search

highcharts / node-export-server

Highcharts Node.js export server
Other
354 stars 260 forks source link

v4: no error is thrown when callback is set and it's a file but allowFileResources is not set to true #575

Open DanielRuf opened 1 month ago

DanielRuf commented 1 month ago

When we set allowCodeExecution to false, we get The 'callback', 'resources' and 'customCode' options have been disabled for this server.

When we set allowCodeExecution to true, we get no error.

But when we set callback to a file, it silently ignores it. No error or warning is provided, that allowFileResources has to be enabled / set to true.

That is not ideal and makes debugging harder.

https://github.com/highcharts/node-export-server/blob/e7409447ab621ef4df3da5da70e67edb7b9b1707/lib/chart.js#L416

To reproduce:

highcharts-export-server --allowCodeExecution true --logToFile false --infile "....in.js" --outfile "...out.jpg" --type "jpg" --globalOptions "....globalOptions.json" --callback "some-invalid-path.js" --width 600 throws no error.

highcharts-export-server --allowCodeExecution true --logToFile false --infile "....in.js" --outfile "...out.jpg" --type "jpg" --globalOptions "....globalOptions.js" --callback "some-invalid-path.js" --allowFileResources true --width 600 throws error no such file or directory, open 'some-invalid-path.json'

DanielRuf commented 4 weeks ago

Also no error is thrown if the file defined for --globalOptions contains invalid JSON.

jszuminski commented 4 weeks ago

Thanks for reporting @DanielRuf!

You're right - it should be solved on our side. I have added this to our backlog.

Regarding your second point, @PaulDalek is currently working on this here: https://github.com/highcharts/node-export-server/pull/561 (full options validation with zod)