@topconsultnpm/sdkui-react 6.20.0-dev1.52 → 6.20.0-dev1.53

package/lib/helper/SDKUI_Localizator.d.ts

@@ -492,6 +492,8 @@ export declare class SDKUI_Localizator {
     static get PhysDelete(): "Physische Stornierung" | "Physical delete" | "Cancelación física" | "Supression" | "Cancelamento física" | "Cancellazione fisica";
     static get PhysicalHistoryDeletion(): string;
     static get Postponed(): "Verschoben" | "Postponed" | "Aplazada" | "Reportée" | "Adiadas" | "Rinviata";
+    static get PotentiallyUnsafeContent(): "Potenziell unsichere Inhalte" | "Potentially Unsafe Content" | "Contenido potencialmente no seguro" | "Contenu potentiellement non sécurisé" | "Conteúdo potencialmente não seguro" | "Contenuti potenzialmente non sicuri";
+    static get PotentiallyUnsafeCodePatternsDetected(): "{{0}} potenziell unsicheres Code-Muster in diesem Dokument erkannt." | "{{0}} potentially unsafe code pattern detected in this document." | "Se han detectado {{0}} patrones de código potencialmente no seguro en este documento." | "{{0}} motifs de code potentiellement non sécurisé détectés dans ce document." | "{{0}} padrões de código potencialmente não seguro detectados neste documento." | "Sono stati rilevati {{0}} pattern di codice potenzialmente non sicuro in questo documento.";
     static get PreparingFileForArchive(): "Datei für Archivierung vorbereiten..." | "Preparing file for archive..." | "Preparando archivo para archivar..." | "Préparation du fichier pour l'archive..." | "Preparando arquivo para arquivar..." | "Preparazione del file per l'archivio...";
     static get Preview(): "Vorschau" | "Preview" | "Vista previa" | "Aperçu" | "Pré-visualização" | "Anteprima";
     static get PreviewDocument(): "Vorschau-Dokument" | "Preview document" | "Documento de vista previa" | "Document d'aperçu" | "Documento de pré-visualização" | "Anteprima documento";

package/lib/helper/SDKUI_Localizator.js

@@ -4878,6 +4878,32 @@ export class SDKUI_Localizator {
             default: return "Rinviata";
         }
     }
+    static get PotentiallyUnsafeContent() {
+        switch (this._cultureID) {
+            case CultureIDs.De_DE: return "Potenziell unsichere Inhalte";
+            case CultureIDs.En_US: return "Potentially Unsafe Content";
+            case CultureIDs.Es_ES: return "Contenido potencialmente no seguro";
+            case CultureIDs.Fr_FR: return "Contenu potentiellement non sécurisé";
+            case CultureIDs.Pt_PT: return "Conteúdo potencialmente não seguro";
+            default: return "Contenuti potenzialmente non sicuri";
+        }
+    }
+    static get PotentiallyUnsafeCodePatternsDetected() {
+        switch (this._cultureID) {
+            case CultureIDs.De_DE:
+                return "{{0}} potenziell unsicheres Code-Muster in diesem Dokument erkannt.";
+            case CultureIDs.En_US:
+                return "{{0}} potentially unsafe code pattern detected in this document.";
+            case CultureIDs.Es_ES:
+                return "Se han detectado {{0}} patrones de código potencialmente no seguro en este documento.";
+            case CultureIDs.Fr_FR:
+                return "{{0}} motifs de code potentiellement non sécurisé détectés dans ce document.";
+            case CultureIDs.Pt_PT:
+                return "{{0}} padrões de código potencialmente não seguro detectados neste documento.";
+            default:
+                return "Sono stati rilevati {{0}} pattern di codice potenzialmente non sicuro in questo documento.";
+        }
+    }
     static get PreparingFileForArchive() {
         switch (this._cultureID) {
             case CultureIDs.De_DE: return "Datei für Archivierung vorbereiten...";

package/lib/helper/TMPdfViewer.js

@@ -1,10 +1,11 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
 import { useEffect, useState, useRef, useCallback } from "react";
 import styled from "styled-components";
 import { LoadIndicator } from 'devextreme-react/load-indicator';
 import { IconCloseOutline } from "./TMIcons";
 import { SDKUI_Localizator } from "./SDKUI_Localizator";
 import { TMColors } from "../utils/theme";
+import { TMMessageBoxManager, ButtonNames } from "../components/base/TMPopUp";
 // Dynamic imports for optional dependencies
 let pdfjs;
 let Document;
@@ -68,6 +69,9 @@ const TMPdfViewer = (props) => {
     const [loadedPagesNumber, setLoadedPagesNumber] = useState(0);
     const [visiblePages, setVisiblePages] = useState(new Set([1]));
     const [pdfUrl, setPdfUrl] = useState("");
+    const [hasUnsafeContent, setHasUnsafeContent] = useState(false);
+    const [isCheckingPdf, setIsCheckingPdf] = useState(true);
+    const [jsMatches, setJsMatches] = useState([]);
     const observerRef = useRef(null);
     useEffect(() => {
         const checkIsMobile = () => {
@@ -82,7 +86,60 @@ const TMPdfViewer = (props) => {
                 (navigator.maxTouchPoints > 1 && !/Win|Mac|Linux x86_64/i.test(userAgent));
