Farooq Ayoade created FINERACT-2669:
---------------------------------------
Summary: Bulk-import download templates throw HTTP 500
(IllegalArgumentException: Invalid name) when a client or office name contains
an apostrophe — the named-range sanitiser uses a denylist that misses ' and
other Excel-illegal characters
Key: FINERACT-2669
URL: https://issues.apache.org/jira/browse/FINERACT-2669
Project: Apache Fineract
Issue Type: Bug
Components: DataImportTool
Reporter: Farooq Ayoade
h3. Observed behavior
Downloading a bulk-import template that embeds client lookups (e.g. loan
repayment: {{{}GET /v1/loans/repayments/downloadtemplate{}}}) returns HTTP 500
when any client in the requesting user's office hierarchy has an apostrophe in
its display name:
{{java.lang.IllegalArgumentException: Invalid name:
'Account_IRE'S_LIMITED_181_': name must be letter, digit, period, or underscore
at org.apache.poi.hssf.usermodel.HSSFName.validateName(HSSFName.java:206)
at org.apache.poi.hssf.usermodel.HSSFName.setNameName(HSSFName.java:134)
at
org.apache.fineract.infrastructure.bulkimport.populator.AbstractWorkbookPopulator.setSanitized(AbstractWorkbookPopulator.java)
at
org.apache.fineract.infrastructure.bulkimport.populator.loanrepayment.LoanRepaymentWorkbookPopulator.setNames(...)}}
{{}}
h3. Expected behavior
The template downloads successfully (HTTP 200). The client/office name is
sanitised into a valid Excel defined-name (only letter, digit, period,
underscore) for the dropdown named range, regardless of which characters the
display name contains.
h3. Steps to reproduce
# Create a client whose display name contains an apostrophe, e.g. {{{}IRE'S
LIMITED{}}}, with an active loan.
# As a user whose office hierarchy includes that client, call {{{}GET
/fineract-provider/api/v1/loans/repayments/downloadtemplate?dateFormat=dd%20MMMM%20yyyy{}}}.
# Observe HTTP 500 with the {{Invalid name}} {{IllegalArgumentException}}
above. (Scope the request to an office that excludes the apostrophe client and
it succeeds — confirming the trigger is the name content.)
h3. Root cause
{{AbstractWorkbookPopulator.setSanitized()}} sanitises a display name before
passing it to {{Name.setNameName(...)}} for a dropdown named range. The
sanitiser uses a *denylist* regex that enumerates "bad" characters to replace
with {{{}_{}}}:
!http://localhost:63343/markdownPreview/870999344/custom-guide/core-tickets!
{{private static final Pattern NAME_REGEX = Pattern.compile("[
@#&()<>,;.:$£€§°\\\\/=!\\?\\-\\+\\*\"\\[\\]]");}}
The apostrophe {{'}} is not in the list (nor are {{{}%{}}}, {{{}~{}}},
{{{}^{}}}, {{{}{{}}}, {{{}}{}}}, {{{}|{}}}, backtick, etc.), so it survives
into the defined name and POI rejects it. A denylist inherently misses any
character it does not enumerate.
h3. Proposed fix
Invert the denylist into an {*}allowlist{*}: replace any character that is not
a valid Excel defined-name character with {{{}_{}}}. Excel/POI permit letters,
digits, period and underscore; keep Unicode letters/digits so accented names
(which the old denylist preserved) are unaffected:
{{private static final Pattern NAME_REGEX =
Pattern.compile("[^\\p\{L}\\p\{N}._]");}}
This fixes the apostrophe and every other Excel-illegal character in one place,
for every template that builds named ranges via {{setSanitized}} (loan
repayment, savings/RD/FD transactions, guarantor, groups, …). Related:
FINERACT-1256 (the original sanitiser change).
----
{{}}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
