You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@openoffice.apache.org by Arrigo Marchiori <ar...@yahoo.it.INVALID> on 2021/06/01 19:57:06 UTC
Re: Hyperlink Warning Message
Dear All,
I'll attempt a multi-level reply here :-)
On Sat, May 29, 2021 at 12:26:52PM -0700, Dave Fisher wrote:
> > On May 28, 2021, at 3:01 PM, Carl Marcum <cm...@apache.org> wrote:
> >
> > Hi All,
> >
> > On 5/28/21 4:46 PM, Peter Kovacs wrote:
> >>
> >> On 28.05.21 22:04, Arrigo Marchiori wrote:
> >>> Hello all,
> >>>
> >>> replying to an older message in this thread.
> >>>
> >>> On Thu, May 13, 2021 at 07:23:16PM -0400, Carl Marcum wrote:
> >>>
> >>> [...]
> >>>> Hopefully we can collect the exceptions in the BZ issue noted in this thread
> >>>> and then agree on the direction.
> >>>>
> >>>> The few I see so far are:
> >>>> 1. in-document links beginning with #.
> >>>> 2. .uno:XXX links
> >>>> 3. Links to local files.
> >>>>
> >>>> I think all 3 are candidates but that's just me.
> >>> I have bad news about number 1. Apparently, when the link is indicated
> >>> as "#anchor", it is transformed into "file://path/document.ods#anchor"
> >>> and then passed to SfxApplication::OpenDocExec_Impl()
> >>>
> >>> This means that if we want to have warning-less links to the same
> >>> document, then we may have to consider the file:// protocol possibly
> >>> safe. We should then rely on extensions.
> >>>
> >>> Suprisingly, the OpenDocument extensions do not seem to be included in
> >>> the standard list of safe extensions. Such list should be in
> >>> main/officecfg/registry/data/org/openoffice/Office/Security.xcu -- I
> >>> cannot recall who brought this to my attention and therefore I am
> >>> unable to credit him/her, I am sorry.
> >>>
> >>> Does anyone see any possible security issues in considering the
> >>> file:// protocol safe and deciding on the target file's extension
> >>> whether to show a warning or not?
> >>
> >> I would not go for file://. Can we go for a pattern derivated from file://path/document.ods#anchor ?
I am not sure I understand your question, Peter.
> >> We had CVEs in the past working with file links, based odf definition and UNO. Maybe you can try the test files from those CVEs.
Ok. I will look for them.
> I think that we should evaluate which protocols are “safe”:
> The full list is here:
> http://opengrok.openoffice.org/xref/aoo4110/main/tools/inc/tools/urlobj.hxx?r=b1cdbd2c#104
Yes Dave, I believe that this is an important question.
> There is this large source file that seems to encode all things to do with a url:
>
> http://opengrok.openoffice.org/xref/aoo4110/main/tools/source/fsys/urlobj.cxx?r=b1cdbd2c#2080
> main/tools/source/fsys/urlobj.cxx has a getPrefix method which returns:
> http://opengrok.openoffice.org/xref/aoo4110/main/tools/source/fsys/urlobj.cxx?r=b1cdbd2c#349
>
> 348 //============================================================================
> 349 struct INetURLObject::PrefixInfo
> 350 {
> 351 enum Kind { OFFICIAL, INTERNAL, EXTERNAL, ALIAS }; // order is important!
> 352
> 353 sal_Char const * m_pPrefix;
> 354 sal_Char const * m_pTranslatedPrefix;
> 355 INetProtocol m_eScheme;
> 356 Kind m_eKind;
> 357 };
>
> I wonder if Kind is helpful for what should be trusted?
It seems to me, that Kind is used to distinguish between ``official''
prefixes, like "http", that anyone should know, from other prefixes,
specific to AOO.
> We are grabbing an INetURLObject here:
> http://opengrok.openoffice.org/xref/aoo4110/main/sfx2/source/appl/appopen.cxx?r=b1cdbd2c#929
>
> The code after here http://opengrok.openoffice.org/xref/aoo4110/main/sfx2/source/appl/appopen.cxx?r=b1cdbd2c#1040 may be helpful.
I do not seem to be able to open your links, sorry...
Now to Carl:
> > I think the file protocol as a hyperlink was considered safe by
> > the office right up until this fix.
Yes, there were no checks. We (re-)enabled them in AOO 4.1.10.
> > It seems the uno and file protocols were caught up in the fix and are the primary ones causing the users problems.
Correct.
> > I don't believe either of these were the subject of the CVE that was fixed so I don't think we're harming that one.
Well, the title of the latest CVE was about "non-http(s) schemes". So
it did include file:// links. But let's remember that there were no
checks on the target file's extension!
> > I would think we could allow these at least for a test build while also going back and verify the previous CVE's didn't get opened up.
Please see branch bug128453, just pushed.
I will look for older CVE's in the next days.
I hope this helps.
Best regards,
--
Arrigo
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Hyperlink Warning Message
Posted by Arrigo Marchiori <ar...@yahoo.it.INVALID>.
Hello All,
On Wed, Jun 02, 2021 at 01:00:08PM -0700, Dave Fisher wrote:
> > On Jun 2, 2021, at 11:58 AM, Marcus <ma...@wtnet.de> wrote:
> >
> > Am 02.06.21 um 00:07 schrieb Peter Kovacs:
> >> On 01.06.21 21:57, Arrigo Marchiori wrote:
> >>>>> I would not go for file://. Can we go for a pattern derivated from file://path/document.ods#anchor ?
> >>> I am not sure I understand your question, Peter.
> >>>
> >> I am suggesting not to trust file:// in general, but the anchored URL,
> >
> > yes, the securty report is talking about nin-http(s) links, And "ile" is not http. There we have to treat this as insecure.
> >
> >> maybe file://*#anchor if you like.
> >> But maybe I got this URL wrong.
> >
> > Hm, I don't see how an anchor makes the document more secure. ;-)
>
> We need to know if the file:// is already open.
We might be able to know whether the file is already open, if it is an
AOO document.
But what if the file is a JPG image? Or a MP3 audio? Should it not be
considered safe as well? And for what I know, AOO cannot open images
or MP3's as documents.
Judging on the file extension seems to me the best way to follow, at
least for the file:/// protocol and any other protocols that rely on
XSystemShellExecute::execute().
I hope this makes sense.
--
Arrigo
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Hyperlink Warning Message
Posted by Dave Fisher <wa...@apache.org>.
> On Jun 2, 2021, at 11:58 AM, Marcus <ma...@wtnet.de> wrote:
>
> Am 02.06.21 um 00:07 schrieb Peter Kovacs:
>> On 01.06.21 21:57, Arrigo Marchiori wrote:
>>>>> I would not go for file://. Can we go for a pattern derivated from file://path/document.ods#anchor ?
>>> I am not sure I understand your question, Peter.
>>>
>> I am suggesting not to trust file:// in general, but the anchored URL,
>
> yes, the securty report is talking about nin-http(s) links, And "ile" is not http. There we have to treat this as insecure.
>
>> maybe file://*#anchor if you like.
>> But maybe I got this URL wrong.
>
> Hm, I don't see how an anchor makes the document more secure. ;-)
We need to know if the file:// is already open.
>
> Marcus
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
> For additional commands, e-mail: dev-help@openoffice.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Hyperlink Warning Message
Posted by Marcus <ma...@wtnet.de>.
Am 02.06.21 um 00:07 schrieb Peter Kovacs:
>
> On 01.06.21 21:57, Arrigo Marchiori wrote:
>>>> I would not go for file://. Can we go for a pattern derivated from
>>>> file://path/document.ods#anchor ?
>> I am not sure I understand your question, Peter.
>>
> I am suggesting not to trust file:// in general, but the anchored URL,
yes, the securty report is talking about nin-http(s) links, And "ile" is
not http. There we have to treat this as insecure.
> maybe file://*#anchor if you like.
> But maybe I got this URL wrong.
Hm, I don't see how an anchor makes the document more secure. ;-)
Marcus
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Hyperlink Warning Message
Posted by Peter Kovacs <pe...@apache.org>.
On 01.06.21 21:57, Arrigo Marchiori wrote:
>>> I would not go for file://. Can we go for a pattern derivated from file://path/document.ods#anchor ?
> I am not sure I understand your question, Peter.
>
I am suggesting not to trust file:// in general, but the anchored URL,
maybe file://*#anchor if you like.
But maybe I got this URL wrong.
--
This is the Way! http://www.apache.org/theapacheway/index.html
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Hyperlink Warning Message
Posted by Carl Marcum <cm...@apache.org>.
