[Libreoffice-commits] core.git: xmlsecurity/source

[Libreoffice Gerrit user]

 xmlsecurity/source/xmlsec/nss/nssinitializer.cxx |   14 ++++++++++++++
 1 file changed, 14 insertions(+)

New commits:
commit 61688aa1abd9db9adbb8dc5d5aacc6269b21fd27
Author:     Michael Stahl <Michael.Stahl at cib.de>
AuthorDate: Thu Aug 9 11:55:09 2018 +0200
Commit:     Miklos Vajna <vmiklos at collabora.co.uk>
CommitDate: Tue Aug 14 08:16:28 2018 +0200

    xmlsecurity: nsscrypto_initialize: try to avoid profile migration
    
    https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.35_release_notes
    
    NSS 3.35 and later will automatically migrate migrate profiles from the
    old "dbm:" BDB format to the new "sql:" SQLite format.
    
    The new format can be read by NSS 3.12 and later, which is old enough that
    it can be assumed to be available.
    
    However LibreOffice still shouldn't migrate the profile on its own:
    LO typically uses a Mozilla Firefox or Thunderbird profile, and if it is
    a system Firefox with system NSS libraries, then it's probably a bad
    idea for LO to migrate the profile under Firefox's nose, particularly
    considering the "partial migration" scenario if the profile is
    password-protected.
    
    Try to avoid this by checking if the profile is the old format and
    explicitly using the "dbm:" prefix to prevent the migration.
    
    Change-Id: I06480522f830ce74e2fb7bf79fee84ad80979b82
    Reviewed-on: https://gerrit.libreoffice.org/58756
    Tested-by: Jenkins
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>

diff --git a/xmlsecurity/source/xmlsec/nss/nssinitializer.cxx b/xmlsecurity/source/xmlsec/nss/nssinitializer.cxx
index dd035c6f657a..3fb94bd256c5 100644
--- a/xmlsecurity/source/xmlsec/nss/nssinitializer.cxx
+++ b/xmlsecurity/source/xmlsec/nss/nssinitializer.cxx
@@ -244,6 +244,20 @@ bool nsscrypto_initialize( const css::uno::Reference< css::uno::XComponentContex
     // there might be no profile
     if ( !sCertDir.isEmpty() )
     {
+        if (sCertDir.indexOf(':') == -1) //might be env var with explicit prefix
+        {
+            OUString sCertDirURL;
+            osl::FileBase::getFileURLFromSystemPath(
+                OStringToOUString(sCertDir, osl_getThreadTextEncoding()),
+                sCertDirURL);
+            osl::DirectoryItem item;
+            if (osl::FileBase::E_NOENT != osl::DirectoryItem::get(sCertDirURL + "/cert8.db", item) &&
+                osl::FileBase::E_NOENT == osl::DirectoryItem::get(sCertDirURL + "/cert9.db", item))
+            {
+                SAL_INFO("xmlsecurity.xmlsec", "nsscrypto_initialize: trying to avoid profile migration");
+                sCertDir = "dbm:" + sCertDir;
+            }
+        }
         if( NSS_InitReadWrite( sCertDir.getStr() ) != SECSuccess )
         {
             SAL_INFO("xmlsecurity.xmlsec", "Initializing NSS with profile failed.");