Bug 131624 - Macro warning when loading template free of macros
Summary: Macro warning when loading template free of macros
Status: RESOLVED WONTFIX
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: framework (show other bugs)
Version:
(earliest affected)
6.4.0.3 release
Hardware: All All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-03-27 13:23 UTC by Andreas Säger
Modified: 2020-04-29 13:56 UTC (History)
5 users (show)

See Also:
Crash report or crash signature:


Attachments
Template raising the macro warning without having any macros (10.58 KB, application/vnd.oasis.opendocument.spreadsheet-template)
2020-03-27 13:23 UTC, Andreas Säger
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Säger 2020-03-27 13:23:40 UTC
Created attachment 159070 [details]
Template raising the macro warning without having any macros

The attached template is my default template for Calc. Since version 6.4.0 I get the macro warning for every new spreadsheet document.
The teplate includes some styles and colours but no macro code.
Comment 1 Adam 2020-03-28 01:36:56 UTC
Thank you for reporting the bug. I can confirm that the bug is present in


Version: 6.4.1.2 (x64)
Windows 10.0 Build 18363


Version: 6.4.2.2 (x64)
Windows 10.0 Build 1836


Version: 7.0.0.0.alpha0+ (x64)
Windows 10.0 Build 18363


When opening the template in the attached document in Calc, a security warning about macros is displayed. Once the template has been opened and you've closed the Macro warning go into Tools => Macros => edit Macros => expand MyDefault1.ots => Standard. There you can clearly see no Macros are in the template. 

Changing status to NEW.
Comment 2 Oliver Brinzing 2020-03-28 12:24:05 UTC
i think the root cause is that "content.xml" contains "script:event-listeners":

<office:scripts>
  <office:event-listeners>
   <script:event-listener script:language="ooo:script" 
     script:event-name="office:start-app"/>
[...]

IMHO the warning message is therefore correct
Comment 3 Adam 2020-03-28 23:48:51 UTC
Hey Oliver, 

Hmm, I haven't worked with LO for very long, and I'm not too familiar with XML. I'm struggling to understand why event listeners would be causing this though, any links you could share for more insight? Also you are more seasoned here than I, do you think I should change this back to unconfirmed?
Comment 4 Andreas Säger 2020-03-29 00:02:57 UTC
Indeed, the file contains a list of unused event hooks, corresponding to the events in Tools>Customize, tab:Events. But none of the hooks is linked to any macro and the macro does not contain any macro code at all.

This is how the office suite behaves since 19 years:

A brand new document (not from template) contains this empty tag:
<office:scripts/>
If I embed any Basic/Python/JavaScript macro within that document, this tag does not change but I get a macro warning because there actually is a code module embedded in this document.
---------------------------------
A document automatically calling some macro in the global scope contains this entry:
<office:scripts>
<office:event-listeners>
<script:event-listener script:language="ooo:script" script:event-name="office:start-app" xlink:href="vnd.sun.star.script:Calc.Module2.InsertDateTime?language=Basic&location=application" xlink:type="simple"/>
</office:event-listeners>
</office:scripts>
This does not trigger any macro warning because there is still no code in the document. The above entry silently calls some installed macro under "My Macros" or under "LibreOffice Macros" (&location=application)

LO 6.4 raises the macro warning because of this event hook pointing to an already installed module which is not embedded in the document.
---------------------------------------
The following entry calls a macro that is embedded within the document (&location=document). But only if the macro is actually there.
<office:scripts>
<office:event-listeners>
<script:event-listener script:language="ooo:script" script:event-name="office:start-app" xlink:href="vnd.sun.star.script:Standard.Module1.Main?language=Basic&location=document" xlink:type="simple"/>
</office:event-listeners>
</office:scripts>
If I remove the code, this entry is still there and the assignment is still visible under Tools>Customize but it does not raise any macro warning because there is no macro embedded in the document. If I enable embedded macros for this document, I get another warning about macro Standard.Module1.Main not being found in this document.

LO 6.4 raises the macro warning because of this event hook pointing to a non-existing embedded module.
---------------------------------------

The mere existance of an event hook should not raise any macro warning as long as no code is embedded in the document, particularly if the hook is not linked to any code. In my template all these entries do not point to any code embedded or not.
Comment 5 Andreas Säger 2020-03-29 00:07:06 UTC
Sorry. The second sentence should be "But none of the hooks is linked to any macro and the file does not contain any macro code at all."
Comment 6 Caolán McNamara 2020-03-30 15:30:43 UTC
The relevant commit is https://cgit.freedesktop.org/libreoffice/core/commit/?id=35fe064a67b54b0680b4845477c9b8751edda160

a little explanation at
https://lists.freedesktop.org/archives/libreoffice/2019-September/083444.html

The cascading list of CVEs during 2019 (https://www.libreoffice.org/about-us/security/advisories) with problems with various scripting exploits led to tagging any document using script:event-listener as a potential hazard with shipped-with-libreoffice scripts considered equally suspect as one contained embedded in a document, erring towards giving a warning if there's potential scripting triggers.
Comment 7 Andreas Säger 2020-03-30 17:01:50 UTC
OK, that's what I suspected. However, my template does not contain any URL pointing to any macro.

<office:scripts>
  <office:event-listeners>
   <script:event-listener script:language="ooo:script" 
     script:event-name="office:start-app"/>

does not include any attribute like xlink:href="vnd.sun.star.script:Library.Module.Routine?language=Basic&location=application" xlink:type="simple"

I don't know how these blank entries made it into my template. Perhaps I did some experiments long time ago.
I will remove that from content.xml of my template and loads of derived documents.
Comment 8 Buovjaga 2020-04-29 13:56:49 UTC
WONTFIX per comment 6