add chaff to encrypted documents

20 files changed, 287 insertions, 6 deletions

diff --git a/comphelper/Library_comphelp.mk b/comphelper/Library_comphelp.mk
index ac1067b48ad3..ab67554093a2 100644
--- a/comphelper/Library_comphelp.mk
+++ b/comphelper/Library_comphelp.mk
@@ -153,6 +153,7 @@ $(eval $(call gb_Library_add_exception_objects,comphelper,\
     comphelper/source/streaming/streamsection \
     comphelper/source/xml/attributelist \
     comphelper/source/xml/ofopxmlhelper \
+    comphelper/source/xml/xmltools \
 ))
 
 # vim: set noet sw=4 ts=4:
diff --git a/comphelper/Package_inc.mk b/comphelper/Package_inc.mk
index 3819721c5e90..df0c6c9b6b9a 100644
--- a/comphelper/Package_inc.mk
+++ b/comphelper/Package_inc.mk
@@ -40,6 +40,7 @@ $(eval $(call gb_Package_add_file,comphelper_inc,inc/comphelper/anycompare.hxx,c
 $(eval $(call gb_Package_add_file,comphelper_inc,inc/comphelper/propagg.hxx,comphelper/propagg.hxx))
 $(eval $(call gb_Package_add_file,comphelper_inc,inc/comphelper/scopeguard.hxx,comphelper/scopeguard.hxx))
 $(eval $(call gb_Package_add_file,comphelper_inc,inc/comphelper/scoped_disposing_ptr.hxx,comphelper/scoped_disposing_ptr.hxx))
+$(eval $(call gb_Package_add_file,comphelper_inc,inc/comphelper/xmltools.hxx,comphelper/xmltools.hxx))
 $(eval $(call gb_Package_add_file,comphelper_inc,inc/comphelper/asyncnotification.hxx,comphelper/asyncnotification.hxx))
 $(eval $(call gb_Package_add_file,comphelper_inc,inc/comphelper/namedvaluecollection.hxx,comphelper/namedvaluecollection.hxx))
 $(eval $(call gb_Package_add_file,comphelper_inc,inc/comphelper/composedprops.hxx,comphelper/composedprops.hxx))
diff --git a/comphelper/inc/comphelper/xmltools.hxx b/comphelper/inc/comphelper/xmltools.hxx
new file mode 100644
index 000000000000..c18cc69123bc
--- /dev/null
+++ b/comphelper/inc/comphelper/xmltools.hxx
@@ -0,0 +1,46 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/*
+ * Version: MPL 1.1 / GPLv3+ / LGPLv3+
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Initial Developer of the Original Code is
+ *        Caolán McNamara <caolanm@redhat.com> (Red Hat, Inc.)
+ * Portions created by the Initial Developer are Copyright (C) 2011 the
+ * Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s): Caolán McNamara <caolanm@redhat.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 3 or later (the "GPLv3+"), or
+ * the GNU Lesser General Public License Version 3 or later (the "LGPLv3+"),
+ * in which case the provisions of the GPLv3+ or the LGPLv3+ are applicable
+ * instead of those above.
+ */
+#ifndef _XMLCHAFF_HXX
+#define _XMLCHAFF_HXX
+
+#include <rtl/strbuf.hxx>
+#include <rtl/ustrbuf.hxx>
+#include <com/sun/star/uno/Sequence.hxx>
+#include <comphelper/comphelperdllapi.h>
+
+namespace comphelper
+{
+    namespace xml
+    {
+        COMPHELPER_DLLPUBLIC rtl::OString makeXMLChaff();
+    }
+}
+
+#endif
+
+/* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/comphelper/source/xml/xmltools.cxx b/comphelper/source/xml/xmltools.cxx
new file mode 100644
index 000000000000..c5a5a724d77a
--- /dev/null
+++ b/comphelper/source/xml/xmltools.cxx
@@ -0,0 +1,115 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/*
+ * Version: MPL 1.1 / GPLv3+ / LGPLv3+
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Initial Developer of the Original Code is
+ *        Caolán McNamara <caolanm@redhat.com> (Red Hat, Inc.)
+ * Portions created by the Initial Developer are Copyright (C) 2011 the
+ * Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s): Caolán McNamara <caolanm@redhat.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 3 or later (the "GPLv3+"), or
