Skip to content
This repository was archived by the owner on May 5, 2021. It is now read-only.

Commit 3d61a80

Browse files
syntakkersyntakker
authored
Merge pull request SORMAS-Foundation#4262 from hzi-braunschweig/bugfix-4057-findings
Bugfixes for findings SORMAS-Foundation#4057, SORMAS-Foundation#2906
2 parents fc46f53 + 2cbfa83 commit 3d61a80

File tree

22 files changed

+228
-156
lines changed

22 files changed

+228
-156
lines changed

‎sormas-api/src/main/java/de/symeda/sormas/api/utils/DataHelper.java

+5-8
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,18 @@
1-
/*******************************************************************************
1+
/*
22
* SORMAS® - Surveillance Outbreak Response Management & Analysis System
3-
* Copyright © 2016-2018 Helmholtz-Zentrum für Infektionsforschung GmbH (HZI)
4-
*
3+
* Copyright © 2016-2021 Helmholtz-Zentrum für Infektionsforschung GmbH (HZI)
54
* This program is free software: you can redistribute it and/or modify
65
* it under the terms of the GNU General Public License as published by
76
* the Free Software Foundation, either version 3 of the License, or
87
* (at your option) any later version.
9-
*
108
* This program is distributed in the hope that it will be useful,
119
* but WITHOUT ANY WARRANTY; without even the implied warranty of
1210
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
1311
* GNU General Public License for more details.
14-
*
1512
* You should have received a copy of the GNU General Public License
1613
* along with this program. If not, see <https://www.gnu.org/licenses/>.
17-
*******************************************************************************/
14+
*/
15+
1816
package de.symeda.sormas.api.utils;
1917

2018
import java.io.BufferedReader;
@@ -35,7 +33,6 @@
3533
import java.util.TreeSet;
3634

3735
import de.symeda.sormas.api.AgeGroup;
38-
import de.symeda.sormas.api.EntityDto;
3936
import de.symeda.sormas.api.HasUuid;
4037
import de.symeda.sormas.api.Language;
4138
import de.symeda.sormas.api.caze.AgeAndBirthDateDto;
@@ -156,7 +153,7 @@ public static byte[] longToBytes(long x, long y) {
156153
return buffer.array();
157154
}
158155

159-
public static String getShortUuid(EntityDto domainObject) {
156+
public static String getShortUuid(HasUuid domainObject) {
160157
return getShortUuid(domainObject.getUuid());
161158
}
162159

‎sormas-api/src/test/java/de/symeda/sormas/api/utils/DataHelperTest.java

+28
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,13 @@
22

33
import static org.junit.Assert.assertEquals;
44
import static org.junit.Assert.assertNull;
5+
import static org.junit.Assert.fail;
56

67
import org.junit.Test;
78

89
import de.symeda.sormas.api.Disease;
10+
import de.symeda.sormas.api.EntityDto;
11+
import de.symeda.sormas.api.ReferenceDto;
912
import de.symeda.sormas.api.caze.CaseDataDto;
1013
import de.symeda.sormas.api.region.RegionReferenceDto;
1114

@@ -42,4 +45,29 @@ public void testTryParseLong() {
4245
assertEquals((Long) Long.MAX_VALUE, DataHelper.tryParseLong(String.valueOf(Long.MAX_VALUE)));
4346
assertNull(DataHelper.tryParseLong(String.valueOf(Long.MAX_VALUE) + "0"));
4447
}
48+
49+
@Test
50+
public void testShortUuid() {
51+
EntityDto entityDto = new EntityDto() {
52+
};
53+
entityDto.setUuid("ABCDEF-GHIJKL");
54+
55+
assertEquals("ABCDEF", DataHelper.getShortUuid(entityDto));
56+
57+
ReferenceDto referenceDto = new ReferenceDto() {
58+
};
59+
referenceDto.setUuid("MNOPQR-STUVWX");
60+
61+
assertEquals("MNOPQR", DataHelper.getShortUuid(referenceDto));
62+
63+
assertEquals("UZOUEH", DataHelper.getShortUuid("UZOUEH-HP7DRG-YOJ74F-PXWL2JZ4"));
64+
assertNull(DataHelper.getShortUuid((String) null));
65+
66+
try {
67+
assertEquals("A", DataHelper.getShortUuid("A"));
68+
fail("getShortUuid should not be graceful on Uuids that are too short.");
69+
} catch (StringIndexOutOfBoundsException e) {
70+
assertEquals("begin 0, end 6, length 1", e.getMessage());
71+
}
72+
}
4573
}

