office-gobmx

History

Stephan Bergmann f0a9ca24fd rhbz#887420 Implement "block untrusted referer links" feature For now, this checks for a trusted referer (if the BlockUntrustedRefererLinks configuration prop is set) in utl::MediaDescriptor::impl_openStreamWithURL and SvxBrushItem::GetGraphicObject. Checking in additional places will probably be necessary to block /all/ unwanted communication. Also, some places marked /TODO?/ currently pass in an empty referer (which is always considered trusted) and will probably need to be adapted. Ideally, Referer URIs would never be empty (and consistently use something like <private:user> for cases where access is explicitly initiated by the user and should never be blocked), but that's a very daunting task, so start small by identifying the places that potentially need blocking and adding appropriate Referer URIs there. Also, Referer information should always be computed as freshly as possible from the context in which an access attempt is made, but, again, always carrying the information from the context all the way to the relevant functions is a very daunting task, so for now store the information upon object instantiation in some cases (SvxBrushItem, SdrGrafObj, ...). The Referer URI (css.document.MediaDescriptor property; SID_REFERER) was already used to track macro execution, and there is one place in SfxApplication::OpenDocExec_Impl where opening of hyperlinks (explicitly clicked by the user) is done that needs the current document's URI as Referer to check execution of macro URIs but needs an empty (or <private:user>, see above) Referer to not block non-macro URIs. Special code has been added there to handle that. Change-Id: Iafbdc07a9fe925d9ee580d4f5778448f18f2ebd9		2013-11-14 11:13:25 +01:00
..
dtd
inc	Move MediaDescriptor from comphelper to unotools	2013-11-14 11:13:24 +01:00
qa
source	rhbz#887420 Implement "block untrusted referer links" feature	2013-11-14 11:13:25 +01:00
util
CppunitTest_xmloff_uxmloff.mk
JunitTest_xmloff_unoapi.mk
Library_xo.mk
Library_xof.mk
Makefile
Module_xmloff.mk
Package_dtd.mk
README

README

Contains ODF import and export filter logic.

The main library "xo" contains the basic ODF import/export filter
implementation for most applications.  The document is accessed
via its UNO API, which has the advantage that the same import/export
code can be used for text in all applications (from/to Writer/EditEngine).
The filter consumes/produces via SAX UNO API interface (implemented in
"sax").  Various bits of the ODF filters are also implemented in
applications, for example sw/source/filter/xml.

There is a central list of all element or attribute names in
xmloff/inc/xmloff/token.hxx.  The main class of the import filter
is SvXMLImport, and of the export filter SvXMLExport.

The Import filter maintains a stack of contexts for each element being
read.  There are many classes specific to particular elements, derived
from SvXMLImportContext.

Note that for export several different versions of ODF are supported,
with the default being the latest ODF version with "extensions", which
means it may contain elements and attributes that are only in drafts of
the specification or are not yet submitted for specification.  Documents
produced in the other (non-extended) ODF modes are supposed to be
strictly conforming to the respecive specification, i.e., only markup
defined by the ODF specification is allowed.

There is another library "xof" built from the source/transform directory,
which is the filter for the OpenOffice.org XML format.  This legacy format
is a predecessor of ODF and was the default in OpenOffice.org 1.x versions,
which did not support ODF.  This filter works as a SAX transformation
from/to ODF, i.e., when importing a document the transform library reads
the SAX events from the file and generates SAX events that are then
consumed by the ODF import filter.

http://www.openoffice.org/xml/general.html
http://www.openoffice.org/xml/xml_specification.pdf

There is some stuff in the "dtd" directory which is most likely related
to the OpenOffice.org XML format but is possibly outdated and obsolete.