+ * the GNU Lesser General Public License Version 3 or later (the "LGPLv3+"),
+ * in which case the provisions of the GPLv3+ or the LGPLv3+ are applicable
+ * instead of those above.
+ */
+#include <comphelper/xmltools.hxx>
+#include <rtl/random.h>
+#include <boost/static_assert.hpp>
+#include <vector>
+
+using namespace com::sun::star;
+
+namespace
+{
+    //Will be inside an xml comment, so can't use '-' in case '--' appears in
+    //output, etc. Despite what *is* legal in an xml comment, just using the
+    //base-64 subset to avoid pain with simplistic third-party parsers
+    static const sal_uInt8 aChaffEncoder[] =
+    {
+        'A', 'Q', 'g', 'w', 'B', 'R', 'h', 'x',
+        'C', 'S', 'i', 'y', 'D', 'T', 'j', 'z',
+        'E', 'U', 'k', '0', 'F', 'V', 'l', '1',
+        'G', 'W', 'm', '2', 'H', 'X', 'n', '3',
+        'I', 'Y', 'o', '4', 'J', 'Z', 'p', '5',
+        'K', 'a', 'q', '6', 'L', 'b', 'r', '7',
+        'M', 'c', 's', '8', 'N', 'd', 't', '9',
+        'O', 'e', 'u', '+', 'P', 'f', 'v', '/',
+
+        'A', 'Q', 'g', 'w', 'B', 'R', 'h', 'x',
+        'C', 'S', 'i', 'y', 'D', 'T', 'j', 'z',
+        'E', 'U', 'k', '0', 'F', 'V', 'l', '1',
+        'G', 'W', 'm', '2', 'H', 'X', 'n', '3',
+        'I', 'Y', 'o', '4', 'J', 'Z', 'p', '5',
+        'K', 'a', 'q', '6', 'L', 'b', 'r', '7',
+        'M', 'c', 's', '8', 'N', 'd', 't', '9',
+        'O', 'e', 'u', '+', 'P', 'f', 'v', '/',
+
+        'A', 'Q', 'g', 'w', 'B', 'R', 'h', 'x',
+        'C', 'S', 'i', 'y', 'D', 'T', 'j', 'z',
+        'E', 'U', 'k', '0', 'F', 'V', 'l', '1',
+        'G', 'W', 'm', '2', 'H', 'X', 'n', '3',
+        'I', 'Y', 'o', '4', 'J', 'Z', 'p', '5',
+        'K', 'a', 'q', '6', 'L', 'b', 'r', '7',
+        'M', 'c', 's', '8', 'N', 'd', 't', '9',
+        'O', 'e', 'u', '+', 'P', 'f', 'v', '/',
+
+        'A', 'Q', 'g', 'w', 'B', 'R', 'h', 'x',
+        'C', 'S', 'i', 'y', 'D', 'T', 'j', 'z',
+        'E', 'U', 'k', '0', 'F', 'V', 'l', '1',
+        'G', 'W', 'm', '2', 'H', 'X', 'n', '3',
+        'I', 'Y', 'o', '4', 'J', 'Z', 'p', '5',
+        'K', 'a', 'q', '6', 'L', 'b', 'r', '7',
+        'M', 'c', 's', '8', 'N', 'd', 't', '9',
+        'O', 'e', 'u', '+', 'P', 'f', 'v', '/'
+    };
+
+    void encodeChaff(std::vector<sal_uInt8> &rChaff)
+    {
+        BOOST_STATIC_ASSERT(sizeof(aChaffEncoder) == 256);
+
+        for (std::vector<sal_uInt8>::iterator aI = rChaff.begin(), aEnd = rChaff.end();
+            aI != aEnd; ++aI)
+        {
+            *aI = aChaffEncoder[*aI];
+        }
+    }
+}
+
+namespace comphelper
+{
+    namespace xml
+    {
+        rtl::OString makeXMLChaff()
+        {
+            rtlRandomPool pool = rtl_random_createPool();
+
+            sal_Int8 n;
+            rtl_random_getBytes(pool, &n, 1);
+
+            //1024 minus max -127/plus max 128
+            sal_Int32 nLength = 1024+n;
+            std::vector<sal_uInt8> aChaff(nLength);
+            rtl_random_getBytes(pool, &aChaff[0], nLength);
+
+            rtl_random_destroyPool(pool);
+
+            encodeChaff(aChaff);
+
+            return rtl::OString(reinterpret_cast<const sal_Char*>(&aChaff[0]), nLength);
+        }
+    }
+}
+/* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/editeng/source/misc/SvXMLAutoCorrectExport.cxx b/editeng/source/misc/SvXMLAutoCorrectExport.cxx
index ceada8ae745b..2b01f036abf7 100644
--- a/editeng/source/misc/SvXMLAutoCorrectExport.cxx
+++ b/editeng/source/misc/SvXMLAutoCorrectExport.cxx
@@ -56,6 +56,8 @@ sal_uInt32 SvXMLAutoCorrectExport::exportDoc(enum XMLTokenEnum /*eClass*/)
 {
     GetDocHandler()->startDocument();
 
