Star1
2
代码
代码
Issues5
Pull Requests1
项目讨论
Wiki
分析
Star1
2
已开启
fix(cve): 修复 CVE-2026-63270 在 libreoffice 中的漏洞 #22
infra_team创建于 25 天前
fix(cve): 修复 CVE-2026-63270 在 libreoffice 中的漏洞 #22
已开启
infra_team创建于 25 天前
从infra_team/libreofficefix-CVE-2026-63270-master合入到src-openeuler/libreofficemaster
共 2 个文件变更+134-1
Abackport-cve-2026-63270-block-exotic-protocols.patch+123-0
@@ -0,0 +1,123 @@
1+From: infra_team <zhaiwenjie1@huawei.com>
2+Date: Wed Oct 07 2026
3+Subject: [PATCH] fix: CVE-2026-63270 - don't bother loading exotic protocols for document-supplied data
4+ 
5+fix: CVE-2026-63270 - don't bother loading exotic protocols for document-supplied data
6+ 
7+Backport of upstream commit c3355f20dcd5956116819ae4f2f843014407cf4d by
8+Caolan McNamara (don't bother loading exotic protocols for document-supplied
9+data, cherry-picked from main commit 0274803ae273fa6bdbd1124cedf37395ce847148,
10+Gerrit 208193), fixed upstream in LibreOffice 26.2.5 / 26.8.0.
11+ 
12+Refuse document-supplied URLs whose protocol is exotic (e.g. environment
13+variable or INI value expansion) before loading them in the XForms instance
14+data loader, the Calc web service link, and the Calc csv/sql data providers,
15+closing the environment/ini-file disclosure path.
16+ 
17+Upstream-commit: https://github.com/LibreOffice/core/commit/c3355f20dcd5956116819ae4f2f843014407cf4d
18+Signed-off-by: infra_team <zhaiwenjie1@huawei.com>
19+---
20+ forms/source/xforms/model.cxx | 8 ++++++++
21+ sc/source/core/tool/webservicelink.cxx | 7 +++++++
22+ sc/source/ui/dataprovider/dataprovider.cxx | 8 ++++++++
23+ sc/source/ui/dataprovider/sqldataprovider.cxx | 9 +++++++++
24+ 4 files changed, 32 insertions(+)
25+ 
26+diff --git a/forms/source/xforms/model.cxx b/forms/source/xforms/model.cxx
27+index 105f7f449963b..27844c6398d52 100644
28+--- a/forms/source/xforms/model.cxx
29++++ b/forms/source/xforms/model.cxx
30+@@ -32,7 +32,9 @@
31+
32+ #include <rtl/ustring.hxx>
33+ #include <rtl/ustrbuf.hxx>
34++#include <sal/log.hxx>
35+ #include <tools/debug.hxx>
36++#include <tools/urlobj.hxx>
37+
38+ #include <comphelper/processfactory.hxx>
39+ #include <comphelper/servicehelper.hxx>
40+@@ -318,6 +320,12 @@ void Model::loadInstance( sal_Int32 nInstance )
41+ if( sURL.isEmpty() )
42+ return;
43+
44++ if( INetURLObject( sURL ).IsExoticProtocol() )
45++ {
46++ SAL_WARN("forms.xforms", "Model::loadInstance: blocked exotic protocol: \"" << sURL << "\"");
47++ return;
48++ }
49++
50+ try
51+ {
52+ Reference<XInputStream> xInput =
53+diff --git a/sc/source/core/tool/webservicelink.cxx b/sc/source/core/tool/webservicelink.cxx
54+index c30f34300edf1..fb5d81afc87b7 100644
55+--- a/sc/source/core/tool/webservicelink.cxx
56++++ b/sc/source/core/tool/webservicelink.cxx
57+@@ -40,6 +40,13 @@ sfx2::SvBaseLink::UpdateResult ScWebServiceLink::DataChanged(const OUString&, co
58+ bHasResult = false;
59+
60+ INetURLObject aURLObject(aURL);
61++ if (aURLObject.IsExoticProtocol())
62++ {
63++ SAL_WARN("sc.ui",
64++ "ScWebServiceLink::DataChanged: blocked exotic protocol: \"" << aURL << "\"");
65++ return ERROR_GENERAL;
66++ }
67++
68+ const OUString sHost = aURLObject.GetHost();
69+ if (HostFilter::isForbidden(sHost))
70+ {
71+diff --git a/sc/source/ui/dataprovider/dataprovider.cxx b/sc/source/ui/dataprovider/dataprovider.cxx
72+index 1a31a1afddaff..2cde3d3d93d00 100644
73+--- a/sc/source/ui/dataprovider/dataprovider.cxx
74++++ b/sc/source/ui/dataprovider/dataprovider.cxx
75+@@ -17,6 +17,7 @@
76+ #include <unotools/charclass.hxx>
77+ #include <tools/stream.hxx>
78+ #include <comphelper/processfactory.hxx>
79++#include <tools/urlobj.hxx>
80+
81+ #include "htmldataprovider.hxx"
82+ #include "xmldataprovider.hxx"
83+@@ -32,6 +33,13 @@ namespace sc {
84+
