diff --git a/DokuReader.py b/DokuReader.py index ea5f2d1..241a6f1 100644 --- a/DokuReader.py +++ b/DokuReader.py @@ -36,6 +36,14 @@ helper_status = 1 raise SystemExit(helper_status) +if __name__ == "__main__" and len(sys.argv) > 1 and sys.argv[1] == "--libreoffice-process-helper": + try: + from libreoffice_process import helper_main + helper_status = helper_main(sys.argv[2:]) + except Exception: + helper_status = 1 + raise SystemExit(helper_status) + import os import json import shutil @@ -48,6 +56,7 @@ from datetime import datetime, timezone from pathlib import Path from office_conversion import convert_word_to_pdf, valid_pdf +from libreoffice_process import run_libreoffice_process import tkinter as tk from tkinter import ttk, filedialog, messagebox, simpledialog @@ -2027,6 +2036,10 @@ def _office_to_pdf(self, path: str, tmpdir: Path) -> str | None: executable = shutil.which(candidate) if not executable: continue + if platform.system() == "Windows": + console_entry = Path(executable).with_suffix(".com") + if console_entry.is_file(): + executable = str(console_entry) staged = None try: with tempfile.TemporaryDirectory(prefix=".dokureader-libreoffice-", dir=tmpdir) as temporary: @@ -2034,14 +2047,14 @@ def _office_to_pdf(self, path: str, tmpdir: Path) -> str | None: output_directory = work / "output" output_directory.mkdir() profile = work / "profile" - result = subprocess.run( + succeeded = run_libreoffice_process( [executable, "-env:UserInstallation=" + profile.as_uri(), "--headless", "--norestore", "--convert-to", "pdf", "--outdir", str(output_directory), str(Path(path).resolve())], - stdout=subprocess.PIPE, stderr=subprocess.PIPE, timeout=180, check=False, + timeout=180, ) output = output_directory / (Path(path).stem + ".pdf") - if result.returncode != 0 or not valid_pdf(output): + if not succeeded or not valid_pdf(output): continue # Vorbereitung außerhalb des Profils: dessen Bereinigung muss # vor dem Ersetzen einer früheren Konvertierung gelingen. diff --git a/README.md b/README.md index ee3c1e4..29103d7 100644 --- a/README.md +++ b/README.md @@ -298,7 +298,7 @@ selection without opening the application or changing its library. ### Optional System Dependencies For full preview rendering and external document conversion: -- **LibreOffice:** Required for headless DOC/DOCX/ODT/RTF to PDF conversion. Each attempt uses a fresh private user profile and output directory, with a 180-second launcher timeout. Only a newly produced, readable PDF with pages and exit code 0 is accepted. Failed conversion, profile cleanup or publication preserves the previous output. The launcher timeout does not guarantee that every descendant process has exited. +- **LibreOffice:** Required for headless DOC/DOCX/ODT/RTF to PDF conversion. Each attempt uses a fresh private profile and output directory with a 180-second deadline. Windows terminates the owned process job and observes its exit before returning; an available `soffice.com` console entry is preferred. Linux/macOS send SIGKILL to the owned process group before waiting for and reaping its supervisor. Cleanup allows up to five additional seconds. Only a fresh readable PDF with pages, exit code 0 and successful cleanup is accepted. Conversion, profile cleanup or publication failures preserve previous output. The deadline applies per attempt; another converter may subsequently be tried. Detached POSIX processes fall outside this group boundary; termination of every grandchild is not generally proven. - **Poppler:** Required if using the optional `pdf2image` preview backend. - **Microsoft Word:** Supported on Windows 10 or later with pywin32. Word automation runs in an owned process job with a 180-second deadline covering startup, export and shutdown, plus