From 2abe187f67b07f6e0328ab3dbacb24e1b9119b05 Mon Sep 17 00:00:00 2001
From: yflory <yann.flory@xwiki.com>
Date: Tue, 19 Oct 2021 13:23:08 +0200
Subject: [PATCH] Run x2t in an iframe

---
 www/common/onlyoffice/main.js     |  11 +--
 www/common/onlyoffice/ooiframe.js |  11 +--
 www/common/sframe-common-outer.js |  25 +++++-
 www/convert/main.js               |  11 +--
 www/unsafeiframe/inner.html       |  13 +++
 www/unsafeiframe/inner.js         |  79 ++++++++++++++++++
 www/unsafeiframe/main.js          | 134 ++++++++++++++++++++++++++++++
 7 files changed, 256 insertions(+), 28 deletions(-)
 create mode 100644 www/unsafeiframe/inner.html
 create mode 100644 www/unsafeiframe/inner.js
 create mode 100644 www/unsafeiframe/main.js

diff --git a/www/common/onlyoffice/main.js b/www/common/onlyoffice/main.js
index 8b79474ae..6a7d81a4b 100644
--- a/www/common/onlyoffice/main.js
+++ b/www/common/onlyoffice/main.js
@@ -145,16 +145,9 @@ define([
             });
 
             // X2T
-            var x2t;
-            var onConvert = function (obj, cb) {
-                x2t.convert(obj, cb);
-            };
             sframeChan.on('Q_OO_CONVERT', function (obj, cb) {
-                if (x2t) { return void onConvert(obj, cb); }
-                require(['/common/outer/x2t.js'], function (X2T) {
-                    x2t = X2T.start();
-                    onConvert(obj, cb);
-                });
+                obj.modal = 'x2t';
+                Utils.initUnsafeIframe(obj, cb);
             });
 
 
diff --git a/www/common/onlyoffice/ooiframe.js b/www/common/onlyoffice/ooiframe.js
index 097d21e5e..23c6424e3 100644
--- a/www/common/onlyoffice/ooiframe.js
+++ b/www/common/onlyoffice/ooiframe.js
@@ -145,16 +145,9 @@ define([
                 });
 
                 // X2T
-                var x2t;
-                var onConvert = function (obj, cb) {
-                    x2t.convert(obj, cb);
-                };
                 sframeChan.on('Q_OO_CONVERT', function (obj, cb) {
-                    if (x2t) { return void onConvert(obj, cb); }
-                    require(['/common/outer/x2t.js'], function (X2T) {
-                        x2t = X2T.start();
-                        onConvert(obj, cb);
-                    });
+                    obj.modal = 'x2t';
+                    Utils.initUnsafeIframe(obj, cb);
                 });
 
                 sframeChan.onReady(function () {
diff --git a/www/common/sframe-common-outer.js b/www/common/sframe-common-outer.js
index 3139aa4f0..95b6c52b9 100644
--- a/www/common/sframe-common-outer.js
+++ b/www/common/sframe-common-outer.js
@@ -72,6 +72,7 @@ define([
         var SFrameChannel;
         var sframeChan;
         var SecureIframe;
+        var UnsafeIframe;
         var OOIframe;
         var Messaging;
         var Notifier;
@@ -99,6 +100,7 @@ define([
                 '/common/cryptget.js',
                 '/common/outer/worker-channel.js',
                 '/secureiframe/main.js',
+                '/unsafeiframe/main.js',
                 '/common/onlyoffice/ooiframe.js',
                 '/common/common-messaging.js',
                 '/common/common-notifier.js',
@@ -114,7 +116,7 @@ define([
                 '/common/test.js',
                 '/common/userObject.js',
             ], waitFor(function (_CpNfOuter, _Cryptpad, _Crypto, _Cryptget, _SFrameChannel,
-            _SecureIframe, _OOIframe, _Messaging, _Notifier, _Hash, _Util, _Realtime, _Notify,
+            _SecureIframe, _UnsafeIframe, _OOIframe, _Messaging, _Notifier, _Hash, _Util, _Realtime, _Notify,
             _Constants, _Feedback, _LocalStore, _Cache, _AppConfig, _Test, _UserObject) {
                 CpNfOuter = _CpNfOuter;
                 Cryptpad = _Cryptpad;
@@ -122,6 +124,7 @@ define([
                 Cryptget = _Cryptget;
                 SFrameChannel = _SFrameChannel;
                 SecureIframe = _SecureIframe;
+                UnsafeIframe = _UnsafeIframe;
                 OOIframe = _OOIframe;
                 Messaging = _Messaging;
                 Notifier = _Notifier;
@@ -1503,6 +1506,26 @@ define([
                 initSecureModal('share', data || {});
             });
 
