Can I get at least a security email address where I can send the malware to? I don't want it to be available in the public bugtracker...

First try to reset your userprofile and test it again

Wish OS

(In reply to Buovjaga from comment #5)
> (In reply to LFlo from comment #2)
> > Can I get at least a security email address where I can send the malware to?
> > I don't want it to be available in the public bugtracker...
> 
> security@documentfoundation.org

Thanks a lot! I just sent the document.

no macro is executed, the layout of a line of text is looping. so its not a virus or a macro, just a hang. Its looping in laying out a line of text, seemingly unable to find a place to line break it on first glance. We don't treat such denial of service issues, (hangs and such), as high priority security issues requiring special handling, but your reporting of it through this channel is commendable. You can attach your test case to the bug in the clear.

its the spell checking, or the calculation of the area of text that is misspelled, that is hanging. So if you uncheck "automatic spell checking" in the tools menu before attempting to open it, it will then open without a hang.

The area calculation does eventually complete so its not a true hang, just very slow. The good news is that while in 6.1 it takes (for me) about 21 seconds, in 6.2 it now takes about 3. So arguably this might be considered fixed in 6.2 if we consider that an acceptable delay.

caolanm->vmiklos; I imagine that's your sallayout cache in action in the time reduction.

@Caolán, Since this is not a security issue, could it be possible to attach the document ?

LFlo sent the doc in private to the security list so I can't assume permission to attach their document in the clear here although I can confirm its safe for them to do so and hopefully they will

(In reply to Caolán McNamara from comment #11)
> LFlo sent the doc in private to the security list so I can't assume
> permission to attach their document in the clear here although I can confirm
> its safe for them to do so and hopefully they will

Oh, you're right!

@LFlo, Please attach a sample document, as this makes it easier for us to verify the bug. 
(Please note that the attachment will be public, remove any sensitive information before attaching it. 
See https://wiki.documentfoundation.org/QA/FAQ#How_can_I_eliminate_confidential_data_from_a_sample_document.3F for help on how to do so.)

I have set the bug's status to 'NEEDINFO'. Please change it back to 'NEW' once the requested document is provided.

Hey sorry for the late response. Actually this isn't a test case I made up, it was actual malware we got on our E-Mail account. I saved the file in order to test if the malware can also attack libre office. As far as I know the file *does* contain macros which can hurt windows environment, at least libre office warned me of macros before opening the file. Also the anti-virus of the Windows system in our office detected it as malware. That's why I wasn't sure if I can actually upload the file since I don't want to provide a "free" way to hurt any Windows System with MS Office although Libre office + Linux seem to be immune against.
@Caolán McNamara: Can you confirm again that the file does not contain any macros which can be malicious for Libre Office and MS Office? Is there a way to get rid of the macros?

Thanks again for the investigation of the file!

Created attachment 147311 [details]
just the textbox that causes the delay

I'll take that as permission to upload the content, so here's just the bit that matters to us

Dear LFlo,

To make sure we're focusing on the bugs that affect our users today, LibreOffice QA is asking bug reporters and confirmers to retest open, confirmed bugs which have not been touched for over a year.

There have been thousands of bug fixes and commits since anyone checked on this bug report. During that time, it's possible that the bug has been fixed, or the details of the problem have changed. We'd really appreciate your help in getting confirmation that the bug is still present.

If you have time, please do the following:

Test to see if the bug is still present with the latest version of LibreOffice from https://www.libreoffice.org/download/

If the bug is present, please leave a comment that includes the information from Help - About LibreOffice.
 
If the bug is NOT present, please set the bug's Status field to RESOLVED-WORKSFORME and leave a comment that includes the information from Help - About LibreOffice.

Please DO NOT

Update the version field
Reply via email (please reply directly on the bug tracker)
Set the bug's Status field to RESOLVED - FIXED (this status has a particular meaning that is not 
appropriate in this case)


If you want to do more to help you can test to see if your issue is a REGRESSION. To do so:
1. Download and install oldest version of LibreOffice (usually 3.3 unless your bug pertains to a feature added after 3.3) from https://downloadarchive.documentfoundation.org/libreoffice/old/

2. Test your bug
3. Leave a comment with your results.
4a. If the bug was present with 3.3 - set version to 'inherited from OOo';
4b. If the bug was not present in 3.3 - add 'regression' to keyword


Feel free to come ask questions or to say hello in our QA chat: https://web.libera.chat/?settings=#libreoffice-qa

Thank you for helping us make LibreOffice even better for everyone!

Warm Regards,
QA Team

MassPing-UntouchedBug