[
https://issues.apache.org/jira/browse/FINERACT-2669?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Adam Saghy resolved FINERACT-2669.
----------------------------------
Resolution: Fixed
> Bulk-import download templates throw HTTP 500 (IllegalArgumentException:
> Invalid name) when a client or office name contains an apostrophe — the
> named-range sanitiser uses a denylist that misses ' and other Excel-illegal
> characters
> ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: FINERACT-2669
> URL: https://issues.apache.org/jira/browse/FINERACT-2669
> Project: Apache Fineract
> Issue Type: Bug
> Components: DataImportTool
> Reporter: Farooq Ayoade
> Priority: Major
> Fix For: 1.15.0
>
>
> h3. Observed behavior
> Downloading a bulk-import template that embeds client lookups (e.g. loan
> repayment: {{{}GET /v1/loans/repayments/downloadtemplate{}}}) returns HTTP
> 500 when any client in the requesting user's office hierarchy has an
> apostrophe in its display name:
> {{java.lang.IllegalArgumentException: Invalid name:
> 'Account_IRE'S_LIMITED_181_': name must be letter, digit, period, or
> underscore
> at org.apache.poi.hssf.usermodel.HSSFName.validateName(HSSFName.java:206)
> at org.apache.poi.hssf.usermodel.HSSFName.setNameName(HSSFName.java:134)
> at
> org.apache.fineract.infrastructure.bulkimport.populator.AbstractWorkbookPopulator.setSanitized(AbstractWorkbookPopulator.java)
> at
> org.apache.fineract.infrastructure.bulkimport.populator.loanrepayment.LoanRepaymentWorkbookPopulator.setNames(...)}}
> {{}}
> h3. Expected behavior
> The template downloads successfully (HTTP 200). The client/office name is
> sanitised into a valid Excel defined-name (only letter, digit, period,
> underscore) for the dropdown named range, regardless of which characters the
> display name contains.
> h3. Steps to reproduce
> # Create a client whose display name contains an apostrophe, e.g. {{{}IRE'S
> LIMITED{}}}, with an active loan.
> # As a user whose office hierarchy includes that client, call {{{}GET
> /fineract-provider/api/v1/loans/repayments/downloadtemplate?dateFormat=dd%20MMMM%20yyyy{}}}.
> # Observe HTTP 500 with the {{Invalid name}} {{IllegalArgumentException}}
> above. (Scope the request to an office that excludes the apostrophe client
> and it succeeds — confirming the trigger is the name content.)
> h3. Root cause
> {{AbstractWorkbookPopulator.setSanitized()}} sanitises a display name before
> passing it to {{Name.setNameName(...)}} for a dropdown named range. The
> sanitiser uses a *denylist* regex that enumerates "bad" characters to replace
> with {{{}_{}}}:
>
>
> {{private static final Pattern NAME_REGEX = Pattern.compile("[
> @#&()<>,;.:$£€§°\\\\/=!\\?\\-\\+\\*\"\\[}}
> {{]]");}}
> The apostrophe {{'}} is not in the list (nor are {{{}%{}}}, {{{}~{}}},
> {{{}^{}}}, {{{{}}{{}}}, {{{}}{}}}, {{{}|{}}}, backtick, etc.), so it survives
> into the defined name and POI rejects it. A denylist inherently misses any
> character it does not enumerate.
> h3. Proposed fix
> Invert the denylist into an {*}allowlist{*}: replace any character that is
> not a valid Excel defined-name character with {{{}_{}}}. Excel/POI permit
> letters, digits, period and underscore; keep Unicode letters/digits so
> accented names (which the old denylist preserved) are unaffected:
>
> {{private static final Pattern NAME_REGEX =
> Pattern.compile("[^\\p\\{L}\\p\\{N}._]");}}
> This fixes the apostrophe and every other Excel-illegal character in one
> place, for every template that builds named ranges via {{setSanitized}} (loan
> repayment, savings/RD/FD transactions, guarantor, groups, …). Related:
> FINERACT-1256 (the original sanitiser change).
> ----
> {{}}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
