From 7eb5ff250ad72f21211f42d9c78ffe2cbfc998cc Mon Sep 17 00:00:00 2001 From: Romain Deltour Date: Mon, 21 Nov 2022 01:50:53 +0100 Subject: [PATCH] feat: warn about non-HTTPS remote resource references This commit introduces a new check `RSC-031` (warning) that is reported when a reference to a remote resource (font, audio, video) is not using HTTPS. Fix #1337 --- .../epubcheck/messages/DefaultSeverities.java | 1 + .../adobe/epubcheck/messages/MessageId.java | 1 + .../com/adobe/epubcheck/opf/XRefChecker.java | 50 ++++++++++++------- .../messages/MessageBundle.properties | 1 + .../EPUB/content_001.xhtml | 4 +- .../EPUB/package.opf | 4 +- .../EPUB/content_001.xhtml | 4 +- .../EPUB/package.opf | 4 +- .../EPUB/content_001.xhtml | 4 +- .../EPUB/package.opf | 5 +- .../EPUB/content_001.xhtml | 11 ++++ .../EPUB/nav.xhtml | 14 ++++++ .../EPUB/package.opf | 20 ++++++++ .../EPUB/style.css | 4 ++ .../META-INF/container.xml | 6 +++ .../mimetype | 1 + .../EPUB/content_001.xhtml | 4 +- .../EPUB/package.opf | 5 +- .../epub3/03-resources/resources.feature | 6 +++ .../EPUB/content_001.xhtml | 2 +- .../EPUB/package.opf | 2 +- .../EPUB/chapter_001_overlay.smil | 2 +- .../EPUB/package.opf | 2 +- .../EPUB/content_001.xhtml | 2 +- .../EPUB/package.opf | 2 +- .../EPUB/content_001.xhtml | 4 +- .../EPUB/package.opf | 2 +- .../EPUB/content_001.xhtml | 2 +- .../EPUB/content_001.xhtml | 2 +- .../EPUB/package.opf | 2 +- 30 files changed, 123 insertions(+), 50 deletions(-) create mode 100644 src/test/resources/epub3/03-resources/files/resources-remote-not-https-warning/EPUB/content_001.xhtml create mode 100644 src/test/resources/epub3/03-resources/files/resources-remote-not-https-warning/EPUB/nav.xhtml create mode 100644 src/test/resources/epub3/03-resources/files/resources-remote-not-https-warning/EPUB/package.opf create mode 100644 src/test/resources/epub3/03-resources/files/resources-remote-not-https-warning/EPUB/style.css create mode 100644 src/test/resources/epub3/03-resources/files/resources-remote-not-https-warning/META-INF/container.xml create mode 100644 src/test/resources/epub3/03-resources/files/resources-remote-not-https-warning/mimetype diff --git a/src/main/java/com/adobe/epubcheck/messages/DefaultSeverities.java b/src/main/java/com/adobe/epubcheck/messages/DefaultSeverities.java index aaa61f901..8a2fbcf73 100644 --- a/src/main/java/com/adobe/epubcheck/messages/DefaultSeverities.java +++ b/src/main/java/com/adobe/epubcheck/messages/DefaultSeverities.java @@ -347,6 +347,7 @@ private void initialize() severities.put(MessageId.RSC_028, Severity.ERROR); severities.put(MessageId.RSC_029, Severity.ERROR); severities.put(MessageId.RSC_030, Severity.ERROR); + severities.put(MessageId.RSC_031, Severity.WARNING); // Scripting severities.put(MessageId.SCP_001, Severity.SUPPRESSED); // checking scripts is out of scope diff --git a/src/main/java/com/adobe/epubcheck/messages/MessageId.java b/src/main/java/com/adobe/epubcheck/messages/MessageId.java index c1f2a6135..cb0939912 100644 --- a/src/main/java/com/adobe/epubcheck/messages/MessageId.java +++ b/src/main/java/com/adobe/epubcheck/messages/MessageId.java @@ -341,6 +341,7 @@ public enum MessageId implements Comparable RSC_028("RSC-028"), RSC_029("RSC-029"), RSC_030("RSC-030"), + RSC_031("RSC-031"), // Messages relating to scripting SCP_001("SCP-001"), diff --git a/src/main/java/com/adobe/epubcheck/opf/XRefChecker.java b/src/main/java/com/adobe/epubcheck/opf/XRefChecker.java index 731841ffb..b284c83a2 100755 --- a/src/main/java/com/adobe/epubcheck/opf/XRefChecker.java +++ b/src/main/java/com/adobe/epubcheck/opf/XRefChecker.java @@ -286,7 +286,7 @@ public Optional getResource(URL url) * Returns set (possibly multiple) types of references to the given resource * * @param path - * the path to a publication resource + * the path to a publication resource * @return an immutable {@link EnumSet} containing the types of references to * {@code path}. */ @@ -428,24 +428,38 @@ private void checkReference(URLReference reference) URLFragment fragment = URLFragment.parse(reference.url, targetMimetype); // Check remote resources - if (container.isRemote(reference.url) - // remote links and hyperlinks are not Publication Resources - && !EnumSet.of(Type.LINK, Type.HYPERLINK).contains(reference.type) - // spine items are checked in OPFChecker30 - && !(version == EPUBVersion.VERSION_3 && targetResource != null - && targetResource.isInSpine()) - // audio, video, and fonts can be remote resources in EPUB 3 - && !