Skip to content

Commit 5e74d1a

Browse files
author
pavel-zrb
authored
Merge pull request #8 from sbervinov/master
Fixed security vulnerabilities, updated integration tests
2 parents 47445c3 + bbe1645 commit 5e74d1a

8 files changed

Lines changed: 514 additions & 150 deletions

File tree

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ java -DSERVER_PORT=8081 -jar libreoffice-api-wrapper-server-1.0-jar-with-depende
3333
* Выполнить локально команды:
3434

3535
```bash
36-
mvn -Dmaven.test.skip=true package
36+
mvn -Dmaven.test.skip=true clean package
3737
```
3838
Далее необходимо запустить libreoffice-api-wrapper-server.jar и докер для тестов:
3939

‎libreoffice-api-wrapper-server/pom.xml‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
<?xml version="1.0" encoding="UTF-8"?>
2-
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5+
36
<modelVersion>4.0.0</modelVersion>
47

58
<artifactId>libreoffice-api-wrapper-server</artifactId>
@@ -11,9 +14,6 @@
1114
<version>3.1.5</version>
1215
</parent>
1316

14-
15-
16-
1717
<build>
1818
<plugins>
1919
<plugin>
@@ -114,6 +114,11 @@
114114
<groupId>org.apache.xmlgraphics</groupId>
115115
<artifactId>batik-codec</artifactId>
116116
</dependency>
117+
<dependency>
118+
<groupId>org.apache.httpcomponents</groupId>
119+
<artifactId>httpclient</artifactId>
120+
<scope>test</scope>
121+
</dependency>
117122
</dependencies>
118123

119124
<distributionManagement>
@@ -124,5 +129,4 @@
124129
</repository>
125130
</distributionManagement>
126131

127-
128132
</project>

‎libreoffice-api-wrapper-server/src/main/java/com/payneteasy/libreofficewrapper/server/servlet/LibreofficeConverterServlet.java‎

Lines changed: 101 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
package com.payneteasy.libreofficewrapper.server.servlet;
22

3+
import javax.servlet.http.HttpServlet;
4+
import javax.servlet.http.HttpServletRequest;
5+
import javax.servlet.http.HttpServletResponse;
6+
import java.io.IOException;
7+
import java.util.HashSet;
8+
import java.util.Set;
9+
310
import com.artofsolving.jodconverter.DefaultDocumentFormatRegistry;
411
import com.artofsolving.jodconverter.DocumentConverter;
512
import com.artofsolving.jodconverter.DocumentFamily;
@@ -9,37 +16,42 @@
916
import com.artofsolving.jodconverter.openoffice.converter.StreamOpenOfficeDocumentConverter;
1017
import com.payneteasy.libreofficewrapper.server.config.ILibreofficeServiceConfiguration;
1118
import com.payneteasy.startup.parameters.StartupParametersFactory;
12-
13-
import java.io.IOException;
14-
import java.util.HashSet;
15-
import java.util.Set;
16-
17-
import javax.servlet.http.HttpServlet;
18-
import javax.servlet.http.HttpServletRequest;
19-
import javax.servlet.http.HttpServletResponse;
20-
2119
import org.slf4j.Logger;
2220
import org.slf4j.LoggerFactory;
2321

22+
@SuppressWarnings("squid:S1989")
2423
public class LibreofficeConverterServlet extends HttpServlet {
2524

25+
private static final String TEXT_PLAIN_CONTENT_TYPE = "text/plain;charset=UTF-8";
26+
2627
private final Logger logger = LoggerFactory.getLogger(LibreofficeConverterServlet.class);
2728

2829
private final DefaultDocumentFormatRegistry formatRegistry = new DefaultDocumentFormatRegistry();
2930

3031
private final Set<String> availableDocumentFormats = new HashSet<>();
3132
private final Set<String> availableOutputFormats = new HashSet<>();
3233

33-
private final ILibreofficeServiceConfiguration libreofficeServiceConfiguration;
34+
private final ILibreofficeServiceConfiguration libreofficeServiceConfiguration =
35+
StartupParametersFactory.getStartupParameters(ILibreofficeServiceConfiguration.class);
3436

