Setting secure processing in TransformerFactory leads to Problems in XSL - java

I am generating a PDF document with XML file as input using Apache FOP 2.4.
To prevent XXE-Attacks I need to set the secure processing feature (FEATURE_SECURE_PROCESSING) in TransformerFactory:
InputStream xslTransformer = getClass().getClassLoader().getResourceAsStream("foo.xsl");
TransformerFactory transformerFactory = TransformerFactory.newInstance();
transformerFactory.setFeature(FEATURE_SECURE_PROCESSING, true);
Transformer transformer = transformerFactory.newTransformer(new StreamSource(xslTransformer));
transformer.transform(new DOMSource(), new SAXResult(fop.getDefaultHandler()));
After setting this feature I can't generate any PDF document and I'm getting warnings:
SystemId Unknown; Line #49; Column #99; "master-name" attribute is not allowed on the fo:simple-page-master element!
SystemId Unknown; Line #49; Column #99; "initial-page-number" attribute is not allowed on the fo:simple-page-master element!
SystemId Unknown; Line #49; Column #99; "page-height" attribute is not allowed on the fo:simple-page-master element!
SystemId Unknown; Line #49; Column #99; "page-width" attribute is not allowed on the fo:simple-page-master element!
etc ...
Here is a section of XSL file (foo.xsl):
<?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="2.0"
xmlns:fo="http://www.w3.org/1999/XSL/Format"
xmlns:pdf="http://xmlgraphics.apache.org/fop/extensions/pdf">
<xsl:template match="/">
<fo:root>
<fo:layout-master-set>
<fo:simple-page-master master-name="A4-portrait" initial-page-number="1"
page-height="29.7cm" page-width="21.0cm" margin-top="0cm"
margin-left="1cm" margin-right="1.3cm" margin-bottom="0cm">
<fo:region-body margin-top="2.2cm" margin-bottom="1.2cm" margin-left="1.3cm"/>
<fo:region-before region-name="xsl-region-before" extent="2.2cm"/>
<fo:region-after region-name="xsl-region-after" extent="1.2cm"/>
<fo:region-start region-name="xsl-region-start" extent="1.3cm"/>
</fo:simple-page-master>
</fo:layout-master-set>
<fo:page-sequence master-reference="A4-portrait" font-family="Consolas" font-size="11">
<fo:flow flow-name="xsl-region-body">
<fo:block linefeed-treatment="preserve" font-weight="bold">
foo
</fo:block>
<fo:block linefeed-treatment="preserve">
bar
</fo:block>
</fo:flow>
</fo:page-sequence>
</fo:root>
</xsl:template>
</xsl:stylesheet>
How should I use this feature and make it work? Java version is 8.

This is due to xalan-2.7.2.
Here is the bug in Xalan-J
Switching to xalan-2.7.1 or earlier will solve your problem.
You may have to force exclusions for xalan on an Apache-FO dependency.
You can also overwrite with 2.7.2_3, which patches this problem.
<dependency>
<groupId>org.apache.servicemix.bundles</groupId>
<artifactId>org.apache.servicemix.bundles.xalan</artifactId>
<version>2.7.2_3</version><!--$NO-MVN-MAN-VER$-->
</dependency>
Use of <!--$NO-MVN-MAN-VER$--> prevents overrides.