(version == EPUBVersion.VERSION_3 && (targetResource != null - // if the item is declared, check its mime type - && (OPFChecker30.isAudioType(targetResource.getMimeType()) - || OPFChecker30.isVideoType(targetResource.getMimeType()) - || OPFChecker30.isFontType(targetResource.getMimeType())) - // else, check if the reference is a type allowing remote resources - || reference.type == Type.FONT || reference.type == Type.AUDIO - || reference.type == Type.VIDEO))) + if (container.isRemote(reference.url)) { - report.message(MessageId.RSC_006, reference.location.context(reference.targetDoc.toString())); - return; + // Check if the remote reference is allowed + if (// remote links and hyperlinks are not Publication Resources + !EnumSet.of(Type.LINK, Type.HYPERLINK).contains(reference.type) + // spine items are checked in OPFChecker30 + && !(version == EPUBVersion.VERSION_3 && targetResource != null + && targetResource.isInSpine()) + // audio, video, and fonts can be remote resources in EPUB 3 + && !(version == EPUBVersion.VERSION_3 && (targetResource != null + // if the item is declared, check its mime type + && (OPFChecker30.isAudioType(targetResource.getMimeType()) + || OPFChecker30.isVideoType(targetResource.getMimeType()) + || OPFChecker30.isFontType(targetResource.getMimeType())) + // else, check if the reference is a type allowing remote + // resources + || reference.type == Type.FONT || reference.type == Type.AUDIO + || reference.type == Type.VIDEO))) + { + report.message(MessageId.RSC_006, + reference.location.context(reference.targetDoc.toString())); + return; + } + // Check if the remote resource is using HTTPS + else if (version == EPUBVersion.VERSION_3 + && !EnumSet.of(Type.LINK, Type.HYPERLINK).contains(reference.type) + && !"https".equals(reference.url.scheme()) + // file URLs are disallowed and reported elsewhere + && !"file".equals(reference.url.scheme())) + { + report.message(MessageId.RSC_031, reference.location, reference.url); + } } // Check undeclared resources diff --git a/src/main/resources/com/adobe/epubcheck/messages/MessageBundle.properties b/src/main/resources/com/adobe/epubcheck/messages/MessageBundle.properties index 638f73a0a..71af7506c 100644 --- a/src/main/resources/com/adobe/epubcheck/messages/MessageBundle.properties +++ b/src/main/resources/com/adobe/epubcheck/messages/MessageBundle.properties @@ -356,6 +356,7 @@ RSC_027=XML document is encoded in UTF-16. It should be encoded in UTF-8 instead RSC_028=XML documents must be encoded in UTF-8, but %1%s was detected. RSC_029=Data URL is not allowed in this context. RSC_030=File URLs are not allowed in EPUB, but found "%1$s". +RSC_031=Remote resource references should use HTTPS, but found "%1$s". #Scripting SCP_001=Use of Javascript eval() function in EPUB scripts is a security risk. diff --git a/src/test/resources/epub3/03-resources/files/resources-remote-audio-sources-foreign-valid/EPUB/content_001.xhtml b/src/test/resources/epub3/03-resources/files/resources-remote-audio-sources-foreign-valid/EPUB/content_001.xhtml index ae3a9a5f7..423cb5fcf 100644 --- a/src/test/resources/epub3/03-resources/files/resources-remote-audio-sources-foreign-valid/EPUB/content_001.xhtml +++ b/src/test/resources/epub3/03-resources/files/resources-remote-audio-sources-foreign-valid/EPUB/content_001.xhtml @@ -7,8 +7,8 @@ diff --git a/src/test/resources/epub3/03-resources/files/resources-remote-audio-sources-foreign-valid/EPUB/package.opf b/src/test/resources/epub3/03-resources/files/resources-remote-audio-sources-foreign-valid/EPUB/package.opf index 4b20abadc..05658317f 100644 --- a/src/test/resources/epub3/03-resources/files/resources-remote-audio-sources-foreign-valid/EPUB/package.opf +++ b/src/test/resources/epub3/03-resources/files/resources-remote-audio-sources-foreign-valid/EPUB/package.opf @@ -9,8 +9,8 @@ - - + + diff --git a/src/test/resources/epub3/03-resources/files/resources-remote-audio-sources-valid/EPUB/content_001.xhtml b/src/test/resources/epub3/03-resources/files/resources-remote-audio-sources-valid/EPUB/content_001.xhtml index 468f27d79..4dd89977f 100644 --- a/src/test/resources/epub3/03-resources/files/resources-remote-audio-sources-valid/EPUB/content_001.xhtml +++ b/src/test/resources/epub3/03-resources/files/resources-remote-audio-sources-valid/EPUB/content_001.xhtml @@ -6,8 +6,8 @@ diff --git a/src/test/resources/epub3/03-resources/files/resources-remote-audio-sources-valid/EPUB/package.opf b/src/test/resources/epub3/03-resources/files/resources-remote-audio-sources-valid/EPUB/package.opf index fca255aa6..c7d629d69 100644 --- a/src/test/resources/epub3/03-resources/files/resources-remote-audio-sources-valid/EPUB/package.opf +++ b/src/test/resources/epub3/03-resources/files/resources-remote-audio-sources-valid/EPUB/package.opf @@ -9,8 +9,8 @@ - - + + diff --git a/src/test/resources/epub3/03-resources/files/resources-remote-audio-valid/EPUB/content_001.xhtml b/src/test/resources/epub3/03-resources/files/resources-remote-audio-valid/EPUB/content_001.xhtml index 6499dbd8c..0e388c2b6 100644 --- a/src/test/resources/epub3/03-resources/files/resources-remote-audio-valid/EPUB/content_001.xhtml +++ b/src/test/resources/epub3/03-resources/files/resources-remote-audio-valid/EPUB/content_001.xhtml @@ -5,11 +5,9 @@ Minimal EPUB - -