Hi Marcus,
On 6/10/21 9:29 AM, Marcus wrote:
> Am 08.06.21 um 11:16 schrieb Matthias Seidel:
>> Find the Windows build here:
>>
>> https://home.apache.org/~mseidel/AOO-builds/AOO-4111-Test/Full%20Installation/Apache_OpenOffice_4.1.11_Win_x86_install_en-US_6652b2eb2e.exe
>>
>
> here my results:
>
> http://www.openoffice.org/
> http://www.openoffice.org/test.exe
> http://www.openoffice.org/test.ods
> https://www.openoffice.org/
> https://www.openoffice.org/test.exe
> https://www.openoffice.org/test.ods
>
> --> Any HTTP or HTTPS links are opened without warning.
>
> smb://www.openoffice.org/
> smb://www.openoffice.org/test.exe
> smb://www.openoffice.org/test.ods
> file://www.openoffice.org/
> file://www.openoffice.org/test.exe
> file://www.openoffice.org/test.ods
>
> --> Any SMB or FILE links get the warning dialog before opening.
>
> How can I test with UNO links like ".uno:reload"?
The test document I created has a button with a .uno:Reload action.
http://home.apache.org/~cmarcum/hyperlink-tests/
Or make a push button using form controls.
Set Action to Open document/web page
Set URL to .uno:Reload
Best regards,
Carl
>
> Thanks
>
> Marcus
>
>
>
>> Am 07.06.21 um 18:09 schrieb Marcus:
>>> Am 07.06.21 um 02:12 schrieb Carl Marcum:
>>>> Hi Arrigo,
>>>>
>>>> On 6/6/21 3:56 PM, Arrigo Marchiori wrote:
>>>>> Hello Carl, All,
>>>>>
>>>>> On Sun, Jun 06, 2021 at 11:50:12AM -0400, Carl Marcum wrote:
>>>>>
>>>>>> Hi Arrigo and All,
>>>>>>
>>>>>> On 6/5/21 5:53 PM, Arrigo Marchiori wrote:
>>>>>>> Hello Carl, All,
>>>>>>>
>>>>>>> On Sat, Jun 05, 2021 at 03:47:12PM -0400, Carl Marcum wrote:
>>>>>>>
>>>>>>>> Hi Arrigo,
>>>>>>>>
>>>>>>>> On 6/5/21 9:50 AM, Arrigo Marchiori wrote:
>>>>>>>>> Dear Matthias, Czesław, All,
>>>>>>>>>
>>>>>>>>> On Sat, Jun 05, 2021 at 12:39:16PM +0200, Matthias Seidel wrote:
>>>>>>>>>
>>>>>>>>>> Hi Czesław,
>>>>>>>>>>
>>>>>>>>>> Am 05.06.21 um 12:35 schrieb Czesław Wolański:
>>>>>>>>>>> Hi Matthias, all
>>>>>>>>>>>
>>>>>>>>>>> A preliminary check in Calc (Windows 7, 64-bit)
>>>>>>>>>>>
>>>>>>>>>>> (1) in-document links beginning with #
>>>>>>>>>>> test: button with link to other sheet
>>>>>>>>>>> result: OK (no security warning)
>>>>>>>>>>>
>>>>>>>>>>> (2) .uno:XXX links
>>>>>>>>>>> result: security warning
>>>>>>>>>>>
>>>>>>>>>>> (3) Links to local files
>>>>>>>>>>> test: the "Hyperlink" dialog, button "WWW Browser"
>>>>>>>>>>> result: OK (no security warning)
>>>>>>>>>> That's what I expected, since the patches are for file://
>>>>>>>>>>
>>>>>>>>>> .uno: hasn't been addressed yet
>>>>>>>>>>
>>>>>>>>>> @Arrigo: correct me if I am wrong ;-)
>>>>>>>>> You should have just become wrong ;-)
>>>>>>>>>
>>>>>>>>> I found out that there are many checks on the URL protocol. I
>>>>>>>>> suggest
>>>>>>>>> that the warning was not checked at the right moment, but too
>>>>>>>>> soon.
>>>>>>>>>
>>>>>>>>> Because we had a report of unexpected _execution_ of malicious
>>>>>>>>> links,
>>>>>>>>> I suggest we leave the safety check on hyperlinks _just before
>>>>>>>>> calling
>>>>>>>>> the OS to execute them_.
>>>>>>>>>
>>>>>>>>> The result is that HTTP, HTTPS, but also "uno:" and all other
>>>>>>>>> protocols already understood by AOO are not checked, and no
>>>>>>>>> warnings
>>>>>>>>> will appear. We could argue that their safety must be assured by
>>>>>>>>> the
>>>>>>>>> code handling them, as we accepted to delegate the browser for
>>>>>>>>> Internet links.
>>>>>>>>>
>>>>>>>>> The latest commit, just pushed to branch bug128453, moves the
>>>>>>>>> check
>>>>>>>>> for "safe extensions" (or directory) from the beginning of
>>>>>>>>> hyperlinks'
>>>>>>>>> processing, to just before the execution of the link target by
>>>>>>>>> the OS.
>>>>>>>>> The protocol is not checked any more, because supported protocols
>>>>>>>>> are already filtered out and processed at that point.
>>>>>>>>>
>>>>>>>>> This should make all links to non-files work again, and still
>>>>>>>>> warn
>>>>>>>>> users when they are going to open JAR's, EXE's and other unknown
>>>>>>>>> types.
>>>>>>>>>
>>>>>>>>> What do you think about this?
>>>>>>>> I like your thinking on this.
>>>>>>>> I'll build this branch on Linux and test using some of the test
>>>>>>>> documents
>>>>>>>> and ones I've made to make sure I understand the different cases.
>>>>>>>> Then I'll report back.
>>>>>>> You can find my 64 bit Linux builds here:
>>>>>>> https://home.apache.org/~ardovm/openoffice/bug128453/
>>>>>>>
>>>>>>> I tried the "beta" option of the build script... I hope it works.
>>>>>>>
>>>>>>> Thank you for your cooperation!
>>>>>>>
>>>>>>> Best regards,
>>>>>> I've built the bug128453 branch [1] on Linux CentOS 7 and ran the
>>>>>> test suite
>>>>>> that included the hyperlink tests for the dialogs [2].
>>>>>>
>>>>>> I put together some test documents here [3].
>>>>> Very nice, thank you!
>>>>>
>>>>> [...]
>>>>>> So far everything looks good and I get the warning everywhere I
>>>>>> expect to
>>>>>> with one exception.
>>>>>> The smb://nonexistant.url.com link does not display the warning and
>>>>>> I get
>>>>>> this output:
>>>>>> ---
>>>>>> This tool has been deprecated, use 'gio open' instead.
>>>>>> See 'gio help open' for more info.
>>>>>>
>>>>>> gio: smb://nonexistant.url.com/: The specified location is not
>>>>>> mounted
>>>>>> ---
>>>>>> Note that I build on CentOS 7 and use --enable-gio and
>>>>>> --disable-gnome-vfs
>>>>>> in configure.
>>>>>>
>>>>>> Maybe there is a reason the SMB protocol is treated differently
>>>>>> than the
>>>>>> others when there is only the host section of the url?
>>>>>>
>>>>>> I'm not saying this is bad but just different. We can discuss...
>>>>> Sure.
>>>>>
>>>>> The smb:// protocol is treated like file://. A proof of this is that
>>>>> the link to "smb://nonexistant.url.com/evil.jar" shows a warning
>>>>> dialog
>>>>> because the ".jar" extension is not considered safe.
>>>>>
>>>>> For the same reason, f you create a link to
>>>>> "smb://nonexistant.url.com/whatever.ods" it will be opened without
>>>>> warnings.
>>>>>
>>>>> The link you are discussing points to "smb://nonexistant.url.com/".
>>>>> The target ends with a backslash, therefore it is considered a
>>>>> directory, and thus safe.
>>>> Thanks for pointing this out. I intended it to end without the /.
>>>> For some reason AOO adds the trailing / for the smb link no matter
>>>> what I try.
>>>> But not for the other types. Even in the automated test since it
>>>> just robots the UI.
>>>>
>>>> I've removed the smb link in the test document and uploaded a new
>>>> copy.
>>>>
>>>> I'll also disable that specific test in the test suite as well due to
>>>> this behavior.
>>>>
>>>>>
>>>>> This is the current logic. It may be worth discussing whether we want
>>>>> to consider links to directories safe or not.
>>>>>
>>>>> The warning messages you reported about gio are worth another
>>>>> discussion: we may need to update the way we "talk to" the OS under
>>>>> GNOME. But as long as it works on current distributions, I would
>>>>> refrain from changing it.
>>>>>
>>>>> I hope that the above makes sense.
>>>>>
>>>>> Best regards,
>>>> So now I'll say everything works as expected.
>>>>
>>>> Thanks again for your work on this!
>>>
>>> Yes, thanks a lot for your efforts. :-)
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
> For additional commands, e-mail: dev-help@openoffice.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Hyperlink Warning Message
Posted by Marcus <ma...@wtnet.de>.
