Skip to content
This repository was archived by the owner on May 5, 2021. It is now read-only.

Commit b22385f

Browse files
MateStrysewskeMateStrysewske
committed
Merge remote-tracking branch 'origin/change-4095-migrate_docx4j' into hotfix-1.54.1
2 parents b8797c2 + 64e1253 commit b22385f

4 files changed

Lines changed: 45 additions & 6 deletions

File tree

‎sormas-backend/pom.xml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,12 +85,20 @@
8585
<artifactId>fr.opensagres.xdocreport.template.velocity</artifactId>
8686
</dependency>
8787

88+
<dependency>
89+
<groupId>org.docx4j</groupId>
90+
<artifactId>docx4j-docx-anon</artifactId>
91+
</dependency>
92+
<dependency>
93+
<groupId>org.docx4j</groupId>
94+
<artifactId>docx4j-JAXB-ReferenceImpl</artifactId>
95+
</dependency>
96+
8897
<dependency>
8998
<groupId>org.freemarker</groupId>
9099
<artifactId>freemarker</artifactId>
91100
</dependency>
92101

93-
94102
<!-- Testing -->
95103

96104
<dependency>

‎sormas-backend/src/main/java/de/symeda/sormas/backend/docgeneration/TemplateEngineService.java‎

Lines changed: 22 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@
1414
import javax.ejb.LocalBean;
1515
import javax.ejb.Stateless;
1616

17+
import org.docx4j.openpackaging.exceptions.Docx4JException;
18+
import org.docx4j.openpackaging.packages.WordprocessingMLPackage;
1719
import org.slf4j.Logger;
1820
import org.slf4j.LoggerFactory;
1921

@@ -37,7 +39,7 @@ public class TemplateEngineService {
3739
private ConfigFacadeEjb.ConfigFacadeEjbLocal configFacade;
3840

3941
public Set<String> extractTemplateVariables(InputStream templateFile) throws IOException, XDocReportException {
40-
IXDocReport report = XDocReportRegistry.getRegistry().loadReport(templateFile, TemplateEngineKind.Velocity);
42+
IXDocReport report = readXDocReport(templateFile);
4143

4244
FieldsExtractor<FieldExtractor> extractor = FieldsExtractor.create();
4345
report.extractFields(extractor);
@@ -60,7 +62,7 @@ public Set<String> extractTemplateVariables(InputStream templateFile) throws IOE
6062
}
6163

6264
public InputStream generateDocument(Properties properties, InputStream templateFile) throws IOException, XDocReportException {
63-
IXDocReport report = XDocReportRegistry.getRegistry().loadReport(templateFile, TemplateEngineKind.Velocity);
65+
IXDocReport report = readXDocReport(templateFile);
6466

6567
IContext context = report.createContext();
6668
for (Object key : properties.keySet()) {
@@ -78,8 +80,9 @@ public InputStream generateDocument(Properties properties, InputStream templateF
7880
}
7981

8082
public void validateTemplate(InputStream templateFile) {
83+
8184
try {
82-
IXDocReport report = XDocReportRegistry.getRegistry().loadReport(templateFile, TemplateEngineKind.Velocity);
85+
IXDocReport report = readXDocReport(templateFile);
8386
FieldsExtractor<FieldExtractor> extractor = FieldsExtractor.create();
8487
report.extractFields(extractor);
8588
} catch (Exception e) {
@@ -90,4 +93,20 @@ public void validateTemplate(InputStream templateFile) {
9093
public String getTempDir() {
9194
return configFacade.getCustomFilesPath();
9295
}
96+
97+
private IXDocReport readXDocReport(InputStream templateFile) throws IOException, XDocReportException {
98+
99+
try {
100+
// Sanitize docx template for XXEs
101+
WordprocessingMLPackage wordMLPackage = WordprocessingMLPackage.load(templateFile);
102+
wordMLPackage.getDocumentModel();
103+
104+
ByteArrayOutputStream outStream = new ByteArrayOutputStream();
105+
wordMLPackage.save(outStream);
106+
ByteArrayInputStream inStream1 = new ByteArrayInputStream(outStream.toByteArray());
107+
return XDocReportRegistry.getRegistry().loadReport(inStream1, TemplateEngineKind.Velocity);
108+
} catch (Docx4JException e) {
109+
throw new IllegalArgumentException(e.getMessage(), e);
110+
}
111+
}
93112
}

