
+ protocol = getEffectiveProtocol(javaURL);
+ } catch (MalformedURLException e) {
+ LOGGER.log(Level.WARNING, e, () -> "Skipping malformed class path entry: " + url);
+ return;
+ }
+ if (LOCAL_PROTOCOLS.contains(protocol)) {
+ LOGGER.fine(() -> "Adding class path entry: " + url);
+ urls.add(javaURL);
+ } else {
+ LOGGER.warning(() -> "Skipping non-local class path entry: " + url);
+ }
+ }
+
+ /**
+ * Returns the scheme that actually locates the resource.
+ *
+ * <p>Since {@code jar:} only wraps another URL, the scheme of that wrapped URL is returned.
+ * For any other URL its own scheme is returned.</p>
+ *
+ * @param url the class path URL to inspect
+ * @return the effective URL scheme
+ * @throws MalformedURLException if the wrapped jar: URL cannot be parsed
+ */
+ private static String getEffectiveProtocol(URL url) throws MalformedURLException {
+ if (!"jar".equals(url.getProtocol())) {
+ return url.getProtocol();
+ }
+ String path = url.getPath();
+ int separator = path.lastIndexOf("!/");
+ return new URL(separator == -1 ? path : path.substring(0, separator)).getProtocol();
+ }
}
diff --git a/main/connectivity/java/sdbc_jdbc/src/main/java/com/sun/star/comp/sdbc/classloading/ClassMap.java b/main/connectivity/java/sdbc_jdbc/src/main/java/com/sun/star/comp/sdbc/classloading/ClassMap.java
index b8a03af528..13bf139a93 100644
--- a/main/connectivity/java/sdbc_jdbc/src/main/java/com/sun/star/comp/sdbc/classloading/ClassMap.java
+++ b/main/connectivity/java/sdbc_jdbc/src/main/java/com/sun/star/comp/sdbc/classloading/ClassMap.java
@@ -21,7 +21,6 @@
package com.sun.star.comp.sdbc.classloading;
import java.lang.ref.WeakReference;
-import java.net.MalformedURLException;
import java.net.URL;
import java.net.URLClassLoader;
import java.util.ArrayList;
@@ -32,6 +31,8 @@ import java.util.StringTokenizer;
import org.apache.openoffice.comp.sdbc.dbtools.comphelper.CompHelper;
+import com.sun.star.comp.sdbc.Tools;
+
import com.sun.star.lang.IllegalArgumentException;
import com.sun.star.uno.RuntimeException;
import com.sun.star.uno.UnoRuntime;
@@ -69,7 +70,7 @@ public class ClassMap {
private final LinkedList<ClassMapEntry> map = new LinkedList<>();
public synchronized ClassLoaderAndClass loadClass(XComponentContext context, String classPath, String className)
- throws MalformedURLException, ClassNotFoundException {
+ throws ClassNotFoundException {
ClassLoader classLoader = null;
Class<?> classObject = null;
@@ -113,7 +114,7 @@ public class ClassMap {
return new ClassLoaderAndClass(classLoader, classObject);
}
- private static List<URL> translateToUrls(XComponentContext context, String classPath) throws MalformedURLException {
+ private static List<URL> translateToUrls(XComponentContext context, String classPath) {
StringTokenizer tokenizer = new StringTokenizer(classPath, " ", false);
ArrayList<URL> urls = new ArrayList<>();
while (tokenizer.hasMoreTokens()) {
@@ -142,8 +143,8 @@ public class ClassMap {
CompHelper.disposeComponent(expUrl);
CompHelper.disposeComponent(macroExpander);
}
- URL javaURL = new URL(url);
- urls.add(javaURL);
+ // Add local entries to classpath
+ Tools.addClassPathURL(urls, url);
}
return urls;
}
diff --git a/main/connectivity/qa/complex/sdbc/ToolsTest.java b/main/connectivity/qa/complex/sdbc/ToolsTest.java
new file mode 100644
index 0000000000..3e5d1a9f85
--- /dev/null
+++ b/main/connectivity/qa/complex/sdbc/ToolsTest.java
@@ -0,0 +1,134 @@
+/**************************************************************
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ *************************************************************/
+package complex.sdbc;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.util.ArrayList;
+import java.util.List;
+
+import org.junit.Assume;
+import org.junit.Test;
+
+import com.sun.star.comp.sdbc.Tools;
+
+/**
+ * Tests for the {@link Tools} helper class.