Am 08.06.21 um 11:16 schrieb Matthias Seidel:
> Find the Windows build here:
>
> https://home.apache.org/~mseidel/AOO-builds/AOO-4111-Test/Full%20Installation/Apache_OpenOffice_4.1.11_Win_x86_install_en-US_6652b2eb2e.exe
here my results:
http://www.openoffice.org/
http://www.openoffice.org/test.exe
http://www.openoffice.org/test.ods
https://www.openoffice.org/
https://www.openoffice.org/test.exe
https://www.openoffice.org/test.ods
--> Any HTTP or HTTPS links are opened without warning.
smb://www.openoffice.org/
smb://www.openoffice.org/test.exe
smb://www.openoffice.org/test.ods
file://www.openoffice.org/
file://www.openoffice.org/test.exe
file://www.openoffice.org/test.ods
--> Any SMB or FILE links get the warning dialog before opening.
How can I test with UNO links like ".uno:reload"?
Thanks
Marcus
> Am 07.06.21 um 18:09 schrieb Marcus:
>> Am 07.06.21 um 02:12 schrieb Carl Marcum:
>>> Hi Arrigo,
>>>
>>> On 6/6/21 3:56 PM, Arrigo Marchiori wrote:
>>>> Hello Carl, All,
>>>>
>>>> On Sun, Jun 06, 2021 at 11:50:12AM -0400, Carl Marcum wrote:
>>>>
>>>>> Hi Arrigo and All,
>>>>>
>>>>> On 6/5/21 5:53 PM, Arrigo Marchiori wrote:
>>>>>> Hello Carl, All,
>>>>>>
>>>>>> On Sat, Jun 05, 2021 at 03:47:12PM -0400, Carl Marcum wrote:
>>>>>>
>>>>>>> Hi Arrigo,
>>>>>>>
>>>>>>> On 6/5/21 9:50 AM, Arrigo Marchiori wrote:
>>>>>>>> Dear Matthias, Czesław, All,
>>>>>>>>
>>>>>>>> On Sat, Jun 05, 2021 at 12:39:16PM +0200, Matthias Seidel wrote:
>>>>>>>>
>>>>>>>>> Hi Czesław,
>>>>>>>>>
>>>>>>>>> Am 05.06.21 um 12:35 schrieb Czesław Wolański:
>>>>>>>>>> Hi Matthias, all
>>>>>>>>>>
>>>>>>>>>> A preliminary check in Calc (Windows 7, 64-bit)
>>>>>>>>>>
>>>>>>>>>> (1) in-document links beginning with #
>>>>>>>>>> test: button with link to other sheet
>>>>>>>>>> result: OK (no security warning)
>>>>>>>>>>
>>>>>>>>>> (2) .uno:XXX links
>>>>>>>>>> result: security warning
>>>>>>>>>>
>>>>>>>>>> (3) Links to local files
>>>>>>>>>> test: the "Hyperlink" dialog, button "WWW Browser"
>>>>>>>>>> result: OK (no security warning)
>>>>>>>>> That's what I expected, since the patches are for file://
>>>>>>>>>
>>>>>>>>> .uno: hasn't been addressed yet
>>>>>>>>>
>>>>>>>>> @Arrigo: correct me if I am wrong ;-)
>>>>>>>> You should have just become wrong ;-)
>>>>>>>>
>>>>>>>> I found out that there are many checks on the URL protocol. I
>>>>>>>> suggest
>>>>>>>> that the warning was not checked at the right moment, but too soon.
>>>>>>>>
>>>>>>>> Because we had a report of unexpected _execution_ of malicious
>>>>>>>> links,
>>>>>>>> I suggest we leave the safety check on hyperlinks _just before
>>>>>>>> calling
>>>>>>>> the OS to execute them_.
>>>>>>>>
>>>>>>>> The result is that HTTP, HTTPS, but also "uno:" and all other
>>>>>>>> protocols already understood by AOO are not checked, and no
>>>>>>>> warnings
>>>>>>>> will appear. We could argue that their safety must be assured by
>>>>>>>> the
>>>>>>>> code handling them, as we accepted to delegate the browser for
>>>>>>>> Internet links.
>>>>>>>>
>>>>>>>> The latest commit, just pushed to branch bug128453, moves the check
>>>>>>>> for "safe extensions" (or directory) from the beginning of
>>>>>>>> hyperlinks'
>>>>>>>> processing, to just before the execution of the link target by
>>>>>>>> the OS.
>>>>>>>> The protocol is not checked any more, because supported protocols
>>>>>>>> are already filtered out and processed at that point.
>>>>>>>>
>>>>>>>> This should make all links to non-files work again, and still warn
>>>>>>>> users when they are going to open JAR's, EXE's and other unknown
>>>>>>>> types.
>>>>>>>>
>>>>>>>> What do you think about this?
>>>>>>> I like your thinking on this.
>>>>>>> I'll build this branch on Linux and test using some of the test
>>>>>>> documents
>>>>>>> and ones I've made to make sure I understand the different cases.
>>>>>>> Then I'll report back.
>>>>>> You can find my 64 bit Linux builds here:
>>>>>> https://home.apache.org/~ardovm/openoffice/bug128453/
>>>>>>
>>>>>> I tried the "beta" option of the build script... I hope it works.
>>>>>>
>>>>>> Thank you for your cooperation!
>>>>>>
>>>>>> Best regards,
>>>>> I've built the bug128453 branch [1] on Linux CentOS 7 and ran the
>>>>> test suite
>>>>> that included the hyperlink tests for the dialogs [2].
>>>>>
>>>>> I put together some test documents here [3].
>>>> Very nice, thank you!
>>>>
>>>> [...]
>>>>> So far everything looks good and I get the warning everywhere I
>>>>> expect to
>>>>> with one exception.
>>>>> The smb://nonexistant.url.com link does not display the warning and
>>>>> I get
>>>>> this output:
>>>>> ---
>>>>> This tool has been deprecated, use 'gio open' instead.
>>>>> See 'gio help open' for more info.
>>>>>
>>>>> gio: smb://nonexistant.url.com/: The specified location is not mounted
>>>>> ---
>>>>> Note that I build on CentOS 7 and use --enable-gio and
>>>>> --disable-gnome-vfs
>>>>> in configure.
>>>>>
>>>>> Maybe there is a reason the SMB protocol is treated differently
>>>>> than the
>>>>> others when there is only the host section of the url?
>>>>>
>>>>> I'm not saying this is bad but just different. We can discuss...
>>>> Sure.
>>>>
>>>> The smb:// protocol is treated like file://. A proof of this is that
>>>> the link to "smb://nonexistant.url.com/evil.jar" shows a warning dialog
>>>> because the ".jar" extension is not considered safe.
>>>>
>>>> For the same reason, f you create a link to
>>>> "smb://nonexistant.url.com/whatever.ods" it will be opened without
>>>> warnings.
>>>>
>>>> The link you are discussing points to "smb://nonexistant.url.com/".
>>>> The target ends with a backslash, therefore it is considered a
>>>> directory, and thus safe.
>>> Thanks for pointing this out. I intended it to end without the /.
>>> For some reason AOO adds the trailing / for the smb link no matter
>>> what I try.
>>> But not for the other types. Even in the automated test since it
>>> just robots the UI.
>>>
>>> I've removed the smb link in the test document and uploaded a new copy.
>>>
>>> I'll also disable that specific test in the test suite as well due to
>>> this behavior.
>>>
>>>>
>>>> This is the current logic. It may be worth discussing whether we want
>>>> to consider links to directories safe or not.
>>>>
>>>> The warning messages you reported about gio are worth another
>>>> discussion: we may need to update the way we "talk to" the OS under
>>>> GNOME. But as long as it works on current distributions, I would
>>>> refrain from changing it.
>>>>
>>>> I hope that the above makes sense.
>>>>
>>>> Best regards,
>>> So now I'll say everything works as expected.
>>>
>>> Thanks again for your work on this!
>>
>> Yes, thanks a lot for your efforts. :-)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Hyperlink Warning Message
Posted by Matthias Seidel <ma...@hamburg.de>.