‎sormas-backend/src/test/java/de/symeda/sormas/backend/docgeneration/QuarantineOrderFacadeEjbTest.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -191,15 +191,15 @@ public void validateTemplateTest() throws IOException {
191191
quarantineOrderFacadeEjb.writeQuarantineTemplate("TemplateFileToBeValidated.docx", new byte[0]);
192192
fail("Invalid docx file not recognized.");
193193
} catch (IllegalArgumentException e) {
194-
assertEquals("InputStream is not a zip.", e.getMessage());
194+
assertEquals("Error reading from the stream (no bytes available)", e.getMessage());
195195
}
196196
try {
197197
byte[] document = IOUtils.toByteArray(getClass().getResourceAsStream("/docgeneration/quarantine/FaultyTemplate.docx"));
198198
quarantineOrderFacadeEjb.writeQuarantineTemplate("TemplateFileToBeValidated.docx", document);
199199
fail("Syntax error not recognized.");
200200
} catch (IllegalArgumentException e) {
201201
String message =
202-
"org.apache.velocity.runtime.parser.TemplateParseException: Encountered \"].</w:t></w:r></w:p><w:p><w:pPr><w:pStyle w:val=\\\"Normal\\\"/><w:bidi w:val=\\\"0\\\"/><w:ind w:right=\\\"3117\\\" w:hanging=\\\"0\\\"/><w:jc w:val=\\\"both\\\"/><w:rPr><w:rFonts w:ascii=\\\"DejaVu Sans\\\" w:hAnsi=\\\"DejaVu Sans\\\"/><w:sz w:val=\\\"21\\\"/><w:szCs w:val=\\\"21\\\"/></w:rPr></w:pPr><w:r><w:rPr><w:b w:val=\\\"false\\\"/><w:bCs w:val=\\\"false\\\"/></w:rPr></w:r></w:p><w:p><w:pPr><w:pStyle w:val=\\\"Normal\\\"/><w:bidi w:val=\\\"0\\\"/><w:ind w:right=\\\"3117\\\" w:hanging=\\\"0\\\"/><w:jc w:val=\\\"both\\\"/><w:rPr><w:b w:val=\\\"false\\\"/><w:b w:val=\\\"false\\\"/><w:bCs w:val=\\\"false\\\"/></w:rPr></w:pPr><w:r><w:rPr><w:rFonts w:ascii=\\\"DejaVu Sans\\\" w:hAnsi=\\\"DejaVu Sans\\\"/><w:b w:val=\\\"false\\\"/><w:bCs w:val=\\\"false\\\"/><w:sz w:val=\\\"21\\\"/><w:szCs w:val=\\\"21\\\"/></w:rPr><w:t>Processing of this template should fail.</w:t></w:r></w:p><w:sectPr><w:type w:val=\\\"nextPage\\\"/><w:pgSz w:w=\\\"11906\\\" w:h=\\\"16838\\\"/><w:pgMar w:left=\\\"1134\\\" w:right=\\\"1134\\\" w:header=\\\"0\\\" w:top=\\\"1134\\\" w:footer=\\\"0\\\" w:bottom=\\\"1134\\\" w:gutter=\\\"0\\\"/><w:pgNumType w:fmt=\\\"decimal\\\"/><w:formProt w:val=\\\"false\\\"/><w:textDirection w:val=\\\"lrTb\\\"/><w:docGrid w:type=\\\"default\\\" w:linePitch=\\\"100\\\" w:charSpace=\\\"0\\\"/></w:sectPr></w:body></w:document>\" at word/document.xml[line 1, column 1240]\n"
202+
