OCA
/
reporting-engine
5
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
Browse Source

[IMP] report_py3o: prevent injections when retrieving the template from path

14.0-report-py3o-pr-506
Laurent Mignon (ACSONE) 8 years ago
committed by default
parent
74a4942c7e
commit
103f44ccf6
3 changed files with 163 additions and 42 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 30
      report_py3o/README.rst
  2. 51
      report_py3o/models/py3o_report.py
  3. 118
      report_py3o/tests/test_report_py3o.py

30
report_py3o/README.rst
View File

@ -127,6 +127,36 @@ For example, to replace the native invoice report by a custom py3o report, add t
where *my_custom_module_base* is the name of the custom Odoo module. In this example, the invoice ODT file is located in *my_custom_module_base/report/account_invoice.odt*.
It's also possible to reference a template located in a trusted path of your
Odoo server. In this case you must let the *module* entry empty and specify
the path to the template as *py3o_template_fallback*.
.. code::
<?xml version="1.0" encoding="utf-8"?>
<odoo>
<record id="account.account_invoices" model="ir.actions.report.xml">
<field name="report_type">py3o</field>
<field name="py3o_filetype">odt</field>
<field name="module">/field>
<field name="py3o_template_fallback">/odoo/templates/py3o/report/account_invoice.odt</field>
</record>
</odoo>
Moreover you must also modify the odoo server configuration file to declare
the allowed root directory for your py3o templates. Only templates located
into this directory can be loaded by py3o report.
.. code::
[options]
...
[report_py3o]
root_tmpl_path=/odoo/templates/py3o
If you want an invoice in PDF format instead of ODT format, the XML file should look like:
.. code::

51
report_py3o/models/py3o_report.py
View File

@ -19,7 +19,7 @@ from zipfile import ZipFile, ZIP_DEFLATED
from odoo.exceptions import AccessError
from odoo.exceptions import UserError
from odoo.report.report_sxw import rml_parse
from odoo import api, fields, models, _
from odoo import api, fields, models, tools, _
logger = logging.getLogger(__name__)
@ -30,7 +30,7 @@ try:
except ImportError:
logger.debug('Cannot import py3o.template')
try:
from py3o.formats import Formats
from py3o.formats import Formats, UnkownFormatException
except ImportError:
logger.debug('Cannot import py3o.formats')
@ -82,9 +82,46 @@ class Py3oReport(models.TransientModel):
required=True
)
@api.multi
def _is_valid_template_path(self, path):
""" Check if the path is a trusted path for py3o templates.
"""
real_path = os.path.realpath(path)
root_path = tools.config.get_misc('report_py3o', 'root_tmpl_path')
if not root_path:
logger.warning(
"You must provide a root template path into odoo.cfg to be "
"able to use py3o template configured with an absolute path "
"%s", real_path)
return False
is_valid = real_path.startswith(root_path + os.path.sep)
if not is_valid:
logger.warning(
"Py3o template path is not valid. %s is not a child of root "
"path %s", real_path, root_path)
return is_valid
@api.multi
def _is_valid_template_filename(self, filename):
""" Check if the filename can be used as py3o template
"""
if filename and os.path.isfile(filename):
fname, ext = os.path.splitext(filename)
ext = ext.replace('.', '')
try:
fformat = Formats().get_format(ext)
if fformat and fformat.native:
return True
except UnkownFormatException:
logger.warning("Invalid py3o template %s", filename,
exc_info=1)
logger.warning(
'%s is not a valid Py3o template filename', filename)
return False
@api.multi
def _get_template_from_path(self, tmpl_name):
""""Return the template from the path to root of the module if specied
""" Return the template from the path to root of the module if specied
or an absolute path on your server
"""
if not tmpl_name:
@ -97,11 +134,9 @@ class Py3oReport(models.TransientModel):
"odoo.addons.%s" % report_xml.module,
tmpl_name,
)
elif os.path.isabs(tmpl_name):
# It is an absolute path
flbk_filename = os.path.normcase(os.path.normpath(tmpl_name))
if flbk_filename and os.path.exists(flbk_filename):
# and it exists on the fileystem
elif self._is_valid_template_path(tmpl_name):
flbk_filename = os.path.realpath(tmpl_name)
if self._is_valid_template_filename(flbk_filename):
with open(flbk_filename, 'r') as tmpl:
return tmpl.read()
return None