+    addChaffWhenEncryptedStorage();
+
     AddAttribute ( XML_NAMESPACE_NONE,
                    _GetNamespaceMap().GetAttrNameByKey ( XML_NAMESPACE_BLOCKLIST ),
                    _GetNamespaceMap().GetNameByKey ( XML_NAMESPACE_BLOCKLIST ) );
@@ -97,6 +99,8 @@ sal_uInt32 SvXMLExceptionListExport::exportDoc(enum XMLTokenEnum /*eClass*/)
 {
     GetDocHandler()->startDocument();
 
+    addChaffWhenEncryptedStorage();
+
     AddAttribute ( XML_NAMESPACE_NONE,
                    _GetNamespaceMap().GetAttrNameByKey ( XML_NAMESPACE_BLOCKLIST ),
                    _GetNamespaceMap().GetNameByKey ( XML_NAMESPACE_BLOCKLIST ) );
diff --git a/offapi/com/sun/star/embed/XEncryptionProtectedSource2.idl b/offapi/com/sun/star/embed/XEncryptionProtectedSource2.idl
index f83937c4709c..7c285739d592 100644
--- a/offapi/com/sun/star/embed/XEncryptionProtectedSource2.idl
+++ b/offapi/com/sun/star/embed/XEncryptionProtectedSource2.idl
@@ -52,6 +52,14 @@ interface XEncryptionProtectedSource2: XEncryptionProtectedSource
      */
     void setEncryptionData( [in] sequence< ::com::sun::star::beans::NamedValue > aEncryptionData )
         raises( ::com::sun::star::io::IOException );
+
+    // -----------------------------------------------------------------------
+    /** determing if an encryption data is set for this object.
+
+        @return
+            true if some encryption data was set, false otherwise
+     */
+    boolean hasEncryptionData();
 };
 
 //============================================================================
diff --git a/package/source/xstor/owriteablestream.cxx b/package/source/xstor/owriteablestream.cxx
index 56b308b60478..29afc8649228 100644
--- a/package/source/xstor/owriteablestream.cxx
+++ b/package/source/xstor/owriteablestream.cxx
@@ -2750,6 +2750,23 @@ void SAL_CALL OWriteStream::setEncryptionData( const uno::Sequence< beans::Named
 }
 
 //-----------------------------------------------
+sal_Bool SAL_CALL OWriteStream::hasEncryptionData()
+    throw (uno::RuntimeException)
+{
+    ::osl::ResettableMutexGuard aGuard( m_pData->m_rSharedMutexRef->GetMutex() );
+
+    if (!m_pImpl)
+        return sal_False;
+
+    sal_Bool bRet = m_pImpl->IsEncrypted();
+
+    if (!bRet && m_pImpl->m_bUseCommonEncryption && m_pImpl->m_pParent)
+        bRet = m_pImpl->m_pParent->m_bHasCommonEncryptionData;
+
+    return bRet;
+}
+
+//-----------------------------------------------
 sal_Bool SAL_CALL OWriteStream::hasByID(  const ::rtl::OUString& sID )
         throw ( io::IOException,
                 uno::RuntimeException )
diff --git a/package/source/xstor/owriteablestream.hxx b/package/source/xstor/owriteablestream.hxx
index 0e9884bd75cb..aefe0b82002c 100644
--- a/package/source/xstor/owriteablestream.hxx
+++ b/package/source/xstor/owriteablestream.hxx
@@ -372,6 +372,7 @@ public:
 
     //XEncryptionProtectedSource2
     virtual void SAL_CALL setEncryptionData( const ::com::sun::star::uno::Sequence< ::com::sun::star::beans::NamedValue >& aEncryptionData ) throw (::com::sun::star::io::IOException, ::com::sun::star::uno::RuntimeException);
+    virtual sal_Bool SAL_CALL hasEncryptionData() throw (::com::sun::star::uno::RuntimeException);
 
     //XRelationshipAccess
     virtual ::sal_Bool SAL_CALL hasByID( const ::rtl::OUString& sID ) throw (::com::sun::star::io::IOException, ::com::sun::star::uno::RuntimeException);
diff --git a/package/source/xstor/xstorage.cxx b/package/source/xstor/xstorage.cxx
index 9c0c117f5e35..40b129ff509a 100644
--- a/package/source/xstor/xstorage.cxx
+++ b/package/source/xstor/xstorage.cxx
@@ -4806,6 +4806,15 @@ void SAL_CALL OStorage::setEncryptionData( const uno::Sequence< beans::NamedValu
     }
 }
 
+sal_Bool SAL_CALL OStorage::hasEncryptionData()
+    throw ( uno::RuntimeException )
+{
+    ::osl::MutexGuard aGuard( m_pData->m_rSharedMutexRef->GetMutex() );
+
+    return m_pImpl && m_pImpl->m_bHasCommonEncryptionData;
+}
+
+
 //____________________________________________________________________________________________________
 //  XEncryptionProtectedStorage
 //____________________________________________________________________________________________________
diff --git a/package/source/xstor/xstorage.hxx b/package/source/xstor/xstorage.hxx
index f472444556c2..f1770e5e372f 100644
--- a/package/source/xstor/xstorage.hxx
+++ b/package/source/xstor/xstorage.hxx
@@ -647,6 +647,9 @@ public:
         throw ( ::com::sun::star::io::IOException,
                 ::com::sun::star::uno::RuntimeException );
 
+    virtual sal_Bool SAL_CALL hasEncryptionData()
+        throw ( ::com::sun::star::uno::RuntimeException );
+
     //____________________________________________________________________________________________________
     //  XEncryptionProtectedStorage
     //____________________________________________________________________________________________________
diff --git a/starmath/source/mathmlexport.cxx b/starmath/source/mathmlexport.cxx
index fe8f77f93918..ae6e30608af0 100644
--- a/starmath/source/mathmlexport.cxx
+++ b/starmath/source/mathmlexport.cxx
@@ -605,6 +605,8 @@ sal_uInt32 SmXMLExport::exportDoc(enum XMLTokenEnum eClass)
 
         GetDocHandler()->startDocument();
 
+        addChaffWhenEncryptedStorage();
+
         /*Add xmlns line*/
         SvXMLAttributeList &rList = GetAttrList();
 
diff --git a/svx/source/xml/xmlxtexp.cxx b/svx/source/xml/xmlxtexp.cxx
index c1704845922c..7f01b788b888 100644
--- a/svx/source/xml/xmlxtexp.cxx
+++ b/svx/source/xml/xmlxtexp.cxx
@@ -293,6 +293,8 @@ sal_Bool SvxXMLXTableExportComponent::exportTable() throw()
     {
         GetDocHandler()->startDocument();
 
+        addChaffWhenEncryptedStorage();
+
         // export namespaces
         sal_uInt16 nPos = GetNamespaceMap().GetFirstKey();
         while( USHRT_MAX != nPos )
diff --git a/sw/source/core/swg/SwXMLBlockExport.cxx b/sw/source/core/swg/SwXMLBlockExport.cxx
index 674a33fe2c4f..848bd6c542df 100644
--- a/sw/source/core/swg/SwXMLBlockExport.cxx
+++ b/sw/source/core/swg/SwXMLBlockExport.cxx
@@ -55,6 +55,8 @@ sal_uInt32 SwXMLBlockListExport::exportDoc(enum XMLTokenEnum )
 {
     GetDocHandler()->startDocument();
 
+    addChaffWhenEncryptedStorage();
+
     AddAttribute ( XML_NAMESPACE_NONE,
                    _GetNamespaceMap().GetAttrNameByKey ( XML_NAMESPACE_BLOCKLIST ),
                    _GetNamespaceMap().GetNameByKey ( XML_NAMESPACE_BLOCKLIST ) );
@@ -110,6 +112,8 @@ sal_uInt32 SwXMLTextBlockExport::exportDoc(const String &rText)
 {
     GetDocHandler()->startDocument();
 
