Check svg URLs before exporting

Reviewed-on: https://gerrit.libreoffice.org/68668
Tested-by: Jenkins
Reviewed-by: Samuel Mehrbrodt <Samuel.Mehrbrodt@cib.de>
(cherry picked from commit 34ec4657)

Change-Id: I3b86b6b82318b0d201c3d7db516664520eb47bed

filter/source/svg/svgexport.cxx

@@ -43,6 +43,7 @@
 #include <comphelper/sequenceashashmap.hxx>
 #include <i18nlangtag/lang.h>
 #include <svl/zforlist.hxx>
+#include <tools/urlobj.hxx>
 #include <xmloff/unointerfacetouniqueidentifiermapper.hxx>
 #include <xmloff/nmspmap.hxx>
 #include <xmloff/xmlnmspe.hxx>
@@ -1809,6 +1810,10 @@ bool SVGFilter::implExportShape( const Reference< XShape >& rxShape, bool bMaste
                         }
 
                         if( !aBookmark.isEmpty() )
+                        {
+                            INetURLObject aINetURLObject(aBookmark);
+                            if (!aINetURLObject.HasError()
+                                && aINetURLObject.GetProtocol() != INetProtocol::Javascript)
                             {
                                 mpSVGExport->AddAttribute( XML_NAMESPACE_NONE, "xlink:href", aBookmark);
                                 SvXMLElementExport alinkA( *mpSVGExport, XML_NAMESPACE_NONE, "a", true, true );
@@ -1818,6 +1823,7 @@ bool SVGFilter::implExportShape( const Reference< XShape >& rxShape, bool bMaste
                                                             &rxShape,
                                                             pEmbeddedBitmapsMtf );
                             }
+                        }
                         else
                         {
                             mpSVGWriter->WriteMetaFile( aTopLeft, aSize, rMtf,

sd/qa/unit/SVGExportTests.cxx

@@ -111,8 +111,23 @@ public:
         assertXPath(svgDoc, MAKE_PATH_STRING( /SVG_SVG/SVG_G[2]/SVG_G/SVG_G/SVG_G/SVG_G/SVG_G[2]/SVG_G/SVG_TEXT/SVG_TSPAN ), "text-decoration", "line-through");
     }
 
+    void testSVGExportJavascriptURL()
+    {
+        executeExport("textbox-link-javascript.odp");
+
+        xmlDocPtr svgDoc = parseXml(maTempFile);
+        CPPUNIT_ASSERT(svgDoc);
+
+        // There should be only one child (no link to javascript url)
+        assertXPathChildren(svgDoc,
+                            MAKE_PATH_STRING(/ SVG_SVG / SVG_G[2] / SVG_G / SVG_G / SVG_G / SVG_G
+                                             / SVG_G[4] / SVG_G),
+                            1);
+    }
+
     CPPUNIT_TEST_SUITE(SdSVGFilterTest);
     CPPUNIT_TEST(testSVGExportTextDecorations);
+    CPPUNIT_TEST(testSVGExportJavascriptURL);
     CPPUNIT_TEST_SUITE_END();
 };