BIRT possible XSS in XLS format - xss

I'm trying to fix an issue that exists in XLS and CSV formats and currently it's not handled by the respective BIRT emitters.
For example, using the following section in a rptdesign file, would produce an Excel file(or a CSV file to import in Excel) which opens the calculator application:
<cell id="22">
<label id="23">
<text-property name="text">=cmd|' /C calc'!A0</text-property>
</label>
</cell>
Does BIRT support a global handler to parse the BIRT model before rendering and escape such values appropriately?
Or is there perhaps another way to properly handle this?
Thank you!

I would say this is not a BIRT issue, but an Excel issue. You would have to check and escape the text yourself.

Related

Workbook gem - how to write the excel to html in a formatted manner?

I am using Workbook gem to preview the excel file without page breaks in my website. Right now, I am successful in extracting the excel file and writing it into html format and display as preview.
The following code extracts and writes the excel to html:
excel_file = Workbook::Book.open "#{file_url}"
excel_file.write_to_html(file_name + ".html")
But this gives me an unformatted html sheet with no rows and columns or any of the existing excel file.
According to murb/workbook documentation, it is said that we can pass the format as a hash within its options.
write_to_html(filename = "#{title}.html", options = {})
So, to achieve the format hash, I tried the following code:
excel_file.template.formats
But this returns a null hash. So, how can i get all the formats from the excel file and write to html? Or at least show the html table with borders for all rows and columns.
The author here. The Workbook gem is mainly built to extract and rerepresent the data in files, and not so much the formatting. In the past I made a few attempts on adding support to maintain formatting when converting, but it is far from complete. Some importers don't even set the formatting hash as you found out, notably the xlsx importer needs work on this.
The HTML was built to simply give a basic preview of the data. It basically returns a html-page with all tables which is by default unformatted, although format-names are used in the classes. There is an option though, if you'd pass style_with_inline_css: true... but then it requires an importer to actually set the format hash properly...
I'm happy to guide you here and there when you want to improve the xlsx importer code to suit your needs and hopefully the workbook gem in general, but it will need serious work if you want more than just some background colours and font properties.

tibco xslt not accepting html script

I have to convert one xml to html page. I read that xml and mapped to transform xml. I have added html formatting tags in xslt. But it is not reflecting in page. I am getting data of xml in one line side by side. The html code not working what i have given. So any one can let me know how to transform xml to html, is there any other solution ?
yes, I have added that "tibco xslt " in title of this question ....
when working on tibco bw, I have to convert xml into html webpage; so i have used html code along with xslt transformation in xslt activity and also referenced it in transform activity. but the resulting html is not as required, all the elements of xml are coming in html side by side;
but when i used this same html code out side of tibco, it is working fine as it is showing in a well formatted table.....
Then my question is will tibco xslt execute html code or not ?
I am not too sure about using xslt transform activity for parsing a xml into html file.
Try parsing xml and then write file activity . You can alter the content of the file as per your requirement with tags and data from the parsed xml file.

Parse xml file and dynamically generate c++ code to build a panel(UI)

I need to parse one xml file using c++ and dynamically populate a QT UI.
Any help in terms of tutorial, links, suggestions, source code example will be deeply appreciated. I have gone through most of the similar stack overflow links but its not helpful much.
Thanks in Advance.
Have a look at QXmlStreamReader and the Bookmarks example.
Basically what you want to do is open an XML file (using QFile), read it line by line and create the necessary UI-object (don't forget to close the file afterwards).
Let's assume your XML file looks something like this:
<ui>
<mainwindow width="800" height="600">
<label position="center">FOO</label>
...
</mainwindow>
</ui>
You'd use something like readNextStartElement() to read to <mainwindow ..>, read its attributes and call a method that creates a QMainWindow using the data you read. Then readNextStartElement() to <label ...>, call a method that creates the label and add it to the main window according to the atributes, and so on.

Localization in c++

I am using rc files to localize my application which works fine.
Unfortunately there are is one module which uses an xml file to match the label name. The functionality of this XML file is much more than just some labels on the form but its irrelevant for this question.
The code reads the xml and constructs a form for data entry. What is the best way to localize this xml? I want to avoid having multiple versions of this file. The part of the xml looks as under
<Attribute name="Description" displayname="Summary" desc="Short Description" type="TEXT" length="32" edit="1" column="DESCRIP"/>
The displayname from above is the label on my form.
Any suggestions?
IMHO, there are 2 ways to localize the XML :
at file level : one xml file per language
at string level : you put labels in the (unique) xml files and lookup localized strings for those labels in your rc files.

Trouble parsing remote RSS feed using ColdFusion

I'm having a vexing time displaying a remote RSS feed on an intranet site. I'm using the MM_ XSLTransform.cfc version 0.6.2 to pull in the feed and a basic xsl to output. The feed url is www.fedsources.com/FedsourcesNet/RssFeeds/RSS_MarketFlash.aspx. If you open it in a browser, you'll see it appears to be an ordinary RSS feed. But when I try to display it in CF, I get the following" MM_ XSLTransform error.
www.fedsources.com/FedsourcesNet/RssFeeds/RSS_ MarketFlash.aspx is not a valid XML document.
Parsing www.fedsources.com/FedsourcesNet/RssFeeds/RSS_ MarketFlash.aspx
An error occured while Parsing an XML document.
Content is not allowed in prolog." (the actual error included http:// in the urls. Then the feed is dumped as part of the error message.
What's especially frustrating is if I view the source of the RSS and copy and paste it into a text file, then parse that text file, it displays fine.
Running CF version 7.
I tried changing the charset from UTF-8 to windows-1252, but that added some weird characters at the beginning and didn't help. I also tried stripping out everything between <channel> and <item> but that didn't help.
I've successfully parsed other RSS feeds outside our firewall using the same code. Is there something about the aspx extension that's causing the error? Any thoughts? Anyone?
Thanks.
What's the exact code that you're using to parse the XML document? This particular error normally happens if you have some data before the <?xml?> tag in the document, even a single space can cause a problem.
I'm not familiar with the particular CFC you mentioned, so I can't troubleshoot that one for you, but make sure that you use the Trim function around any XML content you're going to try to parse.
UPDATE: A quick Google search led me to this post from Ben Nadel: http://www.bennadel.com/blog/1206-Content-Is-Not-Allowed-In-Prolog-ColdFusion-XML-And-The-Byte-Order-Mark-BOM-.htm
You need to remove the Byte-Order-Mark from the feed. This code works without an error:
<cfhttp method="get" url="http://www.fedsources.com/FedsourcesNet/RssFeeds/RSS_MarketFlash.aspx" />
<cfset xmlResult = XmlParse(REReplace( cfhttp.FileContent, "^[^<]*", "", "all" )) />
<cfdump var="#XMLParse(xmlResult)#" />