‎sormas-backend/src/main/java/de/symeda/sormas/backend/docgeneration/CleanHtmlReference.java

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
/*
2+
* SORMAS® - Surveillance Outbreak Response Management & Analysis System
3+
* Copyright © 2016-2021 Helmholtz-Zentrum für Infektionsforschung GmbH (HZI)
4+
* This program is free software: you can redistribute it and/or modify
5+
* it under the terms of the GNU General Public License as published by
6+
* the Free Software Foundation, either version 3 of the License, or
7+
* (at your option) any later version.
8+
* This program is distributed in the hope that it will be useful,
9+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
10+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11+
* GNU General Public License for more details.
12+
* You should have received a copy of the GNU General Public License
13+
* along with this program. If not, see <https://www.gnu.org/licenses/>.
14+
*/
15+
16+
package de.symeda.sormas.backend.docgeneration;
17+
18+
import org.apache.velocity.app.event.ReferenceInsertionEventHandler;
19+
20+
import de.symeda.sormas.api.utils.HtmlHelper;
21+
22+
public class CleanHtmlReference implements ReferenceInsertionEventHandler {
23+
24+
@Override
25+
public Object referenceInsert(String s, Object o) {
26+
return o == null ? null : HtmlHelper.cleanHtml(o.toString(), HtmlHelper.EVENTACTION_WHITELIST);
27+
}
28+
}

‎sormas-backend/src/main/java/de/symeda/sormas/backend/docgeneration/TemplateEngine.java

+15-2
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
import java.io.InputStreamReader;
2626
import java.io.Reader;
2727
import java.io.StringWriter;
28+
import java.nio.charset.StandardCharsets;
2829
import java.util.HashSet;
2930
import java.util.Properties;
3031
import java.util.Set;
@@ -43,13 +44,17 @@
4344
import org.apache.velocity.util.introspection.SecureUberspector;
4445
import org.docx4j.openpackaging.exceptions.Docx4JException;
4546
import org.docx4j.openpackaging.packages.WordprocessingMLPackage;
47+
import org.jsoup.Jsoup;
48+
import org.jsoup.nodes.Document.OutputSettings;
49+
import org.jsoup.safety.Whitelist;
4650
import org.slf4j.Logger;
4751
import org.slf4j.LoggerFactory;
4852

4953
import de.symeda.sormas.api.docgeneneration.DocumentTemplateException;
5054
import de.symeda.sormas.api.docgeneneration.DocumentVariables;
5155
import de.symeda.sormas.api.i18n.I18nProperties;
5256
import de.symeda.sormas.api.i18n.Strings;
57+
import de.symeda.sormas.api.utils.HtmlHelper;
5358
import fr.opensagres.xdocreport.core.XDocReportException;
5459
import fr.opensagres.xdocreport.document.IXDocReport;
5560
import fr.opensagres.xdocreport.document.registry.XDocReportRegistry;
@@ -63,9 +68,11 @@
6368
public class TemplateEngine {
6469

6570
private static final Pattern VARIABLE_PATTERN = Pattern.compile("([{] *(!)? *([A-Za-z0-9._]+) *[}]| *(!)? *([A-Za-z0-9._]+) *)");
71+
private static final Whitelist HTML_TEMPLATE_WHITELIST =
72+
HtmlHelper.EVENTACTION_WHITELIST.addAttributes("div", "class").addAttributes("span", "class").addAttributes("table", "class");
6673
private static final Logger logger = LoggerFactory.getLogger(TemplateEngine.class);
6774

68-
private Properties xdocVelocityProperties;
75+
private final Properties xdocVelocityProperties;
6976