             setIsMobile(isMobileDevice);
         };
+        const checkPdfForJavaScript = async () => {
+            setIsCheckingPdf(true);
+            try {
+                // Legge il PDF come testo per cercare pattern di JavaScript
+                const arrayBuffer = await pdfBlob.arrayBuffer();
+                const uint8Array = new Uint8Array(arrayBuffer);
+                const text = new TextDecoder('latin1').decode(uint8Array);
+                // Pattern specifici per rilevare JavaScript effettivo nelle strutture PDF
+                const jsPatterns = [
+                    // Esempio: /JavaScript [ (app.alert('Hello');) ]
+                    { name: 'JavaScript Dictionary Entry', pattern: /\/JavaScript\s*[(\[<][\s\S]*?[)\]>]/i },
+                    // Esempio: /JS 15 0 R (riferimento a un oggetto JavaScript)
+                    { name: 'JavaScript Object Reference', pattern: /\/JS\s+\d+\s+\d+\s+R/i },
+                    // Esempio: /JS (app.alert('Click');) o /JS <hexstring>
+                    { name: 'Inline JavaScript Code', pattern: /\/JS\s*[(<][\s\S]*?[)>]/i },
+                    // Esempio: /AA << /O << /S /JavaScript /JS (app.alert('Open');) >> >>
+                    { name: 'Additional Actions (AA) with JavaScript', pattern: /\/AA\s*<<[\s\S]*?\/JS[\s\S]*?>>/is },
+                    // Esempio: /OpenAction << /S /JavaScript /JS (this.print();) >>
+                    { name: 'Document Open Action with JavaScript', pattern: /\/OpenAction\s*<<[\s\S]*?\/JS[\s\S]*?>>/is },
+                    // Esempio: /Names << /JavaScript [ (MyScript) 12 0 R ] >>
+                    { name: 'Named JavaScript Functions', pattern: /\/Names\s*<<[\s\S]*?\/JavaScript[\s\S]*?>>/is },
+                ];
+                let foundJS = false;
+                const matches = [];
+                jsPatterns.forEach(({ name, pattern }) => {
+                    const match = text.match(pattern);
+                    if (match) {
+                        foundJS = true;
+                        const matchIndex = match.index || 0;
+                        const contextStart = Math.max(0, matchIndex - 50);
+                        const contextEnd = Math.min(text.length, matchIndex + match[0].length + 50);
+                        const context = text.substring(contextStart, contextEnd);
+                        matches.push({
+                            name,
+                            pattern: pattern.toString(),
+                            match: match[0],
+                            context: context.replace(/[\r\n]+/g, ' ').trim()
+                        });
+                    }
+                });
+                setHasUnsafeContent(foundJS);
+                setJsMatches(matches);
+            }
+            catch (error) {
+                // console.error('Errore nella validazione del PDF:', error);
+                // In caso di errore, permetti la visualizzazione
+                setHasUnsafeContent(false);
+            }
+            finally {
+                setIsCheckingPdf(false);
+            }
+        };
         checkIsMobile();
+        checkPdfForJavaScript();
         // Create URL for iframe
         const url = URL.createObjectURL(pdfBlob);
         setPdfUrl(url);
@@ -133,8 +190,100 @@ const TMPdfViewer = (props) => {
             observerRef.current?.disconnect();
         };
     }, [pageObserverCallback]);
-    // Use iframe se react-pdf non è disponibile O se è desktop
-    if (!isReactPdfAvailable || (!isMobile && pdfUrl)) {
+    const showMatchDetails = () => {
+        const highlightMatch = (context, matchText) => {
+            const matchIndex = context.indexOf(matchText);
+            if (matchIndex === -1) {
+                // Se non trova il match esatto, prova con una versione normalizzata
+                const normalizedContext = context.replace(/\s+/g, ' ');
+                const normalizedMatch = matchText.replace(/\s+/g, ' ');
+                const normalizedIndex = normalizedContext.indexOf(normalizedMatch);
+                if (normalizedIndex === -1) {
+                    // Se ancora non trova, mostra tutto in grassetto rosso
+                    return _jsx("strong", { style: { color: '#d32f2f', fontWeight: 'bold' }, children: context });
+                }
+                return (_jsxs(_Fragment, { children: [normalizedContext.substring(0, normalizedIndex), _jsx("strong", { style: { color: '#d32f2f', fontWeight: 'bold', background: '#ffebee' }, children: normalizedContext.substring(normalizedIndex, normalizedIndex + normalizedMatch.length) }), normalizedContext.substring(normalizedIndex + normalizedMatch.length)] }));
+            }
+            return (_jsxs(_Fragment, { children: [context.substring(0, matchIndex), _jsx("strong", { style: { color: '#d32f2f', fontWeight: 'bold', background: '#ffebee' }, children: context.substring(matchIndex, matchIndex + matchText.length) }), context.substring(matchIndex + matchText.length)] }));
