|
4 | 4 | import it.eng.knowage.commons.multitenant.OrganizationImageManager; |
5 | 5 | import it.eng.knowage.engine.api.export.dashboard.excel.DashboardExcelExporter; |
6 | 6 | import it.eng.knowage.engine.api.export.dashboard.pdf.DashboardPdfExporter; |
| 7 | +import it.eng.knowage.engine.api.export.dashboard.png.PngExporter; |
7 | 8 | import it.eng.knowage.engine.api.export.nodejs.PdfExporterV2; |
8 | 9 | import it.eng.knowage.export.wrapper.beans.RenderOptions; |
9 | 10 | import it.eng.knowage.export.wrapper.beans.ViewportDimensions; |
|
36 | 37 | import javax.ws.rs.core.MediaType; |
37 | 38 | import javax.ws.rs.core.Response; |
38 | 39 |
|
| 40 | +import java.io.ByteArrayInputStream; |
39 | 41 | import java.io.IOException; |
40 | 42 | import java.util.*; |
| 43 | +import java.util.zip.ZipEntry; |
| 44 | +import java.util.zip.ZipInputStream; |
41 | 45 |
|
42 | 46 | import static it.eng.knowage.commons.security.KnowageSystemConfiguration.getKnowageVueContext; |
| 47 | +import static it.eng.spagobi.commons.utilities.UserUtilities.getUserProfile; |
43 | 48 | import static java.nio.charset.StandardCharsets.UTF_8; |
44 | 49 |
|
45 | 50 | @Path("/1.0/dashboardExport") |
@@ -230,6 +235,106 @@ public Object callPuppeteer() { |
230 | 235 | } |
231 | 236 | } |
232 | 237 |
|
| 238 | + @POST |
| 239 | + @Path("/callPuppeteer") |
| 240 | + public Object callPuppeteer( |
| 241 | + @Context HttpServletRequest request, @Context HttpServletResponse response) throws JSONException, IOException, EMFUserError, InterruptedException { |
| 242 | + response.setContentType(MediaType.TEXT_HTML); |
| 243 | + response.setCharacterEncoding(UTF_8.name()); |
| 244 | + |
| 245 | + String documentLabel = request.getParameter("DOCUMENT_LABEL"); |
| 246 | + BIObject biObject; |
| 247 | + try { |
| 248 | + biObject = DAOFactory.getBIObjectDAO().loadBIObjectByLabel(documentLabel); |
| 249 | + } catch (EMFUserError e) { |
| 250 | + throw new SpagoBIRuntimeException("Error retrieving document with label " + documentLabel, e); |
| 251 | + } |
| 252 | + |
| 253 | + Engine eng = biObject.getEngine(); |
| 254 | + URIBuilder externalUrl = GeneralUtilities.getBE2BEEngineUrl(eng); |
| 255 | + String requestURL = getRequestUrl(biObject, documentLabel, externalUrl, false); |
| 256 | + |
| 257 | + RenderOptions renderOptions = getRenderOptionsForPdfExporter(request); |
| 258 | + |
| 259 | + int documentId = Integer.parseInt(request.getParameter("document")); |
| 260 | + String userId = request.getParameter("user_id"); |
| 261 | + String pdfPageOrientation = request.getParameter(PDF_PAGE_ORIENTATION); |
| 262 | + boolean pdfFrontPage = request.getParameter(PDF_FRONT_PAGE) != null |
| 263 | + && Boolean.parseBoolean(request.getParameter(PDF_FRONT_PAGE)); |
| 264 | + boolean pdfBackPage = request.getParameter(PDF_BACK_PAGE) != null |
| 265 | + && Boolean.parseBoolean(request.getParameter(PDF_BACK_PAGE)); |
| 266 | + String params = request.getParameter("parameters"); |
| 267 | + |
| 268 | + String role = getProfileRole(); |
| 269 | + |
| 270 | + String organization = UserProfileManager.getProfile().getOrganization(); |
| 271 | + |
| 272 | + PngExporter pngExporter = new PngExporter(documentId, userId, requestURL, renderOptions, pdfPageOrientation, |