+ */
+public final class ToolsTest {
+
+ /** Runs each entry through addClassPathURL and returns what was accepted. */
+ private static List<URL> collect(String... entries) {
+ List<URL> urls = new ArrayList<URL>();
+ for (String entry : entries) {
+ Tools.addClassPathURL(urls, entry);
+ }
+ return urls;
+ }
+
+ /** True if the running JRE has a URL stream handler for the given scheme. */
+ private static boolean schemeSupported(String scheme) {
+ try {
+ new URL(scheme + ":/probe");
+ return true;
+ } catch (MalformedURLException e) {
+ return false;
+ }
+ }
+
+ @Test
+ public void testAddClassPathURLAddsLocalFileEntry() {
+ List<URL> urls = collect("file:/opt/a.jar");
+ assertEquals(1, urls.size());
+ assertEquals("file", urls.get(0).getProtocol());
+ }
+
+ @Test
+ public void testAddClassPathURLAddsJarWrappedLocalFile() {
+ assertEquals(1, collect("jar:file:/opt/a.jar!/").size());
+ }
+
+ @Test
+ public void testAddClassPathURLTreatsJarInnerSchemeCaseInsensitively() {
+ // URL.getPath() does not normalize the wrapped URL.
+ assertEquals(1, collect("jar:FILE:/opt/a.jar!/").size());
+ }
+
+ @Test
+ public void testAddClassPathURLSkipsRemoteEntries() {
+ assertTrue(collect(
+ "http://host/a.jar",
+ "https://host/b.jar",
+ "ftp://host/c.jar").isEmpty());
+ }
+
+ @Test
+ public void testAddClassPathURLSkipsJarWrappedRemoteEntry() {
+ assertTrue(collect("jar:http://host/a.jar!/").isEmpty());
+ }
+
+ @Test
+ public void testAddClassPathURLSkipsMalformedEntry() {
+ assertTrue(collect("::not-a-url::").isEmpty());
+ }
+
+ @Test
+ public void testAddClassPathURLSkipsUnknownScheme() {
+ // A scheme with no registered URL handler cannot be constructed, so the
+ // entry is treated as malformed and skipped.
+ assertTrue(collect(
+ "wibble:/opt/a.jar",
+ "classpath:/opt/b.jar",
+ "foo://host/c.jar").isEmpty());
+ }
+
+ @Test
+ public void testAddClassPathURLSkipsJarWrappedUnknownScheme() {
+ assertTrue(collect("jar:wibble:/opt/a.jar!/").isEmpty());
+ }
+
+ @Test
+ public void testAddClassPathURLKeepsOnlyLocalEntriesInOrder() {
+ List<URL> urls = collect(
+ "http://host/a.jar",
+ "file:/opt/b.jar",
+ "jar:http://host/c.jar!/",
+ "file:/opt/d.jar");
+ assertEquals(2, urls.size());
+ assertEquals("/opt/b.jar", urls.get(0).getPath());
+ assertEquals("/opt/d.jar", urls.get(1).getPath());
+ }
+
+ @Test
+ public void testAddClassPathURLAddsJrtSchemeWhenSupported() {
+ Assume.assumeTrue(schemeSupported("jrt"));
+ assertEquals(1, collect("jrt:/java.base/module-info.class").size());
+ }
+
+ @Test
+ public void testAddClassPathURLAddsJmodSchemeWhenSupported() {
+ Assume.assumeTrue(schemeSupported("jmod"));
+ assertEquals(1, collect("jmod:/x").size());
+ }
+}
diff --git a/main/connectivity/qa/complex/sdbc/makefile.mk b/main/connectivity/qa/complex/sdbc/makefile.mk
new file mode 100644
index 0000000000..64c1d0cffa
--- /dev/null
+++ b/main/connectivity/qa/complex/sdbc/makefile.mk
@@ -0,0 +1,58 @@
+#**************************************************************
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+#**************************************************************
+
+
+.IF "$(OOO_SUBSEQUENT_TESTS)" == ""
+nothing .PHONY:
+.ELSE
+
+PRJ = ..$/..$/..