Hi all,
Find the Windows build here:
https://home.apache.org/~mseidel/AOO-builds/AOO-4111-Test/Full%20Installation/Apache_OpenOffice_4.1.11_Win_x86_install_en-US_6652b2eb2e.exe
Regards,
Matthias
Am 07.06.21 um 18:09 schrieb Marcus:
> Am 07.06.21 um 02:12 schrieb Carl Marcum:
>> Hi Arrigo,
>>
>> On 6/6/21 3:56 PM, Arrigo Marchiori wrote:
>>> Hello Carl, All,
>>>
>>> On Sun, Jun 06, 2021 at 11:50:12AM -0400, Carl Marcum wrote:
>>>
>>>> Hi Arrigo and All,
>>>>
>>>> On 6/5/21 5:53 PM, Arrigo Marchiori wrote:
>>>>> Hello Carl, All,
>>>>>
>>>>> On Sat, Jun 05, 2021 at 03:47:12PM -0400, Carl Marcum wrote:
>>>>>
>>>>>> Hi Arrigo,
>>>>>>
>>>>>> On 6/5/21 9:50 AM, Arrigo Marchiori wrote:
>>>>>>> Dear Matthias, Czesław, All,
>>>>>>>
>>>>>>> On Sat, Jun 05, 2021 at 12:39:16PM +0200, Matthias Seidel wrote:
>>>>>>>
>>>>>>>> Hi Czesław,
>>>>>>>>
>>>>>>>> Am 05.06.21 um 12:35 schrieb Czesław Wolański:
>>>>>>>>> Hi Matthias, all
>>>>>>>>>
>>>>>>>>> A preliminary check in Calc (Windows 7, 64-bit)
>>>>>>>>>
>>>>>>>>> (1) in-document links beginning with #
>>>>>>>>> test: button with link to other sheet
>>>>>>>>> result: OK (no security warning)
>>>>>>>>>
>>>>>>>>> (2) .uno:XXX links
>>>>>>>>> result: security warning
>>>>>>>>>
>>>>>>>>> (3) Links to local files
>>>>>>>>> test: the "Hyperlink" dialog, button "WWW Browser"
>>>>>>>>> result: OK (no security warning)
>>>>>>>> That's what I expected, since the patches are for file://
>>>>>>>>
>>>>>>>> .uno: hasn't been addressed yet
>>>>>>>>
>>>>>>>> @Arrigo: correct me if I am wrong ;-)
>>>>>>> You should have just become wrong ;-)
>>>>>>>
>>>>>>> I found out that there are many checks on the URL protocol. I
>>>>>>> suggest
>>>>>>> that the warning was not checked at the right moment, but too soon.
>>>>>>>
>>>>>>> Because we had a report of unexpected _execution_ of malicious
>>>>>>> links,
>>>>>>> I suggest we leave the safety check on hyperlinks _just before
>>>>>>> calling
>>>>>>> the OS to execute them_.
>>>>>>>
>>>>>>> The result is that HTTP, HTTPS, but also "uno:" and all other
>>>>>>> protocols already understood by AOO are not checked, and no
>>>>>>> warnings
>>>>>>> will appear. We could argue that their safety must be assured by
>>>>>>> the
>>>>>>> code handling them, as we accepted to delegate the browser for
>>>>>>> Internet links.
>>>>>>>
>>>>>>> The latest commit, just pushed to branch bug128453, moves the check
>>>>>>> for "safe extensions" (or directory) from the beginning of
>>>>>>> hyperlinks'
>>>>>>> processing, to just before the execution of the link target by
>>>>>>> the OS.
>>>>>>> The protocol is not checked any more, because supported protocols
>>>>>>> are already filtered out and processed at that point.
>>>>>>>
>>>>>>> This should make all links to non-files work again, and still warn
>>>>>>> users when they are going to open JAR's, EXE's and other unknown
>>>>>>> types.
>>>>>>>
>>>>>>> What do you think about this?
>>>>>> I like your thinking on this.
>>>>>> I'll build this branch on Linux and test using some of the test
>>>>>> documents
>>>>>> and ones I've made to make sure I understand the different cases.
>>>>>> Then I'll report back.
>>>>> You can find my 64 bit Linux builds here:
>>>>> https://home.apache.org/~ardovm/openoffice/bug128453/
>>>>>
>>>>> I tried the "beta" option of the build script... I hope it works.
>>>>>
>>>>> Thank you for your cooperation!
>>>>>
>>>>> Best regards,
>>>> I've built the bug128453 branch [1] on Linux CentOS 7 and ran the
>>>> test suite
>>>> that included the hyperlink tests for the dialogs [2].
>>>>
>>>> I put together some test documents here [3].
>>> Very nice, thank you!
>>>
>>> [...]
>>>> So far everything looks good and I get the warning everywhere I
>>>> expect to
>>>> with one exception.
>>>> The smb://nonexistant.url.com link does not display the warning and
>>>> I get
>>>> this output:
>>>> ---
>>>> This tool has been deprecated, use 'gio open' instead.
>>>> See 'gio help open' for more info.
>>>>
>>>> gio: smb://nonexistant.url.com/: The specified location is not mounted
>>>> ---
>>>> Note that I build on CentOS 7 and use --enable-gio and
>>>> --disable-gnome-vfs
>>>> in configure.
>>>>
>>>> Maybe there is a reason the SMB protocol is treated differently
>>>> than the
>>>> others when there is only the host section of the url?
>>>>
>>>> I'm not saying this is bad but just different. We can discuss...
>>> Sure.
>>>
>>> The smb:// protocol is treated like file://. A proof of this is that
>>> the link to "smb://nonexistant.url.com/evil.jar" shows a warning dialog
>>> because the ".jar" extension is not considered safe.
>>>
>>> For the same reason, f you create a link to
>>> "smb://nonexistant.url.com/whatever.ods" it will be opened without
>>> warnings.
>>>
>>> The link you are discussing points to "smb://nonexistant.url.com/".
>>> The target ends with a backslash, therefore it is considered a
>>> directory, and thus safe.
>> Thanks for pointing this out. I intended it to end without the /.
>> For some reason AOO adds the trailing / for the smb link no matter
>> what I try.
>> But not for the other types. Even in the automated test since it
>> just robots the UI.
>>
>> I've removed the smb link in the test document and uploaded a new copy.
>>
>> I'll also disable that specific test in the test suite as well due to
>> this behavior.
>>
>>>
>>> This is the current logic. It may be worth discussing whether we want
>>> to consider links to directories safe or not.
>>>
>>> The warning messages you reported about gio are worth another
>>> discussion: we may need to update the way we "talk to" the OS under
>>> GNOME. But as long as it works on current distributions, I would
>>> refrain from changing it.
>>>
>>> I hope that the above makes sense.
>>>
>>> Best regards,
>> So now I'll say everything works as expected.
>>
>> Thanks again for your work on this!
>
> Yes, thanks a lot for your efforts. :-)
>
> Marcus
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
> For additional commands, e-mail: dev-help@openoffice.apache.org
>
Re: Hyperlink Warning Message
Posted by Marcus <ma...@wtnet.de>.
Am 07.06.21 um 02:12 schrieb Carl Marcum:
> Hi Arrigo,
>
> On 6/6/21 3:56 PM, Arrigo Marchiori wrote:
>> Hello Carl, All,
>>
>> On Sun, Jun 06, 2021 at 11:50:12AM -0400, Carl Marcum wrote:
>>
>>> Hi Arrigo and All,
>>>
>>> On 6/5/21 5:53 PM, Arrigo Marchiori wrote:
>>>> Hello Carl, All,
>>>>
>>>> On Sat, Jun 05, 2021 at 03:47:12PM -0400, Carl Marcum wrote:
>>>>
>>>>> Hi Arrigo,
>>>>>
>>>>> On 6/5/21 9:50 AM, Arrigo Marchiori wrote:
>>>>>> Dear Matthias, Czesław, All,
>>>>>>
>>>>>> On Sat, Jun 05, 2021 at 12:39:16PM +0200, Matthias Seidel wrote:
>>>>>>
>>>>>>> Hi Czesław,
>>>>>>>
>>>>>>> Am 05.06.21 um 12:35 schrieb Czesław Wolański:
>>>>>>>> Hi Matthias, all
>>>>>>>>
>>>>>>>> A preliminary check in Calc (Windows 7, 64-bit)
>>>>>>>>
>>>>>>>> (1) in-document links beginning with #
>>>>>>>> test: button with link to other sheet
>>>>>>>> result: OK (no security warning)
>>>>>>>>
>>>>>>>> (2) .uno:XXX links
>>>>>>>> result: security warning
>>>>>>>>
>>>>>>>> (3) Links to local files
>>>>>>>> test: the "Hyperlink" dialog, button "WWW Browser"
>>>>>>>> result: OK (no security warning)
>>>>>>> That's what I expected, since the patches are for file://
>>>>>>>
>>>>>>> .uno: hasn't been addressed yet
>>>>>>>
>>>>>>> @Arrigo: correct me if I am wrong ;-)
>>>>>> You should have just become wrong ;-)
>>>>>>
>>>>>> I found out that there are many checks on the URL protocol. I suggest
>>>>>> that the warning was not checked at the right moment, but too soon.
>>>>>>
>>>>>> Because we had a report of unexpected _execution_ of malicious links,
>>>>>> I suggest we leave the safety check on hyperlinks _just before
>>>>>> calling
>>>>>> the OS to execute them_.
>>>>>>
>>>>>> The result is that HTTP, HTTPS, but also "uno:" and all other
>>>>>> protocols already understood by AOO are not checked, and no warnings
>>>>>> will appear. We could argue that their safety must be assured by the
>>>>>> code handling them, as we accepted to delegate the browser for
>>>>>> Internet links.
>>>>>>
>>>>>> The latest commit, just pushed to branch bug128453, moves the check
>>>>>> for "safe extensions" (or directory) from the beginning of
>>>>>> hyperlinks'
>>>>>> processing, to just before the execution of the link target by the
>>>>>> OS.