| 273 | + pdfFrontPage, pdfBackPage, role, organization, params); |
| 274 | + byte[] data = pngExporter.getBinaryData(); |
| 275 | + |
| 276 | + boolean isZipped = false; |
| 277 | + |
| 278 | + int thresholdEntries = 10000; |
| 279 | + int thresholdSize = 1000000000; |
| 280 | + double thresholdRatio = 10; |
| 281 | + int totalSizeArchive = 0; |
| 282 | + int totalEntryArchive = 0; |
| 283 | + |
| 284 | + ZipInputStream zippedInputStream = new ZipInputStream(new ByteArrayInputStream(data)); |
| 285 | + ZipEntry zipEntry; |
| 286 | + |
| 287 | + while((zipEntry = zippedInputStream.getNextEntry()) != null) { |
| 288 | + |
| 289 | + totalEntryArchive ++; |
| 290 | + |
| 291 | + int nBytes; |
| 292 | + byte[] buffer = new byte[2048]; |
| 293 | + int totalSizeEntry = 0; |
| 294 | + |
| 295 | + while((nBytes = new ZipInputStream(new ByteArrayInputStream(data)).read(buffer)) > 0) { |
| 296 | + //out.write(buffer, 0, nBytes); |
| 297 | + totalSizeEntry += nBytes; |
| 298 | + totalSizeArchive += nBytes; |
| 299 | + |
| 300 | + double compressionRatio = (double) totalSizeEntry / zipEntry.getCompressedSize(); |
| 301 | + if(compressionRatio > thresholdRatio) { |
| 302 | + // ratio between compressed and uncompressed data is highly suspicious, looks like a Zip Bomb Attack |
| 303 | + logger.error("Error while unzip file. Invalid archive file"); |
| 304 | + throw new SpagoBIRuntimeException("Error while unzip file. Invalid archive file"); |
| 305 | + } |
| 306 | + } |
| 307 | + |
| 308 | + if(totalSizeArchive > thresholdSize) { |
| 309 | + // the uncompressed data size is too much for the application resource capacity |
| 310 | + logger.error("Error while unzip file. Invalid archive file"); |
| 311 | + throw new SpagoBIRuntimeException("Error while unzip file. Invalid archive file"); |
| 312 | + } |
| 313 | + |
| 314 | + if(totalEntryArchive > thresholdEntries) { |
| 315 | + // too much entries in this archive, can lead to inodes exhaustion of the system |
| 316 | + logger.error("Error while unzip file. Invalid archive file"); |
| 317 | + throw new SpagoBIRuntimeException("Error while unzip file. Invalid archive file"); |
| 318 | + } |
| 319 | + |
| 320 | + isZipped = new ZipInputStream(new ByteArrayInputStream(data)).getNextEntry() != null; |
| 321 | + } |
| 322 | + |
| 323 | + String mimeType; |
| 324 | + String contentDisposition; |
| 325 | + |
| 326 | + if (!isZipped) { |
| 327 | + mimeType = "image/png"; |
| 328 | + contentDisposition = "attachment; fileName=" + documentLabel + ".png"; |
| 329 | + } else { |
| 330 | + mimeType = "application/zip"; |
| 331 | + contentDisposition = "attachment; fileName=" + documentLabel + ".zip"; |
| 332 | + } |
| 333 | + |
| 334 | + return Response.ok(data, mimeType).header("Content-length", Integer.toString(data.length)) |
| 335 | + .header("Content-Disposition", contentDisposition).build(); |
| 336 | + } |
| 337 | + |
233 | 338 | private Object createSpreadsheet(BIObject biObject, String documentLabel, URIBuilder externalUrl) throws IOException, InterruptedException, JSONException { |
234 | 339 |
|
235 | 340 | String requestURL = getRequestUrl(biObject, documentLabel, externalUrl, true); |
|
0 commit comments