[FIX] base_import: ensure reloaded file is valid

The *Reload File* import functionality stands on an undefined behavior
or the HTML File API. The API is not clear about what should done in
case the underlying file change on the filesystem after it has been
imported in the browser.

It turns out the actual behavior vary among browsers and even among
OSes. The *Reload File* button only works as intended when importing
files via Chrome on Linux.

In other cases, the browser may refuse to send the file or may send it
in a corrupted HTTP request. Such malformed request is rejected in the
best cases by the backend web application but there is chance it hangs.

Security-wise, this problem is not much likely to happen as it requires
an authenticated user with importation privileges to perform the
operation. When it comes to the severity, it is possible to exhaust the
available workers by forcing every one of them to hang.

As there is a security impact, we decided to disable the *Reload File*
functionality.

Steps to reproduce
------------------

1) Import a CSV or XLSX document in any model.
2) Wait for the data visualization to come back to the browser.
3) Change the file on disk to
  a) remove a few lines
  b) add a few more lines.
4) Click the Reload button.

Wrong `size` attribute on Firefox.
----------------------------------

Impact: Firefox

The advertised `Content-Length` HTTP header in the POST request is
a) *greater* than the actual body length. The backend web application
   hangs on a `socket.recv` like function waiting for those missing
   bytes.
b) *smaller* than the actual body length. The request is truncated
   and futher processing is impossible.

The malformed request should have been detected and reported by the http
web application as requested by the HTTP/1.1 spec [1]:

> When a Content-Length is given in a message where a message-body is
  allowed, its field value MUST exactly match the number of OCTETs in
  the message-body. HTTP/1.1 user agents MUST notify the user when an
  invalid length is received and detected.

Mitigating the issue is possible using nginx as reverse-proxy. The
connection is closed after one minute if data are missing.

Invalid `ERR_UPLOAD_FILE_CHANGED`
---------------------------------

Impact: Chrome on Windows

Chrome prevent sending the XHR due to a `ERR_UPLOAD_FILE_CHANGED` error,
this error should only happens when the underlying file content have
been changed the second before the request. On Windows, the error
is triggered as soon as the file have been changed, not considering the
modification time.

[1]: https://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html Section 4.4

opw-2252440

closes odoo/odoo#52276

X-original-commit: 30be09cdb7d5b80fb1e0221f58024586bd72ac61
Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>
Signed-off-by: Julien Castiaux <Julien00859@users.noreply.github.com>

2 files changed, 3 insertions, 6 deletions

diff --git a/addons/base_import/static/src/js/import_action.js b/addons/base_import/static/src/js/import_action.js
index d104fc4b0e6..9893aee821b 100644
--- a/addons/base_import/static/src/js/import_action.js
+++ b/addons/base_import/static/src/js/import_action.js
@@ -201,7 +201,6 @@ var DataImport = AbstractAction.extend({
         this.$buttons = $(QWeb.render("ImportView.buttons", this));
         this.$buttons.filter('.o_import_validate').on('click', this.validate.bind(this));
         this.$buttons.filter('.o_import_import').on('click', this.import.bind(this));
-        this.$buttons.filter('.o_import_file_reload').on('click', this.loaded_file.bind(this, null));
         this.$buttons.filter('.oe_import_file').on('click', function () {
             self.$('.o_content .oe_import_file').click();
         });
@@ -347,7 +346,7 @@ var DataImport = AbstractAction.extend({
             this.toggle_partial(null);
         }
 
-        this.$buttons.filter('.o_import_import, .o_import_validate, .o_import_file_reload').addClass('d-none');
+        this.$buttons.filter('.o_import_import, .o_import_validate').addClass('d-none');
         if (!this.$('input.oe_import_file').val()) { return this['settings_changed'](); }
         this.$('.oe_import_date_format').select2('val', '');
         this.$('.oe_import_datetime_format').val('');
@@ -367,7 +366,7 @@ var DataImport = AbstractAction.extend({
     },
     onpreviewing: function () {
         var self = this;
-        this.$buttons.filter('.o_import_import, .o_import_validate, .o_import_file_reload').addClass('d-none');
+        this.$buttons.filter('.o_import_import, .o_import_validate').addClass('d-none');
         this.$form.addClass('oe_import_with_file');
         // TODO: test that write // succeeded?
         this.$form.removeClass('oe_import_preview_error oe_import_error');
@@ -386,7 +385,6 @@ var DataImport = AbstractAction.extend({
     },
     onpreview_error: function (event, from, to, result) {
         this.$('.oe_import_options').show();
-        this.$buttons.filter('.o_import_file_reload').removeClass('d-none');
         this.$form.addClass('oe_import_preview_error oe_import_error');
         this.$form.find('.oe_import_box, .oe_import_with_file').removeClass('d-none');
         this.$form.find('.o_view_nocontent').addClass('d-none');
@@ -399,7 +397,7 @@ var DataImport = AbstractAction.extend({
             .text(_t('Load New File'))
             .removeClass('btn-primary').addClass('btn-secondary')
             .blur();
-        this.$buttons.filter('.o_import_import, .o_import_validate, .o_import_file_reload').removeClass('d-none');
+        this.$buttons.filter('.o_import_import, .o_import_validate').removeClass('d-none');
         this.$form.find('.oe_import_box, .oe_import_with_file').removeClass('d-none');
         this.$form.find('.o_view_nocontent').addClass('d-none');
         this.$form.addClass('oe_import_preview');
diff --git a/addons/base_import/static/src/xml/base_import.xml b/addons/base_import/static/src/xml/base_import.xml
index 827f95a337a..a0f202468e7 100644
--- a/addons/base_import/static/src/xml/base_import.xml
+++ b/addons/base_import/static/src/xml/base_import.xml
@@ -124,7 +124,6 @@
         <button type="button" class="btn btn-primary o_import_import o_import_import_full d-none">Import</button>
         <button type="button" class="btn btn-primary o_import_import o_import_import_partial d-none">Resume</button>
         <button type="button" class="btn btn-secondary o_import_validate d-none">Test</button>
-        <button type="button" class="btn btn-secondary o_import_file_reload d-none">Reload File</button>
         <button type="button" class="btn btn-primary oe_import_file">Load File</button>
         <button type="button" class="btn btn-secondary o_import_cancel">Cancel</button>
     </t>