at most five seconds for cleanup. Existing Word processes are not reused or terminated. diff --git a/README_de.md b/README_de.md index 969095c..d1dbfcd 100644 --- a/README_de.md +++ b/README_de.md @@ -302,7 +302,7 @@ ohne die App zu öffnen oder die Bibliothek zu verändern. ### Optionale Systemabhängigkeiten Für den vollen Funktionsumfang bei Vorschau und Konvertierung: -- **LibreOffice:** Erforderlich für die automatisierte Konvertierung von DOC/DOCX/ODT/RTF nach PDF. Jeder Versuch verwendet ein neues privates Benutzerprofil und Ausgabeverzeichnis; der gestartete Prozess erhält 180 Sekunden Frist. Nur eine neu erzeugte, lesbare PDF mit Seiten und Exit-Code 0 wird übernommen. Fehler bei Konvertierung, Profilbereinigung oder Veröffentlichung erhalten die vorherige Ausgabe. Die Prozessfrist garantiert nicht, dass sämtliche Nachfahren beendet sind. +- **LibreOffice:** Erforderlich für die automatisierte Konvertierung von DOC/DOCX/ODT/RTF nach PDF. Jeder Versuch verwendet ein neues privates Benutzerprofil und Ausgabeverzeichnis mit 180 Sekunden Frist. Unter Windows wird der eigene Prozessjob vor Rückgabe beendet und sein Ende geprüft; ein vorhandener `soffice.com`-Konsoleneinstieg hat Vorrang. Unter Linux/macOS erhält die eigene Prozessgruppe SIGKILL, bevor ihr Helfer beendet und geerntet wird. Für die Bereinigung sind bis zu fünf zusätzliche Sekunden vorgesehen. Nur eine neue, lesbare PDF mit Seiten, Exit-Code 0 und erfolgreicher Bereinigung wird übernommen. Konvertierungs-, Profilbereinigungs- und Veröffentlichungsfehler erhalten die vorherige Ausgabe. Die Frist gilt je Versuch, anschließend kann ein anderer Konverter versucht werden. Unter POSIX bleiben aus der Gruppe abgesetzte Prozesse außerhalb dieses Schutzes; das Ende sämtlicher Enkelprozesse ist nicht allgemein nachgewiesen. - **Poppler:** Erforderlich bei Nutzung des optionalen `pdf2image`-Vorschau-Backends. - **Microsoft Word:** Unter Windows 10 oder neuer mit pywin32 unterstützt. Die Word-Automatisierung läuft in einem eigenen Prozessjob mit 180 Sekunden Frist für Start, Export und Schließen sowie höchstens fünf Sekunden Aufräumfrist. Bereits laufende Word-Prozesse werden weder verwendet noch beendet. diff --git a/libreoffice_process.py b/libreoffice_process.py new file mode 100644 index 0000000..50ed38e --- /dev/null +++ b/libreoffice_process.py @@ -0,0 +1,89 @@ +"""Bound an owned LibreOffice job/session without inherited output pipes.""" +import json +import os +from pathlib import Path +import signal +import subprocess +import sys +import tempfile +import time + +from office_conversion import run_windows_job + + +def helper_command(result, command): + if getattr(sys, "frozen", False): + prefix = [sys.executable, "--libreoffice-process-helper"] + else: + prefix = [sys.executable, str(Path(__file__).resolve())] + return prefix + [str(result), str(os.getpid()), *command] + + +def run_libreoffice_process(command, timeout=180): + """Return success only after owned cleanup; raise on cleanup failure. + + POSIX targets stay in a private session. Detached descendants are outside + that boundary; only the directly owned session leader can be reaped here. + """ + if os.name == "nt": + return run_windows_job(command, timeout) + if signal.getsignal(signal.SIGCHLD) != signal.SIG_DFL: + raise OSError("Owned process groups require the default SIGCHLD handler") + with tempfile.TemporaryDirectory(prefix="dokureader-lo-process-") as temporary: + result = Path(temporary) / "result.json" + started = time.monotonic() + process = subprocess.Popen(helper_command(result, command), start_new_session=True, + stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL, + stderr=subprocess.DEVNULL) + succeeded = False + try: + while time.monotonic() - started < timeout: + if result.exists(): + code = json.loads(result.read_text(encoding="utf-8")) + succeeded = type(code) is int and code == 0 + break + time.sleep(0.02) + finally: + # Never poll/wait/reap the leader before this signal. Even a crashed + # leader reserves its PID while unreaped, preventing PGID reuse. + try: + os.killpg(process.pid, signal.SIGKILL) + except ProcessLookupError: + pass + finally: + try: + process.wait(timeout=5) + except subprocess.TimeoutExpired as exc: + raise OSError("Owned LibreOffice supervisor did not exit") from exc + return succeeded + + +def helper_main(argv): + """Report converter exit atomically, retain the leader until parent cleanup.""" + if os.name == "nt" or len(argv) < 3: + return 1 + result, parent, command = Path(argv[0]), int(argv[1]), argv[2:] + if (os.getsid(0) != os.getpid() or os.getpgrp() != os.getpid() + or parent <= 0 or os.getppid() != parent): + return 1 + try: + child = subprocess.Popen(command, stdin=subprocess.DEVNULL, + stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) + while child.poll() is None: + if os.getppid() != parent: + os.killpg(os.getpgrp(), signal.SIGKILL) + time.sleep(0.02) + code = child.returncode + except OSError: + code = -1 + staging = result.with_suffix(".tmp") + staging.write_text(json.dumps(code), encoding="utf-8") + os.replace(staging, result) + while True: + if os.getppid() != parent: + os.killpg(os.getpgrp(), signal.SIGKILL) + time.sleep(0.02) + + +if __name__ == "__main__": + raise SystemExit(helper_main(sys.argv[1:])) diff --git a/tests/source_platform_smoke.py b/tests/source_platform_smoke.py index 47e3ce2..fb6fddf 100644 --- a/tests/source_platform_smoke.py +++ b/tests/source_platform_smoke.py @@ -35,7 +35,7 @@ def runner(cmd, stdout=None, stderr=None, timeout=None, check=None): writer.write(stream) finally: writer.close() - return mock.Mock(returncode=0) + return True return runner @@ -116,7 +116,7 @@ def main() -> None: xdg_mock.assert_called_once_with(["xdg-open", str(txt_path)], check=False, timeout=30) with mock.patch.object(DokuReader.shutil, "which", side_effect=lambda name: "/usr/bin/soffice" if name == "soffice" else None), \ - mock.patch.object(DokuReader.subprocess, "run", side_effect=_fake_soffice_run(tmpdir)) as soffice_mock: + mock.patch.object(DokuReader, "run_libreoffice_process", side_effect=_fake_soffice_run(tmpdir)) as soffice_mock: office_pdf = app._office_to_pdf(str(office_path), tmpdir) _assert(office_pdf is not None, "LibreOffice-Fallback erzeugte keine PDF.") _assert(Path(office_pdf).exists(), "LibreOffice-Fallback-Ausgabe fehlt.") diff --git a/tests/test_libreoffice_output.py b/tests/test_libreoffice_output.py index 6b6e01c..41ff66e 100644 --- a/tests/test_libreoffice_output.py +++ b/tests/test_libreoffice_output.py @@ -1,6 +1,5 @@ """LibreOffice failures cannot publish old, partial or invalid output.""" from pathlib import Path -from types import SimpleNamespace from unittest.mock import Mock import subprocess @@ -41,9 +40,9 @@ def run(command, **kwargs): write_pdf(output) if kind == "timeout": raise subprocess.TimeoutExpired(command, 180) - return SimpleNamespace(returncode=7 if kind == "nonzero" else 0) + return kind != "nonzero" - monkeypatch.setattr(app.subprocess, "run", run) + monkeypatch.setattr(app, "run_libreoffice_process", run) assert app.App._office_to_pdf(None, str(source), tmp_path) is None assert source.read_bytes() == b"unchanged original" assert destination.read_bytes() == previous @@ -69,9 +68,9 @@ def run(command, **kwargs): assert command[-1] == str(source.resolve()) write_pdf(output_directory / destination.name, pages=2) captured.append(output_directory.parent) - return SimpleNamespace(returncode=0) + return True - monkeypatch.setattr(app.subprocess, "run", run) + monkeypatch.setattr(app, "run_libreoffice_process", run) result = app.App._office_to_pdf(None, str(source), tmp_path) assert result == str(destination) from pypdf import PdfReader @@ -83,7 +82,7 @@ def run(command, **kwargs): def test_start_error_retains_word_fallback(tmp_path, monkeypatch): monkeypatch.setattr(app.shutil, "which", lambda name: "/private/soffice" if name == "soffice" else None) monkeypatch.setattr(app.platform, "system", lambda: "Windows") - monkeypatch.setattr(app.subprocess, "run", Mock(side_effect=OSError("cannot start"))) + monkeypatch.setattr(app, "run_libreoffice_process", Mock(side_effect=OSError("cannot start"))) word = Mock(return_value="word-result.pdf") monkeypatch.setattr(app, "convert_word_to_pdf", word) assert app.App._office_to_pdf(None, "source.docx", tmp_path) == "word-result.pdf" @@ -106,10 +105,10 @@ def run(command, **kwargs): attempts.append((output, profile)) if len(attempts) == 1: write_pdf(output / "source.pdf", pages=2) - return SimpleNamespace(returncode=1) - return SimpleNamespace(returncode=0) + return False + return True - monkeypatch.setattr(app.subprocess, "run", run) + monkeypatch.setattr(app, "run_libreoffice_process", run) assert app.App._office_to_pdf(None, str(source), tmp_path) is None assert len(attempts) == 2 assert attempts[0][0] != attempts[1][0] @@ -129,9 +128,9 @@ def test_finalization_failure_keeps_previous_pdf(tmp_path, monkeypatch, isolated def run(command, **kwargs): output = Path(command[command.index("--outdir") + 1]) / "source.pdf" write_pdf(output, pages=2) - return SimpleNamespace(returncode=0) + return True - monkeypatch.setattr(app.subprocess, "run", run) + monkeypatch.setattr(app, "run_libreoffice_process", run) if failure == "cleanup": real_temporary = app.tempfile.TemporaryDirectory @@ -160,3 +159,25 @@ def fail_publish(src, dst): assert source.read_bytes() == b"original" assert destination.read_bytes() == previous assert sorted(path.name for path in tmp_path.iterdir()) == ["source.odt", "source.pdf"] + + +def test_windows_prefers_available_console_entry(tmp_path, monkeypatch): + source = tmp_path / "source.odt" + source.write_bytes(b"original") + executable = tmp_path / "soffice.exe" + console = tmp_path / "soffice.com" + executable.touch() + console.touch() + monkeypatch.setattr(app.shutil, "which", lambda name: str(executable) if name == "soffice" else None) + monkeypatch.setattr(app.platform, "system", lambda: "Windows") + + def run(command, **kwargs): + assert command[0] == str(console) + assert kwargs["timeout"] == 180 + output = Path(command[command.index("--outdir") + 1]) / "source.pdf" + write_pdf(output) + return True + + monkeypatch.setattr(app, "run_libreoffice_process", run) + assert app.App._office_to_pdf(None, str(source), tmp_path) == str(tmp_path / "source.pdf") + assert source.read_bytes() == b"original" diff --git a/tests/test_libreoffice_process.py b/tests/test_libreoffice_process.py new file mode 100644 index 0000000..6f2dde9 --- /dev/null +++ b/tests/test_libreoffice_process.py @@ -0,0 +1,208 @@ +"""Real process lifetime probes; only test-owned processes/files are used.""" +import os +import ctypes +import json +from pathlib import Path +import subprocess +import sys +import time + +import pytest + +import libreoffice_process as office + + +def running(pid): + if os.name == "nt": + kernel = ctypes.WinDLL("kernel32", use_last_error=True) + kernel.OpenProcess.argtypes = [ctypes.c_ulong, ctypes.c_int, ctypes.c_ulong] + kernel.OpenProcess.restype = ctypes.c_void_p + kernel.WaitForSingleObject.argtypes = [ctypes.c_void_p, ctypes.c_ulong] + kernel.CloseHandle.argtypes = [ctypes.c_void_p] + handle = kernel.OpenProcess(0x100000, False, pid) + if not handle: + assert ctypes.get_last_error() == 