3537
public LibreofficeConverterServlet() {
36-
libreofficeServiceConfiguration = StartupParametersFactory.getStartupParameters(ILibreofficeServiceConfiguration.class);
37-
38-
// docx and xlsx formats are not in DefaultFormatRegistry, add manually
39-
final DocumentFormat docxFormat = new DocumentFormat("DOCX", DocumentFamily.TEXT, "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "docx");
40-
formatRegistry.addDocumentFormat(docxFormat);
41-
final DocumentFormat xlsxFormat = new DocumentFormat("XLSX", DocumentFamily.SPREADSHEET, "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "xlsx");
42-
formatRegistry.addDocumentFormat(xlsxFormat);
38+
formatRegistry.addDocumentFormat(
39+
new DocumentFormat(
40+
"DOCX",
41+
DocumentFamily.TEXT,
42+
"application/vnd.openxmlformats-officedocument.wordprocessingml.document",
43+
"docx"
44+
)
45+
);
46+
47+
formatRegistry.addDocumentFormat(
48+
new DocumentFormat(
49+
"XLSX",
50+
DocumentFamily.SPREADSHEET,
51+
"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
52+
"xlsx"
53+
)
54+
);
4355

4456
availableDocumentFormats.add("csv");
4557
availableDocumentFormats.add("doc");
@@ -49,45 +61,96 @@ public LibreofficeConverterServlet() {
4961

5062
availableOutputFormats.add("pdf");
5163

52-
logger.info("Libreoffice server configuration: host='{}', port={}", libreofficeServiceConfiguration.getLibreofficeHost(), libreofficeServiceConfiguration.getLibreofficePort());
53-
logger.info("Available document convert formats: {} -> {} ", availableDocumentFormats, availableOutputFormats);
64+
logger.info(
65+
"Libreoffice server configuration: host='{}', port={}\n" +
66+
"Available document convert formats: {} -> {}",
67+
libreofficeServiceConfiguration.getLibreofficeHost(),
68+
libreofficeServiceConfiguration.getLibreofficePort(),
69+
availableDocumentFormats,
70+
availableOutputFormats
71+
);
5472
}
5573

5674
@Override
57-
protected void doPost(final HttpServletRequest req, final HttpServletResponse resp) throws IOException {
58-
logger.info("Received POST request to {}", req.getServletPath());
59-
final String inputFormat = req.getParameter("inputFormat");
60-
final String outputFormat = req.getParameter("outputFormat");
75+
protected void doPost(
76+
HttpServletRequest request,
77+
HttpServletResponse response
78+
) throws IOException {
79+
logger.info("Received POST request to {}", request.getServletPath());
80+
81+
final String inputFormat = request.getParameter("inputFormat");
82+
final String outputFormat = request.getParameter("outputFormat");
6183

6284
if (inputFormat == null || !availableDocumentFormats.contains(inputFormat)) {
63-
resp.setStatus(HttpServletResponse.SC_BAD_REQUEST);
64-
resp.setContentType("text/plain;charset=UTF-8");
65-
resp.getWriter().print("Invalid input document format " + inputFormat + ", expected one of " + availableDocumentFormats.toString());
85+
response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
86+
response.setContentType(TEXT_PLAIN_CONTENT_TYPE);
87+
response
88+
.getWriter()
89+
.printf(
90+
"Invalid input document format %s, expected one of %s",
91+
inputFormat,
92+
availableDocumentFormats
93+
);
6694
return;
6795
}
96+
6897
if (outputFormat == null || !availableOutputFormats.contains(outputFormat)) {
69-
resp.setStatus(HttpServletResponse.SC_BAD_REQUEST);
70-
resp.setContentType("text/plain;charset=UTF-8");
71-
resp.getWriter().print("Invalid output document format " + outputFormat + ", expected one of " + availableDocumentFormats.toString());
98+
response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
99+
response.setContentType(TEXT_PLAIN_CONTENT_TYPE);
100+
response
101+
.getWriter()
102+
.printf(
103+
"Invalid output document format %s, expected one of %s",
104+
outputFormat,
105+
availableOutputFormats
106+
);
72107
return;
73108
}
74109

75110
logger.info("Converting request input from {} to {}", inputFormat, outputFormat);
76-
resp.setContentType(formatRegistry.getFormatByFileExtension(outputFormat).getMimeType());
111+
112+
response.setContentType(
113+
formatRegistry
114+
.getFormatByFileExtension(outputFormat)
115+
.getMimeType()
116+
);
77117