+        };
+        TMMessageBoxManager.show({
+            title: `${SDKUI_Localizator.Attention}: ${SDKUI_Localizator.PotentiallyUnsafeContent}`,
+            buttons: [ButtonNames.OK],
+            showToppy: false,
+            resizable: true,
+            initialWidth: !isMobile ? '800px' : undefined,
+            message: (_jsxs("div", { style: { maxHeight: '500px', overflowY: 'auto', padding: '10px', lineHeight: '1.6' }, children: [_jsxs("div", { style: {
+                            marginBottom: '20px',
+                            padding: '12px',
+                            background: '#fff3cd',
+                            border: '1px solid #ffc107',
+                            borderRadius: '6px',
+                            fontSize: '14px',
+                            wordBreak: 'normal',
+                            hyphens: 'none'
+                        }, children: [_jsxs("strong", { children: [SDKUI_Localizator.Attention, ":"] }), " ", SDKUI_Localizator.PotentiallyUnsafeCodePatternsDetected.replaceParams(jsMatches.length.toString())] }), jsMatches.length > 0 ? (jsMatches.map((match, index) => (_jsxs("div", { style: {
+                            marginBottom: '16px',
+                            padding: '16px',
+                            border: '1px solid #ffcdd2',
+                            borderRadius: '8px',
+                            background: '#fff',
+                            boxShadow: '0 1px 3px rgba(0,0,0,0.1)'
+                        }, children: [_jsx("div", { style: {
+                                    marginBottom: '12px',
+                                    paddingBottom: '8px',
+                                    borderBottom: '2px solid #f44336'
+                                }, children: _jsxs("strong", { style: {
+                                        color: '#d32f2f',
+                                        fontSize: '15px',
+                                        display: 'flex',
+                                        alignItems: 'center',
+                                        gap: '8px'
+                                    }, children: [_jsx("span", { style: {
+                                                background: '#f44336',
+                                                color: '#fff',
+                                                borderRadius: '50%',
+                                                width: '24px',
+                                                height: '24px',
+                                                display: 'inline-flex',
+                                                alignItems: 'center',
+                                                justifyContent: 'center',
+                                                fontSize: '13px',
+                                                fontWeight: 'bold'
+                                            }, children: index + 1 }), match.name] }) }), _jsx("div", { style: { fontSize: '13px' }, children: _jsx("div", { style: {
+                                        background: '#f5f5f5',
+                                        padding: '10px',
+                                        borderRadius: '4px',
+                                        borderLeft: '3px solid #f44336',
+                                        fontFamily: 'Consolas, Monaco, monospace',
+                                        fontSize: '12px',
+                                        wordBreak: 'break-all',
+                                        color: '#333',
+                                        maxHeight: '200px',
+                                        overflowY: 'auto',
+                                        userSelect: 'text'
+                                    }, children: highlightMatch(match.context, match.match) }) })] }, index)))) : (_jsx("div", { style: { textAlign: 'center', padding: '20px', color: '#999' }, children: "Nessun dettaglio disponibile" }))] }))
+        });
+    };
+    // Mostra loading durante la validazione
+    if (isCheckingPdf) {
+        return (_jsx(PDFViewerContainer, { children: _jsxs("div", { style: {
+                    display: 'flex',
+                    justifyContent: 'center',
+                    alignItems: 'center',
+                    height: '100%',
+                    flexDirection: 'column',
+                    gap: '10px'
+                }, children: [_jsx(LoadIndicator, { height: 60, width: 60 }), _jsx("div", { children: "Validazione PDF in corso..." })] }) }));
+    }
+    /**
+     * Usa <iframe> nei seguenti casi:
+     * 1. react-pdf non è disponibile (libreria non installata)
+     * 2. Desktop E nessun contenuto JavaScript rilevato (visualizzazione nativa del browser più performante)
+     *
+     * L'iframe sfrutta il visualizzatore PDF nativo del browser, ma non può prevenire
+     * l'esecuzione di JavaScript embedded nel PDF.