+PRJNAME = connectivity
+TARGET = SdbcToolsTest
+
+.IF "$(OOO_JUNIT_JAR)" != ""
+PACKAGE = complex$/sdbc
+
+# here store only Files which contain a @Test
+JAVATESTFILES = \
+ ToolsTest.java
+
+# put here all other files
+JAVAFILES = $(JAVATESTFILES)
+
+# The class under test lives in sdbc_jdbc.jar; dbtools.jar supplies the two
+# helper types Tools references (ResourceBasedEventLogger, StandardSQLState),
+# so that com.sun.star.comp.sdbc.Tools can be loaded and verified.
+JARFILES = ridl.jar unoil.jar jurt.jar juh.jar java_uno.jar dbtools.jar sdbc_jdbc.jar
+EXTRAJARFILES = $(OOO_JUNIT_JAR)
+
+# Sample how to debug
+# JAVAIFLAGS+=-Xdebug -Xrunjdwp:transport=dt_socket,server=y,address=9003,suspend=y
+
+.END
+
+.INCLUDE: settings.mk
+.INCLUDE: target.mk
+.INCLUDE: installationtest.mk
+
+ALLTAR : javatest
+
+.END
(openoffice) 08/14: Limit paths for text caches for embedded databases
Posted by ji...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jimjag pushed a commit to branch AOO50X
in repository https://gitbox.apache.org/repos/asf/openoffice.git
commit f510625c6b18cd6dce0aa5a38beabec0a3a4536b
Author: Arrigo Marchiori <ar...@yahoo.it>
AuthorDate: Tue Sep 8 22:52:04 2026 +0200
Limit paths for text caches for embedded databases
(cherry picked from commit b81185736b1dc1d0d31d3c6399b1242bd42a93a5)
---
main/hsqldb/makefile.mk | 2 +-
main/hsqldb/patches/text_tables.patch | 13 +++++++++++++
2 files changed, 14 insertions(+), 1 deletion(-)
diff --git a/main/hsqldb/makefile.mk b/main/hsqldb/makefile.mk
index fd77dde950..0583bb51c7 100644
--- a/main/hsqldb/makefile.mk
+++ b/main/hsqldb/makefile.mk
@@ -49,7 +49,7 @@ CONVERTFILES=build$/build.xml \
src$/org$/hsqldb$/persist$/HsqlDatabaseProperties.java \
src$/org$/hsqldb$/Library.java
-PATCH_FILES=patches$/i121754.patch patches$/script.patch patches$/runfinalizers.patch
+PATCH_FILES=patches$/i121754.patch patches$/script.patch patches$/runfinalizers.patch patches$/text_tables.patch