87 + return False + try: + status = kernel.WaitForSingleObject(handle, 0) + assert status in (0, 258), "Process wait failed; termination is unproven" + return status == 258 + finally: + kernel.CloseHandle(handle) + result = subprocess.run(["ps", "-p", str(pid), "-o", "stat="], + capture_output=True, text=True, timeout=2) + state = result.stdout.strip() + assert result.returncode in (0, 1), result.stderr + assert result.returncode != 0 or state, "Empty process state is not termination proof" + return bool(state) and not state.startswith("Z") + + +@pytest.mark.parametrize("mode", ["timeout", "success", "nonzero"]) +def test_descendant_pipes_do_not_extend_deadline(tmp_path, mode): + marker = tmp_path / "descendant.pid" + child = tmp_path / "Öl & child.py" + child.write_text("import os,sys,time; from pathlib import Path; " + "p=Path(sys.argv[1]); staging=p.with_suffix('.tmp'); " + "staging.write_text(str(os.getpid())); os.replace(staging,p); time.sleep(8)", encoding="utf-8") + script = tmp_path / "Ärzte converter.py" + script.write_text('''import subprocess, sys, time +from pathlib import Path +subprocess.Popen([sys.executable, sys.argv[1], sys.argv[3]]) +while not Path(sys.argv[3]).exists(): + time.sleep(0.01) +if sys.argv[2] == "timeout": + time.sleep(10) +raise SystemExit(7 if sys.argv[2] == "nonzero" else 0) +''', encoding="utf-8") + reference = subprocess.Popen([sys.executable, "-c", "import time; time.sleep(30)"]) + try: + started = time.monotonic() + result = office.run_libreoffice_process([sys.executable, str(script), str(child), mode, str(marker)], timeout=3) + assert result is (mode == "success") + assert time.monotonic() - started < 6 + assert marker.exists() + pid = int(marker.read_text()) + deadline = time.monotonic() + 1 + while running(pid) and time.monotonic() < deadline: + time.sleep(0.02) + assert not running(pid), "Owned descendant survived runner cleanup" + assert reference.poll() is None + finally: + reference.kill() + reference.wait(timeout=5) + + +def test_start_failure_is_not_success(tmp_path): + try: + result = office.run_libreoffice_process([str(tmp_path / "missing executable")], timeout=1) + except OSError: + return + assert result is False + + +@pytest.mark.skipif(os.name == "nt", reason="POSIX supervisor identity") +def test_crashed_unreaped_supervisor_still_allows_group_cleanup(tmp_path): + marker = tmp_path / "pids.json" + script = tmp_path / "converter.py" + script.write_text('''import json, os, signal, subprocess, sys, time +from pathlib import Path +child = subprocess.Popen([sys.executable, "-c", "import time; time.sleep(8)"]) +p = Path(sys.argv[1]) +staging = p.with_suffix('.tmp') +staging.write_text(json.dumps([os.getpid(), child.pid])) +os.replace(staging, p) +os.kill(os.getppid(), signal.SIGKILL) +time.sleep(8) +''', encoding="utf-8") + started = time.monotonic() + assert office.run_libreoffice_process([sys.executable, str(script), str(marker)], timeout=3) is False + assert time.monotonic() - started < 6 + assert marker.exists() + for pid in json.loads(marker.read_text()): + deadline = time.monotonic() + 1 + while running(pid) and time.monotonic() < deadline: + time.sleep(0.02) + assert not running(pid) + + +@pytest.mark.skipif(os.name == "nt", reason="POSIX process group protocol") +def test_signal_happens_before_leader_reaping(tmp_path, monkeypatch): + events = [] + + class Process: + pid = 123 + + def wait(self, timeout): + events.append("wait") + assert timeout == 5 + + def poll(self): + pytest.fail("Leader must never be polled before group termination") + + monkeypatch.setattr(office.subprocess, "Popen", lambda *args, **kwargs: Process()) + monkeypatch.setattr(office.os, "killpg", lambda pid, sig: events.append("signal")) + assert