+     */
+    if (!isReactPdfAvailable || (!isMobile && !hasUnsafeContent && pdfUrl)) {
         return (_jsx(PDFViewerContainer, { children: _jsx("iframe", { src: `${pdfUrl}#${enableFitToWidth ? 'view=FitH&' : ''}scrollbar=1`, title: title, style: {
                     width: '100%',
                     height: '100%',
@@ -143,14 +292,25 @@ const TMPdfViewer = (props) => {
                     pointerEvents: isResizingActive === true ? "none" : "auto"
                 } }, pdfUrl) }));
     }
-    // Usa react-pdf solo per mobile e solo se disponibile
-    return _jsxs(PDFViewerContainer, { children: [loadedPagesNumber === 0 && totalPagesNumber > 0 && _jsx(LoadingOverlay, { children: _jsxs("div", { style: {
+    /**
+     * Usa react-pdf nei seguenti casi:
+     * 1. Dispositivo mobile (migliore esperienza utente con lazy loading)
+     * 2. Desktop con contenuto JavaScript rilevato (rendering sicuro senza esecuzione di script)
+     *
+     * react-pdf renderizza il PDF come canvas, prevenendo l'esecuzione di JavaScript embedded,
+     * ma è meno performante dell'iframe nativo su desktop.
+     */
+    return _jsxs(PDFViewerContainer, { style: { display: 'flex', flexDirection: 'column' }, children: [loadedPagesNumber === 0 && totalPagesNumber > 0 && _jsx(LoadingOverlay, { children: _jsxs("div", { style: {
                         display: 'flex',
                         justifyContent: 'center',
                         alignItems: 'center',
                         flexDirection: 'column',
                         gap: '10px'
-                    }, children: [_jsx(LoadIndicator, { height: 60, width: 60 }), _jsxs("div", { children: [SDKUI_Localizator.Loading, "..."] })] }) }), _jsx("div", { style: { display: loadedPagesNumber > 0 && totalPagesNumber > 0 ? 'block' : 'none' }, children: _jsx(Document, { file: pdfBlob, onLoadSuccess: ({ numPages }) => {
+                    }, children: [_jsx(LoadIndicator, { height: 60, width: 60 }), _jsxs("div", { children: [SDKUI_Localizator.Loading, "..."] })] }) }), _jsx("div", { style: {
+                    display: loadedPagesNumber > 0 && totalPagesNumber > 0 ? 'block' : 'none',
+                    flex: 1,
+                    overflow: 'auto'
+                }, children: _jsx(Document, { file: pdfBlob, onLoadSuccess: ({ numPages }) => {
                         setTotalPagesNumber(numPages);
                         setLoadedPagesNumber(0);
                     }, loading: _jsxs("div", { style: {
@@ -182,6 +342,27 @@ const TMPdfViewer = (props) => {
                             }, children: shouldRender && (_jsx(Page, { pageNumber: pageNumber, renderTextLayer: false, renderAnnotationLayer: false, width: Math.min(window.innerWidth - 40, 1200), loading: _jsx("div", { style: { padding: '20px' }, children: _jsx(LoadIndicator, { height: 40, width: 40 }) }), onLoadSuccess: () => {
                                     setLoadedPagesNumber(prev => prev + 1);
                                 } })) }, `page_${pageNumber}`));
-                    }) }) })] });
+                    }) }) }), hasUnsafeContent && (_jsxs("div", { style: {
+                    display: 'flex',
+                    justifyContent: 'center',
+                    alignItems: 'center',
+                    padding: '12px 20px',
+                    background: '#fff3cd',
+                    borderTop: '2px solid #ffc107',
+                    gap: '8px',
+                    flexShrink: 0
+                }, children: [_jsxs("span", { style: {
+                            color: '#856404',
+                            whiteSpace: 'nowrap',
+                            overflow: 'hidden',
+                            textOverflow: 'ellipsis',
+                            flex: 1
+                        }, children: [_jsx("strong", { children: "Attenzione:" }), " Questo documento contiene contenuti potenzialmente non sicuri."] }), jsMatches.length > 0 && (_jsx("span", { className: "dx-icon-info", style: {
+                            fontSize: '20px',
+                            color: '#d32f2f',
+                            cursor: 'pointer',
+                            transition: 'color 0.2s',
+                            marginLeft: '4px'
+                        }, onClick: showMatchDetails, title: "Clicca per vedere i dettagli", onMouseEnter: (e) => e.currentTarget.style.color = '#b71c1c', onMouseLeave: (e) => e.currentTarget.style.color = '#d32f2f' }))] }))] });
 };
 export default TMPdfViewer;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topconsultnpm/sdkui-react",
-  "version": "6.20.0-dev1.52",
+  "version": "6.20.0-dev1.53",
   "description": "",
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1",