7077
public TemplateEngine() {
7178
xdocVelocityProperties = new Properties();
@@ -136,6 +143,9 @@ public String generateDocumentTxt(Properties properties, File templateFile) {
136143
velocityEngine.setProperty(RuntimeConstants.UBERSPECT_CLASSNAME, SecureUberspector.class.getCanonicalName());
137144
// Disable Includes
138145
velocityEngine.setProperty(RuntimeConstants.EVENTHANDLER_INCLUDE, NoIncludesEventHandler.class.getCanonicalName());
146+
// Clean Html
147+
velocityEngine.setProperty(RuntimeConstants.EVENTHANDLER_REFERENCEINSERTION, CleanHtmlReference.class.getCanonicalName());
148+
139149
velocityEngine.setProperty(RuntimeConstants.RESOURCE_LOADER, "file");
140150
velocityEngine.setProperty(RuntimeConstants.FILE_RESOURCE_LOADER_PATH, FilenameUtils.getFullPathNoEndSeparator(templateFile.getPath()));
141151
Template template = velocityEngine.getTemplate(templateFile.getName());
@@ -152,7 +162,10 @@ public String generateDocumentTxt(Properties properties, File templateFile) {
152162

153163
StringWriter stringWriter = new StringWriter();
154164
template.merge(velocityContext, stringWriter);
155-
return stringWriter.toString();
165+
OutputSettings outputSettings = new OutputSettings();
166+
outputSettings.prettyPrint(false);
167+
outputSettings.charset(StandardCharsets.UTF_8);
168+
return Jsoup.clean(stringWriter.toString(), "", HTML_TEMPLATE_WHITELIST, outputSettings);
156169
}
157170

158171
public void validateTemplateDocx(InputStream templateInputStream) throws DocumentTemplateException {

‎sormas-backend/src/main/resources/docgeneration/sormasStyle.html

+3
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,9 @@
3535
div.actions {
3636
margin-top: 35px;
3737
}
38+
.red {
39+
color: #f00;
40+
}
3841
</style>
3942
</header>
4043
<body>

‎sormas-backend/src/test/resources/docgeneration/eventHandout/EventHandout.cmp

+8-5
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,9 @@
3535
div.actions {
3636
margin-top: 35px;
3737
}
38+
.red {
39+
color: #f00;
40+
}
3841
</style>
3942
</header>
4043
<body>
@@ -44,18 +47,18 @@
4447
<p>...where people meet</p>
4548

4649
<table>
47-
<tr><th>Disease</th><th>Status</th><th>Event Date</th><th>Report Date</th></tr>
50+
<tbody><tr><th>Disease</th><th>Status</th><th>Event Date</th><th>Report Date</th></tr>
4851
<tr><td>COVID-19</td><td>Signal</td><td>11/12/2020</td><td>11/13/2020</td></tr>
49-
</table>
52+
</tbody></table>
5053

5154
<h2>Event Participants</h2>
5255

5356
<table>
54-
<tr><th>First Name</th><th>Last Name</th><th>Phone</th><th>Contacted</th></tr>
57+
<tbody><tr><th>First Name</th><th>Last Name</th><th>Phone</th><th>Contacted</th></tr>
5558
<tr><td>Georges</td><td>Bataille</td><td>+49 681 8901</td><td>[ ]</td></tr>
5659
<tr><td>Guy</td><td>Debord</td><td>+49 681 4567</td><td>[ ]</td></tr>
5760
<tr><td>Isidore</td><td>Isou</td><td>+49 681 1234</td><td>[ ]</td></tr>
58-
</table>
61+
</tbody></table>
5962

6063

6164
<div class="actions">
@@ -68,7 +71,7 @@
6871
<h2>Another action</h2>
6972
<p>11/15/2020</p>
7073
<div> This action hast no reply </div>
71-
<div> <span style="color:#f00">*</span> </div>
74+
<div> <span class="red">*</span> </div>
7275
</div>
7376