# hsqldb's build.xml javac tasks specify no source/target; pin them so bytecode
# stays Java 8 compatible regardless of the (possibly much newer) build JDK.
diff --git a/main/hsqldb/patches/text_tables.patch b/main/hsqldb/patches/text_tables.patch
new file mode 100644
index 0000000000..896c8dc3ce
--- /dev/null
+++ b/main/hsqldb/patches/text_tables.patch
@@ -0,0 +1,13 @@
+diff -ru misc/hsqldb/src/org/hsqldb/persist/Log.java misc/build/hsqldb/src/org/hsqldb/persist/Log.java
+--- misc/hsqldb/src/org/hsqldb/persist/Log.java 2008-03-14 16:47:42.000000000 +0100
++++ misc/build/hsqldb/src/org/hsqldb/persist/Log.java 2026-09-08 22:40:39.681242533 +0200
+@@ -763,7 +763,7 @@
+
+ closeTextCache(table);
+
+- if (!properties.isPropertyTrue(
++ if (database.isStoredFileAccess() || !properties.isPropertyTrue(
+ HsqlDatabaseProperties.textdb_allow_full_path)) {
+ if (source.indexOf("..") != -1) {
+ throw (Trace.error(Trace.ACCESS_IS_DENIED, source));
+
(openoffice) 01/14: VCL: when loading PNG's, ensure we do not reuse an object that was created on the stack
Posted by ji...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jimjag pushed a commit to branch AOO50X
in repository https://gitbox.apache.org/repos/asf/openoffice.git
commit cb5c5ed04d1cce6c62b015d945e23f8fe721b7e2
Author: Arrigo Marchiori <ar...@yahoo.it>
AuthorDate: Sun Sep 13 09:04:00 2026 +0200
VCL: when loading PNG's, ensure we do not reuse an object that was created on the stack
Also, add a guard to ZCodec against unwanted reusal of variables.
(cherry picked from commit 56e4d38c33928bade1ec98e3d1fd9ebea94cde1d)
---
main/tools/source/zcodec/zcodec.cxx | 1 +
main/vcl/source/gdi/pngread.cxx | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/main/tools/source/zcodec/zcodec.cxx b/main/tools/source/zcodec/zcodec.cxx
index a0477cc68d..de6d1e6417 100644
--- a/main/tools/source/zcodec/zcodec.cxx
+++ b/main/tools/source/zcodec/zcodec.cxx
@@ -127,6 +127,7 @@ long ZCodec::EndCompression()
}
delete[] mpOutBuf;
delete[] mpInBuf;
+ mbInit = 0;
}
return ( mbStatus ) ? retvalue : -1;
}
diff --git a/main/vcl/source/gdi/pngread.cxx b/main/vcl/source/gdi/pngread.cxx
index 78c3bc876e..d3fe1e2bb1 100644
--- a/main/vcl/source/gdi/pngread.cxx
+++ b/main/vcl/source/gdi/pngread.cxx
@@ -967,7 +967,7 @@ void PNGReaderImpl::ImplReadIDAT()
{
// get bytes needed to fill the current scanline
sal_Int32 nToRead = mnScansize - (mpScanCurrent - mpInflateInBuf);
- sal_Int32 nRead = mpZCodec->ReadAsynchron( aIStrm, mpScanCurrent, nToRead );
+ sal_Int32 nRead = mpZCodec->Read( aIStrm, mpScanCurrent, nToRead );
if ( nRead < 0 )
{
mbStatus = sal_False;
(openoffice) 06/14: sw: ww8: validate PLCF length
Posted by ji...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jimjag pushed a commit to branch AOO50X
in repository https://gitbox.apache.org/repos/asf/openoffice.git
commit 30a740d635c4150c6ce547f88b05498f7c68cf8c
Author: Peter Kovacs <pe...@apache.org>
AuthorDate: Sat Aug 1 12:53:44 2026 +0200
sw: ww8: validate PLCF length
Add an inline WW8PLCF::IsValidLength() predicate and call it at the
entry of both WW8PLCF::ReadPLCF and the WW8PLCFspecial constructor.
Add GoogleTest_sw_ww8plcf covering the boundary values.