>>>>>> The protocol is not checked any more, because supported protocols
>>>>>> are already filtered out and processed at that point.
>>>>>>
>>>>>> This should make all links to non-files work again, and still warn
>>>>>> users when they are going to open JAR's, EXE's and other unknown
>>>>>> types.
>>>>>>
>>>>>> What do you think about this?
>>>>> I like your thinking on this.
>>>>> I'll build this branch on Linux and test using some of the test
>>>>> documents
>>>>> and ones I've made to make sure I understand the different cases.
>>>>> Then I'll report back.
>>>> You can find my 64 bit Linux builds here:
>>>> https://home.apache.org/~ardovm/openoffice/bug128453/
>>>>
>>>> I tried the "beta" option of the build script... I hope it works.
>>>>
>>>> Thank you for your cooperation!
>>>>
>>>> Best regards,
>>> I've built the bug128453 branch [1] on Linux CentOS 7 and ran the
>>> test suite
>>> that included the hyperlink tests for the dialogs [2].
>>>
>>> I put together some test documents here [3].
>> Very nice, thank you!
>>
>> [...]
>>> So far everything looks good and I get the warning everywhere I
>>> expect to
>>> with one exception.
>>> The smb://nonexistant.url.com link does not display the warning and I
>>> get
>>> this output:
>>> ---
>>> This tool has been deprecated, use 'gio open' instead.
>>> See 'gio help open' for more info.
>>>
>>> gio: smb://nonexistant.url.com/: The specified location is not mounted
>>> ---
>>> Note that I build on CentOS 7 and use --enable-gio and
>>> --disable-gnome-vfs
>>> in configure.
>>>
>>> Maybe there is a reason the SMB protocol is treated differently than the
>>> others when there is only the host section of the url?
>>>
>>> I'm not saying this is bad but just different. We can discuss...
>> Sure.
>>
>> The smb:// protocol is treated like file://. A proof of this is that
>> the link to "smb://nonexistant.url.com/evil.jar" shows a warning dialog
>> because the ".jar" extension is not considered safe.
>>
>> For the same reason, f you create a link to
>> "smb://nonexistant.url.com/whatever.ods" it will be opened without
>> warnings.
>>
>> The link you are discussing points to "smb://nonexistant.url.com/".
>> The target ends with a backslash, therefore it is considered a
>> directory, and thus safe.
> Thanks for pointing this out. I intended it to end without the /.
> For some reason AOO adds the trailing / for the smb link no matter what
> I try.
> But not for the other types. Even in the automated test since it just
> robots the UI.
>
> I've removed the smb link in the test document and uploaded a new copy.
>
> I'll also disable that specific test in the test suite as well due to
> this behavior.
>
>>
>> This is the current logic. It may be worth discussing whether we want
>> to consider links to directories safe or not.
>>
>> The warning messages you reported about gio are worth another
>> discussion: we may need to update the way we "talk to" the OS under
>> GNOME. But as long as it works on current distributions, I would
>> refrain from changing it.
>>
>> I hope that the above makes sense.
>>
>> Best regards,
> So now I'll say everything works as expected.
>
> Thanks again for your work on this!
Yes, thanks a lot for your efforts. :-)
Marcus
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Hyperlink Warning Message
Posted by Carl Marcum <cm...@apache.org>.
Hi Arrigo,
On 6/6/21 3:56 PM, Arrigo Marchiori wrote:
> Hello Carl, All,
>
> On Sun, Jun 06, 2021 at 11:50:12AM -0400, Carl Marcum wrote:
>
>> Hi Arrigo and All,
>>
>> On 6/5/21 5:53 PM, Arrigo Marchiori wrote:
>>> Hello Carl, All,
>>>
>>> On Sat, Jun 05, 2021 at 03:47:12PM -0400, Carl Marcum wrote:
>>>
>>>> Hi Arrigo,
>>>>
>>>> On 6/5/21 9:50 AM, Arrigo Marchiori wrote:
>>>>> Dear Matthias, Czesław, All,
>>>>>
>>>>> On Sat, Jun 05, 2021 at 12:39:16PM +0200, Matthias Seidel wrote:
>>>>>
>>>>>> Hi Czesław,
>>>>>>
>>>>>> Am 05.06.21 um 12:35 schrieb Czesław Wolański:
>>>>>>> Hi Matthias, all
>>>>>>>
>>>>>>> A preliminary check in Calc (Windows 7, 64-bit)
>>>>>>>
>>>>>>> (1) in-document links beginning with #
>>>>>>> test: button with link to other sheet
>>>>>>> result: OK (no security warning)
>>>>>>>
>>>>>>> (2) .uno:XXX links
>>>>>>> result: security warning
>>>>>>>
>>>>>>> (3) Links to local files
>>>>>>> test: the "Hyperlink" dialog, button "WWW Browser"
>>>>>>> result: OK (no security warning)
>>>>>> That's what I expected, since the patches are for file://
>>>>>>
>>>>>> .uno: hasn't been addressed yet
>>>>>>
>>>>>> @Arrigo: correct me if I am wrong ;-)
>>>>> You should have just become wrong ;-)
>>>>>
>>>>> I found out that there are many checks on the URL protocol. I suggest
>>>>> that the warning was not checked at the right moment, but too soon.
>>>>>
>>>>> Because we had a report of unexpected _execution_ of malicious links,
>>>>> I suggest we leave the safety check on hyperlinks _just before calling
>>>>> the OS to execute them_.
>>>>>
>>>>> The result is that HTTP, HTTPS, but also "uno:" and all other
>>>>> protocols already understood by AOO are not checked, and no warnings
>>>>> will appear. We could argue that their safety must be assured by the
>>>>> code handling them, as we accepted to delegate the browser for
>>>>> Internet links.
>>>>>
>>>>> The latest commit, just pushed to branch bug128453, moves the check
>>>>> for "safe extensions" (or directory) from the beginning of hyperlinks'
>>>>> processing, to just before the execution of the link target by the OS.
>>>>> The protocol is not checked any more, because supported protocols
>>>>> are already filtered out and processed at that point.
>>>>>
>>>>> This should make all links to non-files work again, and still warn
>>>>> users when they are going to open JAR's, EXE's and other unknown
>>>>> types.
>>>>>
>>>>> What do you think about this?
>>>> I like your thinking on this.
>>>> I'll build this branch on Linux and test using some of the test documents
>>>> and ones I've made to make sure I understand the different cases.
>>>> Then I'll report back.
>>> You can find my 64 bit Linux builds here:
>>> https://home.apache.org/~ardovm/openoffice/bug128453/
>>>
>>> I tried the "beta" option of the build script... I hope it works.
>>>
>>> Thank you for your cooperation!
>>>
>>> Best regards,
>> I've built the bug128453 branch [1] on Linux CentOS 7 and ran the test suite
>> that included the hyperlink tests for the dialogs [2].
>>
>> I put together some test documents here [3].
> Very nice, thank you!
>
> [...]
>> So far everything looks good and I get the warning everywhere I expect to
>> with one exception.
>> The smb://nonexistant.url.com link does not display the warning and I get
>> this output:
>> ---
>> This tool has been deprecated, use 'gio open' instead.
>> See 'gio help open' for more info.
>>
>> gio: smb://nonexistant.url.com/: The specified location is not mounted
>> ---
>> Note that I build on CentOS 7 and use --enable-gio and --disable-gnome-vfs
>> in configure.
>>
>> Maybe there is a reason the SMB protocol is treated differently than the
>> others when there is only the host section of the url?
>>
>> I'm not saying this is bad but just different. We can discuss...
> Sure.
>
> The smb:// protocol is treated like file://. A proof of this is that
> the link to "smb://nonexistant.url.com/evil.jar" shows a warning dialog
> because the ".jar" extension is not considered safe.
>
> For the same reason, f you create a link to
> "smb://nonexistant.url.com/whatever.ods" it will be opened without
> warnings.
>
> The link you are discussing points to "smb://nonexistant.url.com/".
> The target ends with a backslash, therefore it is considered a
> directory, and thus safe.
Thanks for pointing this out. I intended it to end without the /.
For some reason AOO adds the trailing / for the smb link no matter what
I try.
But not for the other types. Even in the automated test since it just
robots the UI.
I've removed the smb link in the test document and uploaded a new copy.
I'll also disable that specific test in the test suite as well due to
this behavior.
>
> This is the current logic. It may be worth discussing whether we want
> to consider links to directories safe or not.
>
> The warning messages you reported about gio are worth another
> discussion: we may need to update the way we "talk to" the OS under
> GNOME. But as long as it works on current distributions, I would
> refrain from changing it.
>
> I hope that the above makes sense.
>
> Best regards,
So now I'll say everything works as expected.
Thanks again for your work on this!
Best regards,
Carl
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Hyperlink Warning Message
Posted by Arrigo Marchiori <ar...@yahoo.it.INVALID>.