+    addChaffWhenEncryptedStorage();
+
     AddAttribute ( XML_NAMESPACE_NONE,
                    _GetNamespaceMap().GetAttrNameByKey ( XML_NAMESPACE_BLOCKLIST ),
                    _GetNamespaceMap().GetNameByKey ( XML_NAMESPACE_BLOCKLIST ) );
diff --git a/unoxml/Library_unordf.mk b/unoxml/Library_unordf.mk
index 2d0276a01a97..cb21c0674fe6 100644
--- a/unoxml/Library_unordf.mk
+++ b/unoxml/Library_unordf.mk
@@ -40,6 +40,7 @@ $(eval $(call gb_Library_add_api,unordf,\
 ))
 
 $(eval $(call gb_Library_add_linked_libs,unordf,\
+    comphelper \
     cppuhelper \
     cppu \
     sal \
diff --git a/unoxml/source/rdf/librdf_repository.cxx b/unoxml/source/rdf/librdf_repository.cxx
index 644d283efc8f..317ba3023e19 100644
--- a/unoxml/source/rdf/librdf_repository.cxx
+++ b/unoxml/source/rdf/librdf_repository.cxx
@@ -67,7 +67,9 @@
 #include <comphelper/stlunosequence.hxx>
 #include <comphelper/sequenceasvector.hxx>
 #include <comphelper/makesequence.hxx>
+#include <comphelper/xmltools.hxx>
 
+#include <com/sun/star/embed/XEncryptionProtectedSource2.hpp>
 
 /**
     Implementation of the service com.sun.star.rdf.Repository.
@@ -991,6 +993,53 @@ throw (uno::RuntimeException, lang::IllegalArgumentException,
     return getGraph(i_xGraphName);
 }
 
+void addChaffWhenEncryptedStorage(const uno::Reference< io::XOutputStream > &rStream, unsigned char* pBuffer, size_t length)
+{
+    if (!length)
+        return;
+
+    uno::Reference< embed::XEncryptionProtectedSource2 > xEncr(rStream,
+        uno::UNO_QUERY);
+
+    bool bAddChaff = xEncr.is() && xEncr->hasEncryptionData();
+
+    // exceptions are propagated
+    if (!bAddChaff)
+    {
+        const uno::Sequence<sal_Int8> buf(
+            reinterpret_cast<sal_Int8*>(pBuffer), length);
+        rStream->writeBytes(buf);
+    }
+    else
+    {
+        unsigned char *postcomment =
+            (unsigned char*)strchr((const char*)pBuffer, '\n');
+        if (postcomment != NULL)
+        {
+            ++postcomment;
+
+            size_t preamblelen = postcomment - pBuffer;
+
+            uno::Sequence<sal_Int8> buf(
+                reinterpret_cast<sal_Int8*>(pBuffer), preamblelen);
+            rStream->writeBytes(buf);
+
+            rtl::OStringBuffer aComment;
+            aComment.append(RTL_CONSTASCII_STRINGPARAM("<!--"));
+            aComment.append(comphelper::xml::makeXMLChaff());
+            aComment.append(RTL_CONSTASCII_STRINGPARAM("-->"));
+
+            buf = uno::Sequence<sal_Int8>(
+                reinterpret_cast<const sal_Int8*>(aComment.getStr()), aComment.getLength());
+            rStream->writeBytes(buf);
+
+            buf = uno::Sequence<sal_Int8>(
+                reinterpret_cast<sal_Int8*>(postcomment), length-preamblelen);
+            rStream->writeBytes(buf);
+        }
+    }
+}
+
 void SAL_CALL
 librdf_Repository::exportGraph(::sal_Int16 i_Format,
     const uno::Reference< io::XOutputStream > & i_xOutStream,
@@ -1130,10 +1179,7 @@ throw (uno::RuntimeException, lang::IllegalArgumentException,
             "librdf_serializer_serialize_stream_to_counted_string failed")),
             *this);
     }
-    const uno::Sequence<sal_Int8> buf(
-        reinterpret_cast<sal_Int8*>(pBuf.get()), length);
-    // exceptions are propagated
-    i_xOutStream->writeBytes(buf);
+    addChaffWhenEncryptedStorage(i_xOutStream, pBuf.get(), length);
 }
 
 uno::Sequence< uno::Reference< rdf::XURI > > SAL_CALL
diff --git a/xmloff/inc/xmloff/xmlexp.hxx b/xmloff/inc/xmloff/xmlexp.hxx
index 153065f9b970..c1bb9c05eb17 100644
--- a/xmloff/inc/xmloff/xmlexp.hxx
+++ b/xmloff/inc/xmloff/xmlexp.hxx
@@ -431,6 +431,8 @@ public:
 
