Desktop: Add OneNote Importer

[pedr]

Summary

I'm adding a new package library that will be used to convert OneNote exports into Joplin Notes.

The onenote-converter is based on the implementations found in:
https://github.com/msiemens/one2html
https://github.com/msiemens/onenote.rs

We will be compiling the Rust code to wasm with the package wasm-pack to output a Node package that can be imported in our codebase

---

What is missing at this point:

• Create resources from the SVG tags after the note is converted to HTML
• Remove the feature from mobile/app-cli. Find a way to disable the option of importing there
• Find a way to build the onenote-converter package (described bellow).
• Fix run_ci.sh (changed to debug)
• Fix yarn dist process (make sure the package is always build there)
• Review code
• [ ]

How the package is being integrated

Now Rust is a requirement, the message that is visible when Rust is not installed in the developer machine:

Error message

Message that shows when you try to run yarn build from the package without having Rust:

js@mint:~/Desktop/joplin/fork/packages/onenote-converter$ yarn build
> wasm-pack build --target nodejs --release
Error: failed to start `cargo metadata`: No such file or directory (os error 2)
Caused by: failed to start `cargo metadata`: No such file or directory (os error 2)
Caused by: No such file or directory (os error 2)
Fatal error
----------------------------------------------------------------
Rust toolchain is missing, please install it: https://rustup.rs/
----------------------------------------------------------------

[pedr]

• Move onenote-converter to shim so it can be injected instead of being required directly (See packages/lib/services/ocr/drivers/OcrDriverTesseract.ts)

[pedr]

Since we talked in the last meeting about finding a way to remove the requirement of adding Rust to the docker image for the server what I did was use shim.dynamicImport to get the file from the package/onenote-converter/pkg during run time.

Inside the Dockerfile.server I added a line to remove the import of @joplin/onenote-converter from the lib/package.json (otherwise the resolve step of yarn install fails)

[laurent22]

is that debugging code?

[pedr]

Yes, sorry, I'm going to clean this up

[laurent22]

That fix should be moved to a separate PR

[laurent22]

A good pattern for this kind of setter is to return the previous generator so that it can be reset by the caller. That's more future proof.

[laurent22]

What's the impact of this change on the app security? Looking at the code, I feel it will have the same SVG-related vulnerabilities that we already dealt with before. What are your thoughts on this? I guess it depends how the extracted SVGs are going to be used.

And as we've discussed before an HTML parser is not capable of parsing an SVG element safely. Maybe a different, more secure parser would be needed?

[laurent22]

Where do you need these? It's not really generic functions so I'm not sure we need it there

[pedr]

@laurent22

What's the impact of this change on the app security? Looking at the code, I feel it will have the same SVG-related vulnerabilities that we already dealt with before. What are your thoughts on this? I guess it depends how the extracted SVGs are going to be used.

And as we've discussed before an HTML parser is not capable of parsing an SVG element safely. Maybe a different, more secure parser would be needed?

The idea here is that we are removing the node out of HTML and using it as a resource linked in

With this we are protecting the user from exploits that happen when the exploit in inside the svg node (e.g.: a script tag inside). While the script tag would still be there it won't be executed unless the user opens the svg by itself, which I don't believe is possible inside Joplin.

Two other things are important to remember, this is a process that happens before any other sanitization and the original idea would be that this was only going to be used in the importer process of OneNote (there isn't any way to add svg to the Note of OneNote).

A simpler implementation (and probably more secure) using jsdom could be done like:

const result = []
const svgs = document.querySelectAll('svg');

for (const svg of svgs) {
    const id = titleGenerator();
    const parent = svg.parentNode;
    parentNode.replaceChild(<img src={id} />, svg);
    result.push({ id, svg: svg: serialize(svg) })
}

[pedr]

• Implement a simple solution (DOMParser.parseFromString