Hello Carl, All,
On Sun, Jun 06, 2021 at 11:50:12AM -0400, Carl Marcum wrote:
> Hi Arrigo and All,
>
> On 6/5/21 5:53 PM, Arrigo Marchiori wrote:
> > Hello Carl, All,
> >
> > On Sat, Jun 05, 2021 at 03:47:12PM -0400, Carl Marcum wrote:
> >
> > > Hi Arrigo,
> > >
> > > On 6/5/21 9:50 AM, Arrigo Marchiori wrote:
> > > > Dear Matthias, Czesław, All,
> > > >
> > > > On Sat, Jun 05, 2021 at 12:39:16PM +0200, Matthias Seidel wrote:
> > > >
> > > > > Hi Czesław,
> > > > >
> > > > > Am 05.06.21 um 12:35 schrieb Czesław Wolański:
> > > > > > Hi Matthias, all
> > > > > >
> > > > > > A preliminary check in Calc (Windows 7, 64-bit)
> > > > > >
> > > > > > (1) in-document links beginning with #
> > > > > > test: button with link to other sheet
> > > > > > result: OK (no security warning)
> > > > > >
> > > > > > (2) .uno:XXX links
> > > > > > result: security warning
> > > > > >
> > > > > > (3) Links to local files
> > > > > > test: the "Hyperlink" dialog, button "WWW Browser"
> > > > > > result: OK (no security warning)
> > > > > That's what I expected, since the patches are for file://
> > > > >
> > > > > .uno: hasn't been addressed yet
> > > > >
> > > > > @Arrigo: correct me if I am wrong ;-)
> > > > You should have just become wrong ;-)
> > > >
> > > > I found out that there are many checks on the URL protocol. I suggest
> > > > that the warning was not checked at the right moment, but too soon.
> > > >
> > > > Because we had a report of unexpected _execution_ of malicious links,
> > > > I suggest we leave the safety check on hyperlinks _just before calling
> > > > the OS to execute them_.
> > > >
> > > > The result is that HTTP, HTTPS, but also "uno:" and all other
> > > > protocols already understood by AOO are not checked, and no warnings
> > > > will appear. We could argue that their safety must be assured by the
> > > > code handling them, as we accepted to delegate the browser for
> > > > Internet links.
> > > >
> > > > The latest commit, just pushed to branch bug128453, moves the check
> > > > for "safe extensions" (or directory) from the beginning of hyperlinks'
> > > > processing, to just before the execution of the link target by the OS.
> > > > The protocol is not checked any more, because supported protocols
> > > > are already filtered out and processed at that point.
> > > >
> > > > This should make all links to non-files work again, and still warn
> > > > users when they are going to open JAR's, EXE's and other unknown
> > > > types.
> > > >
> > > > What do you think about this?
> > > I like your thinking on this.
> > > I'll build this branch on Linux and test using some of the test documents
> > > and ones I've made to make sure I understand the different cases.
> > > Then I'll report back.
> > You can find my 64 bit Linux builds here:
> > https://home.apache.org/~ardovm/openoffice/bug128453/
> >
> > I tried the "beta" option of the build script... I hope it works.
> >
> > Thank you for your cooperation!
> >
> > Best regards,
>
> I've built the bug128453 branch [1] on Linux CentOS 7 and ran the test suite
> that included the hyperlink tests for the dialogs [2].
>
> I put together some test documents here [3].
Very nice, thank you!
[...]
> So far everything looks good and I get the warning everywhere I expect to
> with one exception.
> The smb://nonexistant.url.com link does not display the warning and I get
> this output:
> ---
> This tool has been deprecated, use 'gio open' instead.
> See 'gio help open' for more info.
>
> gio: smb://nonexistant.url.com/: The specified location is not mounted
> ---
> Note that I build on CentOS 7 and use --enable-gio and --disable-gnome-vfs
> in configure.
>
> Maybe there is a reason the SMB protocol is treated differently than the
> others when there is only the host section of the url?
>
> I'm not saying this is bad but just different. We can discuss...
Sure.
The smb:// protocol is treated like file://. A proof of this is that
the link to "smb://nonexistant.url.com/evil.jar" shows a warning dialog
because the ".jar" extension is not considered safe.
For the same reason, f you create a link to
"smb://nonexistant.url.com/whatever.ods" it will be opened without
warnings.
The link you are discussing points to "smb://nonexistant.url.com/".
The target ends with a backslash, therefore it is considered a
directory, and thus safe.
This is the current logic. It may be worth discussing whether we want
to consider links to directories safe or not.
The warning messages you reported about gio are worth another
discussion: we may need to update the way we "talk to" the OS under
GNOME. But as long as it works on current distributions, I would
refrain from changing it.
I hope that the above makes sense.
Best regards,
--
Arrigo
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Hyperlink Warning Message
Posted by Carl Marcum <cm...@apache.org>.
Hi Arrigo and All,
On 6/5/21 5:53 PM, Arrigo Marchiori wrote:
> Hello Carl, All,
>
> On Sat, Jun 05, 2021 at 03:47:12PM -0400, Carl Marcum wrote:
>
>> Hi Arrigo,
>>
>> On 6/5/21 9:50 AM, Arrigo Marchiori wrote:
>>> Dear Matthias, Czesław, All,
>>>
>>> On Sat, Jun 05, 2021 at 12:39:16PM +0200, Matthias Seidel wrote:
>>>
>>>> Hi Czesław,
>>>>
>>>> Am 05.06.21 um 12:35 schrieb Czesław Wolański:
>>>>> Hi Matthias, all
>>>>>
>>>>> A preliminary check in Calc (Windows 7, 64-bit)
>>>>>
>>>>> (1) in-document links beginning with #
>>>>> test: button with link to other sheet
>>>>> result: OK (no security warning)
>>>>>
>>>>> (2) .uno:XXX links
>>>>> result: security warning
>>>>>
>>>>> (3) Links to local files
>>>>> test: the "Hyperlink" dialog, button "WWW Browser"
>>>>> result: OK (no security warning)
>>>> That's what I expected, since the patches are for file://
>>>>
>>>> .uno: hasn't been addressed yet
>>>>
>>>> @Arrigo: correct me if I am wrong ;-)
>>> You should have just become wrong ;-)
>>>
>>> I found out that there are many checks on the URL protocol. I suggest
>>> that the warning was not checked at the right moment, but too soon.
>>>
>>> Because we had a report of unexpected _execution_ of malicious links,
>>> I suggest we leave the safety check on hyperlinks _just before calling
>>> the OS to execute them_.
>>>
>>> The result is that HTTP, HTTPS, but also "uno:" and all other
>>> protocols already understood by AOO are not checked, and no warnings
>>> will appear. We could argue that their safety must be assured by the
>>> code handling them, as we accepted to delegate the browser for
>>> Internet links.
>>>
>>> The latest commit, just pushed to branch bug128453, moves the check
>>> for "safe extensions" (or directory) from the beginning of hyperlinks'
>>> processing, to just before the execution of the link target by the OS.
>>> The protocol is not checked any more, because supported protocols
>>> are already filtered out and processed at that point.
>>>
>>> This should make all links to non-files work again, and still warn
>>> users when they are going to open JAR's, EXE's and other unknown
>>> types.
>>>
>>> What do you think about this?
>> I like your thinking on this.
>> I'll build this branch on Linux and test using some of the test documents
>> and ones I've made to make sure I understand the different cases.
>> Then I'll report back.
> You can find my 64 bit Linux builds here:
> https://home.apache.org/~ardovm/openoffice/bug128453/
>
> I tried the "beta" option of the build script... I hope it works.
>
> Thank you for your cooperation!
>
> Best regards,
I've built the bug128453 branch [1] on Linux CentOS 7 and ran the test
suite that included the hyperlink tests for the dialogs [2].
I put together some test documents here [3].
hyperlink-test-doc.odt has the same 9 links I have in the test suite
that threw the warning dialog with 4.1.10. plus there is a section of
http(s) links that should not display it.
There is a button that uses the .uno:Reload command that was throwing
the dialog in 4.1.10 that doesn't with this test build.
I've also included a section with file:/// links. 2 for the other file
hyperlink-test-target.odt and one inter-document link to one the
sections in the same test doc.
So far everything looks good and I get the warning everywhere I expect
to with one exception.
The smb://nonexistant.url.com link does not display the warning and I
get this output:
---
This tool has been deprecated, use 'gio open' instead.
See 'gio help open' for more info.
gio: smb://nonexistant.url.com/: The specified location is not mounted
---
Note that I build on CentOS 7 and use --enable-gio and
--disable-gnome-vfs in configure.
Maybe there is a reason the SMB protocol is treated differently than the
others when there is only the host section of the url?
I'm not saying this is bad but just different. We can discuss...
Best regards,
Carl
[1]
https://github.com/apache/openoffice/commit/6652b2eb2edb94addf9b9f84de155dbbbcb89b02
[2]
https://github.com/apache/openoffice/blob/trunk/test/testgui/source/fvt/gui/sw/hyperlink/WarningDialog.java
[3] http://home.apache.org/~cmarcum/hyperlink-tests/
Best regards,
Carl
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Hyperlink Warning Message
Posted by Arrigo Marchiori <ar...@yahoo.it.INVALID>.
