Check svg URLs before exporting

Reviewed-on: https://gerrit.libreoffice.org/68668
Tested-by: Jenkins
Reviewed-by: Samuel Mehrbrodt <Samuel.Mehrbrodt@cib.de>
(cherry picked from commit 34ec4657)

Change-Id: I3b86b6b82318b0d201c3d7db516664520eb47bed

filter/source/svg/svgexport.cxx

@@ -43,6 +43,7 @@
 #include <comphelper/sequenceashashmap.hxx>
 #include <i18nlangtag/lang.h>
 #include <svl/zforlist.hxx>
+#include <tools/urlobj.hxx>
 #include <xmloff/unointerfacetouniqueidentifiermapper.hxx>
 #include <xmloff/nmspmap.hxx>
 #include <xmloff/xmlnmspe.hxx>
@@ -1810,13 +1811,18 @@ bool SVGFilter::implExportShape( const Reference< XShape >& rxShape, bool bMaste
 
                         if( !aBookmark.isEmpty() )
                         {
-                            mpSVGExport->AddAttribute( XML_NAMESPACE_NONE, "xlink:href", aBookmark);
-                            SvXMLElementExport alinkA( *mpSVGExport, XML_NAMESPACE_NONE, "a", true, true );
-                            mpSVGWriter->WriteMetaFile( aTopLeft, aSize, rMtf,
-                                                        0xffffffff,
-                                                        pElementId,
-                                                        &rxShape,
-                                                        pEmbeddedBitmapsMtf );
+                            INetURLObject aINetURLObject(aBookmark);
+                            if (!aINetURLObject.HasError()
+                                && aINetURLObject.GetProtocol() != INetProtocol::Javascript)
+                            {
+                                mpSVGExport->AddAttribute( XML_NAMESPACE_NONE, "xlink:href", aBookmark);
+                                SvXMLElementExport alinkA( *mpSVGExport, XML_NAMESPACE_NONE, "a", true, true );
+                                mpSVGWriter->WriteMetaFile( aTopLeft, aSize, rMtf,
+                                                            0xffffffff,
+                                                            pElementId,
+                                                            &rxShape,
+                                                            pEmbeddedBitmapsMtf );
+                            }
                         }
                         else
                         {

sd/qa/unit/SVGExportTests.cxx

@@ -111,8 +111,23 @@ public:
         assertXPath(svgDoc, MAKE_PATH_STRING( /SVG_SVG/SVG_G[2]/SVG_G/SVG_G/SVG_G/SVG_G/SVG_G[2]/SVG_G/SVG_TEXT/SVG_TSPAN ), "text-decoration", "line-through");
     }
 
+    void testSVGExportJavascriptURL()
+    {
+        executeExport("textbox-link-javascript.odp");
+
+        xmlDocPtr svgDoc = parseXml(maTempFile);
+        CPPUNIT_ASSERT(svgDoc);
+
+        // There should be only one child (no link to javascript url)
+        assertXPathChildren(svgDoc,
+                            MAKE_PATH_STRING(/ SVG_SVG / SVG_G[2] / SVG_G / SVG_G / SVG_G / SVG_G
+                                             / SVG_G[4] / SVG_G),
+                            1);
+    }
+
     CPPUNIT_TEST_SUITE(SdSVGFilterTest);
     CPPUNIT_TEST(testSVGExportTextDecorations);
+    CPPUNIT_TEST(testSVGExportJavascriptURL);
     CPPUNIT_TEST_SUITE_END();
 };