Related

using XSLT apply-template to descendents with different names

I am trying to use apply-templates for elements encapsulated within parent element but has different element name. In my example I want to apply it to /Author/Name/ elements and choose either of one whichever has a value. This task is continuation of another question I have asked.
I am using the following XML
<?xml version="1.0" encoding="UTF-8"?>
<Author>
<Info>
<Name>
<FirstName>#3 bb***</FirstName>
<LastName>test</LastName>
</Name>
<Input>
<Item>##### 3 ??***</Item>
</Input>
</Info>
<Custom>Test</Custom>
</Author>
I am applying the following XSLT 1.0 using java. In above example I want template applied to firstName and lastName but show value in firstName since it is the first with a value.
<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:output method="xml" version="1.0" encoding="UTF-8" indent="yes"/>
<xsl:variable name="allowed-start-chars">abcdefghijklmnopqrstuvwxyz</xsl:variable>
<xsl:variable name="allowed-follow-chars">0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ ?abcdefghijklmnopqrstuvwxyz-&apos;.,/#&()!+</xsl:variable>
<xsl:template match="/">
<html>
<body>
<!-- Not sure how to use `xsl:choose` just added to show my intentions-->
<xsl:choose>
<xsl:when test="..">
<div>
<xsl:apply-templates select="Author/Name/FirstName"/>
</div>
</xsl:when>
</xsl:choose>
</body>
</html>
</xsl:template>
<!--used pipe to apply for two different elements but it does not work-->
<xsl:template match="FirstName|LastName">
<!-- find the first character eligible to be starting character -->
<xsl:variable name="start-chars" select="translate(., translate(., $allowed-start-chars, ''), '')"/>
<xsl:variable name="start-char" select="substring($start-chars, 1, 1)"/>
<!-- get text after the chosen starting character -->
<xsl:variable name="tail" select="substring-after(., $start-char)"/>
<!-- remove unwanted characters from tail -->
<xsl:variable name="fo" select="translate($tail, translate($tail, $allowed-follow-chars, ''), '')"/> <xsl:choose>
<!--only show if character remain after removing bad ones, and not empty-->
<xsl:when test="string-length($start-char) > 0 and normalize-space(concat($start-char, $fo))">
<xsl:value-of select="normalize-space(concat($start-char, $fo))"/>
</xsl:when>
</xsl:choose>
</xsl:template>
</xsl:stylesheet>
The Java code is Stylizer class from Oracle tuorial page example, please refer the link for full code. I am running command-line sending xml and xslt files.
File stylesheet = new File(argv[0]);
File datafile = new File(argv[1]);
DocumentBuilder builder = factory.newDocumentBuilder();
document = builder.parse(datafile);
// Use a Transformer for output
TransformerFactory tFactory = TransformerFactory.newInstance();
StreamSource stylesource = new StreamSource(stylesheet);
Transformer transformer = tFactory.newTransformer(stylesource);
DOMSource source = new DOMSource(document);
StreamResult result = new StreamResult(System.out);
transformer.transform(source, result);
I would appreciate again help on this one. As I am learning XSLT and I am also not sure what performance issue using approach
From the context of:
<xsl:template match="/">
you can do:
<xsl:apply-templates select="(Author/Info/Name/FirstName | Author/Info/Name/LastName)[text()][1]"/>
to select the first element of the two that has a child text node. If there are only FirstName and LastName, you can shorten this to:
<xsl:apply-templates select="Author/Info/Name/*[text()][1]"/>
Note that your attempt:
<xsl:apply-templates select="Author/Name/FirstName"/>
cannot work because Name is not a child of Author.

Issue with XSLT and FOP when configuring XMLConstants.html#FEATURE_SECURE_PROCESSING

I have an issue when generating PDF from Java objects using XSLFO and XSLT:
I have this code:
TransformerFactory.newInstance("org.apache.xalan.processor.TransformerFactoryImpl",
Thread.currentThread().getContextClassLoader());
templates = factory.newTemplates(new StreamSource(PdfGenerator.class.getResourceAsStream(ORDERS_XSL)));
FOUserAgent foUserAgent = fopFactory.newFOUserAgent();
Source src = getSourceForCommandList(commandeList);
try {
Fop fop = fopFactory.newFop(MimeConstants.MIME_PDF, foUserAgent, out);
Result res = new SAXResult(fop.getDefaultHandler());
templates.newTransformer().transform(src, res);
} finally {
out.flush();
}
My xslt uses fo namespace:
<?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet version="1.1"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:fo="http://www.w3.org/1999/XSL/Format">
<xsl:template match="orders">
<fo:root xmlns:fo="http://www.w3.org/1999/XSL/Format">
<fo:layout-master-set>
<fo:simple-page-master master-name="simpleA4"
page-height="29.7cm" page-width="21cm" margin-top="2cm"
margin-bottom="1cm" margin-left="0.5cm" margin-right="0.5cm">
<fo:region-body />
</fo:simple-page-master>
</fo:layout-master-set>
<xsl:apply-templates select="order" />
</fo:root>
</xsl:template>
...
</xsl:template>
</xsl:stylesheet>
It works fine and generates a PDF from source Objects using Apache FOP and XSLT.
However, when I add this line to respect best practices regarding security:
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
It breaks because fo namespace is not loaded, I have those warning on template parsing:
SystemId Unknown; Line #13; Column #67; "master-name" attribute is not allowed on the fo:simple-page-master element!
SystemId Unknown; Line #13; Column #67; "page-height" attribute is not allowed on the fo:simple-page-master element!
SystemId Unknown; Line #13; Column #67; "page-width" attribute is not allowed on the fo:simple-page-master element!
SystemId Unknown; Line #13; Column #67; "margin-top" attribute is not allowed on the fo:simple-page-master element!
Issue was due to xalan TransformerFactory implementation being loaded instead of JDK's embedded one com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl
I excluded xalan from dependencies :
<exclusions>
<exclusion>
<artifactId>xalan</artifactId>
<groupId>xalan</groupId>
</exclusion>
</exclusions>
And it worked