78118
OpenOfficeConnection connection = null;
79119
try {
80-
connection = new SocketOpenOfficeConnection(libreofficeServiceConfiguration.getLibreofficeHost(), libreofficeServiceConfiguration.getLibreofficePort());
120+
connection = new SocketOpenOfficeConnection(
121+
libreofficeServiceConfiguration.getLibreofficeHost(),
122+
libreofficeServiceConfiguration.getLibreofficePort()
123+
);
124+
81125
connection.connect();
82-
final DocumentConverter converter = new StreamOpenOfficeDocumentConverter(connection, formatRegistry);
83-
converter.convert(req.getInputStream(), formatRegistry.getFormatByFileExtension(inputFormat), resp.getOutputStream(), formatRegistry.getFormatByFileExtension(outputFormat));
126+
127+
final DocumentConverter converter = new StreamOpenOfficeDocumentConverter(
128+
connection,
129+
formatRegistry
130+
);
131+
132+
converter.convert(
133+
request.getInputStream(),
134+
formatRegistry.getFormatByFileExtension(inputFormat),
135+
response.getOutputStream(),
136+
formatRegistry.getFormatByFileExtension(outputFormat)
137+
);
138+
84139
logger.info("Converted document from {} to {}", inputFormat, outputFormat);
85-
} catch (final Exception e) {
140+
} catch (Exception e) {
86141
logger.error("Cannot convert file to {} format", outputFormat, e);
87-
resp.reset();
88-
resp.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
89-
resp.setContentType("text/plain;charset=UTF-8");
90-
resp.getWriter().print("Unexpected error while converting document from " + inputFormat + " to " + outputFormat + ": " + e.getMessage());
142+
143+
response.reset();
144+
response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
145+
response.setContentType(TEXT_PLAIN_CONTENT_TYPE);
146+
response
147+
.getWriter()
148+
.printf(
149+
"Unexpected error while converting document from %s to %s: %s",
150+
inputFormat,
151+
outputFormat,
152+
e.getMessage()
153+
);
91154
} finally {
92155
if (connection != null && connection.isConnected()) {
93156
connection.disconnect();

‎libreoffice-api-wrapper-server/src/main/java/com/payneteasy/libreofficewrapper/server/servlet/SvgToPngConverterServlet.java‎

Lines changed: 33 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,57 @@
11
package com.payneteasy.libreofficewrapper.server.servlet;
22

3+
import javax.servlet.http.HttpServlet;
4+
import javax.servlet.http.HttpServletRequest;
5+
import javax.servlet.http.HttpServletResponse;
6+
import java.io.BufferedInputStream;
7+
import java.io.BufferedOutputStream;
8+
import java.io.File;
9+
import java.io.FileInputStream;
10+
import java.io.FileOutputStream;
11+
import java.io.IOException;
12+
import java.io.OutputStream;
13+
314
import org.apache.batik.transcoder.TranscoderException;
415
import org.apache.batik.transcoder.TranscoderInput;
516
import org.apache.batik.transcoder.TranscoderOutput;
617
import org.apache.batik.transcoder.image.PNGTranscoder;
718
import org.slf4j.Logger;
819
import org.slf4j.LoggerFactory;
920

10-
import javax.servlet.ServletException;
11-
import javax.servlet.http.HttpServlet;
12-
import javax.servlet.http.HttpServletRequest;
13-
import javax.servlet.http.HttpServletResponse;
14-
import java.io.*;
15-
21+
@SuppressWarnings("squid:S1989")
1622
public class SvgToPngConverterServlet extends HttpServlet {
1723

1824
private final Logger logger = LoggerFactory.getLogger(SvgToPngConverterServlet.class);
1925

2026
@Override
21-
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
22-
logger.info("Received POST request to {}", req.getServletPath());
23-
File png = File.createTempFile("png", ".png");
24-
png.deleteOnExit();
27+
protected void doPost(
28+
HttpServletRequest request,
29+
HttpServletResponse response
30+
) throws IOException {
31+
logger.info("Received POST request to {}", request.getServletPath());
32+
33+
final File pngFile = File.createTempFile("png", ".pngFile");
34+
pngFile.deleteOnExit();
35+
2536
try {
26-
TranscoderInput transcoderInput = new TranscoderInput(req.getInputStream());
37+
final TranscoderInput transcoderInput = new TranscoderInput(request.getInputStream());
2738

28-
OutputStream os = new FileOutputStream(png);
29-
TranscoderOutput transcoderOutput = new TranscoderOutput(os);
30-
PNGTranscoder pngTranscoder = new PNGTranscoder();
39+
final OutputStream os = new FileOutputStream(pngFile);
40+
final TranscoderOutput transcoderOutput = new TranscoderOutput(os);
3141

42+
final PNGTranscoder pngTranscoder = new PNGTranscoder();
3243
pngTranscoder.transcode(transcoderInput, transcoderOutput);
3344

3445
os.flush();
3546
os.close();
3647

37-
resp.setContentType("image/png");
38-
resp.setContentLength((int) png.length());
48+
response.setContentType("image/png");
49+
response.setContentLength((int) pngFile.length());
50+
response.setHeader("Content-Disposition", "attachment; filename=" + pngFile.getName());
3951

40-
resp.setHeader("Content-Disposition", "attachment; filename=" + png.getName());
41-
try (BufferedInputStream inStream = new BufferedInputStream(new FileInputStream(png))) {
42-
BufferedOutputStream outStream = new BufferedOutputStream(resp.getOutputStream());
43-
byte[] buffer = new byte[1024];
52+
try (final BufferedInputStream inStream = new BufferedInputStream(new FileInputStream(pngFile))) {
53+
final BufferedOutputStream outStream = new BufferedOutputStream(response.getOutputStream());
54+
final byte[] buffer = new byte[1024];
4455
int bytesRead;
4556
while ((bytesRead = inStream.read(buffer)) != -1) {
4657
outStream.write(buffer, 0, bytesRead);
@@ -50,8 +61,8 @@ protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws S
5061
} catch (TranscoderException e) {
5162
logger.error("Cannot convert file to {} format", "png", e);
5263
} finally {
53-
if(png.exists()){
54-
png.delete();
64+
if (pngFile.exists()) {
65+
pngFile.delete();
5566
}
5667
}
5768
}

‎libreoffice-api-wrapper-server/src/main/java/com/payneteasy/libreofficewrapper/server/servlet/VersionServlet.java‎

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,32 @@
11
package com.payneteasy.libreofficewrapper.server.servlet;
22

3-
import com.payneteasy.libreofficewrapper.server.Main;
4-
3+
import javax.servlet.http.HttpServlet;
4+
import javax.servlet.http.HttpServletRequest;
5+
import javax.servlet.http.HttpServletResponse;
56
import java.io.IOException;
67
import java.io.InputStream;
7-
import java.net.URL;
8-
import java.util.Enumeration;
98
import java.util.Properties;
10-
import java.util.jar.JarFile;
11-
import java.util.jar.Manifest;
129

13-
import javax.servlet.ServletContext;
14-
import javax.servlet.http.HttpServlet;
15-
import javax.servlet.http.HttpServletRequest;
16-
import javax.servlet.http.HttpServletResponse;
10+
import com.payneteasy.libreofficewrapper.server.Main;
1711

1812
public class VersionServlet extends HttpServlet {
1913

2014
@Override
21-
protected void doGet(final HttpServletRequest aRequest, final HttpServletResponse aResponse) throws IOException {
22-
try (final InputStream resources = Main.class.getResourceAsStream("/META-INF/maven/com.payneteasy/libreoffice-api-wrapper-server/pom.properties")) {
23-
if (resources != null) {
15+
protected void doGet(
16+
HttpServletRequest request,
17+
HttpServletResponse response
18+
) throws IOException {
19+
try (
20+
final InputStream is = Main.class.getResourceAsStream(
21+
"/META-INF/maven/com.payneteasy/libreoffice-api-wrapper-server/pom.properties"
22+
)
23+
) {
24+
if (is != null) {
2425
final Properties properties = new Properties();
25-
properties.load(resources);
26-
aResponse.getWriter().print(properties.getProperty("version"));
26+
properties.load(is);
27+
response.getWriter().print(properties.getProperty("version"));
2728
} else {
28-
aResponse.sendError(500);
29+
response.sendError(500);
2930
}
3031
}
3132
}

0 commit comments

Comments
 (0)