118
report_py3o/tests/test_report_py3o.py
View File

@ -6,10 +6,13 @@ from base64 import b64decode
import mock
import os
import pkg_resources
import shutil
import tempfile
from contextlib import contextmanager
from py3o.formats import Formats
from odoo import tools
from odoo.tests.common import TransactionCase
from odoo.exceptions import ValidationError
@ -17,13 +20,29 @@ from ..models.py3o_report import TemplateNotFound
from base64 import b64encode
@contextmanager
def temporary_copy(path):
filname, ext = os.path.splitext(path)
tmp_filename = tempfile.mktemp(suffix='.' + ext)
try:
shutil.copy2(path, tmp_filename)
yield tmp_filename
finally:
os.unlink(tmp_filename)
class TestReportPy3o(TransactionCase):
def setUp(self):
super(TestReportPy3o, self).setUp()
self.report = self.env.ref("report_py3o.res_users_report_py3o")
self.py3o_report = self.env['py3o.report'].create({
'ir_actions_report_xml_id': self.report.id})
def test_no_local_fusion_without_fusion_server(self):
report = self.env.ref("report_py3o.res_users_report_py3o")
self.assertTrue(report.py3o_is_local_fusion)
self.assertTrue(self.report.py3o_is_local_fusion)
with self.assertRaises(ValidationError) as e:
report.py3o_is_local_fusion = False
self.report.py3o_is_local_fusion = False
self.assertEqual(
e.exception.name,
"Can not use not native format in local fusion. "
@ -49,17 +68,15 @@ class TestReportPy3o(TransactionCase):
"Please specify a Fusion Server")
def test_required_py3_filetype(self):
report = self.env.ref("report_py3o.res_users_report_py3o")
self.assertEqual(report.report_type, "py3o")
self.assertEqual(self.report.report_type, "py3o")
with self.assertRaises(ValidationError) as e:
report.py3o_filetype = False
self.report.py3o_filetype = False
self.assertEqual(
e.exception.name,
"Field 'Output Format' is required for Py3O report")
def test_reports(self):
py3o_report = self.env['py3o.report']
report = self.env.ref("report_py3o.res_users_report_py3o")
with mock.patch.object(
py3o_report.__class__, '_create_single_report') as patched_pdf:
result = tempfile.mktemp('.txt')
@ -67,26 +84,26 @@ class TestReportPy3o(TransactionCase):
fp.write('dummy')
patched_pdf.return_value = result
# test the call the the create method inside our custom parser
report.render_report(self.env.user.ids,
report.report_name,
self.report.render_report(self.env.user.ids,
self.report.report_name,
{})
self.assertEqual(1, patched_pdf.call_count)
# generated files no more exists
self.assertFalse(os.path.exists(result))
res = report.render_report(
self.env.user.ids, report.report_name, {})
res = self.report.render_report(
self.env.user.ids, self.report.report_name, {})
self.assertTrue(res)
py3o_server = self.env['py3o.server'].create({"url": "http://dummy"})
# check the call to the fusion server
report.write({"py3o_filetype": "pdf",
self.report.write({"py3o_filetype": "pdf",
"py3o_server_id": py3o_server.id})
with mock.patch('requests.post') as patched_post:
magick_response = mock.MagicMock()
magick_response.status_code = 200
patched_post.return_value = magick_response
magick_response.iter_content.return_value = "test result"
res = report.render_report(
self.env.user.ids, report.report_name, {})
res = self.report.render_report(
self.env.user.ids, self.report.report_name, {})
self.assertEqual(('test result', 'pdf'), res)
def test_report_post_process(self):
@ -118,31 +135,38 @@ class TestReportPy3o(TransactionCase):
self.assertEqual('test result', b64decode(attachements.datas))
def test_report_template_configs(self):
report = self.env.ref("report_py3o.res_users_report_py3o")