office.run_libreoffice_process(["unused"], timeout=0) is False + assert events == ["signal", "wait"] + + +@pytest.mark.skipif(os.name == "nt", reason="POSIX child auto-reaping") +def test_custom_sigchld_handler_is_rejected_before_start(monkeypatch): + monkeypatch.setattr(office.signal, "getsignal", lambda sig: office.signal.SIG_IGN) + monkeypatch.setattr(office.subprocess, "Popen", lambda *args, **kwargs: pytest.fail("Unsafe leader started")) + with pytest.raises(OSError, match="SIGCHLD"): + office.run_libreoffice_process(["unused"]) + + +@pytest.mark.skipif(os.name == "nt", reason="POSIX session ownership") +def test_unisolated_helper_cannot_spawn_or_signal(tmp_path, monkeypatch): + monkeypatch.setattr(office.os, "getsid", lambda pid: os.getpid() + 1) + monkeypatch.setattr(office.os, "killpg", lambda *args: pytest.fail("Foreign group signalled")) + monkeypatch.setattr(office.subprocess, "Popen", lambda *args, **kwargs: pytest.fail("Unisolated child started")) + assert office.helper_main([str(tmp_path / "result"), str(os.getppid()), "unused"]) == 1 + + +@pytest.mark.skipif(os.name == "nt", reason="POSIX supervisor parent death") +def test_parent_death_stops_its_session(tmp_path): + marker = tmp_path / "pids.json" + converter = tmp_path / "converter.py" + converter.write_text('''import json, os, sys, time +from pathlib import Path +p = Path(sys.argv[1]) +staging = p.with_suffix('.tmp') +staging.write_text(json.dumps([os.getppid(), os.getpid()])) +os.replace(staging, p) +time.sleep(15) +''', encoding="utf-8") + program = "import sys; from libreoffice_process import run_libreoffice_process; run_libreoffice_process(sys.argv[1:], timeout=20)" + owner = subprocess.Popen([sys.executable, "-c", program, sys.executable, str(converter), str(marker)], + cwd=Path(office.__file__).parent) + pids = [] + try: + deadline = time.monotonic() + 5 + while not marker.exists() and time.monotonic() < deadline: + time.sleep(0.02) + assert marker.exists() + pids = json.loads(marker.read_text()) + owner.kill() + owner.wait(timeout=5) + deadline = time.monotonic() + 3 + while any(running(pid) for pid in pids) and time.monotonic() < deadline: + time.sleep(0.02) + assert all(not running(pid) for pid in pids) + finally: + if owner.poll() is None: + owner.kill() + owner.wait(timeout=5) + if pids and running(pids[0]): + # A failed probe may leave its known helper alive. Confirm the unique + # scratch converter argument and group leadership before cleanup. + command = subprocess.run(["ps", "-p", str(pids[0]), "-o", "command="], + capture_output=True, text=True, timeout=2).stdout + assert str(converter) in command and os.getpgid(pids[0]) == pids[0] + os.killpg(pids[0], office.signal.SIGKILL) + + +def test_frozen_helper_command_preserves_argument_boundaries(tmp_path, monkeypatch): + monkeypatch.setattr(sys, "frozen", True, raising=False) + result = tmp_path / "Ärzte result.json" + command = ["space & executable", "Öl # 100% argument"] + assert office.helper_command(result, command) == [ + sys.executable, "--libreoffice-process-helper", str(result), str(os.getpid()), *command] + + +def test_early_helper_path_does_not_import_gui(): + source = Path(office.__file__).with_name("DokuReader.py") + program = '''import builtins,runpy,sys +original = builtins.__import__ +def guarded(name, *args, **kwargs): + if name.startswith(("tkinter", "PIL", "fitz")): + raise AssertionError("GUI import in helper") + return original(name,*args,**kwargs) +builtins.__import__ = guarded +sys.argv = [sys.argv[1], "--libreoffice-process-helper"] +runpy.run_path(sys.argv[0], run_name="__main__") +''' + result = subprocess.run([sys.executable, "-c", program, str(source)], + capture_output=True, timeout=10) + assert result.returncode == 1 + assert not result.stderr