Facing issues while calling java method from xslt which uses fop

I'm using fop to convert xml to pdf, so for that I have written an xslt code.
In the same xslt, I have used java code but somehow I get an error stating nosuchmethodexception : couldn't find method org.apache.xml.utils.NodeVector.input([ExpressionContext,]).
But my java code is a user defined code which is in a different package.
My xml has local_curr attribute.
My java class name is XMLData.
Package is com.pdf
Java Method is input which takes a String value and returns a String
xslt code :
<?xml version="1.0" encoding="utf-8"?>
<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:fo="http://www.w3.org/1999/XSL/Format"
xmlns:java="com.pdf.XMLData">
<xsl:output method="xml" indent="yes" />
<xsl:template match="/">
<fo:root xmlns:fo="http://www.w3.org/1999/XSL/Format">
<!-- Defining Page Layout -->
<fo:layout-master-set>
<fo:simple-page-master master-name="A3-portrait"
page-height="29.7cm" page-width="40.0cm" margin="2cm">
<fo:region-body margin-bottom="20mm" />
</fo:simple-page-master>
</fo:layout-master-set>
<fo:page-sequence master-reference="A3-portrait">
<fo:flow flow-name="xsl-region-body">
<fo:table table-layout="fixed" width="100%" border-width="1mm"
border-collapse="separate">
<fo:table-row>
<fo:table-cell background-color="#F79F81"
border-width="0.1mm" border-style="solid">
<fo:block wrap-option="wrap" font-size="15pt"
padding="5pt" text-align="right">
<xsl:value-of select="java:input(#local_curr)" />
</fo:block>
</fo:table-cell>
</fo:table-row>
</fo:table>
</fo:flow>
</fo:page-sequence>
</fo:root>
</xsl:template>
</xsl:stylesheet>
The problem is that #local_curr probably does not return the type your java method is expecting.
You need to parse it for example as a string
<xsl:value-of select="java:input(string(#local_curr))" />
Or as a number
<xsl:value-of select="java:input(number(#local_curr))" />
The NoSuchMethodException was thrown because no method was found with the given type as argument.
Thanks for the help.
It is resolved. Actually I have to add my jar file in the batch file of fop which resolved my problem.
Thanks...

Create xmlns attribute in the XML using XSLT Transformation

I am trying to add the xmlns attribute to the resulting XML with a value passed by parameter during XSLT transformation using JDK Transformer (Oracle XML v2 Parser or JAXP) but it always defaults to http://www.w3.org/2000/xmlns/
My source XML
<test/>
My XSLT
<?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet version="2.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://example.com">
<xsl:param name="myNameSpace" select="'http://neilghosh.com'"/>
<xsl:template match="/">
<process>
<xsl:attribute name="xmlns:neil">
<xsl:value-of select="$myNameSpace"/>
</xsl:attribute>
</process>
</xsl:template>
</xsl:stylesheet>
My Result
<?xml version="1.0"?>
<process xmlns="http://www.w3.org/2000/xmlns/" xmlns:neil="neilghosh.com">
</process>
My Desired Result
<?xml version="1.0"?>
<process xmlns="http://example.com" xmlns:neil="neilghosh.com">
</process>
Firstly, in the XSLT data model, you don't want to create an attribute node, you want to create a namespace node.
Namespace nodes are usually created automatically: if you create an element or attribute in a particular namespace, the requisite namespace node (and hence, when serialized, the namespace declaration) are added automatically by the processor.
If you want to create a namespace node that isn't necessary (because it's not used in the name of any element or attribute) then in XSLT 2.0 you can use xsl:namespace. If you're stuck with XSLT 1.0 then there's a workaround, that involves creating an element in the relevant namespace and then copying its namespace node:
<xsl:variable name="ns">
<xsl:element name="neil:dummy" namespace="{$param}"/>
</xsl:variable>
<process>
<xsl:copy-of select="$ns/*/namespace::neil"/>
</process>
Michael Kay provided you with the correct answer, but based on your comments, you aren't sure how to use it in your transformation.
Here is a complete transformation:
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:ext="http://exslt.org/common" exclude-result-prefixes="ext">
<xsl:output omit-xml-declaration="yes" indent="yes"/>
<xsl:param name="pNamespace" select="'neilghosh.com'"/>
<xsl:variable name="vDummy">
<xsl:element name="neil:x" namespace="{$pNamespace}"/>
</xsl:variable>
<xsl:template match="/*">
<xsl:element name="process" namespace="http://example.com">
<xsl:copy-of select="namespace::*"/>
<xsl:copy-of select="ext:node-set($vDummy)/*/namespace::*[.=$pNamespace]"/>
</xsl:element>
</xsl:template>
</xsl:stylesheet>
When this transformation is applied on the provided XML document:
<test/>
the wanted, correct result is produced:
<process xmlns="http://example.com" xmlns:neil="neilghosh.com" />
Namespace declarations in XML are not attributes even though they look like attributes. In XSLT 2.0 you can use <xsl:namespace name="neil" select="$myNameSpace" /> to add a namespace declaration to the result tree dynamically but that feature is not available in XSLT 1.0.
Don't try to create "xmlns" attributes yourself. Create the namespaces in the XSLT and they will be done automatically.
This XSLT works (tested with Saxon 9.4):
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:neil="neilghosh.com"
xpath-default-namespace="http://example.com"
xmlns="http://example.com" version="2.0">
<xsl:output method="xml" version="1.0" encoding="UTF-8" indent="yes"/>
<xsl:param name="myDynamicNamespace" select="'http://neilghosh.com'"/>
<xsl:template match="/">
<xsl:element name="process">
<xsl:namespace name="neil" select="$myDynamicNamespace"/>
</xsl:element>
</xsl:template>
</xsl:stylesheet>
And gives the following output:
<?xml version="1.0" encoding="UTF-8"?>
<process xmlns="http://example.com" xmlns:neil="http://neilghosh.com"/>
Finally got an workaround which worked with my XSLT Processor (Oracle XML V2 Parser)
I had to transform it to a DOM Document and then persist that DOM to filesystem instead of outputting directly to StreamResult
I used DOMResult in the transform method
Following XSLT fragment worked but there was an extra xmlns:xmlns="http://www.w3.org/2000/xmlns/" which was probably absorbed by Document and did not appear in the final output when I persisted to file system.
<process>
<xsl:attribute name="xmlns">
<xsl:value-of select="'http://example.com'"/>
</xsl:attribute>
<process>
I know this is not the best way to do but given the parse constraint this is the only choice I have now.