Thanks to Yukihiro Nakamura (nakamurabeer@gmail.com)
Co-authored-by: Yukihiro Nakamura (nakamurabeer@gmail.com)
Co-Authored-By: Claude Opus 5 <no...@anthropic.com>
(cherry picked from commit 8604ca21f9283f811f592bd95847a6002173ce6e)
---
main/sw/{Module_sw.mk => GoogleTest_sw_ww8plcf.mk} | 42 ++++++------
main/sw/Module_sw.mk | 1 +
main/sw/source/filter/ww8/qa/ww8plcf_test.cxx | 78 ++++++++++++++++++++++
main/sw/source/filter/ww8/ww8scan.cxx | 15 +++++
main/sw/source/filter/ww8/ww8scan.hxx | 3 +
5 files changed, 116 insertions(+), 23 deletions(-)
diff --git a/main/sw/Module_sw.mk b/main/sw/GoogleTest_sw_ww8plcf.mk
similarity index 59%
copy from main/sw/Module_sw.mk
copy to main/sw/GoogleTest_sw_ww8plcf.mk
index 5465500bca..5ffedcc35a 100644
--- a/main/sw/Module_sw.mk
+++ b/main/sw/GoogleTest_sw_ww8plcf.mk
@@ -20,34 +20,30 @@
#**************************************************************
+$(eval $(call gb_GoogleTest_GoogleTest,sw_ww8plcf))
-$(eval $(call gb_Module_Module,sw))
-
-$(eval $(call gb_Module_add_targets,sw,\
- AllLangResTarget_sw \
- Library_msword \
- Library_sw \
- Library_swd \
- Library_swui \
- Library_vbaswobj \
- Package_misc \
- Package_uiconfig \
- Package_xml \
+$(eval $(call gb_GoogleTest_add_exception_objects,sw_ww8plcf, \
+ sw/source/filter/ww8/qa/ww8plcf_test \
))
-
-ifeq ($(ENABLE_UNIT_TESTS),YES)
-$(eval $(call gb_Module_add_check_targets,sw,\
- GoogleTest_sw_bigpointerarray \
+# WW8PLCF::IsValidLength is inline and references only compile-time constants,
+# so the test compiles against the ww8 filter headers without linking msword.
+$(eval $(call gb_GoogleTest_add_linked_libs,sw_ww8plcf, \
+ sal \
+ stl \
+ sw \
+ tl \
+ $(gb_STDLIBS) \
))
-endif
-
-ifneq ($(OOO_JUNIT_JAR),)
-$(eval $(call gb_Module_add_subsequentcheck_targets,sw,\
- JunitTest_sw_complex \
- JunitTest_sw_unoapi \
+$(eval $(call gb_GoogleTest_set_include,sw_ww8plcf,\
+ $$(INCLUDE) \
+ -I$(SRCDIR)/sw/inc \
+ -I$(SRCDIR)/sw/inc/pch \
+ -I$(SRCDIR)/sw/source/filter/inc \
+ -I$(SRCDIR)/sw/source/filter/ww8 \
+ -I$(OUTDIR)/inc/offuh \
+ -I$(OUTDIR)/inc \
))
-endif
# vim: set noet sw=4 ts=4:
diff --git a/main/sw/Module_sw.mk b/main/sw/Module_sw.mk
index 5465500bca..eda7a25d88 100644
--- a/main/sw/Module_sw.mk
+++ b/main/sw/Module_sw.mk
@@ -39,6 +39,7 @@ $(eval $(call gb_Module_add_targets,sw,\
ifeq ($(ENABLE_UNIT_TESTS),YES)
$(eval $(call gb_Module_add_check_targets,sw,\
GoogleTest_sw_bigpointerarray \
+ GoogleTest_sw_ww8plcf \
))
endif
diff --git a/main/sw/source/filter/ww8/qa/ww8plcf_test.cxx b/main/sw/source/filter/ww8/qa/ww8plcf_test.cxx
new file mode 100644
index 0000000000..c20a795e1a
--- /dev/null
+++ b/main/sw/source/filter/ww8/qa/ww8plcf_test.cxx
@@ -0,0 +1,78 @@
+/**************************************************************
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ *************************************************************/
+
+// Regression test for WW8PLCF::IsValidLength, the length guard shared by
+// WW8PLCF::ReadPLCF and the WW8PLCFspecial constructor (ww8scan.cxx).