Hello Carl, All,
On Sat, Jun 05, 2021 at 03:47:12PM -0400, Carl Marcum wrote:
> Hi Arrigo,
>
> On 6/5/21 9:50 AM, Arrigo Marchiori wrote:
> > Dear Matthias, Czesław, All,
> >
> > On Sat, Jun 05, 2021 at 12:39:16PM +0200, Matthias Seidel wrote:
> >
> > > Hi Czesław,
> > >
> > > Am 05.06.21 um 12:35 schrieb Czesław Wolański:
> > > > Hi Matthias, all
> > > >
> > > > A preliminary check in Calc (Windows 7, 64-bit)
> > > >
> > > > (1) in-document links beginning with #
> > > > test: button with link to other sheet
> > > > result: OK (no security warning)
> > > >
> > > > (2) .uno:XXX links
> > > > result: security warning
> > > >
> > > > (3) Links to local files
> > > > test: the "Hyperlink" dialog, button "WWW Browser"
> > > > result: OK (no security warning)
> > > That's what I expected, since the patches are for file://
> > >
> > > .uno: hasn't been addressed yet
> > >
> > > @Arrigo: correct me if I am wrong ;-)
> > You should have just become wrong ;-)
> >
> > I found out that there are many checks on the URL protocol. I suggest
> > that the warning was not checked at the right moment, but too soon.
> >
> > Because we had a report of unexpected _execution_ of malicious links,
> > I suggest we leave the safety check on hyperlinks _just before calling
> > the OS to execute them_.
> >
> > The result is that HTTP, HTTPS, but also "uno:" and all other
> > protocols already understood by AOO are not checked, and no warnings
> > will appear. We could argue that their safety must be assured by the
> > code handling them, as we accepted to delegate the browser for
> > Internet links.
> >
> > The latest commit, just pushed to branch bug128453, moves the check
> > for "safe extensions" (or directory) from the beginning of hyperlinks'
> > processing, to just before the execution of the link target by the OS.
> > The protocol is not checked any more, because supported protocols
> > are already filtered out and processed at that point.
> >
> > This should make all links to non-files work again, and still warn
> > users when they are going to open JAR's, EXE's and other unknown
> > types.
> >
> > What do you think about this?
> I like your thinking on this.
> I'll build this branch on Linux and test using some of the test documents
> and ones I've made to make sure I understand the different cases.
> Then I'll report back.
You can find my 64 bit Linux builds here:
https://home.apache.org/~ardovm/openoffice/bug128453/
I tried the "beta" option of the build script... I hope it works.
Thank you for your cooperation!
Best regards,
--
Arrigo
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Hyperlink Warning Message
Posted by Peter Kovacs <pe...@apache.org>.
On 05.06.21 15:50, Arrigo Marchiori wrote:
> Dear Matthias, Czesław, All,
>
> On Sat, Jun 05, 2021 at 12:39:16PM +0200, Matthias Seidel wrote:
>
>> Hi Czesław,
>>
>> Am 05.06.21 um 12:35 schrieb Czesław Wolański:
>>> Hi Matthias, all
>>>
>>> A preliminary check in Calc (Windows 7, 64-bit)
>>>
>>> (1) in-document links beginning with #
>>> test: button with link to other sheet
>>> result: OK (no security warning)
>>>
>>> (2) .uno:XXX links
>>> result: security warning
>>>
>>> (3) Links to local files
>>> test: the "Hyperlink" dialog, button "WWW Browser"
>>> result: OK (no security warning)
>> That's what I expected, since the patches are for file://
>>
>> .uno: hasn't been addressed yet
>>
>> @Arrigo: correct me if I am wrong ;-)
> You should have just become wrong ;-)
>
> I found out that there are many checks on the URL protocol. I suggest
> that the warning was not checked at the right moment, but too soon.
>
> Because we had a report of unexpected _execution_ of malicious links,
> I suggest we leave the safety check on hyperlinks _just before calling
> the OS to execute them_.
>
> The result is that HTTP, HTTPS, but also "uno:" and all other
> protocols already understood by AOO are not checked, and no warnings
> will appear. We could argue that their safety must be assured by the
> code handling them, as we accepted to delegate the browser for
> Internet links.
>
> The latest commit, just pushed to branch bug128453, moves the check
> for "safe extensions" (or directory) from the beginning of hyperlinks'
> processing, to just before the execution of the link target by the OS.
> The protocol is not checked any more, because supported protocols
> are already filtered out and processed at that point.
>
> This should make all links to non-files work again, and still warn
> users when they are going to open JAR's, EXE's and other unknown
> types.
>
> What do you think about this?
I like this a lot. It seems that you have found the solution. The main
pain point is that the user is warned on possible code execution.
Thank you for your relentless time to look into this issue.
All the best
Peter
--
This is the Way! http://www.apache.org/theapacheway/index.html
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Hyperlink Warning Message
Posted by Carl Marcum <cm...@apache.org>.
Hi Arrigo,
On 6/5/21 9:50 AM, Arrigo Marchiori wrote:
> Dear Matthias, Czesław, All,
>
> On Sat, Jun 05, 2021 at 12:39:16PM +0200, Matthias Seidel wrote:
>
>> Hi Czesław,
>>
>> Am 05.06.21 um 12:35 schrieb Czesław Wolański:
>>> Hi Matthias, all
>>>
>>> A preliminary check in Calc (Windows 7, 64-bit)
>>>
>>> (1) in-document links beginning with #
>>> test: button with link to other sheet
>>> result: OK (no security warning)
>>>
>>> (2) .uno:XXX links
>>> result: security warning
>>>
>>> (3) Links to local files
>>> test: the "Hyperlink" dialog, button "WWW Browser"
>>> result: OK (no security warning)
>> That's what I expected, since the patches are for file://
>>
>> .uno: hasn't been addressed yet
>>
>> @Arrigo: correct me if I am wrong ;-)
> You should have just become wrong ;-)
>
> I found out that there are many checks on the URL protocol. I suggest
> that the warning was not checked at the right moment, but too soon.
>
> Because we had a report of unexpected _execution_ of malicious links,
> I suggest we leave the safety check on hyperlinks _just before calling
> the OS to execute them_.
>
> The result is that HTTP, HTTPS, but also "uno:" and all other
> protocols already understood by AOO are not checked, and no warnings
> will appear. We could argue that their safety must be assured by the
> code handling them, as we accepted to delegate the browser for
> Internet links.
>
> The latest commit, just pushed to branch bug128453, moves the check
> for "safe extensions" (or directory) from the beginning of hyperlinks'
> processing, to just before the execution of the link target by the OS.
> The protocol is not checked any more, because supported protocols
> are already filtered out and processed at that point.
>
> This should make all links to non-files work again, and still warn
> users when they are going to open JAR's, EXE's and other unknown
> types.
>
> What do you think about this?
I like your thinking on this.
I'll build this branch on Linux and test using some of the test
documents and ones I've made to make sure I understand the different cases.
Then I'll report back.
Thanks again for your work on this!
Best regards,
Carl
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Hyperlink Warning Message
Posted by Arrigo Marchiori <ar...@yahoo.it.INVALID>.
Dear Matthias, Czesław, All,
On Sat, Jun 05, 2021 at 12:39:16PM +0200, Matthias Seidel wrote:
> Hi Czesław,
>
> Am 05.06.21 um 12:35 schrieb Czesław Wolański:
> > Hi Matthias, all
> >
> > A preliminary check in Calc (Windows 7, 64-bit)
> >
> > (1) in-document links beginning with #
> > test: button with link to other sheet
> > result: OK (no security warning)
> >
> > (2) .uno:XXX links
> > result: security warning
> >
> > (3) Links to local files
> > test: the "Hyperlink" dialog, button "WWW Browser"
> > result: OK (no security warning)
>
> That's what I expected, since the patches are for file://
>
> .uno: hasn't been addressed yet
>
> @Arrigo: correct me if I am wrong ;-)
You should have just become wrong ;-)
I found out that there are many checks on the URL protocol. I suggest
that the warning was not checked at the right moment, but too soon.
Because we had a report of unexpected _execution_ of malicious links,
I suggest we leave the safety check on hyperlinks _just before calling
the OS to execute them_.
The result is that HTTP, HTTPS, but also "uno:" and all other
protocols already understood by AOO are not checked, and no warnings
will appear. We could argue that their safety must be assured by the
code handling them, as we accepted to delegate the browser for
Internet links.
The latest commit, just pushed to branch bug128453, moves the check
for "safe extensions" (or directory) from the beginning of hyperlinks'
processing, to just before the execution of the link target by the OS.
The protocol is not checked any more, because supported protocols
are already filtered out and processed at that point.