Generate PDF from a big image using Apache FOP

I would like to generate a PDF from an image, using Apache FOP and XSLT. However, if image s bigger, then PDF document page, then it only gets as much space as it is available on the page (including right and bottom margin). So, part of the image is out of page bounds.
Is this possible to setup fop so that if image can't be fitted into the page it is automatically splitted into the multiple pages?
Here is my xslt template:
<?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet version="1.1"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:fo="http://www.w3.org/1999/XSL/Format"
xmlns:java="http://xml.apache.org/xslt/java"
xmlns:dp="http://www.dpawson.co.uk"
xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:f="Functions"
xmlns:xdt="http://www.w3.org/2005/02/xpath-datatypes"
exclude-result-prefixes="java">
<xsl:output method="xml" version="1.0" omit-xml-declaration="no" indent="yes" />
<xsl:param name="image-print-path" />
<xsl:template match="/">
<fo:root xmlns:fo="http://www.w3.org/1999/XSL/Format">
<fo:layout-master-set>
<fo:simple-page-master master-name="simpleA4"
page-height="29.7cm" page-width="21cm" margin-top="2cm"
margin-bottom="2cm" margin-left="2cm" margin-right="2cm">
<fo:region-body margin-top="20pt" margin-bottom="35pt" />
<fo:region-before extent=".5in"/>
<fo:region-after extent=".5in"/>
</fo:simple-page-master>
</fo:layout-master-set>
<fo:page-sequence master-reference="simpleA4">
<fo:static-content flow-name="xsl-region-before" text-align="left">
<fo:block font-size="10pt">
Print
</fo:block>
</fo:static-content>
<fo:static-content flow-name="xsl-region-after">
<fo:block font-size="10pt" text-align="left">
something else
</fo:block>
<!-- TODO: add current date, page number -->
</fo:static-content>
<fo:flow flow-name="xsl-region-body">
<fo:block font-size="10pt" page-break-after="always">
<fo:external-graphic src="{$image-print-path}"/>
</fo:block>
</fo:flow>
</fo:page-sequence>
</fo:root>
</xsl:template>
</xsl:stylesheet>
Doesn't look like there's anything in the spec that can format in the way you need. This leaves you with a few options:
check the graphic before you inject it into your XSL workflow and cut it up into a number of images to use across multiple pages
inspect the graphic to determine it's dimensions and create a page size big enough to contain it, and leave the slicing to printers
set content-width to scale-down-to-fit to show the entire graphic on a single page

Categories