+
+#include "gtest/gtest.h"
+
+#include "ww8scan.hxx" // WW8PLCF::IsValidLength (inline, no filter link)
+#include "ww8struc.hxx" // WW8_CP_MAX
+#include <sal/types.h>
+
+// Non-positive count must be rejected.
+TEST(WW8Plcf, IsValidLengthRejectsNegativeAndZero)
+{
+ EXPECT_FALSE( WW8PLCF::IsValidLength( -1 ) ); // 0xFFFFFFFF narrowed
+ EXPECT_FALSE( WW8PLCF::IsValidLength( 0 ) );
+ EXPECT_FALSE( WW8PLCF::IsValidLength( -64 ) );
+ EXPECT_FALSE( WW8PLCF::IsValidLength( SAL_MIN_INT32 ) );
+}
+
+// Lengths close to the maximum must be rejected too
+TEST(WW8Plcf, IsValidLengthRejectsOverflowingUpperRange)
+{
+ EXPECT_FALSE( WW8PLCF::IsValidLength( WW8_CP_MAX ) );
+ EXPECT_FALSE( WW8PLCF::IsValidLength( WW8_CP_MAX - 1 ) );
+ EXPECT_FALSE( WW8PLCF::IsValidLength( WW8_CP_MAX - 3 ) );
+}
+
+// Genuine lengths are accepted
+TEST(WW8Plcf, IsValidLengthAcceptsBenignLengths)
+{
+ EXPECT_TRUE( WW8PLCF::IsValidLength( 1 ) );
+ EXPECT_TRUE( WW8PLCF::IsValidLength( 12 ) );
+ EXPECT_TRUE( WW8PLCF::IsValidLength( 64 ) );
+ EXPECT_TRUE( WW8PLCF::IsValidLength( WW8_CP_MAX - 4 ) ); // largest accepted
+}
+
+// For every accepted length, the element count both readers allocate is
+// large enough to hold the nPLCF bytes the subsequent Read copies in.
+TEST(WW8Plcf, AcceptedLengthSizesBufferToHoldRead)
+{
+ const sal_Int32 aLens[] = { 1, 3, 4, 5, 12, 64, 4096, WW8_CP_MAX - 4 };
+ for ( size_t i = 0; i < sizeof(aLens) / sizeof(aLens[0]); ++i )
+ {
+ const sal_Int32 nPLCF = aLens[i];
+ ASSERT_TRUE( WW8PLCF::IsValidLength( nPLCF ) );
+ // Done in 64-bit to model the allocation without itself overflowing.
+ const sal_Int64 nElems = ( static_cast<sal_Int64>(nPLCF) + 3 ) / 4;
+ const sal_Int64 nCapacityBytes = nElems * 4; // sizeof(WW8_CP) == 4
+ EXPECT_GT( nElems, 0 );
+ EXPECT_GE( nCapacityBytes, static_cast<sal_Int64>(nPLCF) );
+ }
+}
+
+int main( int argc, char** argv )
+{
+ ::testing::InitGoogleTest( &argc, argv );
+ return RUN_ALL_TESTS();
+}
diff --git a/main/sw/source/filter/ww8/ww8scan.cxx b/main/sw/source/filter/ww8/ww8scan.cxx
index 250ca6f65b..40667c826d 100644
--- a/main/sw/source/filter/ww8/ww8scan.cxx
+++ b/main/sw/source/filter/ww8/ww8scan.cxx
@@ -2208,6 +2208,15 @@ WW8PLCFspecial::WW8PLCFspecial(SvStream* pSt, long nFilePos, long nPLCF,
long nStruct, long nStartPos)
: nIdx(0), nStru(nStruct)
{
+ if (!WW8PLCF::IsValidLength(static_cast<sal_Int32>(nPLCF)))
+ {
+ nIMax = 0;
+ pPLCF_PosArray = new sal_Int32[1];
+ pPLCF_PosArray[0] = WW8_CP_MAX;
+ pPLCF_Contents = 0;
+ return;
+ }
+
nIMax = ( nPLCF - 4 ) / ( 4 + nStruct );
// Pointer auf Pos- u. Struct-Array
pPLCF_PosArray = new sal_Int32[ ( nPLCF + 3 ) / 4 ];
@@ -2382,6 +2391,12 @@ void WW8PLCF::ReadPLCF( SvStream* pSt, WW8_FC nFilePos, sal_Int32 nPLCF )
{
bool failure = false;
+ if (!IsValidLength(nPLCF))
+ {
+ MakeFailedPLCF();
+ return;
+ }
+
// Pointer auf Pos-Array
pPLCF_PosArray = new WW8_CP[ ( nPLCF + 3 ) / 4 ];