7477
</body>

‎sormas-backend/src/test/resources/docgeneration/eventHandout/EventHandout.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,6 @@ <h2>Event Participants</h2>
2323
<h2>$action.title</h2>
2424
<p>$F.format($action.getDate())</p>
2525
<div>#if($action.getDescription()) $action.getDescription() #else <span style="color:#f00">*</span> #end</div>
26-
<div>#if($action.reply) $action.reply #else <span style="color:#f00">*</span> #end</div>
26+
<div>#if($action.reply) $action.reply #else <span class="red">*</span> #end</div>
2727
</div>
2828
#end

‎sormas-backend/src/test/resources/docgeneration/eventHandout/EventHandoutError.cmp

+3
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,9 @@
3535
div.actions {
3636
margin-top: 35px;
3737
}
38+
.red {
39+
color: #f00;
40+
}
3841
</style>
3942
</header>
4043
<body>

‎sormas-backend/src/test/resources/docgeneration/eventHandout/EventHandoutNullableVariables.cmp

+3
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,9 @@
3535
div.actions {
3636
margin-top: 35px;
3737
}
38+
.red {
39+
color: #f00;
40+
}
3841
</style>
3942
</header>
4043
<body>

‎sormas-backend/src/test/resources/docgeneration/eventHandout/EventHandoutPreformatting.cmp

+8-5
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,9 @@
3535
div.actions {
3636
margin-top: 35px;
3737
}
38+
.red {
39+
color: #f00;
40+
}
3841
</style>
3942
</header>
4043
<body>
@@ -44,18 +47,18 @@
4447
<p>...where people meet</p>
4548

4649
<table>
47-
<tr><th>Disease</th><th>Status</th><th>Event Date</th><th>Report Date</th><th>User</th></tr>
50+
<tbody><tr><th>Disease</th><th>Status</th><th>Event Date</th><th>Report Date</th><th>User</th></tr>
4851
<tr><td>COVID-19</td><td>Signal</td><td>11/12/2020</td><td>11/13/2020</td><td>Surv Sup</td></tr>
49-
</table>
52+
</tbody></table>
5053

5154
<h2>Event Participants</h2>
5255

5356
<table>
54-
<tr><th>First Name</th><th>Last Name</th><th>Phone</th><th>Contacted</th></tr>
57+
<tbody><tr><th>First Name</th><th>Last Name</th><th>Phone</th><th>Contacted</th></tr>
5558
<tr><td>Georges</td><td>Bataille</td><td>+49 681 8901</td><td>[ ]</td></tr>
5659
<tr><td>Guy</td><td>Debord</td><td>+49 681 4567</td><td>[ ]</td></tr>
5760
<tr><td>Isidore</td><td>Isou</td><td>+49 681 1234</td><td>[ ]</td></tr>
58-
</table>
61+
</tbody></table>
5962

6063

6164
<div class="actions">
@@ -68,7 +71,7 @@
6871
<h2>Another action</h2>
6972
<p>11/15/2020</p>
7073
<div> This action hast no reply </div>
71-
<div> <span style="color:#f00">*</span> </div>
74+
<div> <span class="red">*</span> </div>
7275
</div>
7376

7477
</body>

‎sormas-backend/src/test/resources/docgeneration/eventHandout/EventHandoutPreformatting.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,6 @@ <h2>Event Participants</h2>
2323
<h2>$action.title</h2>
2424
<p>$F.format($action.getDate())</p>
2525
<div>#if($action.getDescription()) $action.getDescription() #else <span style="color:#f00">*</span> #end</div>
26-
<div>#if($action.reply) $action.reply #else <span style="color:#f00">*</span> #end</div>
26+
<div>#if($action.reply) $action.reply #else <span class="red">*</span> #end</div>
2727
</div>
2828
#end

‎sormas-backend/src/test/resources/docgeneration/testcasesTxt/CleanHtml.cmp

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
This is a test:

‎sormas-backend/src/test/resources/docgeneration/testcasesTxt/CleanHtml.properties

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
alert=This is a test: <script>alert('Hey!');</script>

‎sormas-backend/src/test/resources/docgeneration/testcasesTxt/CleanHtml.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
$alert

‎sormas-cargoserver/src/main/resources/layout/sormasfolders/custom/docgeneration/eventHandout/EventHandout.html

-68
This file was deleted.

0 commit comments

Comments
 (0)