Created attachment 159070 [details] Template raising the macro warning without having any macros The attached template is my default template for Calc. Since version 6.4.0 I get the macro warning for every new spreadsheet document. The teplate includes some styles and colours but no macro code.
Thank you for reporting the bug. I can confirm that the bug is present in Version: 6.4.1.2 (x64) Windows 10.0 Build 18363 Version: 6.4.2.2 (x64) Windows 10.0 Build 1836 Version: 7.0.0.0.alpha0+ (x64) Windows 10.0 Build 18363 When opening the template in the attached document in Calc, a security warning about macros is displayed. Once the template has been opened and you've closed the Macro warning go into Tools => Macros => edit Macros => expand MyDefault1.ots => Standard. There you can clearly see no Macros are in the template. Changing status to NEW.
i think the root cause is that "content.xml" contains "script:event-listeners": <office:scripts> <office:event-listeners> <script:event-listener script:language="ooo:script" script:event-name="office:start-app"/> [...] IMHO the warning message is therefore correct
Hey Oliver, Hmm, I haven't worked with LO for very long, and I'm not too familiar with XML. I'm struggling to understand why event listeners would be causing this though, any links you could share for more insight? Also you are more seasoned here than I, do you think I should change this back to unconfirmed?
Indeed, the file contains a list of unused event hooks, corresponding to the events in Tools>Customize, tab:Events. But none of the hooks is linked to any macro and the macro does not contain any macro code at all. This is how the office suite behaves since 19 years: A brand new document (not from template) contains this empty tag: <office:scripts/> If I embed any Basic/Python/JavaScript macro within that document, this tag does not change but I get a macro warning because there actually is a code module embedded in this document. --------------------------------- A document automatically calling some macro in the global scope contains this entry: <office:scripts> <office:event-listeners> <script:event-listener script:language="ooo:script" script:event-name="office:start-app" xlink:href="vnd.sun.star.script:Calc.Module2.InsertDateTime?language=Basic&location=application" xlink:type="simple"/> </office:event-listeners> </office:scripts> This does not trigger any macro warning because there is still no code in the document. The above entry silently calls some installed macro under "My Macros" or under "LibreOffice Macros" (&location=application) LO 6.4 raises the macro warning because of this event hook pointing to an already installed module which is not embedded in the document. --------------------------------------- The following entry calls a macro that is embedded within the document (&location=document). But only if the macro is actually there. <office:scripts> <office:event-listeners> <script:event-listener script:language="ooo:script" script:event-name="office:start-app" xlink:href="vnd.sun.star.script:Standard.Module1.Main?language=Basic&location=document" xlink:type="simple"/> </office:event-listeners> </office:scripts> If I remove the code, this entry is still there and the assignment is still visible under Tools>Customize but it does not raise any macro warning because there is no macro embedded in the document. If I enable embedded macros for this document, I get another warning about macro Standard.Module1.Main not being found in this document. LO 6.4 raises the macro warning because of this event hook pointing to a non-existing embedded module. --------------------------------------- The mere existance of an event hook should not raise any macro warning as long as no code is embedded in the document, particularly if the hook is not linked to any code. In my template all these entries do not point to any code embedded or not.
Sorry. The second sentence should be "But none of the hooks is linked to any macro and the file does not contain any macro code at all."
The relevant commit is https://cgit.freedesktop.org/libreoffice/core/commit/?id=35fe064a67b54b0680b4845477c9b8751edda160 a little explanation at https://lists.freedesktop.org/archives/libreoffice/2019-September/083444.html The cascading list of CVEs during 2019 (https://www.libreoffice.org/about-us/security/advisories) with problems with various scripting exploits led to tagging any document using script:event-listener as a potential hazard with shipped-with-libreoffice scripts considered equally suspect as one contained embedded in a document, erring towards giving a warning if there's potential scripting triggers.
OK, that's what I suspected. However, my template does not contain any URL pointing to any macro. <office:scripts> <office:event-listeners> <script:event-listener script:language="ooo:script" script:event-name="office:start-app"/> does not include any attribute like xlink:href="vnd.sun.star.script:Library.Module.Routine?language=Basic&location=application" xlink:type="simple" I don't know how these blank entries made it into my template. Perhaps I did some experiments long time ago. I will remove that from content.xml of my template and loads of derived documents.
WONTFIX per comment 6