diff --git a/main/sw/source/filter/ww8/ww8scan.hxx b/main/sw/source/filter/ww8/ww8scan.hxx
index 72f154623a..19eff0af3f 100644
--- a/main/sw/source/filter/ww8/ww8scan.hxx
+++ b/main/sw/source/filter/ww8/ww8scan.hxx
@@ -291,6 +291,9 @@ private:
void MakeFailedPLCF();
public:
+ static bool IsValidLength( sal_Int32 nPLCF )
+ { return nPLCF >= 1 && nPLCF <= ( WW8_CP_MAX - 4 ); }
+
WW8PLCF( SvStream* pSt, WW8_FC nFilePos, sal_Int32 nPLCF, int nStruct,
WW8_CP nStartPos = -1 );
(openoffice) 14/14: svx, avmedia: put the media question when the URL is set, not while painting
Posted by ji...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jimjag pushed a commit to branch AOO50X
in repository https://gitbox.apache.org/repos/asf/openoffice.git
commit eb76c9b3bfb7ce7d890ac889324e415ea72ee970
Author: Peter <pe...@apache.org>
AuthorDate: Wed Sep 30 22:28:23 2026 +0200
svx, avmedia: put the media question when the URL is set, not while painting
Avoid multiple popups.
Keep the checks where they are, but have the question put earlier, in a
place that does not paint: when a media object gets its URL -- on insertion,
while the document loads, through the API -- ask the document that holds the
object. Its LinkManager keeps the answer, and the checks made later while a
view paints get it without a question. A copy takes the URL without asking
again.
Co-Authored-By: Claude Opus 5.5 <no...@anthropic.com>
(cherry picked from commit fb122de935def4d7d318cbb25ee0b9de0a4547ae)
---
main/avmedia/source/viewer/mediawindow.cxx | 15 ++++-----
main/svx/source/svdraw/svdomedia.cxx | 51 ++++++++++++++++++++++++++++++
2 files changed, 57 insertions(+), 9 deletions(-)
diff --git a/main/avmedia/source/viewer/mediawindow.cxx b/main/avmedia/source/viewer/mediawindow.cxx
index 182b68ae88..f0ecd05f1f 100644
--- a/main/avmedia/source/viewer/mediawindow.cxx
+++ b/main/avmedia/source/viewer/mediawindow.cxx
@@ -526,18 +526,15 @@ uno::Reference< graphic::XGraphic > MediaWindow::grabFrame( const ::rtl::OUStrin
bool bAllowToCreateReplacementGraphic,
double fMediaTime )
{
- uno::Reference< media::XPlayer > xPlayer;
+ // createPlayer() applies the shared policy (mayLoadDocumentReference): a
+ // relative reference or a local file is grabbed without asking. This runs
+ // while a view paints, so it must not put a question to the user for the
+ // ordinary case; anything else has been put to the document already, when
+ // the media object got its URL (see SdrMediaObj).
+ uno::Reference< media::XPlayer > xPlayer( createPlayer( rURL ) );
uno::Reference< graphic::XGraphic > xRet;
::std::auto_ptr< Graphic > apGraphic;
- // Stricter than mayLoadDocumentReference: a grabbed frame is drawn into the
- // document and exported with it, so any reference that carries a scheme is
- // put to the document, a local file included. A relative reference is the
- // document's own content and is grabbed as before.
