Add simple xlsx file render support #4106
Conversation
lunny
added
type/proposal
Codecov Report
@@ Coverage Diff @@
## master #4106 +/- ##
==========================================
+ Coverage 19.97% 19.97% +<.01%
==========================================
Files 153 153
Lines 30494 30497 +3
==========================================
+ Hits 6091 6093 +2
- Misses 23489 23490 +1
Partials 914 914
Continue to review full report at Codecov.
|
bkcsoft
added
the
lgtm/need 2
| @@ -0,0 +1,84 @@ | |||
| // Copyright 20178 The Gitea Authors. All rights reserved. | |||
| if i == 0 { | ||
| active = "active" | ||
| } | ||
| tmpBlock.WriteString(fmt.Sprintf(`<a class="%s item" data-tab="%d">%s</a>`, active, i, sheetMap[i+1])) |
|
IMHO a xlsx render may be out of scope of the gitea project. Could this be implemented as external renderer? This would reduce the amount of maintenance required. |
|
It's actually quite small code on Gitea side so I would not mind it being included |
|
Well, it's adding an external library as a dependency, increasing the attack surface of gitea by several thousands line of code. |
|
It should not be increasing attack vector as it just reads file. Stack/heap overflows should not be possible in Go and used lib is pure go code so it should be quite safe |
|
It might add XSS, CSRF, arbitrary file inclusion, … And yes, you can get arbitrary remote code execution via go, even in its stdlib :) |
|
There is risk but as we are using same sanitizer as markdown it should not be too high to not implement this feature |
|
But to be honest, I'm more worried about adding an other repository for an attacker to take over to introduce malicious code into gitea. But I guess that it's how go is working 🤷♂️ |
|
@jvoisin I was talking about library not current PR code. What I was trying to say that library code should not be problem in this case, current PRs code of course needs to be fixed in multiple places. |
|
I'm with @jvoisin on this one... At least put this behind a build tag as it might introduce attack-vectors 😐 (In before we need a build-service like Caddy 😂 ) |
|
Closing due to external rendering available. Re-open if needed. |
partial fix #4104