Skip to content

Deprecate printToFile #730

Closed
Closed
@tresf

Description

@tresf

Printing to file should be extremely restricted, like #306 and only allow writing to certain pre-approved locations.

qz.configs.create({ file: 'foo/bar.txt'});
// -- OR --
cfg.setPrinter({ file: 'foo/bar.txt'});

Considerations

  • This technique is still somewhat popular for writing to a UNC path. e.g. \\print-server\printer-share\my printer. We should consider allowing non-loopback UNC paths. Detecting a non-loopback can be tricky. e.g. \\127.0.0.1\, \\COMPUTER\\, as well as IPv6 variants. This may make UNC too difficult to support. A decision must be made on UNC paths.
  • Add a deprecation warning immediately for this feature, since it needs to be removed or inhibited. (Done via 80bd7ae)
  • It may be viable to alias this to a convenience wrapper around FileIO writing. That way the existing FileIO whitelisting techniques can be reused.
  • As a replacement to users using this feature, we'd may offer instructions for setting up a file-printer. This varies per-platform.

Use Cases

I believe existing deployments fall into the the following three use-cases.

  • A shortcut to print raw to a UNC share
    • See consideration above about possibly keeping UNC path support
  • Testing/troubleshooting raw content
    • This can be mitigated by adding instructions for setting up a RAW file printer
  • 3rd-party device interfacing

Some relevant code snippets:

} else if (output.isSetFile()) {
printToFile(output.getFile(), bab.getByteArray());
} else {

if (configPrinter.has("file")) {
String filename = configPrinter.getString("file");
if (!FileUtilities.isGoodExtension(Paths.get(filename))) {
throw new IllegalArgumentException("Writing to file \"" + filename + "\" is denied for security reasons. (Prohibited file extension)");
} else if (FileUtilities.isBadPath(filename)) {
throw new IllegalArgumentException("Writing to file \"" + filename + "\" is denied for security reasons. (Prohibited directory name)");
} else {
file = new File(filename);
}
}

Supersedes #631

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions