Commit Graph

10 Commits

Author SHA1 Message Date
Marcel de Rooy 610a6cf78b Bug 23290: [RMaint version] Mitigate XML/XSLT vulnerabilities
This is a squashed version for backporting to stable branches.
IMPORTANT: It does not move XSLT_Handler to XSLT/Base as in master.

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit d8bf40281b)

Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
2020-02-24 09:10:06 +13:00
Jonathan Druart b6a6bfb9fb Bug 24313: Always display XSLT errors in logs
From
  commit 295ae33800
  Bug 20272: Replace error numbers by codes in XSLT_Handler

"""
    Make XSLT_Handler a little bit less noisy by defaulting print_warns to
    false unless $ENV{DEBUG} is set. (See also bug 19018).
"""

I think we should warn the errors in the logs. They are not debug messages here, we should not rely on DEBUG.
If too noisy we should fix the original issues, not hide all the errors (which make the XSLT debugging super hard)

Test plan:
Break a XSLT, reload the page and confirm that there are useful errors in the Koha log file

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit ec79582374)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 8bcafbe3cf)

Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>
2020-02-20 16:11:13 +13:00
Marcel de Rooy 295ae33800 Bug 20272: Replace error numbers by codes in XSLT_Handler
We remove the error numbers 1 to 7 by readable codes.
And remove the errstr attribute (not used widely).
Make XSLT_Handler a little bit less noisy by defaulting print_warns to
false unless $ENV{DEBUG} is set. (See also bug 19018).

The unit has been changed accordingly.
(A few warnings are no longer tested.)

Test plan:
Run t/db_dependent/XSLT_Handler.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
2018-07-02 12:12:48 +00:00
Marcel de Rooy 60bddbcc96 Bug 17807: Add format parameter to XSLT_Handler->transform
Format may be chars (default), bytes or xmldoc.
Note: xmldoc is a XML::LibXML document object.
Since the default is chars, this does not affect current use.

Note: The format parameter (xmldoc) will be used later in one of the OAI
modules to prevent duplicated xml parsing.

Test plan:
Run t/db_dependent/XSLT_Handler.t

Signed-off-by: Josef Moravec <josef.moravec@gmail.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
2017-08-30 15:06:40 -03:00
David Cook d3c128af9d Bug 13262 - Add parameters to XSLT Handler transform method
This patch adds an optional hashref argument to the XSLT_Handler
transform() method. It allows you to send key => value pairs
parameters to the XML::LibXSLT object, which you can reference
in a XSLT via <xsl:param name="XXX" />.

The parameter value is evaluated as an XPath query, so you can only
pass quoted strings (i.e. "'test'") or numbers. Otherwise, the
XSLT engine will interpret it as a Xpath query and will run it
on the XML that you're transforming.

The most common use case is sending strings to a XSLT. In my case,
this is an OAI-PMH identifier that comes in a OAI response but not
the actual metadata. See the following link from the official POD:
http://search.cpan.org/~shlomif/XML-LibXSLT-1.92/LibXSLT.pm#Parameters

_TEST PLAN_

1) Run "perl t/db_dependent/XSLT_Handler.t". If all tests pass,
you should be free to sign off. Feel free to inspect the last
test in XSLT_Handler.t and the XSL in test04.xsl to see how it
works.

If you really want to be thorough, you could write your own test
cases using mine as an example.

Alternatively, you could go into C4::XSLT, and try to pass a
value to a parameter in the search results or the detail page,
but that might be a bit over the top.

It's a pretty simple patch.

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2015-02-05 15:24:29 -03:00
Marcel de Rooy 64aeb86456 Bug 12973: Allow passing code to XSLT_Handler instead of filename
This patch adds the option to pass a code string to the XSLT handler object
instead of passing a filename.
This is achieved by a change to parameter hashref. The old style parameters
are also allowed.
Note that this patch should not change behavior but will be used in future
development: see bug 12758 or bug 12754.

Test plan:
Verify that behavior did not change in the following steps.
[1] Edit OPACXSLTResultsDisplay in order to use XSLT.
[2] Check search results page in OPAC.
[3] Edit OPACXSLTDetailsDisplay in order to use XSLT.
[4] Check detail page in OPAC.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
2015-01-18 10:29:10 -03:00
Galen Charlton 5f6f7e002c Bug 11826: (follow-up) run perltidy on Koha/XSLT_Handler.pm
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2014-05-26 03:59:11 +00:00
Marcel de Rooy bb961cbba6 Bug 11826: (follow-up) enable printing warnings
Conform former (implicit) behavior the handler now prints warnings by
default (via STDERR to logfile).
This can be adjusted by: $engine->print_warns(0);

Test plan:
Generate some error on a XSLT file (e.g. wrong path).
Check if your log contains the associated error(s)/warning(s).

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2014-05-26 03:52:46 +00:00
Marcel de Rooy 21df671131 Bug 11826: Use the XSLT handler in C4/XSLT module
Incorporate the new object into C4/XSLT module.
The handler object needed one adjustment to allow for passing URLs.
Removed the GetURI function; it is no longer needed.
Added some documentation lines.
Moved a file-level lexical upwards in the code for visibility.
Removed some tabs (on two lines).

Note: The handler could perhaps be moved up to the Context module, or
be saved in a global ('our') variable.  But I would rather not do that
now, making testing not too complex at this moment.

Test plan:
Enable XSLT preferences for opac and intranet.
Check result and detail pages.
Check individual list display (virtual shelves).
Force an XSLT error by editing one of your xsl files. Check the
corresponding display.
Put an URL in one the XSLT prefs (could just be to your own server).
Check the display.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Running XSLTParse4Display in a loop showed no significant performance
change.
One pass cost me around 0.012 sec (except for the first pass).

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Results, detail, url and list view Ok
No koha-qa errors

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2014-05-26 03:52:45 +00:00
Marcel de Rooy 41caa8e970 Bug 11826: Add XSLT handler object to Koha namespace
In achieving the goals of umbrella report 6536 (Z3950 improvements), this
report adds a XSLT handler object to the Koha namespace.
A follow-up adds unit tests for this module.
This patch does not yet incorporate the new object into Z3950 search. So
it does not change any behavior and is therefore harder to test.

Test plan:
Run the unit tests of the follow-up patch on report 11826.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
I tested the new module in two additional ways:

[1] Made a simple script (four lines as below) that ran a larger xml file
    with 1500 records through a test XSLT file modifying the title.

    my $eng= Koha::XSLT_Handler->new;
    open my $fh1, '<', '_example_file';
    my @xml= <$fh1>;
    print $eng->transform( join('', @xml), '_example_xsl_file');

[2] Incorporated the object into my local changes of Breeding.pm (based on
    older work, not ready for submittal now).
    Ran transformation on Z3950 search results. Worked well :)

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Test runs Ok. No koha-qa errors.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Galen Charlton <gmc@esilibrary.com>
2014-05-26 03:52:28 +00:00