# the demo template is specified with a relative path in in the module
# path
tmpl_name = report.py3o_template_fallback
tmpl_name = self.report.py3o_template_fallback
flbk_filename = pkg_resources.resource_filename(
"odoo.addons.%s" % report.module,
"odoo.addons.%s" % self.report.module,
tmpl_name)
self.assertTrue(os.path.exists(flbk_filename))
res = report.render_report(
self.env.user.ids, report.report_name, {})
res = self.report.render_report(
self.env.user.ids, self.report.report_name, {})
self.assertTrue(res)
# The generation fails if the tempalte is not found
report.module = False
self.report.module = False
with self.assertRaises(TemplateNotFound), self.env.cr.savepoint():
report.render_report(
self.env.user.ids, report.report_name, {})
self.report.render_report(
self.env.user.ids, self.report.report_name, {})
# the template can also be provided as an abspaath
report.py3o_template_fallback = flbk_filename
res = report.render_report(
self.env.user.ids, report.report_name, {})
# the template can also be provided as an abspath if it's root path
# is trusted
self.report.py3o_template_fallback = flbk_filename
with self.assertRaises(TemplateNotFound):
self.report.render_report(
self.env.user.ids, self.report.report_name, {})
with temporary_copy(flbk_filename) as tmp_filename:
self.report.py3o_template_fallback = tmp_filename
tools.config.misc['report_py3o'] = {
'root_tmpl_path': os.path.dirname(tmp_filename)}
res = self.report.render_report(
self.env.user.ids, self.report.report_name, {})
self.assertTrue(res)
# the tempalte can also be provided as a binay field
report.py3o_template_fallback = False
self.report.py3o_template_fallback = False
with open(flbk_filename) as tmpl_file:
tmpl_data = b64encode(tmpl_file.read())
@ -150,8 +174,40 @@ class TestReportPy3o(TransactionCase):
'name': 'test_template',
'py3o_template_data': tmpl_data,
'filetype': 'odt'})
report.py3o_template_id = py3o_template
report.py3o_template_fallback = flbk_filename
res = report.render_report(
self.env.user.ids, report.report_name, {})
self.report.py3o_template_id = py3o_template
self.report.py3o_template_fallback = flbk_filename
res = self.report.render_report(
self.env.user.ids, self.report.report_name, {})
self.assertTrue(res)
def test_report_template_fallback_validity(self):
tmpl_name = self.report.py3o_template_fallback
flbk_filename = pkg_resources.resource_filename(
"odoo.addons.%s" % self.report.module,
tmpl_name)
# an exising file in a native format is a valid template if it's
self.assertTrue(self.py3o_report._get_template_from_path(
tmpl_name))
self.report.module = None
# a directory is not a valid template..
self.assertFalse(self.py3o_report._get_template_from_path('/etc/'))
self.assertFalse(self.py3o_report._get_template_from_path('.'))
# an vaild template outside the root_tmpl_path is not a valid template
# path
# located in trusted directory
self.report.py3o_template_fallback = flbk_filename
self.assertFalse(self.py3o_report._get_template_from_path(
flbk_filename))
with temporary_copy(flbk_filename) as tmp_filename:
self.assertTrue(self.py3o_report._get_template_from_path(
tmp_filename))
# check security
self.assertFalse(self.py3o_report._get_template_from_path(
'rm -rf . & %s' % flbk_filename))
# a file in a non native LibreOffice format is not a valid template
with tempfile.NamedTemporaryFile(suffix='.toto')as f:
self.assertFalse(self.py3o_report._get_template_from_path(
f.name))
# non exising files are not valid template
self.assertFalse(self.py3o_report._get_template_from_path(
'/etc/test.odt'))
Write Preview
Loading…
Cancel
Save