michaaels opened a new pull request, #8276: URL: https://github.com/apache/hop/pull/8276
## Summary Adds browser-native file operations to Hop Web while preserving the existing server-side `File` workflow. - Adds a separate `File Browser` category for creating, uploading, downloading, and exporting pipelines/workflows and projects. - Keeps `Close` and `Close All` only in `File`, and shows SVG export only while a pipeline or workflow is active. - Adds session-isolated RAP upload/download handling with bounded sizes, one-time download tokens, expiry, cleanup, and safe response headers. - Validates Kettle/PDI ZIP uploads against traversal, duplicate paths, excessive depth/count/size, and suspicious compression ratios. - Reuses the existing Projects and Kettle import GUI plugins rather than duplicating their implementation. - Includes `hop-misc-import` once in the standard plugin assembly so the action is available in the standard web distribution, and removes it from the optional marketplace catalog. - Adds English/Spanish messages and focused unit tests. ## Compatibility - Java 21 - Desktop SWT/RCP behavior remains server-file based. - Hop Web/RAP receives the browser-native `File Browser` actions. - RAP/FileUpload dependencies in the web assembly are aligned at 4.7.0; Commons FileUpload is M5 and Commons IO is 2.22.0. ## Security notes Uploads are scoped to a RAP UI session. Download handlers require both the owning HTTP session and UI session, use one-time expiring tokens, and delete temporary files after use or session disposal. Kettle ZIP extraction rejects absolute/traversal paths, duplicates, overlong/deep paths, excessive entry counts, per-entry and aggregate expansion limits, and high compression ratios. ## Validation - Focused Java 21 tests: 28 passed (`HopVfsTest`, `HopHomeTest`, `HopGuiWebUserFileMenuTest`, `HopWebUserFilePluginTest`, `KettleImportDialogTest`). - `assemblies/web` package: passed. - Spotless check for core/import/marketplace/projects/ui/rap/web and dependencies: passed. - Broader `assemblies/client -am -Pskip-uitest package`: passed across 284 modules. - `git diff --check`: passed. - Direct RAT checks for `rap` and `plugins/misc/import`: passed with zero unapproved files. The root RAT run also scanned locally installed untracked Tomcat/runtime files, so it was not used as a clean-worktree signal. - Local Tomcat 10.1.59 returned HTTP 200 using Java 21. Chrome/Selenium confirmed GUI startup, browser console access, and pipeline creation. A headless-only repaint issue in the existing `ContextDialog` prevented a fully repeatable automated click-through of the browser download action; focused menu-state and transfer tests cover those paths. ------------------------ Thank you for your contribution! Follow this checklist to help us incorporate your contribution quickly and easily: - [ ] Run `mvn clean install apache-rat:check` to make sure basic checks pass. A more thorough check will be performed on your pull request automatically. - [x] If you have a group of commits related to the same change, please squash your commits into one and force push your branch using `git rebase -i`. - [ ] Mention the appropriate issue in your description (for example: `addresses #123`), if applicable. To make clear that you license your contribution under the [Apache License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0) you have to acknowledge this by using the following check-box. - [x] I hereby declare this contribution to be licensed under the [Apache License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0) - [ ] In any other case, please file an [Apache Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