- if( !::svt::linkpolicy::isAbsoluteUrl( rURL )
- || ::svt::linkpolicy::mayFollowDocumentLink( rURL ) )
- xPlayer = createPlayer( rURL );
-
if( xPlayer.is() )
{
uno::Reference< media::XFrameGrabber > xGrabber( xPlayer->createFrameGrabber() );
diff --git a/main/svx/source/svdraw/svdomedia.cxx b/main/svx/source/svdraw/svdomedia.cxx
index 617e092941..5b2dc39f23 100644
--- a/main/svx/source/svdraw/svdomedia.cxx
+++ b/main/svx/source/svdraw/svdomedia.cxx
@@ -30,7 +30,48 @@
#include "svx/svdglob.hxx"
#include "svx/svdstr.hrc"
#include <svx/sdr/contact/viewcontactofsdrmediaobj.hxx>
+#include <svx/svdmodel.hxx>
#include <avmedia/mediawindow.hxx>
+#include <svtools/linkpolicy.hxx>
+
+#include <com/sun/star/document/XLinkAuthorizer.hpp>
+#include <com/sun/star/uno/RuntimeException.hpp>
+
+using namespace ::com::sun::star;
+
+namespace {
+
+// Asks the document that holds the media object whether rURL may be loaded.
+// The document's LinkManager keeps the answer, so the checks that avmedia makes
+// later -- some of them while a view paints -- get it without a question.
+// A reference mayLoadDocumentReference() accepts without asking (relative, or
+// a local file) needs nothing; nor does a model without a document behind it.
+void lcl_authorizeURL( SdrModel* pModel, const ::rtl::OUString& rURL )
+{
+ if( !pModel || !pModel->GetPersist() || rURL.getLength() == 0 )
+ return;
+
+ if( !::svt::linkpolicy::isAbsoluteUrl( rURL ) )
+ {
+ if( !rURL.matchIgnoreAsciiCaseAsciiL( RTL_CONSTASCII_STRINGPARAM( "\\\\" ) )
+ && !rURL.matchIgnoreAsciiCaseAsciiL( RTL_CONSTASCII_STRINGPARAM( "//" ) ) )
+ return;
+ }
+ else if( ::svt::linkpolicy::isLocalFileUrl( rURL ) )
+ return;
+
+ try
+ {
+ const uno::Reference< document::XLinkAuthorizer > xAuthorizer( pModel->getUnoModel(), uno::UNO_QUERY );
+ if( xAuthorizer.is() )
+ xAuthorizer->authorizeLinks( rURL );
+ }
+ catch( const uno::RuntimeException& )
+ {
+ }
+}
+
+}
// ---------------
// - SdrMediaObj -
@@ -138,6 +179,10 @@ void SdrMediaObj::operator=(const SdrObject& rObj)
{
const SdrMediaObj& rMediaObj = static_cast< const SdrMediaObj& >( rObj );
+ // A copy is not a new reference from document content: take the URL
+ // first, so mediaPropertiesChanged() sees no change and asks nobody
+ // (a copy to the clipboard would otherwise put the question again).
+ maMediaProperties.setURL( rMediaObj.getURL() );
setMediaProperties( rMediaObj.getMediaProperties() );
setGraphic( rMediaObj.mapGraphic.get() );
}
@@ -265,6 +310,12 @@ void SdrMediaObj::mediaPropertiesChanged( const ::avmedia::MediaItem& rNewProper
{
setGraphic();
maMediaProperties.setURL( rNewProperties.getURL() );
+
+ // The URL is set on insertion, while a document loads, and through
+ // the API -- never while painting. Put the question now, so that the
+ // checks made later while a view paints (the player and the frame
+ // grab in avmedia) find the document's answer already given.
+ lcl_authorizeURL( GetModel(), getURL() );
}
if( AVMEDIA_SETMASK_LOOP & nMaskSet )