+            // Unsafe iframe
+            var UnsafeObject = {};
+            Utils.initUnsafeIframe = function (cfg, cb) {
+                if (!UnsafeObject.$iframe) {
+                    var config = {};
+                    config.addCommonRpc = addCommonRpc;
+                    config.modules = {
+                        Cryptpad: Cryptpad,
+                        SFrameChannel: SFrameChannel,
+                        Utils: Utils
+                    };
+                    UnsafeObject.$iframe = $('<iframe>', {id: 'sbox-unsafe-iframe'}).appendTo($('body')).hide();
+                    UnsafeObject.modal = UnsafeIframe.create(config);
+                }
+                UnsafeObject.modal.refresh(cfg, function (data) {
+                    console.error(data);
+                    cb(data);
+                });
+            };
+
             // OO iframe
             var OOIframeObject = {};
             var initOOIframe = function (cfg, cb) {
diff --git a/www/convert/main.js b/www/convert/main.js
index 1bef9f9cd..04ab76846 100644
--- a/www/convert/main.js
+++ b/www/convert/main.js
@@ -19,16 +19,9 @@ define([
         }
         var addRpc = function (sframeChan) {
             // X2T
-            var x2t;
-            var onConvert = function (obj, cb) {
-                x2t.convert(obj, cb);
-            };
             sframeChan.on('Q_OO_CONVERT', function (obj, cb) {
-                if (x2t) { return void onConvert(obj, cb); }
-                require(['/common/outer/x2t.js'], function (X2T) {
-                    x2t = X2T.start();
-                    onConvert(obj, cb);
-                });
+                obj.modal = 'x2t';
+                Utils.initUnsafeIframe(obj, cb);
             });
         };
         var addData = function (obj) {
diff --git a/www/unsafeiframe/inner.html b/www/unsafeiframe/inner.html
new file mode 100644
index 000000000..9067fe7ca
--- /dev/null
+++ b/www/unsafeiframe/inner.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html style="height: 100%; background: transparent;">
+<head>
+    <meta content="text/html; charset=utf-8" http-equiv="content-type"/>
+    <script async data-bootload="/unsafeiframe/inner.js" data-main="/common/sframe-boot.js?ver=1.7" src="/bower_components/requirejs/require.js?ver=2.3.5"></script>
+    <style>
+        html, body { display: none; }
+    </style>
+</head>
+<body class="cp-app-unsafeiframe" style="background: transparent;">
+</body>
+</html>
+
diff --git a/www/unsafeiframe/inner.js b/www/unsafeiframe/inner.js
new file mode 100644
index 000000000..34a13cbe1
--- /dev/null
+++ b/www/unsafeiframe/inner.js
@@ -0,0 +1,79 @@
+define([
+    'jquery',
+    '/bower_components/chainpad-crypto/crypto.js',
+    '/bower_components/nthen/index.js',
+    '/common/sframe-common.js',
+    '/common/common-interface.js',
+    '/common/common-ui-elements.js',
+    '/common/common-util.js',
+    '/common/common-hash.js',
+    '/common/hyperscript.js',
+    'json.sortify',
+    '/customize/messages.js',
+], function (
+    $,
+    Crypto,
+    nThen,
+    SFCommon,
+    UI,
+    UIElements,
+    Util,
+    Hash,
+    h,
+    Sortify,
+    Messages)
+{
+    var APP = window.APP = {};
+
+    var andThen = function (common) {
+        var metadataMgr = common.getMetadataMgr();
+        var sframeChan = common.getSframeChannel();
+        var $body = $('body');
+        var displayed;
+
+        var create = {};
+
+        var x2t;
+        var onConvert = function (obj, cb) {
+            x2t.convert(obj, cb);
+        };
+        create['x2t'] = function (obj, cb) {
+            if (x2t) { return void onConvert(obj, cb); }
+            require(['/common/outer/x2t.js'], function (X2T) {
+                x2t = X2T.start();
+                onConvert(obj, cb);
+            });
+        };
+
+        sframeChan.on('Q_COMMAND', function (data, cb) {
+            if (!data) { return; }
+            var type = data.modal;
+            if (!create[type]) { return; }
+            create[type](data, cb);
+        });
+
+        UI.removeLoadingScreen();
+    };
+
+    var main = function () {
+        var common;
+        var _andThen = Util.once(andThen);
+
+        nThen(function (waitFor) {
+            $(waitFor(function () {
+                UI.addLoadingScreen({hideTips: true, hideLogo: true});
+            }));
+            SFCommon.create(waitFor(function (c) { APP.common = common = c; }));
+        }).nThen(function (/*waitFor*/) {
+            var metadataMgr = common.getMetadataMgr();
+            if (metadataMgr.getMetadataLazy() !== 'uninitialized') {
+                _andThen(common);
+                return;
+            }
+            metadataMgr.onChange(function () {
+                _andThen(common);
+            });
+        });
+    };
+    main();
+});
diff --git a/www/unsafeiframe/main.js b/www/unsafeiframe/main.js
new file mode 100644
index 000000000..5cecc11bf
--- /dev/null
+++ b/www/unsafeiframe/main.js
@@ -0,0 +1,134 @@
+// Load #1, load as little as possible because we are in a race to get the loading screen up.
+define([
+    '/bower_components/nthen/index.js',
+    '/api/config',
+    'jquery',
+    '/common/requireconfig.js',
+    '/customize/messages.js',
+], function (nThen, ApiConfig, $, RequireConfig, Messages) {
+    var requireConfig = RequireConfig();
+
+    var ready = false;
+