85+ std::unique_ptr<SvStream> DataProvider::FetchStreamFromURL(const OUString& rURL, OStringBuffer& rBuffer)
86+ {
87++ INetURLObject aURLObject(rURL);
88++ if (aURLObject.IsExoticProtocol())
89++ {
90++ SAL_WARN("sc.ui", "DataProvider::FetchStreamFromURL: blocked exotic protocol: \"" << rURL << "\"");
91++ return nullptr;
92++ }
93++
94+ try
95+ {
96+ uno::Reference< ucb::XSimpleFileAccess3 > xFileAccess = ucb::SimpleFileAccess::create( comphelper::getProcessComponentContext() );
97+diff --git a/sc/source/ui/dataprovider/sqldataprovider.cxx b/sc/source/ui/dataprovider/sqldataprovider.cxx
98+index 7929754e9b689..ac61a8dc53f03 100644
99+--- a/sc/source/ui/dataprovider/sqldataprovider.cxx
100++++ b/sc/source/ui/dataprovider/sqldataprovider.cxx
101+@@ -9,6 +9,8 @@
102+
103+ #include "sqldataprovider.hxx"
104+ #include <datatransformation.hxx>
105++#include <sal/log.hxx>
106++#include <tools/urlobj.hxx>
107+ #include <salhelper/thread.hxx>
108+ #include <com/sun/star/sdb/DatabaseContext.hpp>
109+ #include <com/sun/star/sdb/XCompletedConnection.hpp>
110+@@ -65,6 +67,13 @@ void SQLFetchThread::execute()
111+ OUString aTable = maID.copy(0, nIndex);
112+ OUString aDatabase = maID.copy(nIndex + 1);
113+
114++ if (INetURLObject(aDatabase).IsExoticProtocol())
115++ {
116++ SAL_WARN("sc.ui",
117++ "SQLFetchThread::execute: blocked exotic protocol: \"" << aDatabase << "\"");
118++ return;
119++ }
120++
121+ try
122+ {
123+ uno::Reference<sdb::XDatabaseContext> xContext
Mlibreoffice.spec+11-1
@@ -48,7 +48,7 @@ Summary: Free Software Productivity Suite
48Name: libreoffice48Name: libreoffice
49Epoch: 149Epoch: 1
50Version: %{libo_version}.250Version: %{libo_version}.2
51-Release: 551+Release: 6
52# default new files are: MPLv252# default new files are: MPLv2
53# older files are typically: MPLv2 incorporating work under ASLv253# older files are typically: MPLv2 incorporating work under ASLv2
54# nlpsolver is: LGPLv354# nlpsolver is: LGPLv3
@@ -277,6 +277,8 @@ Requires: %{name}-emailmerge%{?_isa} = %{epoch}:%{version}-%{release}
277# https://lists.freedesktop.org/archives/libreoffice/2023-September/090948.html277# https://lists.freedesktop.org/archives/libreoffice/2023-September/090948.html
278Patch4: kahansum_test_fix_for_aarch64_s390x.patch278Patch4: kahansum_test_fix_for_aarch64_s390x.patch
279 279 
280+Patch5: backport-cve-2026-63270-block-exotic-protocols.patch
281+ 
280# Patches for riscv64 here282# Patches for riscv64 here
281 283 
282# Fix build with poppler 25.10.0284# Fix build with poppler 25.10.0
@@ -1029,6 +1031,8 @@ rm -rf git-hooks */git-hooks
1029%patch -P 4 -p1 -b .aarch641031%patch -P 4 -p1 -b .aarch64
1030%endif1032%endif
1031 1033 
1034+%patch -P 5 -p1
1035+ 
1032%autopatch -m 6000 -p11036%autopatch -m 6000 -p1
1033 1037 
1034# Temporarily disable failing tests1038# Temporarily disable failing tests
@@ -2177,6 +2181,12 @@ gtk-update-icon-cache -q %{_datadir}/icons/hicolor &>/dev/null || :
2177%{_includedir}/LibreOfficeKit2181%{_includedir}/LibreOfficeKit
2178 2182 
2179%changelog2183%changelog
2184+* Wed Oct 07 2026 infra_team <zhaiwenjie1@huawei.com> - 1:25.8.0.2-6
2185+- fix CVE-2026-63270: don't bother loading exotic protocols for document-supplied
2186+ data, refusing exotic protocols (e.g. environment variable or INI value
2187+ expansion) in the XForms instance data loader, the Calc web service link and
2188+ the Calc csv/sql data providers
2189+ 
2180* Wed Jun 03 2026 Funda Wang <fundawang@yeah.net> - 1:25.8.0.2-52190* Wed Jun 03 2026 Funda Wang <fundawang@yeah.net> - 1:25.8.0.2-5
2181- fix build with recent poppler2191- fix build with recent poppler
2182- filter sdk-doc for dependency scanning (90 min. faster)2192- filter sdk-doc for dependency scanning (90 min. faster)