"org.apache.velocity.runtime.parser.TemplateParseException: Encountered \"].</w:t>\\n </w:r>\\n </w:p>\\n <w:p>\\n <w:pPr>\\n <w:pStyle w:val=\\\"Normal\\\"/>\\n <w:bidi w:val=\\\"false\\\"/>\\n <w:ind w:right=\\\"3117\\\" w:hanging=\\\"0\\\"/>\\n <w:jc w:val=\\\"both\\\"/>\\n <w:rPr>\\n <w:rFonts w:ascii=\\\"DejaVu Sans\\\" w:hAnsi=\\\"DejaVu Sans\\\"/>\\n <w:sz w:val=\\\"21\\\"/>\\n <w:szCs w:val=\\\"21\\\"/>\\n </w:rPr>\\n </w:pPr>\\n <w:r>\\n <w:rPr>\\n <w:b w:val=\\\"false\\\"/>\\n <w:bCs w:val=\\\"false\\\"/>\\n </w:rPr>\\n </w:r>\\n </w:p>\\n <w:p>\\n <w:pPr>\\n <w:pStyle w:val=\\\"Normal\\\"/>\\n <w:bidi w:val=\\\"false\\\"/>\\n <w:ind w:right=\\\"3117\\\" w:hanging=\\\"0\\\"/>\\n <w:jc w:val=\\\"both\\\"/>\\n <w:rPr>\\n <w:b w:val=\\\"false\\\"/>\\n <w:bCs w:val=\\\"false\\\"/>\\n </w:rPr>\\n </w:pPr>\\n <w:r>\\n <w:rPr>\\n <w:rFonts w:ascii=\\\"DejaVu Sans\\\" w:hAnsi=\\\"DejaVu Sans\\\"/>\\n <w:b w:val=\\\"false\\\"/>\\n <w:bCs w:val=\\\"false\\\"/>\\n <w:sz w:val=\\\"21\\\"/>\\n <w:szCs w:val=\\\"21\\\"/>\\n </w:rPr>\\n <w:t>Processing of this template should fail.</w:t>\\n </w:r>\\n </w:p>\\n <w:sectPr>\\n <w:type w:val=\\\"nextPage\\\"/>\\n <w:pgSz w:w=\\\"11906\\\" w:h=\\\"16838\\\"/>\\n <w:pgMar w:top=\\\"1134\\\" w:right=\\\"1134\\\" w:bottom=\\\"1134\\\" w:left=\\\"1134\\\" w:header=\\\"0\\\" w:footer=\\\"0\\\" w:gutter=\\\"0\\\"/>\\n <w:pgNumType w:fmt=\\\"decimal\\\"/>\\n <w:formProt w:val=\\\"false\\\"/>\\n <w:textDirection w:val=\\\"lrTb\\\"/>\\n <w:docGrid w:type=\\\"default\\\" w:linePitch=\\\"100\\\" w:charSpace=\\\"0\\\"/>\\n </w:sectPr>\\n </w:body>\\n</w:document>\" at word/document.xml[line 22, column 59]\n"
203203
+ "Was expecting one of:\n" //
204204
+ " \"[\" ...\n" //
205205
+ " \"}\" ...\n ";

‎sormas-base/pom.xml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
<bouncycastle.version>1.67</bouncycastle.version>
3434
<keycloak.version>12.0.1</keycloak.version>
3535
<xdocreport.version>2.0.2</xdocreport.version>
36+
<docx4j.version>8.2.8</docx4j.version>
3637

3738
<!-- Attention: Compile dependencies with versions are maintained redundantly in sormas-app/app/build.gradle -->
3839

@@ -616,6 +617,17 @@
616617
<version>${swagger.version}</version>
617618
</dependency>
618619

620+
<dependency>
621+
<groupId>org.docx4j</groupId>
622+
<artifactId>docx4j-docx-anon</artifactId>
623+
<version>${docx4j.version}</version>
624+
</dependency>
625+
<dependency>
626+
<groupId>org.docx4j</groupId>
627+
<artifactId>docx4j-JAXB-ReferenceImpl</artifactId>
628+
<version>${docx4j.version}</version>
629+
</dependency>
630+
619631
<dependency>
620632
<groupId>org.freemarker</groupId>
621633
<artifactId>freemarker</artifactId>

0 commit comments

Comments
 (0)