Bug 93488 - Implement password protection for VBA export
Summary: Implement password protection for VBA export
Status: ASSIGNED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: BASIC (show other bugs)
Version:
(earliest affected)
Inherited From OOo
Hardware: Other All
: medium normal
Assignee: Ujjawal Kumar
URL:
Whiteboard:
Keywords: difficultyInteresting, easyHack, skillCpp
Depends on:
Blocks: MSO-Formats Macro-VBA
  Show dependency treegraph
 
Reported: 2015-08-17 17:29 UTC by Markus Mohrhard
Modified: 2025-04-12 13:46 UTC (History)
2 users (show)

See Also:
Crash report or crash signature:


Attachments
- Generates ProjKey from the VBA project GUID - Encrypts the CMG, DPB, and GC values per the MS VBA specification (section 2.4.3) - Removes static/fake protection values and applies real encryption (171.74 KB, patch)
2025-04-11 06:15 UTC, Rahul
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Markus Mohrhard 2015-08-17 17:29:36 UTC
Currently the VBA export is developed in the feature/vba-export branch. However the current export is quite limited and we only support normal code modules and the basic VBA structure.

This task would be about implementing the password protection for the VBA export. The related part in the VBA specification (https://msdn.microsoft.com/en-us/library/office/cc313094%28v=office.12%29.aspx) is section 2.4.3.

The current export code is in oox/source/ole/vbaexport.cxx
Comment 1 Robinson Tryon (qubit) 2015-12-14 05:03:44 UTC Comment hidden (obsolete)
Comment 2 Robinson Tryon (qubit) 2016-02-18 14:51:29 UTC Comment hidden (obsolete)
Comment 3 Sachin 2020-04-11 12:02:13 UTC
(In reply to Markus Mohrhard from comment #0)
> Currently the VBA export is developed in the feature/vba-export branch.
> However the current export is quite limited and we only support normal code
> modules and the basic VBA structure.
> 
> This task would be about implementing the password protection for the VBA
> export. The related part in the VBA specification
> (https://msdn.microsoft.com/en-us/library/office/cc313094%28v=office.12%29.
> aspx) is section 2.4.3.
> 
> The current export code is in oox/source/ole/vbaexport.cxx

Can you please give little more idea on this
Comment 4 nirnaykorde 2023-04-04 17:21:02 UTC
Could someone update the requirements for this hack and maybe explain a little bit more for what needs to be done
Comment 5 Ujjawal Kumar 2025-04-09 14:26:22 UTC
(In reply to Markus Mohrhard from comment #0)
> Currently the VBA export is developed in the feature/vba-export branch.
> However the current export is quite limited and we only support normal code
> modules and the basic VBA structure.
> 
> This task would be about implementing the password protection for the VBA
> export. The related part in the VBA specification
> (https://msdn.microsoft.com/en-us/library/office/cc313094%28v=office.12%29.
> aspx) is section 2.4.3.
> 
> The current export code is in oox/source/ole/vbaexport.cxx

Hi Markus, I want to work on this issue. I had few questions, do we have the frontend which allows to specify the password  for the encryption. According to me the only changes required would be to encrypt the password hash and implementing the frontend if not present. Thanks!
Comment 6 Buovjaga 2025-04-09 15:13:54 UTC
(In reply to Ujjawal Kumar from comment #5)
> (In reply to Markus Mohrhard from comment #0)
> > Currently the VBA export is developed in the feature/vba-export branch.
> > However the current export is quite limited and we only support normal code
> > modules and the basic VBA structure.
> > 
> > This task would be about implementing the password protection for the VBA
> > export. The related part in the VBA specification
> > (https://msdn.microsoft.com/en-us/library/office/cc313094%28v=office.12%29.
> > aspx) is section 2.4.3.
> > 
> > The current export code is in oox/source/ole/vbaexport.cxx
> 
> Hi Markus, I want to work on this issue. I had few questions, do we have the
> frontend which allows to specify the password  for the encryption. According
> to me the only changes required would be to encrypt the password hash and
> implementing the frontend if not present. Thanks!

Recent examples of work in password dialogs:
https://gerrit.libreoffice.org/c/core/+/182693
https://gerrit.libreoffice.org/c/core/+/182694

Not sure, if they can be reused here, but at least it should help you in researching.
Comment 7 Parth Gadekar 2025-04-10 20:44:42 UTC
Hi, I’m a GSoC 2025 applicant who would like to work on this EasyHack. I’m currently setting up the development environment and will begin investigating the export flow for VBA macros. If this bug is still available, please assign it to me. Thanks!
Comment 8 Buovjaga 2025-04-11 04:53:51 UTC
(In reply to Parth Gadekar from comment #7)
> Hi, I’m a GSoC 2025 applicant who would like to work on this EasyHack. I’m
> currently setting up the development environment and will begin
> investigating the export flow for VBA macros. If this bug is still
> available, please assign it to me. Thanks!

Per comment 5, Ujjawal is working on this, although no patch has been submitted yet.
Comment 9 Rahul 2025-04-11 06:15:23 UTC
Created attachment 200290 [details]
- Generates ProjKey from the VBA project GUID - Encrypts the CMG, DPB, and GC values per the MS VBA specification (section 2.4.3) - Removes static/fake protection values and applies real encryption

Patch for tdf#93488 - Implements password protection in VBA export using the existing VBAEncryption class.

- Replaces hardcoded CMG, DPB, GC values with encrypted values generated at export time.
- Uses ProjKey derived from GUID to seed encryption.
- Makes password protection export-compliant per spec section 2.4.3.
Comment 10 Ujjawal Kumar 2025-04-12 13:46:42 UTC
(In reply to Buovjaga from comment #8)
> (In reply to Parth Gadekar from comment #7)
> > Hi, I’m a GSoC 2025 applicant who would like to work on this EasyHack. I’m
> > currently setting up the development environment and will begin
> > investigating the export flow for VBA macros. If this bug is still
> > available, please assign it to me. Thanks!
> 
> Per comment 5, Ujjawal is working on this, although no patch has been
> submitted yet.

Hi Buovjaga, I've uploaded a patch at https://gerrit.libreoffice.org/c/core/+/184086.
Could you review it or assign appropriate reviewers. Thank you!