     SvXMLUnitConverter& GetMM100UnitConverter() { return *mpUnitConv; }
 
+    void addChaffWhenEncryptedStorage();
+
     // Export the document.
     virtual sal_uInt32 exportDoc( enum ::xmloff::token::XMLTokenEnum eClass = ::xmloff::token::XML_TOKEN_INVALID );
 
diff --git a/xmloff/source/core/xmlexp.cxx b/xmloff/source/core/xmlexp.cxx
index 25f1e093cf03..7b03fad5a4a9 100644
--- a/xmloff/source/core/xmlexp.cxx
+++ b/xmloff/source/core/xmlexp.cxx
@@ -94,10 +94,11 @@
 #include <tools/inetdef.hxx>
 #include <com/sun/star/document/XDocumentProperties.hpp>
 #include <com/sun/star/document/XDocumentPropertiesSupplier.hpp>
-
+#include <com/sun/star/embed/XEncryptionProtectedSource2.hpp>
 #include <com/sun/star/rdf/XMetadatable.hpp>
 #include "RDFaExportHelper.hxx"
 
+#include <comphelper/xmltools.hxx>
 
 using ::rtl::OUString;
 
@@ -1278,6 +1279,16 @@ lcl_AddGrddl(SvXMLExport & rExport, const sal_Int32 /*nExportMode*/)
 #endif
 }
 
+void SvXMLExport::addChaffWhenEncryptedStorage()
+{
+    uno::Reference< embed::XEncryptionProtectedSource2 > xEncr(mpImpl->mxTargetStorage, uno::UNO_QUERY);
+
+    if (xEncr.is() && xEncr->hasEncryptionData() && mxExtHandler.is())
+    {
+        mxExtHandler->comment(rtl::OStringToOUString(comphelper::xml::makeXMLChaff(), RTL_TEXTENCODING_ASCII_US));
+    }
+}
+
 sal_uInt32 SvXMLExport::exportDoc( enum ::xmloff::token::XMLTokenEnum eClass )
 {
     bool bOwnGraphicResolver = false;
@@ -1366,9 +1377,10 @@ sal_uInt32 SvXMLExport::exportDoc( enum ::xmloff::token::XMLTokenEnum eClass )
         }
     }
 
-
     mxHandler->startDocument();
 
+    addChaffWhenEncryptedStorage();
+
     // <office:document ...>
     CheckAttrList();
 
diff --git a/xmloff/source/meta/MetaExportComponent.cxx b/xmloff/source/meta/MetaExportComponent.cxx
index 37af37bb498e..fac1984e3e39 100644
--- a/xmloff/source/meta/MetaExportComponent.cxx
+++ b/xmloff/source/meta/MetaExportComponent.cxx
@@ -135,6 +135,9 @@ sal_uInt32 XMLMetaExportComponent::exportDoc( enum XMLTokenEnum )
 
 
     xDocHandler->startDocument();
+
+    addChaffWhenEncryptedStorage();
+
     {
 
         const SvXMLNamespaceMap& rMap = GetNamespaceMap();
diff --git a/xmloff/source/meta/xmlversion.cxx b/xmloff/source/meta/xmlversion.cxx
index 8163dd5adbb1..c80f5f7a5e66 100644
--- a/xmloff/source/meta/xmlversion.cxx
+++ b/xmloff/source/meta/xmlversion.cxx
@@ -75,6 +75,8 @@ sal_uInt32 XMLVersionListExport::exportDoc( enum ::xmloff::token::XMLTokenEnum )
 {
     GetDocHandler()->startDocument();
 
+    addChaffWhenEncryptedStorage();
+
     sal_uInt16 nPos = _GetNamespaceMap().GetIndexByKey( XML_NAMESPACE_DC );
 
     AddAttribute( XML_NAMESPACE_NONE, _GetNamespaceMap().GetAttrNameByIndex( nPos ),
diff --git a/xmloff/source/text/XMLAutoTextEventExport.cxx b/xmloff/source/text/XMLAutoTextEventExport.cxx
index 1b14c1fb9665..30cc1246c700 100644
--- a/xmloff/source/text/XMLAutoTextEventExport.cxx
+++ b/xmloff/source/text/XMLAutoTextEventExport.cxx
@@ -168,6 +168,8 @@ sal_uInt32 XMLAutoTextEventExport::exportDoc( enum XMLTokenEnum )
     {
         GetDocHandler()->startDocument();
 
+        addChaffWhenEncryptedStorage();
+
         addNamespaces();
 
         {