This should make all links to non-files work again, and still warn
users when they are going to open JAR's, EXE's and other unknown
types.
What do you think about this?
--
Arrigo
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Hyperlink Warning Message
Posted by Czesław Wolański <cz...@gmail.com>.
Hi Matthias,
> That's what I expected, since the patches are for file://
>
> .uno: hasn't been addressed yet
Yes I know.
"The impossible we can do right now. Miracles take a little longer." ;‑)
Regards,
Czesław
сб, 5 июн. 2021 г. в 12:39, Matthias Seidel <ma...@hamburg.de>:
> Hi Czesław,
>
> Am 05.06.21 um 12:35 schrieb Czesław Wolański:
> > Hi Matthias, all
> >
> > A preliminary check in Calc (Windows 7, 64-bit)
> >
> > (1) in-document links beginning with #
> > test: button with link to other sheet
> > result: OK (no security warning)
> >
> > (2) .uno:XXX links
> > result: security warning
> >
> > (3) Links to local files
> > test: the "Hyperlink" dialog, button "WWW Browser"
> > result: OK (no security warning)
>
> That's what I expected, since the patches are for file://
>
> .uno: hasn't been addressed yet
>
> @Arrigo: correct me if I am wrong ;-)
>
> Regards,
>
> Matthias
>
> >
> >
> > Regards,
> > Czesław
> >
> > сб, 5 июн. 2021 г. в 11:20, Matthias Seidel <matthias.seidel@hamburg.de
> >:
> >
> >> Hi all,
> >>
> >> Am 04.06.21 um 19:20 schrieb Matthias Seidel:
> >>> Hi Arrigo,
> >>>
> >>> Am 01.06.21 um 21:57 schrieb Arrigo Marchiori:
> >>>>> We are grabbing an INetURLObject here:
> >>>>>
> >>
> http://opengrok.openoffice.org/xref/aoo4110/main/sfx2/source/appl/appopen.cxx?r=b1cdbd2c#929
> >>>>> The code after here
> >>
> http://opengrok.openoffice.org/xref/aoo4110/main/sfx2/source/appl/appopen.cxx?r=b1cdbd2c#1040
> >> may be helpful.
> >>>> I do not seem to be able to open your links, sorry...
> >>> I have no problem opening these links...
> >>>> Please see branch bug128453, just pushed.
> >>> I just started a Windows Test Build on that branch.
> >> Here it is:
> >>
> >>
> >>
> https://home.apache.org/~mseidel/AOO-builds/AOO-4111-Test/Full%20Installation/Apache_OpenOffice_4.1.11_Win_x86_install_en-US_af31ee45ce.exe
> >>
> >> Regards,
> >>
> >> Matthias
> >>
> >>> Regards,
> >>>
> >>> Matthias
> >>>
> >>>> I will look for older CVE's in the next days.
> >>>>
> >>>> I hope this helps.
> >>>>
> >>>> Best regards,
> >>
>
>
Re: Hyperlink Warning Message
Posted by Matthias Seidel <ma...@hamburg.de>.
Hi Czesław,
Am 05.06.21 um 12:35 schrieb Czesław Wolański:
> Hi Matthias, all
>
> A preliminary check in Calc (Windows 7, 64-bit)
>
> (1) in-document links beginning with #
> test: button with link to other sheet
> result: OK (no security warning)
>
> (2) .uno:XXX links
> result: security warning
>
> (3) Links to local files
> test: the "Hyperlink" dialog, button "WWW Browser"
> result: OK (no security warning)
That's what I expected, since the patches are for file://
.uno: hasn't been addressed yet
@Arrigo: correct me if I am wrong ;-)
Regards,
Matthias
>
>
> Regards,
> Czesław
>
> сб, 5 июн. 2021 г. в 11:20, Matthias Seidel <ma...@hamburg.de>:
>
>> Hi all,
>>
>> Am 04.06.21 um 19:20 schrieb Matthias Seidel:
>>> Hi Arrigo,
>>>
>>> Am 01.06.21 um 21:57 schrieb Arrigo Marchiori:
>>>>> We are grabbing an INetURLObject here:
>>>>>
>> http://opengrok.openoffice.org/xref/aoo4110/main/sfx2/source/appl/appopen.cxx?r=b1cdbd2c#929
>>>>> The code after here
>> http://opengrok.openoffice.org/xref/aoo4110/main/sfx2/source/appl/appopen.cxx?r=b1cdbd2c#1040
>> may be helpful.
>>>> I do not seem to be able to open your links, sorry...
>>> I have no problem opening these links...
>>>> Please see branch bug128453, just pushed.
>>> I just started a Windows Test Build on that branch.
>> Here it is:
>>
>>
>> https://home.apache.org/~mseidel/AOO-builds/AOO-4111-Test/Full%20Installation/Apache_OpenOffice_4.1.11_Win_x86_install_en-US_af31ee45ce.exe
>>
>> Regards,
>>
>> Matthias
>>
>>> Regards,
>>>
>>> Matthias
>>>
>>>> I will look for older CVE's in the next days.
>>>>
>>>> I hope this helps.
>>>>
>>>> Best regards,
>>
Re: Hyperlink Warning Message
Posted by Czesław Wolański <cz...@gmail.com>.
Hi Matthias, all
A preliminary check in Calc (Windows 7, 64-bit)
(1) in-document links beginning with #
test: button with link to other sheet
result: OK (no security warning)
(2) .uno:XXX links
result: security warning
(3) Links to local files
test: the "Hyperlink" dialog, button "WWW Browser"
result: OK (no security warning)
Regards,
Czesław
сб, 5 июн. 2021 г. в 11:20, Matthias Seidel <ma...@hamburg.de>:
> Hi all,
>
> Am 04.06.21 um 19:20 schrieb Matthias Seidel:
> > Hi Arrigo,
> >
> > Am 01.06.21 um 21:57 schrieb Arrigo Marchiori:
> >>> We are grabbing an INetURLObject here:
> >>>
> http://opengrok.openoffice.org/xref/aoo4110/main/sfx2/source/appl/appopen.cxx?r=b1cdbd2c#929
> >>>
> >>> The code after here
> http://opengrok.openoffice.org/xref/aoo4110/main/sfx2/source/appl/appopen.cxx?r=b1cdbd2c#1040
> may be helpful.
> >> I do not seem to be able to open your links, sorry...
> > I have no problem opening these links...
> >> Please see branch bug128453, just pushed.
> > I just started a Windows Test Build on that branch.
>
> Here it is:
>
>
> https://home.apache.org/~mseidel/AOO-builds/AOO-4111-Test/Full%20Installation/Apache_OpenOffice_4.1.11_Win_x86_install_en-US_af31ee45ce.exe
>
> Regards,
>
> Matthias
>
> >
> > Regards,
> >
> > Matthias
> >
> >> I will look for older CVE's in the next days.
> >>
> >> I hope this helps.
> >>
> >> Best regards,
>
>
Re: Hyperlink Warning Message
Posted by Matthias Seidel <ma...@hamburg.de>.
Hi all,
Am 04.06.21 um 19:20 schrieb Matthias Seidel:
> Hi Arrigo,
>
> Am 01.06.21 um 21:57 schrieb Arrigo Marchiori:
>>> We are grabbing an INetURLObject here:
>>> http://opengrok.openoffice.org/xref/aoo4110/main/sfx2/source/appl/appopen.cxx?r=b1cdbd2c#929
>>>
>>> The code after here http://opengrok.openoffice.org/xref/aoo4110/main/sfx2/source/appl/appopen.cxx?r=b1cdbd2c#1040 may be helpful.
>> I do not seem to be able to open your links, sorry...
> I have no problem opening these links...
>> Please see branch bug128453, just pushed.
> I just started a Windows Test Build on that branch.
Here it is:
https://home.apache.org/~mseidel/AOO-builds/AOO-4111-Test/Full%20Installation/Apache_OpenOffice_4.1.11_Win_x86_install_en-US_af31ee45ce.exe
Regards,
Matthias
>
> Regards,
>
> Matthias
>
>> I will look for older CVE's in the next days.
>>
>> I hope this helps.
>>
>> Best regards,
Re: Hyperlink Warning Message
Posted by Matthias Seidel <ma...@hamburg.de>.
Hi Arrigo,
Am 01.06.21 um 21:57 schrieb Arrigo Marchiori:
>> We are grabbing an INetURLObject here:
>> http://opengrok.openoffice.org/xref/aoo4110/main/sfx2/source/appl/appopen.cxx?r=b1cdbd2c#929
>>
>> The code after here http://opengrok.openoffice.org/xref/aoo4110/main/sfx2/source/appl/appopen.cxx?r=b1cdbd2c#1040 may be helpful.
> I do not seem to be able to open your links, sorry...
I have no problem opening these links...
> Please see branch bug128453, just pushed.
I just started a Windows Test Build on that branch.
Regards,
Matthias
>
> I will look for older CVE's in the next days.
>
> I hope this helps.
>
> Best regards,