+    var create = function (config) {
+        // Loaded in load #2
+        var sframeChan;
+        nThen(function (waitFor) {
+            $(waitFor());
+        }).nThen(function (waitFor) {
+            var req = {
+                cfg: requireConfig,
+                req: [ '/common/loading.js' ],
+                pfx: window.location.origin,
+            };
+            window.rc = requireConfig;
+            window.apiconf = ApiConfig;
+            $('#sbox-unsafe-iframe').attr('src',
+                ApiConfig.httpUnsafeOrigin + '/unsafeiframe/inner.html?' + requireConfig.urlArgs +
+                    '#' + encodeURIComponent(JSON.stringify(req))).attr("sandbox", "");
+
+            // This is a cheap trick to avoid loading sframe-channel in parallel with the
+            // loading screen setup.
+            var done = waitFor();
+            var onMsg = function (msg) {
+                var data = typeof(msg.data) === "object" ? msg.data : JSON.parse(msg.data);
+                if (data.q !== 'READY') { return; }
+                window.removeEventListener('message', onMsg);
+                var _done = done;
+                done = function () { };
+                _done();
+            };
+            window.addEventListener('message', onMsg);
+        }).nThen(function (/*waitFor*/) {
+            var Cryptpad = config.modules.Cryptpad;
+            var Utils = config.modules.Utils;
+
+            nThen(function (waitFor) {
+                // The inner iframe tries to get some data from us every ms (cache, store...).
+                // It will send a "READY" message and wait for our answer with the correct txid.
+                // First, we have to answer to this message, otherwise we're going to block
+                // sframe-boot.js. Then we can start the channel.
+                var msgEv = Utils.Util.mkEvent();
+                var iframe = $('#sbox-unsafe-iframe')[0].contentWindow;
+                var postMsg = function (data) {
+                    iframe.postMessage(data, '*');
+                };
+                var w = waitFor();
+                var whenReady = function (msg) {
+                    if (msg.source !== iframe) { return; }
+                    var data = JSON.parse(msg.data);
+                    if (!data.txid) { return; }
+                    // Remove the listener once we've received the READY message
+                    window.removeEventListener('message', whenReady);
+                    // Answer with the requested data
+                    postMsg(JSON.stringify({ txid: data.txid, language: Cryptpad.getLanguage(), localStore: window.localStore, cache: window.cpCache }));
+
+                    // Then start the channel
+                    window.addEventListener('message', function (msg) {
+                        if (msg.source !== iframe) { return; }
+                        msgEv.fire(msg);
+                    });
+                    config.modules.SFrameChannel.create(msgEv, postMsg, waitFor(function (sfc) {
+                        sframeChan = sfc;
+                    }));
+                    w();
+                };
+                window.addEventListener('message', whenReady);
+            }).nThen(function () {
+                var updateMeta = function () {
+                    var metaObj;
+                    nThen(function (waitFor) {
+                        Cryptpad.getMetadata(waitFor(function (err, n) {
+                            if (err) {
+                                waitFor.abort();
+                                return void console.log(err);
+                            }
+                            metaObj = n;
+                        }));
+                    }).nThen(function (/*waitFor*/) {
+                        metaObj.doc = {};
+                        var additionalPriv = {
+                            fileHost: ApiConfig.fileHost,
+                            loggedIn: Utils.LocalStore.isLoggedIn(),
+                            origin: window.location.origin,
+                            pathname: window.location.pathname,
+                            feedbackAllowed: Utils.Feedback.state,
+                        };
+                        for (var k in additionalPriv) { metaObj.priv[k] = additionalPriv[k]; }
+
+                        sframeChan.event('EV_METADATA_UPDATE', metaObj);
+                    });
+                };
+                Cryptpad.onMetadataChanged(updateMeta);
+                sframeChan.onReg('EV_METADATA_UPDATE', updateMeta);
+
+                config.addCommonRpc(sframeChan, true);
+
+                sframeChan.onReady(function () {
+                    if (ready === true) { return; }
+                    if (typeof ready === "function") {
+                        ready();
+                    }
+                    ready = true;
+                });
+            });
+        });
+        var refresh = function (data, cb) {
+            if (!ready) {
+                ready = function () {
+                    refresh(data, cb);
+                };
+                return;
+            }
+            sframeChan.query('Q_COMMAND', data, function (err, obj) {
+                cb(obj);
+            }, {raw: true});
+        };
+        return {
+            refresh: refresh
+        };
+    };
+    return {
+        create: create
+    };
+});